Skip to content

Commit 80e4c60

Browse files
davdarrasdavdarras
committed
feat: add platine management export permission check
- check permission - add compose
1 parent 296e078 commit 80e4c60

18 files changed

Lines changed: 1136 additions & 2 deletions

‎.env‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
IMAGES_REGISTRY_DOCKER_IO=docker.io
2+
IMAGES_REGISTRY_QUAY_IO=quay.io
3+
4+
IMAGE_BDD_POSTGRES=postgres:14.20
5+
IMAGE_BDD_MONGO=mongo:7.0.5
6+
IMAGE_PLATINE_PILOTAGE_API=inseefr/platine-management-back-office:4.41.1-rc
7+
IMAGE_KEYCLOAK=keycloak/keycloak:24.0
8+
9+
PLATINE_PILOTAGE_DB_USER=mypostgresuser
10+
PLATINE_PILOTAGE_DB_PASSWORD=mypostgrespassword
11+
PLATINE_PILOTAGE_DB_PORT=5433
12+
PLATINE_PILOTAGE_DB_NAME=platine-management
13+
14+
PLATINE_PILOTAGE_API_PORT=3000
15+
16+
GENESIS_DB_USER=genesisuser
17+
GENESIS_DB_PASSWORD=genesispassword
18+
GENESIS_DB_PORT=27017
19+
GENESIS_DB_NAME=genesisdb
20+
21+
KEYCLOAK_PORT=7080
22+
KEYCLOAK_ADMIN=administrator
23+
KEYCLOAK_ADMIN_PASSWORD=administrator
24+
AUTH_SERVER_URL=http://localhost:${KEYCLOAK_PORT}
25+
AUTH_REALM=platine
26+
JWT_ROLE_CLAIM=
27+
IDP_HINT=
28+
AUTH_CLIENT_ID=myclient
29+
RESPONDENT_ROLE=respondent
30+
INTERNAL_USER_ROLE=gestionnaire
31+
ADMIN_ROLE=admin
32+
WEBCLIENT_ROLE=webclient

