diff --git a/.env.sample b/.env.sample index 35e1670..b620ff4 100644 --- a/.env.sample +++ b/.env.sample @@ -1,6 +1,7 @@ TYPE=lasuite-drive DOMAIN=lasuite-drive.example.com +MINIO_DOMAIN="minio.${DOMAIN}" ## Domain aliases #EXTRA_DOMAINS=', `www.lasuite-docs.example.com`' @@ -21,12 +22,8 @@ SECRET_DJANGO_SP_VERSION=v1 SECRET_MINIO_RP_VERSION=v1 # MINIO_ROOT_USER SECRET_MINIO_RU_VERSION=v1 -# COLLABORATION_SERVER_SECRET -SECRET_COLLAB_SS_VERSION=v1 # POSTGRES_PASSWORD SECRET_POSTGRES_P_VERSION=v1 -# Y_PROVIDER_API_KEY -SECRET_Y_API_KEY_VERSION=v1 # DJANGO_HOST_EMAIL_PASSWORD SECRET_EMAIL_PASS_VERSION=v1 @@ -46,17 +43,18 @@ DJANGO_EMAIL_FROM=mail@example.com ############################################################################## # NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README OIDC_REALM=yourkeycloakrealm -OIDC_OP_JWKS_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs -OIDC_OP_AUTHORIZATION_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth -OIDC_OP_TOKEN_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token -OIDC_OP_USER_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo +AUTH_DOMAIN="auth.${DOMAIN}" +OIDC_OP_JWKS_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs +OIDC_OP_AUTHORIZATION_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth +OIDC_OP_TOKEN_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token +OIDC_OP_USER_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo OIDC_RP_CLIENT_ID=yourkeycloakclientid OIDC_RP_SIGN_ALGO=RS256 OIDC_RP_SCOPES="openid email" LOGIN_REDIRECT_URL=https://${DOMAIN} LOGIN_REDIRECT_URL_FAILURE=https://${DOMAIN} LOGOUT_REDIRECT_URL=https://${DOMAIN} -OIDC_REDIRECT_ALLOWED_HOSTS='["https://auth.${DOMAIN}", "https://${DOMAIN}"]' +OIDC_REDIRECT_ALLOWED_HOSTS='["https://${AUTH_DOMAIN}", "https://${DOMAIN}"]' OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}' ############################################################################## diff --git a/abra-entrypoint.sh b/abra-entrypoint.sh index 470e0dd..c795941 100644 --- a/abra-entrypoint.sh +++ b/abra-entrypoint.sh @@ -7,8 +7,6 @@ set -e [ -f /run/secrets/minio_ru ] && export AWS_S3_ACCESS_KEY_ID="$(cat /run/secrets/minio_ru)" [ -f /run/secrets/django_sp ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_sp)" [ -f /run/secrets/oidc_rpcs ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rpcs)" -[ -f /run/secrets/collab_ss ] && export COLLABORATION_SERVER_SECRET="$(cat /run/secrets/collab_ss)" -[ -f /run/secrets/y_api_key ] && export Y_PROVIDER_API_KEY="$(cat /run/secrets/y_api_key)" [ -f /run/secrets/email_pass ] && export DJANGO_EMAIL_HOST_PASSWORD="$(cat /run/secrets/email_pass)" # if not in "env" mode, then execute the original entrypoint and command diff --git a/compose.yml b/compose.yml index 5d19655..d9cefb0 100644 --- a/compose.yml +++ b/compose.yml @@ -125,11 +125,9 @@ services: - django_sk - django_sp - oidc_rpcs - - collab_ss - minio_rp - minio_ru - postgres_p - - y_api_key - email_pass celery: @@ -153,10 +151,8 @@ services: - django_sk - django_sp - oidc_rpcs - - collab_ss - minio_rp - postgres_p - - y_api_key - email_pass db: @@ -233,10 +229,6 @@ services: entrypoint: ["/usr/bin/docker-entrypoint.sh"] volumes: - minio:/data -# deploy: -# labels: -# backupbot.backup: "${ENABLE_BACKUPS:-true}" -# entrypoint: /abra-entrypoint.sh configs: - source: abra_entrypoint target: /abra-entrypoint.sh @@ -318,18 +310,12 @@ secrets: postgres_p: external: true name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION} - collab_ss: - external: true - name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION} minio_rp: external: true name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION} minio_ru: external: true name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RP_VERSION} - y_api_key: - external: true - name: ${STACK_NAME}_y_api_key_${SECRET_Y_API_KEY_VERSION} email_pass: external: true name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION} \ No newline at end of file