From a4039672a53515515c683c3726c24dda5f3bcfc4 Mon Sep 17 00:00:00 2001 From: janskiba Date: Wed, 13 Nov 2024 17:15:35 +0000 Subject: [PATCH 01/12] feat: migrate to new dnpm:dip node --- ccp/modules/dnpm-node-compose.yml | 100 ++++++++++++++++++++------ ccp/modules/dnpm-node-setup.sh | 21 ++---- minimal/docker-compose.yml | 2 +- minimal/modules/dnpm-node-compose.yml | 100 ++++++++++++++++++++------ minimal/modules/dnpm-node-setup.sh | 21 ++---- 5 files changed, 163 insertions(+), 81 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index ee84d89b..8430ee1d 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -1,34 +1,88 @@ version: "3.7" services: - dnpm-backend: - image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector - container_name: bridgehead-dnpm-backend + dnpm-mysql: + image: mysql:latest + healthcheck: + test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ] + interval: 3s + timeout: 5s + retries: 5 environment: - - ZPM_SITE=${ZPM_SITE} - - N_RANDOM_FILES=${DNPM_SYNTH_NUM} + MYSQL_ROOT_HOST: "%" + MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD} + volumes: + - dnpm-mysql:/var/lib/mysql + + dnpm-authup: + image: authup/authup:latest + container_name: bridgehead-dnpm-authup volumes: - - /etc/bridgehead/dnpm:/bwhc_config:ro - - ${DNPM_DATA_DIR}:/bwhc_data + - dnpm-authup:/usr/src/app/writable + depends_on: + dnpm-mysql: + condition: service_healthy + command: server/core start + environment: + - PUBLIC_URL=https://${HOST}/auth/ + - AUTHORIZE_REDIRECT_URL=https://${HOST} + - ROBOT_ADMIN_ENABLED=true + - ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET} + - ROBOT_ADMIN_SECRET_RESET=true + - DB_TYPE=mysql + - DB_HOST=dnpm-mysql + - DB_USERNAME=root + - DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD} + - DB_DATABASE=auth labels: - "traefik.enable=true" - - "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)" - - "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000" - - "traefik.http.routers.bwhc-backend.tls=true" + - "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth" + - "traefik.http.routers.dnpm-auth.middlewares=authup-strip" + - "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)" + - "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000" + - "traefik.http.routers.dnpm-auth.tls=true" - dnpm-frontend: - image: ghcr.io/kohlbacherlab/bwhc-frontend:2209 - container_name: bridgehead-dnpm-frontend - links: - - dnpm-backend + dnpm-portal: + image: ghcr.io/kohlbacherlab/dnpm-dip-portal:latest + container_name: bridgehead-dnpm-portal environment: - - NUXT_HOST=0.0.0.0 - - NUXT_PORT=8080 - - BACKEND_PROTOCOL=https - - BACKEND_HOSTNAME=$HOST - - BACKEND_PORT=443 + - NUXT_API_URL=http://dnpm-backend:9000/ + - NUXT_PUBLIC_API_URL=https://${HOST}/api/ + - NUXT_AUTHUP_URL=http://dnpm-authup:3000/ + - NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/ labels: - "traefik.enable=true" - - "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)" - - "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080" - - "traefik.http.routers.bwhc-frontend.tls=true" + - "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)" + - "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000" + - "traefik.http.routers.dnpm-frontend.tls=true" + + dnpm-backend: + container_name: bridgehead-dnpm-backend + image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest + environment: + - LOCAL_SITE=${ZPM_SITE}:${SITE_ID} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen + - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} + - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} + - HATEOAS_HOST=https://${HOST} + - CONNECTOR_TYPE=${BACKEND_CONNECTOR_TYPE:-broker} + - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 + volumes: + - /etc/bridgehead/dnpm/config:/dnpm_config + - dnpm-backend-data:/dnpm_data + depends_on: + dnpm-authup: + condition: service_healthy + labels: + - "traefik.enable=true" + - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" + - "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000" + - "traefik.http.routers.dnpm-backend.tls=true" + + landing: + labels: + - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)" + +volumes: + dnpm-authup: + dnpm-mysql: + dnpm-backend-data: diff --git a/ccp/modules/dnpm-node-setup.sh b/ccp/modules/dnpm-node-setup.sh index bf8fd261..2b1eb1b6 100644 --- a/ccp/modules/dnpm-node-setup.sh +++ b/ccp/modules/dnpm-node-setup.sh @@ -1,28 +1,15 @@ #!