Add initial package and configuration files for FHIR info Gateway

config.yaml

@@ -27,6 +27,7 @@ packages:
   - database-postgres
   - reprocess-mediator
   - fhir-ig-importer
+  - fhir-info-gateway
 
 profiles:
   - name: cdr-dw
@@ -47,6 +48,7 @@ profiles:
       - kafka-unbundler-consumer
       - fhir-ig-importer
       - reprocess-mediator
+      - fhir-info-gateway
     envFiles:
       - cdr-dw.env
 
@@ -63,6 +65,8 @@ profiles:
       - client-registry-jempi
       - identity-access-manager-keycloak
       - openhim-mapping-mediator
+      - fhir-ig-importer
+      - fhir-info-gateway
     envFiles:
       - cdr.env
 

fhir-info-gateway/docker-compose-smart_keycloak.yml

@@ -0,0 +1,17 @@
+version: "3.9"
+
+services:
+  smart-config:
+    image: jembi/keycloak-config:v0.0.1
+    networks:
+      keycloak:
+    environment:
+      KEYCLOAK_BASE_URL: ${KC_API_URL}
+      KEYCLOAK_USER: ${KC_ADMIN_USERNAME}
+      KEYCLOAK_PASSWORD: ${KC_ADMIN_PASSWORD}
+      KEYCLOAK_REALM: ${KC_REALM_NAME}
+    command: [ "-configFile", "config/backend-services-config.json" ]
+networks:
+  keycloak:
+    name: keycloak_public
+    external: true

fhir-info-gateway/docker-compose.dev.yml

@@ -0,0 +1,8 @@
+version: '3.9'
+
+services:
+  fhir-info-gateway:
+    ports:
+      - target: 8080
+        published: 8880
+        mode: host

fhir-info-gateway/docker-compose.yml

@@ -0,0 +1,33 @@
+version: "3.9"
+services:
+  fhir-info-gateway:
+    image: ${FHIR_INFO_GATEWAY_IMAGE}
+    networks:
+      openhim:
+      keycloak:
+      default:
+    environment:
+      TOKEN_ISSUER: ${KC_API_URL}/realms/${KC_REALM_NAME}
+      ACCESS_CHECKER: ${ACCESS_CHECKER}
+      PROXY_TO: ${GATEWAY_MPI_PROXY_URL}
+      BACKEND_TYPE: ${BACKEND_TYPE}
+      RUN_MODE: ${RUN_MODE}
+    deploy:
+      replicas: ${FHIR_INFO_GATEWAY_INSTANCES}
+      placement:
+        max_replicas_per_node: ${FHIR_INFO_GATEWAY_MAX_REPLICAS_PER_NODE}
+      resources:
+        limits:
+          cpus: ${FHIR_INFO_GATEWAY_CPU_LIMIT}
+          memory: ${FHIR_INFO_GATEWAY_MEMORY_LIMIT}
+        reservations:
+          cpus: ${FHIR_INFO_GATEWAY_CPU_RESERVE}
+          memory: ${FHIR_INFO_GATEWAY_MEMORY_RESERVE}
+networks:
+    openhim:
+      name: openhim_public
+      external: true
+    keycloak:
+      name: keycloak_public
+      external: true
+    default:

fhir-info-gateway/importer/keycloak-config.json

@@ -0,0 +1,231 @@
+{
+  "clientScopes": {
+    "system/*.rs": {
+      "protocol": "openid-connect",
+      "description": "Read access to all resources",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "admin",
+        "name": "administrator",
+        "description": "Has full access to all resources"
+      }
+    },
+
+    "system/Patient.cruds": {
+      "protocol": "openid-connect",
+      "description": "Read access to all data",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "admin",
+        "name": "administrator",
+        "description": "Has full access to all resources"
+      }
+    },
+    "system/Patient.cud": {
+      "protocol": "openid-connect",
+      "description": "Read and write access to all Patient",
+      "attributes": {
+        "include.in.token.scope": "false"
+      },
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "manager",
+        "name": "manager",
+        "description": "Has limited access to all resources"
+      }
+    },
+    "system/Patient.rs": {
+      "protocol": "openid-connect",
+      "description": "Read access to all Patient",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "user",
+        "name": "user",
+        "description": "Has read access to all resources"
+      }
+    },
+    "system/Encounter.rs": {
+      "protocol": "openid-connect",
+      "description": "Read access to all Encounter data",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "user",
+        "name": "user",
+        "description": "Has read access to all resources"
+      }
+    },
+    "system/Observation.rs": {
+      "protocol": "openid-connect",
+      "description": "Read access to all Observation data",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "user",
+        "name": "user",
+        "description": "Has read access to all resources"
+      }
+    },
+    "system/Encounter.cruds": {
+      "protocol": "openid-connect",
+      "description": "Read, write and search access to all Encounter data",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "admin",
+        "name": "administrator",
+        "description": "Has full access to all resources"
+      }
+    },
+    "system/Encounter.cud": {
+      "protocol": "openid-connect",
+      "description": "Read and write access to all Encounter data",
+      "attributes": {
+        "include.in.token.scope": "false"
+      },
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "manager",
+        "name": "manager",
+        "description": "Has limited access to all resources"
+      }
+    },
+    "system/Observation.cruds": {
+      "protocol": "openid-connect",
+      "description": "Read access to all Observation data",
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "admin",
+        "name": "administrator",
+        "description": "Has full access to all resources"
+      }
+    },
+    "system/Observation.cud": {
+      "protocol": "openid-connect",
+      "description": "Read and write access to all Observation data",
+      "attributes": {
+        "include.in.token.scope": "false"
+      },
+      "mappers": {
+        "Audience Mapper": {
+          "protocol": "openid-connect",
+          "protocolmapper": "oidc-audience-mapper",
+          "config": {
+            "access.token.claim": "true"
+          }
+        }
+      },
+      "role": {
+        "id": "manager",
+        "name": "manager",
+        "description": "Has limited access to all resources"
+      }
+    }
+  },
+
+  "client": {
+    "protocol": "openid-connect",
+    "clientId": "emr",
+    "name": "EMR user",
+    "description": "",
+    "publicClient": false,
+    "authorizationServicesEnabled": false,
+    "serviceAccountsEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "standardFlowEnabled": true,
+    "frontchannelLogout": true,
+    "alwaysDisplayInConsole": false,
+    "attributes": {
+      "oauth2.device.authorization.grant.enabled": false,
+      "oidc.ciba.grant.enabled": false
+    }
+  },
+  "groups": {
+    "fhirUser": {}
+  },
+  "defaultGroup": "fhir-user-group",
+  "defaultUser": {
+    "username": "fhirUser",
+    "firstName": "FHIR",
+    "lastName": "User",
+    "email": "[email protected]",
+    "emailVerified": false,
+    "enabled": true,
+    "groups": ["fhirUser"]
+  },
+  "resetPassword": {
+    "temporary": false,
+    "type": "password",
+    "value": "dev_password_only"
+  }
+}