Skip to content

Commit 7d39dab

Browse files
holashchandholashchand
committed
updated docker compose file with 2.0 services
1 parent d9a1113 commit 7d39dab

File tree

6 files changed

+221
-34
lines changed

6 files changed

+221
-34
lines changed

‎.env

+31-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,31 @@
1-
RELEASE_VERSION=v1.0.0
1+
RELEASE_VERSION=v2.0.0
2+
KEYCLOAK_SECRET=**********
3+
4+
# vault service
5+
VAULT_ADDR=http://0.0.0.0:8200
6+
VAULT_API_ADDR=http://0.0.0.0:8200
7+
VAULT_ADDRESS=http://0.0.0.0:8200
8+
9+
# identity service
10+
VAULT_ADDR=http://vault:8200
11+
VAULT_TOKEN=
12+
VAULT_BASE_URL=http://vault:8200/v1
13+
VAULT_ROOT_PATH=http://vault:8200/v1/kv
14+
VAULT_TIMEOUT=5000
15+
VAULT_PROXY=false
16+
SIGNING_ALGORITHM=Ed25519Signature2020
17+
JWKS_URI=
18+
ENABLE_AUTH=false
19+
WEB_DID_BASE_URL=https://example.com/identifier
20+
21+
# credential schema service
22+
IDENTITY_BASE_URL=http://identity:3332
23+
JWKS_URI=
24+
ENABLE_AUTH=false
25+
26+
# credential service
27+
IDENTITY_BASE_URL=http://identity:3332
28+
SCHEMA_BASE_URL=http://schema:3333
29+
CREDENTIAL_SERVICE_BASE_URL=https://example.com/credentials
30+
JWKS_URI=
31+
ENABLE_AUTH=false

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -88,5 +88,6 @@ out
8888

8989
.ipynb_checkpoints
9090
db-data*
91+
vault-data
9192
es-data*
9293
keycloak-mobile*.jar

‎Makefile

+4-1
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,7 @@ release: test
9090
docker push $$image:latest;\
9191
docker push $$image:$(RELEASE_VERSION);\
9292
done
93-
@cd tools/cli/ && npm publish
93+
@cd tools/cli/ && npm publish
94+
95+
compose-init:
96+
bash setup_vault.sh docker-compose.yml vault