/bin/bash if [ -n "${ENABLE_DNPM_NODE}" ]; then - log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node." + log INFO "DNPM setup detected -- will start DNPM:DIP node." OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml" # Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/.conf - DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" if [ -z "${ZPM_SITE+x}" ]; then log ERROR "Mandatory variable ZPM_SITE not defined!" exit 1 fi - if [ -z "${DNPM_DATA_DIR+x}" ]; then - log ERROR "Mandatory variable DNPM_DATA_DIR not defined!" - exit 1 - fi - DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:-0} - if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then - echo "Override of landing page url already in place" - else - echo "Adding override of landing page url" - if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then - echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml - else - echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml - fi - fi + DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1} + DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')" + DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')" fi diff --git a/minimal/docker-compose.yml b/minimal/docker-compose.yml index dc763314..159276a8 100644 --- a/minimal/docker-compose.yml +++ b/minimal/docker-compose.yml @@ -16,7 +16,7 @@ services: - --entrypoints.web.http.redirections.entrypoint.scheme=https labels: - "traefik.enable=true" - - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard/`)" + - "traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard/`)" - "traefik.http.routers.dashboard.entrypoints=websecure" - "traefik.http.routers.dashboard.service=api@internal" - "traefik.http.routers.dashboard.tls=true" diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index ee84d89b..8430ee1d 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -1,34 +1,88 @@ version: "3.7" services: - dnpm-backend: - image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector - container_name: bridgehead-dnpm-backend + dnpm-mysql: + image: mysql:latest + healthcheck: + test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ] + interval: 3s + timeout: 5s + retries: 5 environment: - - ZPM_SITE=${ZPM_SITE} - - N_RANDOM_FILES=${DNPM_SYNTH_NUM} + MYSQL_ROOT_HOST: "%" + MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD} + volumes: + - dnpm-mysql:/var/lib/mysql + + dnpm-authup: + image: authup/authup:latest + container_name: bridgehead-dnpm-authup volumes: - - /etc/bridgehead/dnpm:/bwhc_config:ro - - ${DNPM_DATA_DIR}:/bwhc_data + - dnpm-authup:/usr/src/app/writable + depends_on: + dnpm-mysql: + condition: service_healthy + command: server/core start + environment: + - PUBLIC_URL=https://${HOST}/auth/ + - AUTHORIZE_REDIRECT_URL=https://${HOST} + - ROBOT_ADMIN_ENABLED=true + - ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET} + - ROBOT_ADMIN_SECRET_RESET=true + - DB_TYPE=mysql + - DB_HOST=dnpm-mysql + - DB_USERNAME=root + - DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD} + - DB_DATABASE=auth labels: - "traefik.enable=true" - - "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)" - - "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000" - - "traefik.http.routers.bwhc-backend.tls=true" + - "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth" + - "traefik.http.routers.dnpm-auth.middlewares=authup-strip" + - "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)" + - "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000" + - "traefik.http.routers.dnpm-auth.tls=true" - dnpm-frontend: - image: ghcr.io/kohlbacherlab/bwhc-frontend:2209 - container_name: bridgehead-dnpm-frontend - links: - - dnpm-backend + dnpm-portal: + image: ghcr.io/kohlbacherlab/dnpm-dip-portal:latest + container_name: bridgehead-dnpm-portal environment: - - NUXT_HOST=0.0.0.0 - - NUXT_PORT=8080 - - BACKEND_PROTOCOL=https - - BACKEND_HOSTNAME=$HOST - - BACKEND_PORT=443 + - NUXT_API_URL=http://dnpm-backend:9000/ + - NUXT_PUBLIC_API_URL=https://${HOST}/api/ + - NUXT_AUTHUP_URL=http://dnpm-authup:3000/ + - NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/ labels: - "traefik.enable=true" - - "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)" - - "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080" - - "traefik.http.routers.bwhc-frontend.tls=true" + - "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)" + - "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000" + - "traefik.http.routers.dnpm-frontend.tls=true" + + dnpm-backend: + container_name: bridgehead-dnpm-backend + image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest + environment: + - LOCAL_SITE=${ZPM_SITE}:${SITE_ID} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen + - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} + - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} + - HATEOAS_HOST=https://${HOST} + - CONNECTOR_TYPE=${BACKEND_CONNECTOR_TYPE:-broker} + - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 + volumes: + - /etc/bridgehead/dnpm/config:/dnpm_config + - dnpm-backend-data:/dnpm_data + depends_on: + dnpm-authup: + condition: service_healthy + labels: + - "traefik.enable=true" + - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" + - "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000" + - "traefik.http.routers.dnpm-backend.tls=true" + + landing: + labels: + - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)" + +volumes: + dnpm-authup: + dnpm-mysql: + dnpm-backend-data: diff --git a/minimal/modules/dnpm-node-setup.sh b/minimal/modules/dnpm-node-setup.sh index bf8fd261..2b1eb1b6 100644 --- a/minimal/modules/dnpm-node-setup.sh +++ b/minimal/modules/dnpm-node-setup.sh @@ -1,28 +1,15 @@ #!/bin/bash if [ -n "${ENABLE_DNPM_NODE}" ]; then - log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node." + log INFO "DNPM setup detected -- will start DNPM:DIP node." OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml" # Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/.conf - DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" if [ -z "${ZPM_SITE+x}" ]; then log ERROR "Mandatory variable ZPM_SITE not defined!" exit 1 fi - if [ -z "${DNPM_DATA_DIR+x}" ]; then - log ERROR "Mandatory variable DNPM_DATA_DIR not defined!" - exit 1 - fi - DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:-0} - if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then - echo "Override of landing page url already in place" - else - echo "Adding override of landing page url" - if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then - echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml - else - echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml - fi - fi + DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1} + DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')" + DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')" fi From 839207702b8ca6d5dc44fc4435191450a3868f84 Mon Sep 17 00:00:00 2001 From: janskiba Date: Fri, 15 Nov 2024 12:46:40 +0000 Subject: [PATCH 02/12] hardcode dnpm connector type to broker --- ccp/modules/dnpm-node-compose.yml | 2 +- minimal/modules/dnpm-node-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 8430ee1d..5ffc5ed2 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -64,7 +64,7 @@ services: - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - HATEOAS_HOST=https://${HOST} - - CONNECTOR_TYPE=${BACKEND_CONNECTOR_TYPE:-broker} + - CONNECTOR_TYPE=broker - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 volumes: - /etc/bridgehead/dnpm/config:/dnpm_config diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 8430ee1d..5ffc5ed2 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -64,7 +64,7 @@ services: - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - HATEOAS_HOST=https://${HOST} - - CONNECTOR_TYPE=${BACKEND_CONNECTOR_TYPE:-broker} + - CONNECTOR_TYPE=broker - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 volumes: - /etc/bridgehead/dnpm/config:/dnpm_config From eed1fe79bfb1c10b0f50d578d5c33a2041a234ba Mon Sep 17 00:00:00 2001 From: janskiba Date: Fri, 15 Nov 2024 12:52:11 +0000 Subject: [PATCH 03/12] use `SITE_NAME` for dnpm `LOCAL_SITE` --- ccp/modules/dnpm-node-compose.yml | 2 +- minimal/modules/dnpm-node-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 5ffc5ed2..6f85ca54 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -60,7 +60,7 @@ services: container_name: bridgehead-dnpm-backend image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest environment: - - LOCAL_SITE=${ZPM_SITE}:${SITE_ID} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen + - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - HATEOAS_HOST=https://${HOST} diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 5ffc5ed2..6f85ca54 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -60,7 +60,7 @@ services: container_name: bridgehead-dnpm-backend image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest environment: - - LOCAL_SITE=${ZPM_SITE}:${SITE_ID} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen + - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} - HATEOAS_HOST=https://${HOST} From 6ed1cd402b58462ce5624b4da1f999fc9162ba1c Mon Sep 17 00:00:00 2001 From: janskiba Date: Wed, 20 Nov 2024 10:59:33 +0000 Subject: [PATCH 04/12] host central targets in git --- ccp/modules/dnpm-compose.yml | 4 +- minimal/modules/dnpm-central-targets.json | 136 ++++++++++++++++++++++ minimal/modules/dnpm-compose.yml | 4 +- 3 files changed, 140 insertions(+), 4 deletions(-) create mode 100644 minimal/modules/dnpm-central-targets.json diff --git a/ccp/modules/dnpm-compose.yml b/ccp/modules/dnpm-compose.yml index c32426f4..0ce7f745 100644 --- a/ccp/modules/dnpm-compose.yml +++ b/ccp/modules/dnpm-compose.yml @@ -13,7 +13,7 @@ services: PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT} APP_ID: dnpm-connect.${PROXY_ID} DISCOVERY_URL: "./conf/central_targets.json" - LOCAL_TARGETS_FILE: "./conf/connect_targets.json" + LOCAL_TARGETS_FILE: "/conf/connect_targets.json" HTTP_PROXY: "http://forward_proxy:3128" HTTPS_PROXY: "http://forward_proxy:3128" NO_PROXY: beam-proxy,dnpm-backend,host.docker.internal${DNPM_ADDITIONAL_NO_PROXY} @@ -25,7 +25,7 @@ services: volumes: - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro - - /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro + - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro labels: - "traefik.enable=true" - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)" diff --git a/minimal/modules/dnpm-central-targets.json b/minimal/modules/dnpm-central-targets.json new file mode 100644 index 00000000..e5e39e17 --- /dev/null +++ b/minimal/modules/dnpm-central-targets.json @@ -0,0 +1,136 @@ +{ + "sites": [ + { + "id": "UKFR", + "name": "Freiburg", + "virtualhost": "ukfr.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKHD", + "name": "Heidelberg", + "virtualhost": "ukhd.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKT", + "name": "Tübingen", + "virtualhost": "ukt.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKU", + "name": "Ulm", + "virtualhost": "uku.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UM", + "name": "Mainz", + "virtualhost": "um.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKMR", + "name": "Marburg", + "virtualhost": "ukmr.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKE", + "name": "Hamburg", + "virtualhost": "uke.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKA", + "name": "Aachen", + "virtualhost": "uka.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "Charite", + "name": "Berlin", + "virtualhost": "charite.dnpm.de", + "beamconnect": "dnpm-connect.berlin-test.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "MRI", + "name": "Muenchen-tum", + "virtualhost": "mri.dnpm.de", + "beamconnect": "dnpm-connect.muenchen-tum.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "KUM", + "name": "Muenchen-lmu", + "virtualhost": "kum.dnpm.de", + "beamconnect": "dnpm-connect.muenchen-lmu.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "MHH", + "name": "Hannover", + "virtualhost": "mhh.dnpm.de", + "beamconnect": "dnpm-connect.hannover.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKDD", + "name": "dresden-dnpm", + "virtualhost": "ukdd.dnpm.de", + "beamconnect": "dnpm-connect.dresden-dnpm.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKB", + "name": "Bonn", + "virtualhost": "ukb.dnpm.de", + "beamconnect": "dnpm-connect.bonn-dnpm.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKD", + "name": "Duesseldorf", + "virtualhost": "ukd.dnpm.de", + "beamconnect": "dnpm-connect.duesseldorf-dnpm.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKK", + "name": "Koeln", + "virtualhost": "ukk.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UME", + "name": "Essen", + "virtualhost": "ume.dnpm.de", + "beamconnect": "dnpm-connect.essen.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKM", + "name": "Muenster", + "virtualhost": "ukm.dnpm.de", + "beamconnect": "dnpm-connect.muenster-dnpm.