WEBDIENSTE/lasuite-docs
1
0
Fork 0
mirror of https://github.com/suitenumerique/docs.git synced 2026-08-17 21:25:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

🧑‍💻(dev) run Docs beside Drive on a shared identity provider

Browse Source 
The POC needs both stacks up at once on one machine, so the default
ports (3000, 8071, 8083, 4444...) are remapped to a parallel scheme
(3001, 8072, 8084, 4445...) and both compose networks share the
lasuite-network bridge. Authentication is delegated to Drive's
Keycloak: users must have the same OIDC sub in both apps for the
impersonation headers to resolve, so a single realm serves the two of
them and the local Keycloak is no longer proxied. The Drive
server-to-server dev token is a placeholder, mirrored in the Drive
branch of the POC.
This commit is contained in:
Nathan Vasse
2026-07-30 15:49:38 +02:00
parent 0a6cfa3a33
commit b59778f657
5 changed files with 42 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compose-e2e.yml
+3 -3
View File
@@ -6,12 +6,12 @@ services:
dockerfile: ./src/frontend/Dockerfile
target: frontend-production
args:
API_ORIGIN: "http://localhost:8071"
API_ORIGIN: "http://localhost:8072"
PUBLISH_AS_MIT: "false"
SW_DEACTIVATED: "true"
image: impress:frontend-production
ports:
- "3000:3000"
- "3001:3000"
y-provider:
user: ${DOCKER_USER:-1000}
@@ -25,7 +25,7 @@ services:
- env.d/development/common
- env.d/development/common.local
ports:
- "4444:4444"
- "4445:4444"
y-provider-converter:
user: ${DOCKER_USER:-1000}
compose.yml
+12 -17
View File
@@ -22,7 +22,7 @@ services:
mailcatcher:
image: sj26/mailcatcher:latest
ports:
- "1081:1080"
- "1082:1080"
minio:
user: ${DOCKER_USER:-1000}
@@ -31,8 +31,8 @@ services:
- MINIO_ROOT_USER=impress
- MINIO_ROOT_PASSWORD=password
ports:
- "9000:9000"
- "9001:9001"
- "9002:9000"
- "9003:9001"
healthcheck:
test: ["CMD", "mc", "ready", "local"]
interval: 1s
@@ -73,7 +73,7 @@ services:
- env.d/development/postgresql
- env.d/development/postgresql.local
ports:
- "8071:8000"
- "8072:8000"
networks:
default: {}
lasuite:
@@ -118,7 +118,7 @@ services:
nginx:
image: nginx:1.25
ports:
- "8083:8083"
- "8084:8083"
networks:
default: {}
lasuite:
@@ -129,21 +129,14 @@ services:
depends_on:
app-dev:
condition: service_started
keycloak:
condition: service_healthy
restart: true
nginx-frontend:
image: nginx:1.25
ports:
- "3000:3000"
- "3001:3000"
volumes:
- ./src/frontend/apps/impress/conf/default.conf:/etc/nginx/conf.d/impress.conf
- ./src/frontend/apps/impress/out:/app
depends_on:
keycloak:
condition: service_healthy
restart: true
frontend-development:
user: "${DOCKER_USER:-1000}"
@@ -152,16 +145,18 @@ services:
dockerfile: ./src/frontend/Dockerfile
target: impress-dev
args:
API_ORIGIN: "http://localhost:8071"
API_ORIGIN: "http://localhost:8072"
PUBLISH_AS_MIT: "false"
SW_DEACTIVATED: "true"
image: impress:frontend-development
environment:
- NEXT_PUBLIC_API_ORIGIN=http://localhost:8072
volumes:
- ./src/frontend:/home/frontend
- /home/frontend/node_modules
- /home/frontend/apps/impress/node_modules
ports:
- "3000:3000"
- "3001:3000"
crowdin:
image: crowdin/cli:3.16.0
@@ -193,7 +188,7 @@ services:
- env.d/development/common
- env.d/development/common.local
ports:
- "4444:4444"
- "4445:4444"
volumes:
- ./src/frontend/:/home/frontend
- /home/frontend/node_modules
@@ -252,7 +247,7 @@ services:
timeout: 2s
retries: 300
ports:
- "8080:8080"
- "8082:8080"
depends_on:
kc_postgresql:
condition: service_healthy
docker/files/etc/nginx/conf.d/default.conf
+3 -12
View File
@@ -37,16 +37,7 @@ server {
proxy_set_header X-Original-Method $request_method;
}
location / {
proxy_pass http://keycloak:8080;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Increase proxy buffer size to allow keycloak to send large
