3ca39ceb8a
Support for two API keys has been added to the YProvider microservice to decouple responsibilities between the collaboration server and other endpoints. This improves security by scoping keys to specific purposes and ensures a clearer separation of concerns for easier management and debugging.
142 lines
4.3 KiB
Go Template
142 lines
4.3 KiB
Go Template
image:
|
|
repository: localhost:5001/impress-backend
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
backend:
|
|
replicas: 1
|
|
envVars:
|
|
COLLABORATION_API_URL: https://impress.127.0.0.1.nip.io/collaboration/api/
|
|
COLLABORATION_SERVER_SECRET: my-secret
|
|
DJANGO_CSRF_TRUSTED_ORIGINS: https://impress.127.0.0.1.nip.io
|
|
DJANGO_CONFIGURATION: Feature
|
|
DJANGO_ALLOWED_HOSTS: impress.127.0.0.1.nip.io
|
|
DJANGO_SERVER_TO_SERVER_API_TOKENS: secret-api-key
|
|
DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
|
|
DJANGO_SETTINGS_MODULE: impress.settings
|
|
DJANGO_SUPERUSER_PASSWORD: admin
|
|
DJANGO_EMAIL_HOST: "mailcatcher"
|
|
DJANGO_EMAIL_PORT: 1025
|
|
DJANGO_EMAIL_USE_SSL: False
|
|
LOGGING_LEVEL_HANDLERS_CONSOLE: ERROR
|
|
LOGGING_LEVEL_LOGGERS_ROOT: INFO
|
|
LOGGING_LEVEL_LOGGERS_APP: INFO
|
|
OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
|
|
OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
|
|
OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
|
|
OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
|
|
OIDC_RP_CLIENT_ID: {{ .Values.oidc.clientId }}
|
|
OIDC_RP_CLIENT_SECRET: {{ .Values.oidc.clientSecret }}
|
|
OIDC_RP_SIGN_ALGO: RS256
|
|
OIDC_RP_SCOPES: "openid email given_name usual_name"
|
|
USER_OIDC_FIELD_TO_SHORTNAME: "given_name"
|
|
USER_OIDC_FIELDS_TO_FULLNAME: "given_name,usual_name"
|
|
OIDC_REDIRECT_ALLOWED_HOSTS: https://impress.127.0.0.1.nip.io
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
|
|
LOGIN_REDIRECT_URL: https://impress.127.0.0.1.nip.io
|
|
LOGIN_REDIRECT_URL_FAILURE: https://impress.127.0.0.1.nip.io
|
|
LOGOUT_REDIRECT_URL: https://impress.127.0.0.1.nip.io
|
|
DB_HOST: postgres-postgresql
|
|
DB_NAME: impress
|
|
DB_USER: dinum
|
|
DB_PASSWORD: pass
|
|
DB_PORT: 5432
|
|
POSTGRES_DB: impress
|
|
POSTGRES_USER: dinum
|
|
POSTGRES_PASSWORD: pass
|
|
REDIS_URL: redis://default:pass@redis-master:6379/1
|
|
AWS_S3_ENDPOINT_URL: http://minio.impress.svc.cluster.local:9000
|
|
AWS_S3_ACCESS_KEY_ID: impress
|
|
AWS_S3_SECRET_ACCESS_KEY: password
|
|
AWS_STORAGE_BUCKET_NAME: impress-media-storage
|
|
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
|
|
Y_PROVIDER_API_BASE_URL: http://impress-y-provider:443/api/
|
|
Y_PROVIDER_API_KEY: my-secret
|
|
|
|
migrate:
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
- |
|
|
python manage.py migrate --no-input &&
|
|
python manage.py create_demo --force
|
|
restartPolicy: Never
|
|
|
|
command:
|
|
- "gunicorn"
|
|
- "-c"
|
|
- "/usr/local/etc/gunicorn/impress.py"
|
|
- "impress.wsgi:application"
|
|
- "--reload"
|
|
|
|
createsuperuser:
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
- |
|
|
python manage.py createsuperuser --email admin@example.com --password admin
|
|
restartPolicy: Never
|
|
|
|
frontend:
|
|
envVars:
|
|
PORT: 8080
|
|
NEXT_PUBLIC_API_ORIGIN: https://impress.127.0.0.1.nip.io
|
|
|
|
replicas: 1
|
|
command:
|
|
- yarn
|
|
- dev
|
|
|
|
image:
|
|
repository: localhost:5001/impress-frontend
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
yProvider:
|
|
replicas: 1
|
|
|
|
image:
|
|
repository: localhost:5001/impress-y-provider
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
envVars:
|
|
COLLABORATION_LOGGING: true
|
|
COLLABORATION_SERVER_ORIGIN: https://impress.127.0.0.1.nip.io
|
|
COLLABORATION_SERVER_SECRET: my-secret
|
|
Y_PROVIDER_API_KEY: my-secret
|
|
|
|
ingress:
|
|
enabled: true
|
|
host: impress.127.0.0.1.nip.io
|
|
|
|
ingressCollaborationWS:
|
|
enabled: true
|
|
host: impress.127.0.0.1.nip.io
|
|
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/auth-url: https://impress.127.0.0.1.nip.io/api/v1.0/documents/collaboration-auth/
|
|
|
|
ingressCollaborationApi:
|
|
enabled: true
|
|
host: impress.127.0.0.1.nip.io
|
|
|
|
ingressAdmin:
|
|
enabled: true
|
|
host: impress.127.0.0.1.nip.io
|
|
|
|
ingressMedia:
|
|
enabled: true
|
|
host: impress.127.0.0.1.nip.io
|
|
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/auth-url: https://impress.127.0.0.1.nip.io/api/v1.0/documents/media-auth/
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
|
|
nginx.ingress.kubernetes.io/upstream-vhost: minio.impress.svc.cluster.local:9000
|
|
nginx.ingress.kubernetes.io/rewrite-target: /impress-media-storage/$1
|
|
|
|
serviceMedia:
|
|
host: minio.impress.svc.cluster.local
|
|
port: 9000
|