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKF", + "name": "Frankfurt", + "virtualhost": "ukf.dnpm.de", + "beamconnect": "dnpm-connect.frankfurt.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UMG", + "name": "Goettingen", + "virtualhost": "umg.dnpm.de", + "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "UKW", + "name": "Würzburg", + "virtualhost": "ukw.dnpm.de", + "beamconnect": "dnpm-connect.wuerzburg-dnpm.broker.ccp-it.dktk.dkfz.de" + }, + { + "id": "TKT", + "name": "Test", + "virtualhost": "tkt.dnpm.de", + "beamconnect": "dnpm-connect.tobias-develop.broker.ccp-it.dktk.dkfz.de" + } + ] +} diff --git a/minimal/modules/dnpm-compose.yml b/minimal/modules/dnpm-compose.yml index 646a4571..1c9a36aa 100644 --- a/minimal/modules/dnpm-compose.yml +++ b/minimal/modules/dnpm-compose.yml @@ -29,7 +29,7 @@ services: PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT} APP_ID: dnpm-connect.${DNPM_PROXY_ID} DISCOVERY_URL: "./conf/central_targets.json" - LOCAL_TARGETS_FILE: "./conf/connect_targets.json" + LOCAL_TARGETS_FILE: "/conf/connect_targets.json" HTTP_PROXY: http://forward_proxy:3128 HTTPS_PROXY: http://forward_proxy:3128 NO_PROXY: dnpm-beam-proxy,dnpm-backend, host.docker.internal${DNPM_ADDITIONAL_NO_PROXY} @@ -41,7 +41,7 @@ services: volumes: - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro - - /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro + - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro labels: - "traefik.enable=true" - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)" From 2a11b6cab132e7c33e22980af15ed493b7cba0c9 Mon Sep 17 00:00:00 2001 From: janskiba Date: Fri, 29 Nov 2024 10:58:42 +0000 Subject: [PATCH 05/12] dnpm: add goettingen to central targets --- minimal/modules/dnpm-central-targets.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/minimal/modules/dnpm-central-targets.json b/minimal/modules/dnpm-central-targets.json index e5e39e17..ebf14811 100644 --- a/minimal/modules/dnpm-central-targets.json +++ b/minimal/modules/dnpm-central-targets.json @@ -118,7 +118,7 @@ "id": "UMG", "name": "Goettingen", "virtualhost": "umg.dnpm.de", - "beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de" + "beamconnect": "dnpm-connect.goettingen.broker.ccp-it.dktk.dkfz.de" }, { "id": "UKW", From af88abfae2944dfc286f774e5e764aa380cf79eb Mon Sep 17 00:00:00 2001 From: janskiba Date: Thu, 12 Dec 2024 12:36:16 +0000 Subject: [PATCH 06/12] dnpm: add uksh to central targets --- minimal/modules/dnpm-central-targets.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/minimal/modules/dnpm-central-targets.json b/minimal/modules/dnpm-central-targets.json index ebf14811..5469da03 100644 --- a/minimal/modules/dnpm-central-targets.json +++ b/minimal/modules/dnpm-central-targets.json @@ -126,6 +126,12 @@ "virtualhost": "ukw.dnpm.de", "beamconnect": "dnpm-connect.wuerzburg-dnpm.broker.ccp-it.dktk.dkfz.de" }, + { + "id": "UKSH", + "name": "Schleswig-Holstein", + "virtualhost": "uksh.dnpm.de", + "beamconnect": "dnpm-connect.uksh-dnpm.broker.ccp-it.dktk.dkfz.de" + }, { "id": "TKT", "name": "Test", From 7acf7b06c3a2ac6f8242eab0de8619fa4b5a76f3 Mon Sep 17 00:00:00 2001 From: janskiba Date: Wed, 18 Dec 2024 10:53:37 +0000 Subject: [PATCH 07/12] dnpm: replace named volumes with fs volumes --- ccp/modules/dnpm-node-compose.yml | 11 +++-------- ccp/modules/dnpm-node-setup.sh | 1 + minimal/modules/dnpm-node-compose.yml | 11 +++-------- minimal/modules/dnpm-node-setup.sh | 1 + 4 files changed, 8 insertions(+), 16 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 6f85ca54..03df9f2a 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -12,13 +12,13 @@ services: MYSQL_ROOT_HOST: "%" MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD} volumes: - - dnpm-mysql:/var/lib/mysql + - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql dnpm-authup: image: authup/authup:latest container_name: bridgehead-dnpm-authup volumes: - - dnpm-authup:/usr/src/app/writable + - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable depends_on: dnpm-mysql: condition: service_healthy @@ -68,7 +68,7 @@ services: - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 volumes: - /etc/bridgehead/dnpm/config:/dnpm_config - - dnpm-backend-data:/dnpm_data + - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data