docker-compose-oauth.yaml

# Copyright 2020 Cargill Incorporated
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------------------------

version: '3.6'

volumes:
  alpha-keys:
  beta-keys:
  contracts:
  registry:

services:

  # ---== alpha node ==---

  splinterd-alpha:
    image: splintercommunity/splinterd:experimental
    container_name: splinterd-alpha
    hostname: splinterd-alpha
    expose:
      - 8044
      - 8085
    ports:
      - "8044:8044"
      - "8085:8085"
    volumes:
      - alpha-keys:/keys
    entrypoint: |
      bash -c "
        if [ ! -f /keys/alpha.priv ]
        then
          splinter keygen alpha --key-dir /keys
        fi && \
        if [ ! -s /etc/splinter/allow_keys ]
        then
          echo $$(cat /keys/alpha.pub) > /etc/splinter/allow_keys
        fi && \
        until PGPASSWORD=admin psql -h splinter-db-alpha -U admin -d splinter -c '\q'; do
          >&2 echo \"Database is unavailable - sleeping\"
          sleep 1
        done
        if [ ! -f /etc/splinter/certs/private/server.key ]
        then
          splinter-cli cert generate --force
        fi && \
        splinter database migrate -C postgres://admin:admin@splinter-db-alpha:5432/splinter && \
        splinter keygen --system --skip && \
        splinterd -v \
        --registries http://registry-server:80/registry.yaml \
        --rest-api-endpoint http://0.0.0.0:8085 \
        --network-endpoints tcps://0.0.0.0:8044 \
        --advertised-endpoints tcps://splinterd-alpha:8044 \
        --node-id alpha-node-000 \
        --service-endpoint tcp://0.0.0.0:8043 \
        --tls-client-cert /etc/splinter/certs/client.crt \
        --tls-client-key /etc/splinter/certs/private/client.key \
        --tls-server-cert /etc/splinter/certs/server.crt \
        --tls-server-key /etc/splinter/certs/private/server.key \
        --enable-biome-credentials \
        --database postgres://admin:admin@splinter-db-alpha:5432/splinter \
        --tls-insecure
      "
    environment:
      - OAUTH_REDIRECT_URL=http://localhost:3030/splinterd/oauth/callback
      - OAUTH_PROVIDER
      - OAUTH_CLIENT_ID
      - OAUTH_CLIENT_SECRET
      - OAUTH_OPENID_URL

  splinter-db-alpha:
    image: postgres
    container_name: splinter-db-alpha
    restart: always
    expose:
      - 5432
    environment:
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: admin
      POSTGRES_DB: splinter

  splinter-ui-alpha:
    build:
      context: .
      dockerfile: Dockerfile-oauth
      args:
        REPO_VERSION: ${REPO_VERSION}
    image: ${NAMESPACE}splinter-ui:${ISOLATION_ID}
    container_name: splinter-ui-alpha
    expose:
      - 80
    ports:
      - '3030:80'
    environment:
      SPLINTER_URL: 'http://splinterd-alpha:8085'

  alpha-node-permissions:
    image: splintercommunity/splinter-cli:main
    volumes:
      - alpha-keys:/alpha_keys
    depends_on:
      - splinterd-alpha
    command: |
      bash -c "
      # This service simulates the work that would normally be done by an admin, assigning
      # the necessary permissions to the logged in users. This should be used for example
      # purposes only.
        # check if splinterd-alpha is available (will get 401 because no auth is provided)
        while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-alpha:8085/status) -ne 401 ]] ; do
            >&2 echo \"splinterd is unavailable - sleeping\"
            sleep 1
        done
        num_users=0
        # while splinterd-alpha is running assign the admin role to all logged in users
        while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-alpha:8085/status) -eq 401 ]] ; do
          # check that the list of splinter users is not empty
          alpha_users=$$(splinter user list --url http://splinterd-alpha:8085 --key /alpha_keys/alpha.priv --format csv | sed 1d | grep -o '^[^,]\+')
          while [[ -z $$alpha_users ]] ; do
            sleep 5
            alpha_users=$$(splinter user list --url http://splinterd-alpha:8085 --key /alpha_keys/alpha.priv --format csv | sed 1d | grep -o '^[^,]\+')
          done
          if [ $$num_users -ne $$(echo $$alpha_users | wc -w) ]
          then
            num_users=$$(echo $$alpha_users | wc -w)
            for user_id in $$alpha_users ; do
              # check that the admin role has not already been assigned
              if [[ $$(splinter authid show --url http://splinterd-alpha:8085 --key /alpha_keys/alpha.priv --id-user $$user_id) != *"admin"* ]]
              then
                splinter authid create \
                  --url http://splinterd-alpha:8085 \
                  --key /alpha_keys/alpha.priv \
                  --role admin \
                  --id-user $$user_id
              fi
            done
          fi
          sleep 5
        done
      "