# header responses when a user is created.
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
# Authentication is delegated to Drive's Keycloak (single shared
# instance, reachable on http://localhost:8083), so this server only
# handles media.
}
env.d/development/common
+23 -18
View File
@@ -18,42 +18,43 @@ PYTHONPATH=/app
# Mail
DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
DJANGO_EMAIL_HOST="mailcatcher"
DJANGO_EMAIL_LOGO_IMG="http://localhost:3000/assets/logo-suite-numerique.png"
DJANGO_EMAIL_LOGO_IMG="http://localhost:3001/assets/logo-suite-numerique.png"
DJANGO_EMAIL_PORT=1025
DJANGO_EMAIL_URL_APP="http://localhost:3000"
DJANGO_EMAIL_URL_APP="http://localhost:3001"
# Backend url
IMPRESS_BASE_URL="http://localhost:8072"
DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8072,http://localhost:3001
# Media
STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
AWS_S3_ENDPOINT_URL=http://minio:9000
AWS_S3_ACCESS_KEY_ID=impress
AWS_S3_SECRET_ACCESS_KEY=password
MEDIA_BASE_URL=http://localhost:8083
MEDIA_BASE_URL=http://localhost:8084
# OIDC
OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/certs
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/impress/protocol/openid-connect/auth
OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token
OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/userinfo
OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token/introspect
OIDC_OP_JWKS_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/certs
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/drive/protocol/openid-connect/auth
OIDC_OP_TOKEN_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token
OIDC_OP_USER_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/userinfo
OIDC_OP_INTROSPECTION_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token/introspect
OIDC_RP_CLIENT_ID=impress
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
OIDC_RP_SIGN_ALGO=RS256
OIDC_RP_SCOPES="openid email"
LOGIN_REDIRECT_URL=http://localhost:3000
LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
LOGOUT_REDIRECT_URL=http://localhost:3000
LOGIN_REDIRECT_URL=http://localhost:3001
LOGIN_REDIRECT_URL_FAILURE=http://localhost:3001
LOGOUT_REDIRECT_URL=http://localhost:3001
OIDC_REDIRECT_ALLOWED_HOSTS="localhost:8083,localhost:3000"
OIDC_REDIRECT_ALLOWED_HOSTS="localhost:8083,localhost:3001"
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
# Resource Server Backend
OIDC_OP_URL=http://localhost:8083/realms/docs
OIDC_OP_INTROSPECTION_ENDPOINT = http://nginx:8083/realms/docs/protocol/openid-connect/token/introspect
OIDC_OP_URL=http://localhost:8083/realms/drive
OIDC_OP_INTROSPECTION_ENDPOINT = http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token/introspect
OIDC_RESOURCE_SERVER_ENABLED=False
OIDC_RS_CLIENT_ID=docs
OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
@@ -69,18 +70,18 @@ OIDC_RS_ALLOWED_AUDIENCES=""
# OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
# User reconciliation
USER_RECONCILIATION_FORM_URL=http://localhost:3000
USER_RECONCILIATION_FORM_URL=http://localhost:3001
# Collaboration
COLLABORATION_API_URL=http://y-provider-development:4444/collaboration/api/
COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000
COLLABORATION_SERVER_ORIGIN=http://localhost:3000
COLLABORATION_SERVER_ORIGIN=http://localhost:3001
COLLABORATION_SERVER_SECRET=my-secret
COLLABORATION_WS_NOT_CONNECTED_READ_ONLY=true
COLLABORATION_WS_URL=ws://localhost:4444/collaboration/ws/
COLLABORATION_WS_URL=ws://localhost:4445/collaboration/ws/
COLLABORATION_WS_INACTIVITY_TIMEOUT=15 # Seconds
DJANGO_SERVER_TO_SERVER_API_TOKENS=server-api-token
DJANGO_SERVER_TO_SERVER_API_TOKENS=server-api-token,docs-drive-poc-secret
Y_PROVIDER_API_BASE_URL=http://y-provider-development-converter:4444/api/
Y_PROVIDER_API_KEY=yprovider-api-key
@@ -97,3 +98,7 @@ SEARCH_URL=http://find:8000/api/v1.0/documents/search/
SEARCH_INDEXER_QUERY_LIMIT=50
CONVERSION_UPLOAD_ENABLED=true
# Docs <-> Drive POC integration
DRIVE_API_BASE_URL=http://drive-app-dev-1:8000/api/v1.0
DRIVE_SERVER_TO_SERVER_TOKEN=docs-drive-poc-secret
env.d/development/kc_auth
+1 -1
View File
@@ -1,6 +1,6 @@
# Keycloak
KC_HOSTNAME=http://localhost:8083
KC_HOSTNAME=http://localhost:8084
KEYCLOAK_ADMIN: admin
KEYCLOAK_ADMIN_PASSWORD: admin
KC_DB: postgres