-
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
doc: Add example how to run with local dex IDP
- Loading branch information
1 parent
ff9bf8a
commit 64bca45
Showing
8 changed files
with
279 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,3 +18,4 @@ repos: | |
| rev: "v3.1.0" | ||
| hooks: | ||
| - id: prettier | ||
| exclude: "(example|hasura|docs)/.*" | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| OAUTH2_PROXY_CLIENT_ID=sitrep | ||
| OAUTH2_PROXY_CLIENT_SECRET=ds8LCRW4jhB58nWdMgZHeVISqx3O3e1o3g0LEr9H8tM= # generate with: openssl rand -base64 32 | tr -- '+/' '-_' | ||
| OAUTH2_PROXY_COOKIE_SECRET=kvicWov5Y_w10r2vmnxJTUTugMUtBp6_R4loxuANMtg= # generate with: openssl rand -base64 32 | tr -- '+/' '-_' | ||
| HASURA_GRAPHQL_ADMIN_SECRET=388HMfQ00gEyg636O63S1jxRODTSoAiu_XHa0fXhtRo= # generate with: openssl rand -base64 32 | tr -- '+/' '-_' | ||
| POSTGRES_PASSWORD=postgrespassword # set to something secure or generate with: openssl rand -base64 32 | tr -- '+/' '-_' | ||
|
|
||
| # the hostname you want to serve sitrep on, should match your caddy config file | ||
| # locally resolvable dns names like sitrep.local work as well if your server is setup accrodingly | ||
| SITREP_HOSTNAME=192.168.1.2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # add your IP / domain here | ||
| sitrep.local, 10.40.1.125 { | ||
| log | ||
| reverse_proxy /dex* localhost:5556 { | ||
| header_up Host {host} # redundant | ||
| header_up X-Real-IP {remote} | ||
| header_up X-Forwarded-For {remote} # redundant | ||
| header_up X-Forwarded-Port {server_port} # redundant | ||
| header_up X-Forwarded-Proto {scheme} | ||
| } | ||
|
|
||
| reverse_proxy localhost:4180 { | ||
| header_up Host {host} # redundant | ||
| header_up X-Real-IP {remote} | ||
| header_up X-Forwarded-For {remote} # redundant | ||
| header_up X-Forwarded-Port {server_port} # redundant | ||
| header_up X-Forwarded-Proto {scheme} | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Example Setup Sitrep | ||
|
|
||
| This shows how to start sitrep with a local DEX IDP. | ||
|
|
||
| Prerequisites: | ||
|
|
||
| - docker / docker compose | ||
| - caddy webserver (every other reverse proxy would work as well, nginx, apache, etc.) | ||
|
|
||
| ## Configuration | ||
|
|
||
| All configuration can be done in the .env and the Caddyfile file: | ||
|
|
||
| ### Caddyfile | ||
|
|
||
| set the hostname in the caddyfile server block: | ||
|
|
||
| ```diff | ||
| - sitrep.local, 192.168.9.2 { | ||
| + myserver.example.com { | ||
|
|
||
| ``` | ||
|
|
||
| ### .env file | ||
|
|
||
| - Make sure to set the SITREP_HOSTNAME to the same thing you set in the Caddyfile. | ||
| - regenerate all secrets as mentioned in the file | ||
|
|
||
| ## Run Sitrep | ||
|
|
||
| 1. Start Caddy webserver (from this directory): | ||
|
|
||
| ``` | ||
| $ caddy run | ||
| ``` | ||
|
|
||
| 2. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| issuer: {{ getenv "DEX_ISSUER" "http://127.0.0.1:5556/dex" }} | ||
|
|
||
| storage: | ||
| type: sqlite3 | ||
| config: | ||
| file: var/sqlite/dex/dex.db | ||
|
|
||
| web: | ||
| http: {{ getenv "DEX_WEB_HTTP" "0.0.0.0:5556" }} | ||
|
|
||
| telemetry: | ||
| http: 127.0.0.1:5558 | ||
|
|
||
| logger: | ||
| level: {{ getenv "DEX_LOG_LEVEL" "debug" }} | ||
| format: {{ getenv "DEX_LOG_FORMAT" "text" }} | ||
|
|
||
| staticClients: | ||
| - id: {{ getenv "OAUTH2_PROXY_CLIENT_ID" "sitrep" }} | ||
| redirectURIs: | ||
| - "http://localhost:4180/oauth2/callback" | ||
| - "http://localhost:3000/oauth2/callback" | ||
| - {{ getenv "OAUTH2_PROXY_REDIRECT_URL" "https://localhost/oauth2/callback" }} | ||
| name: "Sitrep" | ||
| secret: {{ getenv "OAUTH2_PROXY_CLIENT_SECRET" "ZXhhbXBsZS1hcHAtc2VjcmV0" }} | ||
|
|
||
| connectors: | ||
| {{- if getenv "DEX_CONNECTORS_ENABLE_MOCK" }} | ||
| - type: mockCallback | ||
| id: mock | ||
| name: Example | ||
| {{- end }} | ||
|
|
||
| {{- if getenv "DEX_CONNECTORS_ENABLE_DEMO_USER" }} | ||
| enablePasswordDB: true | ||
| staticPasswords: | ||
| - email: "[email protected]" | ||
| hash: "$2y$10$Og387KAsKCaYF.rZXElhluHR/13BYdtQQfERy.Wf3WVzTYT8j9BiW" # pw: sitrep-demo | ||
| username: "demo" | ||
