docker/prod/nginx/docker-compose.oauth2-proxy.yml at master · KomMonitor/docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
networks:
  kommonitor:
    name: kommonitor
    driver: bridge

services:
  kommonitor-proxy:
    image: nginx:latest
    container_name: kommonitor-proxy
    restart: unless-stopped
    ports:
      - 443:443
    volumes:
      - ./templates/oauth2-proxy.conf.template:/etc/nginx/templates/default.conf.template
      - ../certs/cert.pem:/etc/ssl/cert.pem
      - ../certs/key.pem:/etc/ssl/key.pem
    environment:
      - NGINX_PORT=443
      - CLIENT=kommonitor-client:80
      - CLIENT_CONFIG=kommonitor-client-config:8088
      - IMPORTER=kommonitor-importer:8087
      - DATA_MANAGEMENT=kommonitor-data-management:8085
      - SPATIAL_DATA_PROCESSOR=kommonitor-spatial-data-processor:8090
      - PROCESSES_API=kommonitor-processes-api:8099
      - PREFECT_SERVER=prefect-server:4200
    networks:
      - kommonitor
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5

  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.13.0
    container_name: oauth2-proxy
    volumes:
      - ../certs/cert.pem:/etc/ssl/certs/keycloak.crt
    environment:
      - OAUTH2_PROXY_PROVIDER=keycloak-oidc
      - OAUTH2_PROXY_PROVIDER_CA_FILE=/etc/ssl/certs/keycloak.crt
      - OAUTH2_PROXY_CODE_CHALLENGE_METHOD=S256
      - OAUTH2_PROXY_OIDC_ISSUER_URL=${KEYCLOAK_URL}/realms/kommonitor

      - OAUTH2_PROXY_CLIENT_ID=prefect-ui
      - OAUTH2_PROXY_CLIENT_SECRET=${KEYCLOAK_PREFECT_UI_SECRET}
      - OAUTH2_PROXY_COOKIE_SECRET=${OAUTH2_COOKIE_SECRET}
      - OAUTH2_PROXY_COOKIE_SECURE=false

      - OAUTH2_PROXY_REDIRECT_URL=https://${KOMMONITOR_HOST_NAME}/prefect/oauth2/callback
      - OAUTH2_PROXY_PROXY_PREFIX=/prefect/oauth2

      - OAUTH2_PROXY_UPSTREAM=http://prefect-server:4200
      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180

      - OAUTH2_PROXY_ALLOWED_ROLES=kommonitor-creator
      - OAUTH2_PROXY_USER_ID_CLAIM=preferred_username
      - OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true
      - OAUTH2_PROXY_EMAIL_DOMAINS=*

      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_LOGGING_LEVEL=debug
      - OAUTH2_PROXY_SESSION_COOKIE_MINIMAL=true
    networks:
      - kommonitor
    depends_on:
      oauth2-redis:
        condition: service_healthy