‎docker-compose.yml

+90-32
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ services:
8080
- did_generate_url=${DID_GENERATE_URL-http://identity:3332/did/generate}
8181
- did_resolve_url=${DID_RESOLVE_URL-http://identity:3332/did/resolve}
8282
- signature_enabled=${SIGNATURE_ENABLED-false}
83-
- signature_provider=${SIGNATURE_PROVIDER-dev.sunbirdrc.registry.service.impl.SignatureV1ServiceImpl}
83+
- signature_provider=${SIGNATURE_PROVIDER-dev.sunbirdrc.registry.service.impl.SignatureV2ServiceImpl}
8484
- signature_v2_health_check_url=${SIGNATURE_V2_HEALTH_CHECK_URL-http://credential:3000/health}
8585
- signature_v2_issue_url=${SIGNATURE_V2_ISSUE_URL-http://credential:3000/credentials/issue}
8686
- signature_v2_get_url=${SIGNATURE_V2_GET_URL-http://credential:3000/credentials/{id}}
@@ -110,7 +110,7 @@ services:
110110
- logging.level.root=INFO
111111
- enable_external_templates=true
112112
- async_enabled=${ASYNC_ENABLED-false}
113-
- authentication_enabled=${AUTHENTICATION_ENABLED-true}
113+
- authentication_enabled=${AUTHENTICATION_ENABLED-false}
114114
- kafka_bootstrap_address=kafka:9092
115115
- webhook_enabled=false
116116
- webhook_url=http://localhost:5001/api/v1/callback
@@ -124,9 +124,6 @@ services:
124124
- notification_url=${NOTIFICATION_URL-http://notification-ms:8765/notification-service/v1/notification}
125125
ports:
126126
- '8081:8081'
127-
networks:
128-
default:
129-
rcw:
130127
depends_on:
131128
db:
132129
condition: service_healthy
@@ -191,35 +188,101 @@ services:
191188
interval: 30s
192189
timeout: 10s
193190
retries: 10
194-
certificate-signer:
195-
image: ghcr.io/sunbird-rc/sunbird-rc-certificate-signer:${RELEASE_VERSION}
196-
environment:
197-
- PORT=8079
198-
- TIME_ZONE=Asia/Kolkata
199-
ports:
200-
- '8079:8079'
191+
vault:
192+
image: vault:1.13.3
193+
restart: always
201194
volumes:
202-
- ./imports:/etc/signer
203-
healthcheck:
204-
test: ['CMD-SHELL', 'curl -f http://localhost:8079/health || exit 1']
205-
interval: 30s
206-
timeout: 10s
207-
retries: 10
208-
certificate-api:
209-
image: ghcr.io/sunbird-rc/sunbird-rc-certificate-api:${RELEASE_VERSION}
195+
- ./vault.json:/vault/config/vault.json
196+
- ./vault-data:/vault/file
210197
environment:
211-
- PORT=8078
198+
- VAULT_ADDR=${VAULT_ADDR}
199+
- VAULT_API_ADDR=${VAULT_API_ADDR}
200+
- VAULT_ADDRESS=${VAULT_ADDRESS}
201+
cap_add:
202+
- IPC_LOCK
203+
command: vault server -config=/vault/config/vault.json
212204
ports:
213-
- '8078:8078'
205+
- 8200:8200
214206
healthcheck:
215207
test:
216208
[
217-
'CMD-SHELL',
218-
'wget -nv -t1 --spider http://localhost:8078/health || exit 1',
209+
"CMD-SHELL",
210+
"wget --spider http://127.0.0.1:8200/v1/sys/health || exit 1",
219211
]
220-
interval: 30s
221-
timeout: 10s
222-
retries: 10
212+
interval: 10s
213+
timeout: 5s
214+
retries: 3
215+
identity:
216+
image: ghcr.io/sunbird-rc/sunbird-rc-identity-service:${RELEASE_VERSION}
217+
ports:
218+
- "3332:3332"
219+
depends_on:
220+
vault:
221+
condition: service_healthy
222+
db:
223+
condition: service_healthy
224+
environment:
225+
- DATABASE_URL=postgres://postgres:postgres@db:5432/registry
226+
- VAULT_ADDR=${VAULT_ADDR}
227+
- VAULT_TOKEN=${VAULT_TOKEN}
228+
- VAULT_BASE_URL=${VAULT_BASE_URL}
229+
- VAULT_ROOT_PATH=${VAULT_ROOT_PATH}
230+
- VAULT_TIMEOUT=${VAULT_TIMEOUT}
231+
- VAULT_PROXY=${VAULT_PROXY}
232+
- SIGNING_ALGORITHM=${SIGNING_ALGORITHM}
233+
- JWKS_URI=${JWKS_URI}
234+
- ENABLE_AUTH=${ENABLE_AUTH}
235+
- WEB_DID_BASE_URL=${WEB_DID_BASE_URL}
236+
healthcheck:
237+
test:
238+
[ "CMD-SHELL", "curl -f http://localhost:3332/health || exit 1" ]
239+
interval: 10s
240+
timeout: 5s
241+
retries: 5
242+
credential-schema:
243+
image: ghcr.io/sunbird-rc/sunbird-rc-credential-schema:${RELEASE_VERSION}
244+
ports:
245+
- "3333:3333"
246+
depends_on:
247+
db:
248+
condition: service_healthy
249+
identity:
250+
condition: service_healthy
251+
environment:
252+
- DATABASE_URL=postgres://postgres:postgres@db:5432/registry
253+
- IDENTITY_BASE_URL=${IDENTITY_BASE_URL}
254+
- JWKS_URI=${JWKS_URI}
255+
- ENABLE_AUTH=${ENABLE_AUTH}
256+
healthcheck:
257+
test:
258+
[ "CMD-SHELL", "curl -f http://localhost:3333/health || exit 1" ]
259+
interval: 10s
260+
timeout: 5s
261+
retries: 5
262+
credential:
263+
image: ghcr.io/sunbird-rc/sunbird-rc-credentials-service:${RELEASE_VERSION}
264+
ports:
265+
- "3000:3000"
266+
depends_on:
267+
db:
268+
condition: service_healthy
269+
identity:
270+
condition: service_healthy
271+
credential-schema:
272+
condition: service_healthy
273+
environment:
274+
- DATABASE_URL=postgres://postgres:postgres@db:5432/registry
275+
- IDENTITY_BASE_URL=${IDENTITY_BASE_URL}
276+
- SCHEMA_BASE_URL=${SCHEMA_BASE_URL}
277+
- CREDENTIAL_SERVICE_BASE_URL=${CREDENTIAL_SERVICE_BASE_URL}
278+
- JWKS_URI=${JWKS_URI}
279+
- ENABLE_AUTH=${ENABLE_AUTH}
280+
healthcheck:
281+
test:
282+
[ "CMD-SHELL", "curl -f http://localhost:3000/health || exit 1" ]
283+
interval: 10s
284+
timeout: 5s
285+
retries: 5
223286
file-storage:
224287
image: quay.io/minio/minio
225288
volumes:
@@ -413,8 +476,3 @@ services:
413476
depends_on:
414477
db:
415478
condition: service_healthy
416-
417-
418-
networks:
419-
rcw:
420-
external: true