| userID: "325d59a7-5240-4616-88d7-c2eb57fff7a6" | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| name: sitrep | ||
| services: | ||
| graphql-engine: | ||
| depends_on: | ||
| postgres: | ||
| condition: service_started | ||
| environment: | ||
| HASURA_GRAPHQL_ADMIN_SECRET: ${HASURA_GRAPHQL_ADMIN_SECRET} | ||
| HASURA_GRAPHQL_DEV_MODE: "true" | ||
| HASURA_GRAPHQL_ENABLE_CONSOLE: "false" | ||
| HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, webhook-log, websocket-log, query-log | ||
| HASURA_GRAPHQL_JWT_SECRET: '{"type":"RS256","jwk_url": "http://dex:5556/dex/keys" ,"header":{"type":"Authorization"},"claims_map":{"x-hasura-user-id":{"path":"$.sub"},"x-hasura-email":{"path":"$.email"},"x-hasura-allowed-roles":["viewer","editor"],"x-hasura-default-role":"editor"}}' | ||
| HASURA_GRAPHQL_METADATA_DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres | ||
| HASURA_GRAPHQL_UNAUTHORIZED_ROLE: anonymous | ||
| HASURA_GRAPHQL_EXPERIMENTAL_FEATURES: naming_convention | ||
| HASURA_GRAPHQL_DEFAULT_NAMING_CONVENTION: graphql-default | ||
| PG_DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres | ||
| image: ghcr.io/f-eld-ch/sitrep-hasura:edge | ||
| networks: | ||
| default: null | ||
| restart: always | ||
| sitrep: | ||
| depends_on: | ||
| graphql-engine: | ||
| condition: service_started | ||
| environment: | ||
| OAUTH2_PROXY_CLIENT_ID: ${OAUTH2_PROXY_CLIENT_ID} | ||
| OAUTH2_PROXY_CLIENT_SECRET: ${OAUTH2_PROXY_CLIENT_SECRET} | ||
| OAUTH2_PROXY_CODE_CHALLENGE_METHOD: S256 | ||
| OAUTH2_PROXY_COOKIE_SECRET: ${OAUTH2_PROXY_COOKIE_SECRET} | ||
| OAUTH2_PROXY_COOKIE_CSRF_PER_REQUEST: true | ||
| OAUTH2_PROXY_COOKIE_CSRF_EXPIRE: 5m | ||
| OAUTH2_PROXY_EMAIL_DOMAINS: "*" | ||
| OAUTH2_PROXY_HTTP_ADDRESS: :4180 | ||
| OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true" | ||
| OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true" | ||
| OAUTH2_PROXY_PROVIDER: oidc | ||
| OAUTH2_PROXY_PROXY_WEBSOCKETS: "true" | ||
| OAUTH2_PROXY_UPSTREAMS: "http://graphql-engine:8080/v1/graphql,file:///static/#/" | ||
| OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: true | ||
| OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: true | ||
| OAUTH2_PROXY_REDIRECT_URL: https://${SITREP_HOSTNAME}/oauth2/callback | ||
| OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY: true | ||
| OAUTH2_PROXY_OIDC_ISSUER_URL: http://dex:5556/dex | ||
| image: ghcr.io/f-eld-ch/sitrep:edge | ||
| extra_hosts: | ||
| - "${SITREP_HOSTNAME}:host-gateway" | ||
| networks: | ||
| default: null | ||
| ports: | ||
| - mode: ingress | ||
| target: 4180 | ||
| published: "4180" | ||
| protocol: tcp | ||
| restart: always | ||
| postgres: | ||
| environment: | ||
| POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} | ||
| image: postgis/postgis:14-3.2 | ||
| networks: | ||
| default: null | ||
| restart: always | ||
| volumes: | ||
| - type: volume | ||
| source: db_data | ||
| target: /var/lib/postgresql/data | ||
| volume: {} | ||
| ports: | ||
| - mode: ingress | ||
| target: 5432 | ||
| published: "5432" | ||
| protocol: tcp | ||
| dex: | ||
| image: docker.io/dexidp/dex:v2.38.0 | ||
| environment: | ||
| OAUTH2_PROXY_CLIENT_ID: ${OAUTH2_PROXY_CLIENT_ID} | ||
| OAUTH2_PROXY_CLIENT_SECRET: ${OAUTH2_PROXY_CLIENT_SECRET} | ||
| DEX_CONNECTORS_ENABLE_MOCK: "true" | ||
| DEX_CONNECTORS_ENABLE_DEMO_USER: "true" | ||
| DEX_ISSUER: https://${SITREP_HOSTNAME}/dex | ||
| OAUTH2_PROXY_REDIRECT_URL: https://${SITREP_HOSTNAME}/oauth2/callback | ||
| networks: | ||
| default: null | ||
| restart: always | ||
| extra_hosts: | ||
| - "${SITREP_HOSTNAME}:host-gateway" | ||
| command: dex serve /etc/dex/config-demo.yaml | ||
| volumes: | ||
| - type: bind | ||
| source: ./dexidp/config-demo.yaml | ||
| target: /etc/dex/config-demo.yaml | ||
| read_only: true | ||
| - type: volume | ||
| source: dex_data | ||
| target: /var/sqlite/dex | ||
| volume: {} | ||
| ports: | ||
| - mode: ingress | ||
| target: 5556 | ||
| published: "5556" | ||
| protocol: tcp | ||
| - mode: ingress | ||
| target: 5557 | ||
| published: "5557" | ||
| protocol: tcp | ||
| networks: | ||
| default: | ||
| name: sitrep_default | ||
| volumes: | ||
| db_data: | ||
| name: sitrep_db_data | ||
| dex_data: | ||
| name: sitrep_dex_data |