depends_on: dnpm-authup: condition: service_healthy @@ -81,8 +81,3 @@ services: landing: labels: - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)" - -volumes: - dnpm-authup: - dnpm-mysql: - dnpm-backend-data: diff --git a/ccp/modules/dnpm-node-setup.sh b/ccp/modules/dnpm-node-setup.sh index 2b1eb1b6..4376909f 100644 --- a/ccp/modules/dnpm-node-setup.sh +++ b/ccp/modules/dnpm-node-setup.sh @@ -9,6 +9,7 @@ if [ -n "${ENABLE_DNPM_NODE}" ]; then log ERROR "Mandatory variable ZPM_SITE not defined!" exit 1 fi + mkdir -p /var/cache/bridgehead/dnpm/ || fail_and_report 1 "Failed to create '/var/cache/bridgehead/dnpm/'. Please run sudo './bridgehead install $PROJECT' again to fix the permissions." DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1} DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')" DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')" diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 6f85ca54..03df9f2a 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -12,13 +12,13 @@ services: MYSQL_ROOT_HOST: "%" MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD} volumes: - - dnpm-mysql:/var/lib/mysql + - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql dnpm-authup: image: authup/authup:latest container_name: bridgehead-dnpm-authup volumes: - - dnpm-authup:/usr/src/app/writable + - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable depends_on: dnpm-mysql: condition: service_healthy @@ -68,7 +68,7 @@ services: - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 volumes: - /etc/bridgehead/dnpm/config:/dnpm_config - - dnpm-backend-data:/dnpm_data + - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data depends_on: dnpm-authup: condition: service_healthy @@ -81,8 +81,3 @@ services: landing: labels: - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)" - -volumes: - dnpm-authup: - dnpm-mysql: - dnpm-backend-data: diff --git a/minimal/modules/dnpm-node-setup.sh b/minimal/modules/dnpm-node-setup.sh index 2b1eb1b6..4376909f 100644 --- a/minimal/modules/dnpm-node-setup.sh +++ b/minimal/modules/dnpm-node-setup.sh @@ -9,6 +9,7 @@ if [ -n "${ENABLE_DNPM_NODE}" ]; then log ERROR "Mandatory variable ZPM_SITE not defined!" exit 1 fi + mkdir -p /var/cache/bridgehead/dnpm/ || fail_and_report 1 "Failed to create '/var/cache/bridgehead/dnpm/'. Please run sudo './bridgehead install $PROJECT' again to fix the permissions." DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1} DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')" DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')" From 5807a3c2600d61de5ea458a9f4fd70260b54d024 Mon Sep 17 00:00:00 2001 From: janskiba Date: Wed, 18 Dec 2024 12:47:33 +0000 Subject: [PATCH 08/12] chore: change dnpm images --- ccp/modules/dnpm-node-compose.yml | 4 ++-- minimal/modules/dnpm-node-compose.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 03df9f2a..099dcdcf 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -43,7 +43,7 @@ services: - "traefik.http.routers.dnpm-auth.tls=true" dnpm-portal: - image: ghcr.io/kohlbacherlab/dnpm-dip-portal:latest + image: ghcr.io/dnpm-dip/portal:latest container_name: bridgehead-dnpm-portal environment: - NUXT_API_URL=http://dnpm-backend:9000/ @@ -58,7 +58,7 @@ services: dnpm-backend: container_name: bridgehead-dnpm-backend - image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest + image: ghcr.io/dnpm-dip/backend:latest environment: - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 03df9f2a..099dcdcf 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -43,7 +43,7 @@ services: - "traefik.http.routers.dnpm-auth.tls=true" dnpm-portal: - image: ghcr.io/kohlbacherlab/dnpm-dip-portal:latest + image: ghcr.io/dnpm-dip/portal:latest container_name: bridgehead-dnpm-portal environment: - NUXT_API_URL=http://dnpm-backend:9000/ @@ -58,7 +58,7 @@ services: dnpm-backend: container_name: bridgehead-dnpm-backend - image: ghcr.io/kohlbacherlab/dnpm-dip-backend:latest + image: ghcr.io/dnpm-dip/backend:latest environment: - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1} From 4e8eb6218adc1770611a1b6859f9832073d5d397 Mon Sep 17 00:00:00 2001 From: janskiba Date: Wed, 18 Dec 2024 14:17:17 +0000 Subject: [PATCH 09/12] chore: pin mysql --- ccp/modules/dnpm-node-compose.yml | 2 +- minimal/modules/dnpm-node-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 