‎compose.yml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
x-mongo-volumes-setup-rs-1: &mongo-volumes-setup-rs-1
2+
- mongo_vol_1:/data/db
3+
- ./container/mongodb/mongodb_rs1_init.sh:/scripts/mongodb_rs_init.sh
4+
5+
x-mongo-volumes-1: &mongo-volumes-1
6+
- mongo_vol_1:/data
7+
8+
services:
9+
#----------------------------------------------------------------------------
10+
# /) /)
11+
# (^.^) platine (collecte WEB)
12+
# (")_(")
13+
#----------------------------------------------------------------------------
14+
platine-pilotage-db:
15+
image: ${IMAGES_REGISTRY_DOCKER_IO}/${IMAGE_BDD_POSTGRES}
16+
profiles:
17+
- platine-pilotage-db
18+
- all
19+
environment:
20+
- POSTGRES_USER=${PLATINE_PILOTAGE_DB_USER}
21+
- POSTGRES_PASSWORD=${PLATINE_PILOTAGE_DB_PASSWORD}
22+
- POSTGRES_DB=${PLATINE_PILOTAGE_DB_NAME}
23+
command: ["postgres"]
24+
healthcheck:
25+
test: ["CMD-SHELL", "pg_isready -U ${PLATINE_PILOTAGE_DB_USER} -d ${PLATINE_PILOTAGE_DB_NAME} -h localhost"]
26+
interval: 5s
27+
timeout: 10s
28+
retries: 10
29+
# volumes:
30+
# - ./container/pilotage/init.sql:/docker-entrypoint-initdb.d/init.sql
31+
ports:
32+
- ${PLATINE_PILOTAGE_DB_PORT}:5432
33+
#----------------------------------------------------------------------------
34+
platine-pilotage-api:
35+
image: ${IMAGES_REGISTRY_DOCKER_IO}/${IMAGE_PLATINE_PILOTAGE_API}
36+
profiles:
37+
- platine-pilotage-api
38+
- all
39+
depends_on:
40+
platine-pilotage-db:
41+
condition: service_healthy
42+
environment:
43+
- SPRING_DATASOURCE_DRIVERCLASSNAME=org.postgresql.Driver
44+
- SPRING_DATASOURCE_URL=jdbc:postgresql://platine-pilotage-db:5432/${PLATINE_PILOTAGE_DB_NAME}
45+
- SPRING_DATASOURCE_USERNAME=${PLATINE_PILOTAGE_DB_USER}
46+
- SPRING_DATASOURCE_PASSWORD=${PLATINE_PILOTAGE_DB_PASSWORD}
47+
- SPRING_LIQUIBASE_ENABLED=TRUE
48+
# use initdb,prod if database does not already exist in specific profile environment
49+
- SPRING_LIQUIBASE_CONTEXTS=init-db,demo,prod
50+
- SPRING_LIQUIBASE_DEFAULTSCHEMA=public
51+
#- SPRING_LIQUIBASE_CHANGE-LOG=classpath:db/master.xml
52+
- SPRING_LIQUIBASE_CHANGE-LOG=classpath:db/integration-demo.xml
53+
- SPRINGDOC_SWAGGER_UI_OAUTH_ADDITIONALQUERYSTRINGPARAMS_KC_IDP_HINT=${IDP_HINT}
54+
# issuer-uri is used to auto discover keycloak configuration endpoints and to validate the iss in the token (spring boot check that issuer-uri and iss are identical)
55+
# When using jwk-set-uri, issuer-uri is not used anymore to auto discover configuration.
56+
# That's what we want here. By authenticating with swagger, host machine is used and the iss generated in the token is equals to issuer-uri
57+
- SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI=${AUTH_SERVER_URL}/realms/${AUTH_REALM}
58+
- SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWKSETURI=http://keycloak:8080/realms/${AUTH_REALM}/protocol/openid-connect/certs
59+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_ROLES_RESPONDENT_ROLE=${RESPONDENT_ROLE}
60+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_ROLES_INTERNAL_USER_ROLE=${INTERNAL_USER_ROLE}
61+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_ROLES_ADMIN_ROLE=${ADMIN_ROLE}
62+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_ROLES_WEBCLIENT_ROLE=${WEBCLIENT_ROLE}
63+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_AUTH_MODE=OIDC
64+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_AUTH_SERVERURL=${AUTH_SERVER_URL}
65+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_AUTH_REALM=${AUTH_REALM}
66+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_QUESTIONING_API_URL=
67+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_QUESTIONING_SENSITIVE_API_URL=
68+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_LUNATIC_NORMAL_URL=
69+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_LUNATIC_SENSITIVE_URL=
70+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_XFORM1_URL=
71+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_API_XFORM2_URL=
72+
- FR_INSEE_DATACOLLECTIONMANAGEMENT_LDAP_API_ACCREDITATION_ID=id
73+
- JWT_ROLE_CLAIM=${JWT_ROLE_CLAIM}
74+
- SPRINGDOC_SWAGGER_UI_OAUTH_CLIENT_ID=${AUTH_CLIENT_ID}
75+
ports:
76+
- ${PLATINE_PILOTAGE_API_PORT}:8080
77+
78+
#----------------------------------------------------------------------------
79+
# 0"""0
80+
# ( �.�,) Genesis (traiter)
81+
# (")_(")
82+
#----------------------------------------------------------------------------
83+
mongo-init:
84+
container_name: mongo-init
85+
image: ${IMAGES_REGISTRY_DOCKER_IO}/${IMAGE_BDD_MONGO}
86+
profiles:
87+
- mongodb
88+
- all
89+
volumes: *mongo-volumes-1
90+
restart: on-failure
91+
command:
92+
- /bin/bash
93+
- -c
94+
- |
95+
openssl rand -base64 756 > /data/replica.key
96+
chmod 400 /data/replica.key
97+
chown mongodb:mongodb /data/replica.key
98+
ls -ltrah /data
99+
cat /data/replica.key
100+
#----------------------------------------------------------------------------
101+
mongod1:
102+
container_name: mongod1
103+
image: ${IMAGES_REGISTRY_DOCKER_IO}/${IMAGE_BDD_MONGO}
104+
profiles:
105+
- mongodb
106+
- all
107+
environment:
108+
MONGO_INITDB_ROOT_USERNAME: ${GENESIS_DB_USER}
109+
MONGO_INITDB_ROOT_PASSWORD: ${GENESIS_DB_PASSWORD}
110+
MONGO_INITDB_DATABASE: ${GENESIS_DB_NAME}
111+
depends_on:
112+
- mongo-init
113+
ports:
114+
- ${GENESIS_DB_PORT}:27017
115+
volumes: *mongo-volumes-1
116+
restart: always
117+
healthcheck:
118+
test: ["CMD","mongosh", "--eval", "db.adminCommand('ping')"]
119+
interval: 10s
120+
timeout: 10s
121+
retries: 12
122+
start_period: 120s
123+
command: "mongod --bind_ip_all --replSet dbrs --keyFile /data/replica.key"
124+
#----------------------------------------------------------------------------
125+
mongo-setup-rs-1:
126+
container_name: mongo-setup
127+
image: ${IMAGES_REGISTRY_DOCKER_IO}/${IMAGE_BDD_MONGO}
128+
profiles:
129+
- mongodb
130+
- all
131+
environment:
132+
MONGO_INITDB_ROOT_USERNAME: ${GENESIS_DB_USER}
133+
MONGO_INITDB_ROOT_PASSWORD: ${GENESIS_DB_PASSWORD}
134+
depends_on:
135+
- mongod1
136+
volumes: *mongo-volumes-setup-rs-1
137+
restart: on-failure
138+
entrypoint: ["/bin/bash", "/scripts/mongodb_rs_init.sh"]
139+
140+
#----------------------------------------------------------------------------
141+
# (•_•)
142+
# /( )> Authentification et habilitation
143+
# ^^ ^^
144+
#----------------------------------------------------------------------------
145+
keycloak:
146+
image: ${IMAGES_REGISTRY_QUAY_IO}/${IMAGE_KEYCLOAK}
147+
profiles:
148+
- keycloak
149+
- all
150+
environment:
151+
KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
152+
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
153+
KC_HEALTH_ENABLED: "true"
154+
KC_LOG_LEVEL: info
155+
healthcheck:
156+
test: ["CMD", "curl", "-f", "http://keycloak:8080/health/ready"]
157+
interval: 15s
158+
timeout: 2s
159+
retries: 15
160+
command: ["start-dev", "--import-realm"]
161+
ports:
162+
- "${KEYCLOAK_PORT}:8080"
163+
volumes:
164+
- ./container/keycloak/realms:/opt/keycloak/data/import
165+
#----------------------------------------------------------------------------
166+
volumes:
167+
mongo_vol_1:

0 commit comments

Comments
 (0)