mirror of
https://github.com/samply/bridgehead.git
synced 2026-11-01 18:20:36 +01:00
Jan
563af88a76
- Switch system auth from robot to client: authup no longer reads ROBOT_ADMIN_* (since 1.0.0-beta.54) and the backend no longer accepts robot:// in AUTHUP_URL, so use CLIENT_SYSTEM_* and client://. - command: server/core start -> start: the server/core prefix is deprecated. - Drop the /usr/src/app/writable volume: the path no longer exists in the image and nothing durable is stored there with mysql. - Replace AUTHORIZE_REDIRECT_URL with TRUSTED_ORIGINS: the old key was removed upstream; TRUSTED_ORIGINS controls the allowed redirect origins. - Set NUXT_PUBLIC_ACCOUNT_URL on the portal: authup now serves the account console under /auth/console/account, the portal's default link 404s. Mirrors dnpm-dip/deployment#15 and 56cc618.
100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
version: "3.7"
|
|
|
|
services:
|
|
dnpm-mysql:
|
|
image: mysql:9
|
|
healthcheck:
|
|
test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
|
|
interval: 3s
|
|
timeout: 5s
|
|
retries: 5
|
|
environment:
|
|
MYSQL_ROOT_HOST: "%"
|
|
MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
|
|
volumes:
|
|
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
|
|
|
|
dnpm-authup:
|
|
image: authup/authup:latest
|
|
container_name: bridgehead-dnpm-authup
|
|
depends_on:
|
|
dnpm-mysql:
|
|
condition: service_healthy
|
|
command: start
|
|
environment:
|
|
- PUBLIC_URL=https://${HOST}/auth/
|
|
- TRUSTED_ORIGINS=https://${HOST}
|
|
- CLIENT_SYSTEM_ENABLED=true
|
|
- CLIENT_SYSTEM_SECRET=${DNPM_AUTHUP_SECRET}
|
|
- CLIENT_SYSTEM_SECRET_RESET=true
|
|
- DB_TYPE=mysql
|
|
- DB_HOST=dnpm-mysql
|
|
- DB_USERNAME=root
|
|
- DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD}
|
|
- DB_DATABASE=auth
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth/"
|
|
- "traefik.http.routers.dnpm-auth.middlewares=authup-strip"
|
|
- "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)"
|
|
- "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.dnpm-auth.tls=true"
|
|
|
|
dnpm-portal:
|
|
image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
|
|
container_name: bridgehead-dnpm-portal
|
|
environment:
|
|
- NUXT_API_URL=http://dnpm-backend:9000/
|
|
- NUXT_PUBLIC_API_URL=https://${HOST}/api/
|
|
- NUXT_AUTHUP_URL=http://dnpm-authup:3000/
|
|
- NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
|
|
- NUXT_PUBLIC_ACCOUNT_URL=https://${HOST}/auth/console/account
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
|
|
- "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.dnpm-frontend.tls=true"
|
|
|
|
dnpm-backend:
|
|
container_name: bridgehead-dnpm-backend
|
|
image: ghcr.io/dnpm-dip/api-gateway:latest
|
|
environment:
|
|
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
|
|
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
|
- MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
|
- HATEOAS_HOST=https://${HOST}
|
|
- CONNECTOR_TYPE=broker
|
|
- AUTHUP_URL=client://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
|
|
- TZ=Europe/Berlin
|
|
volumes:
|
|
- /etc/bridgehead/dnpm/config:/dnpm_config
|
|
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
|
|
depends_on:
|
|
dnpm-authup:
|
|
condition: service_healthy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000"
|
|
# expose everything
|
|
- "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)"
|
|
- "traefik.http.routers.dnpm-backend.tls=true"
|
|
- "traefik.http.routers.dnpm-backend.service=dnpm-backend"
|
|
# except ETL
|
|
- "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)"
|
|
- "traefik.http.routers.dnpm-backend-etl.tls=true"
|
|
- "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend"
|
|
# this needs an ETL processor with support for basic auth
|
|
- "traefik.http.routers.dnpm-backend-etl.middlewares=auth"
|
|
# except peer-to-peer
|
|
- "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)"
|
|
- "traefik.http.routers.dnpm-backend-peer.tls=true"
|
|
- "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend"
|
|
- "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer"
|
|
# this effectively denies all requests
|
|
# this is okay, because requests from peers don't go through Traefik
|
|
- "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32"
|
|
|
|
landing:
|
|
labels:
|
|
- "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"
|