‎setup_vault.sh

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/bin/bash
2+
3+
# This script does the following things
4+
# * Start a vault instance with vault/vault.json configuration
5+
# * Unseal the vault
6+
# * Create a v2 kv engine
7+
# * Prints the unseal keys and root token
8+
# * This script does not automatically unseal vault on restarts, it only works with fresh installations
9+
10+
COMPOSE_FILE="${1:-docker-compose.yml}"
11+
SERVICE_NAME="${2:-vault}"
12+
13+
echo "Setting up $SERVICE_NAME in $COMPOSE_FILE"
14+
15+
docker-compose -f "$COMPOSE_FILE" up -d "$SERVICE_NAME"
16+
17+
# Function to check if Vault is ready
18+
check_vault_status() {
19+
vault_status=$(docker-compose -f "$COMPOSE_FILE" exec "$SERVICE_NAME" vault status 2>&1)
20+
if [[ $vault_status == *"connection refused"* ]]; then
21+
echo "Unable to connect to Vault. Waiting for Vault to start..."
22+
return 1
23+
elif [[ $vault_status == *"Sealed true"* ]]; then
24+
echo "Vault is sealed. Waiting for unsealing..."
25+
return 0
26+
else
27+
echo "Unsealed and up. Moving to next steps."
28+
return 0
29+
fi
30+
}
31+
32+
33+
# Wait for Vault service to become available
34+
until check_vault_status; do
35+
echo "Waiting for Vault service to start..."
36+
sleep 1;
37+
done
38+
39+
40+
if [[ $vault_status == *"Initialized true"* ]]; then
41+
echo "Vault is initialized already. Unsealing if it is not unsealed"
42+
else
43+
# keys contains ansi escape sequences, remove them if any
44+
docker-compose -f "$COMPOSE_FILE" exec -T "$SERVICE_NAME" vault operator init > ansi-keys.txt
45+
sed 's/\x1B\[[0-9;]*[JKmsu]//g' < ansi-keys.txt > keys.txt
46+
fi
47+
48+
sed -n 's/Unseal Key [1-1]\+: \(.*\)/\1/p' keys.txt > parsed-key.txt
49+
key=$(cat parsed-key.txt)
50+
docker-compose -f "$COMPOSE_FILE" exec -T "$SERVICE_NAME" vault operator unseal "$key" < /dev/null
51+
52+
sed -n 's/Unseal Key [2-2]\+: \(.*\)/\1/p' keys.txt > parsed-key.txt
53+
key=$(cat parsed-key.txt)
54+
docker-compose -f "$COMPOSE_FILE" exec -T "$SERVICE_NAME" vault operator unseal "$key" < /dev/null
55+
56+
sed -n 's/Unseal Key [3-3]\+: \(.*\)/\1/p' keys.txt > parsed-key.txt
57+
key=$(cat parsed-key.txt)
58+
docker-compose -f "$COMPOSE_FILE" exec -T "$SERVICE_NAME" vault operator unseal "$key" < /dev/null
59+
60+
root_token=$(sed -n 's/Initial Root Token: \(.*\)/\1/p' keys.txt | tr -dc '[:print:]')
61+
62+
if [[ $vault_status == *"Initialized true"* ]]; then
63+
echo "Vault is initialized already. Skipping creating a KV engine"
64+
else
65+
sed -i "s/VAULT_TOKEN=.*/VAULT_TOKEN=$root_token/" ".env"
66+
docker-compose -f "$COMPOSE_FILE" exec -e VAULT_TOKEN=$root_token -T "$SERVICE_NAME" vault secrets enable -path=kv kv-v2
67+
fi
68+
69+
echo -e "\nNOTE: KEYS ARE STORED IN keys.txt"
70+
71+
if [ -f "ansi-keys.txt" ] ; then
72+
rm ansi-keys.txt
73+
fi
74+
75+
if [ -f "parsed-key.txt" ] ; then
76+
rm parsed-key.txt
77+
fi

‎vault.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"listener": {
3+
"tcp": {
4+
"address": "0.0.0.0:8200",
5+
"tls_disable": 1
6+
}
7+
},
8+
"backend": {
9+
"file": {
10+
"path": "/vault/file"
11+
}
12+
},
13+
"default_lease_ttl": "168h",
14+
"max_lease_ttl": "0h",
15+
"api_addr": "http://0.0.0.0:8200",
16+
"ui": "true",
17+
"disable_mlock": "true"
18+
}

0 commit comments

Comments
 (0)