099dcdcf..6fe81335 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -2,7 +2,7 @@ version: "3.7" services: dnpm-mysql: - image: mysql:latest + image: mysql:9 healthcheck: test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ] interval: 3s diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 099dcdcf..6fe81335 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -2,7 +2,7 @@ version: "3.7" services: dnpm-mysql: - image: mysql:latest + image: mysql:9 healthcheck: test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ] interval: 3s From 0eff3626906556b9dc4216c493d18ce0a30a829d Mon Sep 17 00:00:00 2001 From: Niklas Date: Tue, 21 Jan 2025 13:36:06 +0100 Subject: [PATCH 10/12] dnpm: Secure endpoints for ETL and p2p communications (#254) --- ccp/modules/dnpm-node-compose.yml | 18 +++++++++++++++++- minimal/modules/dnpm-node-compose.yml | 18 +++++++++++++++++- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml index 6fe81335..c1f7ddef 100644 --- a/ccp/modules/dnpm-node-compose.yml +++ b/ccp/modules/dnpm-node-compose.yml @@ -74,9 +74,25 @@ services: condition: service_healthy labels: - "traefik.enable=true" - - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" - "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000" + # expose everything + - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" - "traefik.http.routers.dnpm-backend.tls=true" + - "traefik.http.routers.dnpm-backend.service=dnpm-backend" + # except ETL + - "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)" + - "traefik.http.routers.dnpm-backend-etl.tls=true" + - "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend" + # this needs an ETL processor with support for basic auth + - "traefik.http.routers.dnpm-backend-etl.middlewares=auth" + # except peer-to-peer + - "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)" + - "traefik.http.routers.dnpm-backend-peer.tls=true" + - "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend" + - "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer" + # this effectively denies all requests + # this is okay, because requests from peers don't go through Traefik + - "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32" landing: labels: diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index 6fe81335..c1f7ddef 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -74,9 +74,25 @@ services: condition: service_healthy labels: - "traefik.enable=true" - - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" - "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000" + # expose everything + - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)" - "traefik.http.routers.dnpm-backend.tls=true" + - "traefik.http.routers.dnpm-backend.service=dnpm-backend" + # except ETL + - "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)" + - "traefik.http.routers.dnpm-backend-etl.tls=true" + - "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend" + # this needs an ETL processor with support for basic auth + - "traefik.http.routers.dnpm-backend-etl.middlewares=auth" + # except peer-to-peer + - "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)" + - "traefik.http.routers.dnpm-backend-peer.tls=true" + - "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend" + - "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer" + # this effectively denies all requests + # this is okay, because requests from peers don't go through Traefik + - "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32" landing: labels: From 50ee54078e4b9b40eca2639d0494b92eee1f7d5a Mon Sep 17 00:00:00 2001 From: Niklas Sombert Date: Thu, 12 Dec 2024 14:30:23 +0100 Subject: [PATCH 11/12] Add support for SELinux systems --- lib/functions.sh | 26 ++++++++++++++++++++++++++ lib/install-bridgehead.sh | 1 + minimal/docker-compose.yml | 3 +++ minimal/modules/dnpm-compose.yml | 12 ++++-------- 4 files changed, 34 insertions(+), 8 deletions(-) diff --git a/lib/functions.sh b/lib/functions.sh index 3fcae384..34ab88a7 100644 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -36,6 +36,32 @@ setupProxy() { export HTTPS_PROXY_HOST HTTPS_PROXY_PORT HTTPS_PROXY_FULL_URL } +checkAndSetSelinux() { + # This is needed for the systemd service to start on SELinux systems. + if ! command -v sestatus > /dev/null 2>&1; then + echo "SELinux not available; nothing