981cecbcbd
The provisioned IdP client (https://auth.forgecore.work) is confidential rather than public/PKCE-only, so a client secret must never reach the browser. The frontend now only performs the Authorization Code + PKCE redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed) and hands the resulting code + verifier to a new, intentionally unauthenticated POST /api/v1/auth/session endpoint, which performs the code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and returns only {accessToken, expiresIn} — refresh_token/id_token are never forwarded to the client. New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET. Added frontend/proxy.conf.json so the Angular dev server forwards /api and /health to the local API without needing CORS.
111 lines
3.1 KiB
YAML
111 lines
3.1 KiB
YAML
services:
|
|
edge:
|
|
image: "${REGISTRY}/travel-edge:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/edge.Dockerfile
|
|
args:
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
ports:
|
|
- "${APP_HTTPS_PORT:-443}:443"
|
|
volumes:
|
|
- "${TLS_CERT_FILE}:/run/tls/tls.crt:ro"
|
|
- "${TLS_KEY_FILE}:/run/tls/tls.key:ro"
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
api:
|
|
image: "${REGISTRY}/travel-api:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/api.Dockerfile
|
|
expose:
|
|
- "3000"
|
|
environment:
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
|
|
REDIS_URL: "redis://redis:6379"
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
|
|
APP_VERSION: "${APP_VERSION:-dev}"
|
|
TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
|
|
SOURCE_REVISION: "${SOURCE_REVISION:-local}"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/health/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
start_period: 10s
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
worker:
|
|
image: "${REGISTRY}/travel-worker:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/worker.Dockerfile
|
|
environment:
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
|
|
REDIS_URL: "redis://redis:6379"
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
|
|
APP_VERSION: "${APP_VERSION:-dev}"
|
|
TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
|
|
SOURCE_REVISION: "${SOURCE_REVISION:-local}"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
postgres:
|
|
image: "postgres:${POSTGRES_IMAGE_TAG:-18.4-alpine}"
|
|
environment:
|
|
POSTGRES_DB: "${POSTGRES_DB}"
|
|
POSTGRES_USER: "${POSTGRES_USER}"
|
|
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
|
|
expose:
|
|
- "5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
redis:
|
|
image: "redis:${REDIS_IMAGE_TAG:-8.8.1-alpine}"
|
|
expose:
|
|
- "6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres_data:
|
|
|
|
networks:
|
|
travel:
|
|
driver: bridge
|