# ---== beta node ==---

  splinterd-beta:
    image: splintercommunity/splinterd:experimental
    container_name: splinterd-beta
    hostname: splinterd-beta
    expose:
      - 8044
      - 8055
    ports:
      - "8045:8044"
    volumes:
      - beta-keys:/keys
    entrypoint: |
      bash -c "
        if [ ! -f /keys/beta.priv ]
        then
          splinter keygen beta --key-dir /keys
        fi && \
        if [ ! -s /etc/splinter/allow_keys ]
        then
          echo $$(cat /keys/beta.pub) > /etc/splinter/allow_keys
        fi && \
        until PGPASSWORD=admin psql -h splinter-db-beta -U admin -d splinter -c '\q'; do
          >&2 echo \"Database is unavailable - sleeping\"
          sleep 1
        done
        if [ ! -f /etc/splinter/certs/private/server.key ]
        then
          splinter-cli cert generate --force
        fi && \
        splinter database migrate -C postgres://admin:admin@splinter-db-beta:5432/splinter && \
        splinter keygen --system --skip && \
        splinterd -v \
        --registries http://registry-server:80/registry.yaml \
        --rest-api-endpoint http://0.0.0.0:8085 \
        --network-endpoints tcps://0.0.0.0:8044 \
        --advertised-endpoints tcps://splinterd-beta:8044 \
        --node-id beta-node-000 \
        --service-endpoint tcp://0.0.0.0:8043 \
        --tls-client-cert /etc/splinter/certs/client.crt \
        --tls-client-key /etc/splinter/certs/private/client.key \
        --tls-server-cert /etc/splinter/certs/server.crt \
        --tls-server-key /etc/splinter/certs/private/server.key \
        --enable-biome-credentials \
        --database postgres://admin:admin@splinter-db-beta:5432/splinter \
        --tls-insecure
      "
    environment:
      - OAUTH_REDIRECT_URL=http://localhost:3031/splinterd/oauth/callback
      - OAUTH_PROVIDER
      - OAUTH_CLIENT_ID
      - OAUTH_CLIENT_SECRET
      - OAUTH_OPENID_URL

  splinter-db-beta:
    image: postgres
    container_name: splinter-db-beta
    restart: always
    expose:
      - 5432
    environment:
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: admin
      POSTGRES_DB: splinter

  splinter-ui-beta:
    build:
      context: .
      dockerfile: Dockerfile-oauth
      args:
        REPO_VERSION: ${REPO_VERSION}
    image: ${NAMESPACE}splinter-ui:${ISOLATION_ID}
    container_name: splinter-ui-beta
    expose:
      - 80
    ports:
      - '3031:80'
    environment:
      SPLINTER_URL: 'http://splinterd-beta:8085'

  beta-node-permissions:
    image: splintercommunity/splinter-cli:main
    volumes:
      - beta-keys:/beta_keys
    depends_on:
      - splinterd-beta
    command: |
      bash -c "
      # This service simulates the work that would normally be done by an admin, assigning
      # the necessary permissions to the logged in users. This should be used for example
      # purposes only.
        # check if splinterd-beta is available (will get 401 because no auth is provided)
        while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-beta:8085/status) -ne 401 ]] ; do
            >&2 echo \"splinterd is unavailable - sleeping\"
            sleep 1
        done
        num_users=0
        # while splinterd-beta is running assign the admin role to all logged in users
        while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-beta:8085/status) -eq 401 ]] ; do
          # check that the list of splinter users is not empty
          beta_users=$$(splinter user list --url http://splinterd-beta:8085 --key /beta_keys/beta.priv --format csv | sed 1d | grep -o '^[^,]\+')
          while [[ -z $$beta_users ]] ; do
            sleep 5
            beta_users=$$(splinter user list --url http://splinterd-beta:8085 --key /beta_keys/beta.priv --format csv | sed 1d | grep -o '^[^,]\+')
          done
          if [ $$num_users -ne $$(echo $$beta_users | wc -w) ]
          then
            num_users=$$(echo $$beta_users | wc -w)
            for user_id in $$beta_users ; do
              # check that the admin role has not already been assigned
              if [[ $$(splinter authid show --url http://splinterd-beta:8085 --key /beta_keys/beta.priv --id-user $$user_id) != *"admin"* ]]
              then
                splinter authid create \
                  --url http://splinterd-beta:8085 \
                  --key /beta_keys/beta.priv \
                  --role admin \
                  --id-user $$user_id
              fi
            done
          fi
          sleep 5
        done
      "

# ---== shared services ==---

  generate-registry:
    image: splintercommunity/splinter-cli:main
    volumes:
      - registry:/registry
      - alpha-keys:/alpha_keys
      - beta-keys:/beta_keys
    command: |
      bash -c "
        if [ ! -f /registry/registry.yaml ]
        then
          # generate keys
          splinter keygen alice --key-dir /registry
          splinter keygen bob --key-dir /registry
          # check if splinterd-alpha is available (will get 401 because no auth is provided)
          while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-alpha:8085/status) -ne 401 ]] ; do
             >&2 echo \"splinterd is unavailable - sleeping\"
             sleep 1
          done
          # check if splinterd-beta is available (will get 401 because no auth is provided)
          while [[ $$(curl --write-out %{http_code} --silent --output /dev/null http://splinterd-beta:8085/status) -ne 401 ]] ; do
             >&2 echo \"splinterd is unavailable - sleeping\"
             sleep 1
          done
          # build the registry
          splinter registry build \
            http://splinterd-alpha:8085 \
            --file /registry/registry.yaml \
            --key /alpha_keys/alpha.priv \
            --key-file /registry/alice.pub \
            --metadata organization='Alpha'
          splinter registry build \
            http://splinterd-beta:8085 \
            --file /registry/registry.yaml \
            --key /beta_keys/beta.priv \
            --key-file /registry/bob.pub \
            --metadata organization='Beta'
        fi
      "

  registry-server:
    image: httpd:2.4
    container_name: registry-server
    restart: always
    expose:
      - 80
    ports:
        - "8099:80"
    volumes:
      - registry:/usr/local/apache2/htdocs