to do" + return + fi + if ! sestatus | grep "SELinux status:" | grep enabled > /dev/null; then + echo "SELinux disabled; nothing to do" + return + fi + current_mode="$(sestatus | grep 'Current mode:' | tr -s ' ' | cut -d' ' -f 3)" + echo "SELinux is active and ${current_mode}, checking for labels..." + # TODO: perhaps split this into checkSelinux (without the need for root) and setSelinux (needing root) + # "stat /srv/docker/bridgehead/bridgehead --printf %C" could be used for a check that doesn't need root + exitIfNotRoot + labels_for_srv="$(semanage fcontext --list | grep -e ^/srv)" + echo "Found the following labels for /srv:" + echo "${labels_for_srv}" + if ! echo "${labels_for_srv}" | grep -e ^/srv/docker/bridgehead/bridgehead > /dev/null; then + echo "Adding a label for /srv/docker/bridgehead/bridgehead..." + semanage fcontext --add --type bin_t /srv/docker/bridgehead/bridgehead + fi + restorecon -v /srv/docker/bridgehead/bridgehead # this survives a reboot + # TODO: check if this survives updates +} + exitIfNotRoot() { if [ "$EUID" -ne 0 ]; then log "ERROR" "Please run as root" diff --git a/lib/install-bridgehead.sh b/lib/install-bridgehead.sh index 38c38749..135cb06f 100755 --- a/lib/install-bridgehead.sh +++ b/lib/install-bridgehead.sh @@ -3,6 +3,7 @@ source lib/functions.sh exitIfNotRoot +checkAndSetSelinux if [ $# -eq 0 ]; then log "ERROR" "Please provide a Project as argument" diff --git a/minimal/docker-compose.yml b/minimal/docker-compose.yml index 159276a8..c75e5de2 100644 --- a/minimal/docker-compose.yml +++ b/minimal/docker-compose.yml @@ -25,6 +25,9 @@ services: ports: - 80:80 - 443:443 + security_opt: + # allow access to the docker socket on systems with SELinux + - "label:type:container_runtime_t" volumes: - /etc/bridgehead/traefik-tls:/certs:ro - ../lib/traefik-configuration/:/configuration:ro diff --git a/minimal/modules/dnpm-compose.yml b/minimal/modules/dnpm-compose.yml index 1c9a36aa..23d88140 100644 --- a/minimal/modules/dnpm-compose.yml +++ b/minimal/modules/dnpm-compose.yml @@ -12,13 +12,13 @@ services: ALL_PROXY: http://forward_proxy:3128 TLS_CA_CERTIFICATES_DIR: ./conf/trusted-ca-certs ROOTCERT_FILE: ./conf/root.crt.pem - secrets: - - proxy.pem depends_on: - "forward_proxy" volumes: - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro - - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro + - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro,Z + # secrets don't seem to allow us to specify Z + - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro dnpm-beam-connect: depends_on: [ dnpm-beam-proxy ] @@ -41,7 +41,7 @@ services: volumes: - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro - - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro + - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro,Z labels: - "traefik.enable=true" - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)" @@ -53,7 +53,3 @@ services: dnpm-echo: image: docker.verbis.dkfz.de/cache/samply/bridgehead-echo:latest container_name: bridgehead-dnpm-echo - -secrets: - proxy.pem: - file: /etc/bridgehead/pki/${SITE_ID}.priv.pem From 30a6c1e4d9f32a97f487c9b3c030e02789d89b52 Mon Sep 17 00:00:00 2001 From: Niklas Sombert Date: Tue, 21 Jan 2025 16:10:01 +0100 Subject: [PATCH 12/12] dnpm: Make volumes in /var/cache writable for containers --- minimal/modules/dnpm-node-compose.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml index c1f7ddef..99aa15e0 100644 --- a/minimal/modules/dnpm-node-compose.yml +++ b/minimal/modules/dnpm-node-compose.yml @@ -12,13 +12,13 @@ services: MYSQL_ROOT_HOST: "%" MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD} volumes: - - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql + - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql:Z dnpm-authup: image: authup/authup:latest container_name: bridgehead-dnpm-authup volumes: - - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable + - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable:Z depends_on: dnpm-mysql: condition: service_healthy @@ -68,7 +68,7 @@ services: - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000 volumes: - /etc/bridgehead/dnpm/config:/dnpm_config - - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data + - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data:Z depends_on: dnpm-authup: condition: service_healthy