From 7c92f6054bf85a9b96970450a6dcab1b3d4ee937 Mon Sep 17 00:00:00 2001 From: leo <260626284+cameledev@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:08:17 +0200 Subject: [PATCH] wip --- Makefile | 6 + compose.yml | 22 ++-- docker/auth/realm.json | 269 ++++++++++++++++++++++++++++++++++++----- 3 files changed, 257 insertions(+), 40 deletions(-) diff --git a/Makefile b/Makefile index ac86b94d..71c4d5d7 100644 --- a/Makefile +++ b/Makefile @@ -84,6 +84,7 @@ bootstrap: \ data/media \ data/static \ create-env-files \ + create-docker-network \ build \ migrate \ demo \ @@ -117,11 +118,16 @@ down: ## stop and remove containers, networks, images, and volumes @$(COMPOSE) down .PHONY: down +create-docker-network: ## create the shared lasuite-network if it doesn't exist + @docker network create lasuite-network || true +.PHONY: create-docker-network + logs: ## display app-dev logs (follow mode) @$(COMPOSE) logs -f app-dev .PHONY: logs run-backend: ## start only the backend application and all needed services + @$(MAKE) create-docker-network @$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans @$(COMPOSE) up --force-recreate -d nginx @echo "Wait for postgresql to be up..." diff --git a/compose.yml b/compose.yml index 659f145f..cde3430c 100644 --- a/compose.yml +++ b/compose.yml @@ -14,6 +14,9 @@ services: image: sj26/mailcatcher:latest ports: - "1081:1080" + networks: + - default + - lasuite minio: user: ${DOCKER_USER:-1000} @@ -196,32 +199,32 @@ services: - env.d/development/kc_postgresql keycloak: - image: quay.io/keycloak/keycloak:20.0.1 + image: quay.io/keycloak/keycloak:26.3.2 volumes: - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json command: - start-dev - --features=preview - --import-realm - - --proxy=edge - - --hostname-url=http://localhost:8083 - - --hostname-admin-url=http://localhost:8083/ + - --proxy-headers=xforwarded + - --hostname=http://localhost:8083 - --hostname-strict=false - - --hostname-strict-https=false environment: - KEYCLOAK_ADMIN: admin - KEYCLOAK_ADMIN_PASSWORD: admin + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: admin KC_DB: postgres KC_DB_URL_HOST: kc_postgresql KC_DB_URL_DATABASE: keycloak KC_DB_PASSWORD: pass KC_DB_USERNAME: meet KC_DB_SCHEMA: public - PROXY_ADDRESS_FORWARDING: 'true' ports: - "8080:8080" depends_on: - kc_postgresql + networks: + - default + - lasuite livekit: image: livekit/livekit-server @@ -338,3 +341,6 @@ services: networks: default: resource-server: + lasuite: + name: lasuite-network + external: true diff --git a/docker/auth/realm.json b/docker/auth/realm.json index 2746c781..63605b56 100644 --- a/docker/auth/realm.json +++ b/docker/auth/realm.json @@ -56,7 +56,9 @@ "value": "meet" } ], - "realmRoles": ["user"] + "realmRoles": [ + "user" + ] }, { "username": "user-e2e-chromium", @@ -70,7 +72,9 @@ "value": "password-e2e-chromium" } ], - "realmRoles": ["user"] + "realmRoles": [ + "user" + ] }, { "username": "user-e2e-webkit", @@ -84,7 +88,9 @@ "value": "password-e2e-webkit" } ], - "realmRoles": ["user"] + "realmRoles": [ + "user" + ] }, { "username": "user-e2e-firefox", @@ -98,7 +104,9 @@ "value": "password-e2e-firefox" } ], - "realmRoles": ["user"] + "realmRoles": [ + "user" + ] } ], "roles": { @@ -118,9 +126,15 @@ "description": "${role_default-roles}", "composite": "true", "composites": { - "realm": ["offline_access", "uma_authorization"], + "realm": [ + "offline_access", + "uma_authorization" + ], "client": { - "account": ["view-profile", "manage-account"] + "account": [ + "view-profile", + "manage-account" + ] } }, "clientRole": "false", @@ -269,7 +283,9 @@ "composite": "true", "composites": { "client": { - "realm-management": ["query-clients"] + "realm-management": [ + "query-clients" + ] } }, "clientRole": "true", @@ -292,7 +308,10 @@ "composite": "true", "composites": { "client": { - "realm-management": ["query-users", "query-groups"] + "realm-management": [ + "query-users", + "query-groups" + ] } }, "clientRole": "true", @@ -368,7 +387,9 @@ "composite": "true", "composites": { "client": { - "account": ["view-consent"] + "account": [ + "view-consent" + ] } }, "clientRole": "true", @@ -400,7 +421,9 @@ "composite": "true", "composites": { "client": { - "account": ["manage-account-links"] + "account": [ + "manage-account-links" + ] } }, "clientRole": "true", @@ -455,7 +478,9 @@ "clientRole": "false", "containerId": "ccf4fd40-4286-474d-854a-4714282a8bec" }, - "requiredCredentials": ["password"], + "requiredCredentials": [ + "password" + ], "otpPolicyType": "totp", "otpPolicyAlgorithm": "HmacSHA1", "otpPolicyInitialCounter": 0, @@ -463,9 +488,14 @@ "otpPolicyLookAheadWindow": 1, "otpPolicyPeriod": 30, "otpPolicyCodeReusable": "false", - "otpSupportedApplications": ["totpAppGoogleName", "totpAppFreeOTPName"], + "otpSupportedApplications": [ + "totpAppGoogleName", + "totpAppFreeOTPName" + ], "webAuthnPolicyRpEntityName": "keycloak", - "webAuthnPolicySignatureAlgorithms": ["ES256"], + "webAuthnPolicySignatureAlgorithms": [ + "ES256" + ], "webAuthnPolicyRpId": "", "webAuthnPolicyAttestationConveyancePreference": "not specified", "webAuthnPolicyAuthenticatorAttachment": "not specified", @@ -475,7 +505,9 @@ "webAuthnPolicyAvoidSameAuthenticatorRegister": "false", "webAuthnPolicyAcceptableAaguids": [], "webAuthnPolicyPasswordlessRpEntityName": "keycloak", - "webAuthnPolicyPasswordlessSignatureAlgorithms": ["ES256"], + "webAuthnPolicyPasswordlessSignatureAlgorithms": [ + "ES256" + ], "webAuthnPolicyPasswordlessRpId": "", "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified", "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified", @@ -487,14 +519,19 @@ "scopeMappings": [ { "clientScope": "offline_access", - "roles": ["offline_access"] + "roles": [ + "offline_access" + ] } ], "clientScopeMappings": { "account": [ { "client": "account-console", - "roles": ["manage-account", "view-groups"] + "roles": [ + "manage-account", + "view-groups" + ] } ] }, @@ -509,7 +546,9 @@ "enabled": "true", "alwaysDisplayInConsole": "false", "clientAuthenticatorType": "client-secret", - "redirectUris": ["/realms/meet/account/*"], + "redirectUris": [ + "/realms/meet/account/*" + ], "webOrigins": [], "notBefore": 0, "bearerOnly": "false", @@ -551,7 +590,9 @@ "enabled": "true", "alwaysDisplayInConsole": "false", "clientAuthenticatorType": "client-secret", - "redirectUris": ["/realms/meet/account/*"], + "redirectUris": [ + "/realms/meet/account/*" + ], "webOrigins": [], "notBefore": 0, "bearerOnly": "false", @@ -796,8 +837,12 @@ "enabled": "true", "alwaysDisplayInConsole": "false", "clientAuthenticatorType": "client-secret", - "redirectUris": ["/admin/meet/console/*"], - "webOrigins": ["+"], + "redirectUris": [ + "/admin/meet/console/*" + ], + "webOrigins": [ + "+" + ], "notBefore": 0, "bearerOnly": "false", "consentRequired": "false", @@ -845,6 +890,142 @@ "offline_access", "microprofile-jwt" ] + }, + { + "clientId": "drive", + "name": "", + "description": "", + "rootUrl": "", + "adminUrl": "", + "baseUrl": "", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "secret": "ThisIsAnExampleKeyForDevPurposeOnly", + "redirectUris": [ + "http://localhost:3100/*", + "http://localhost:8171/*", + "http://localhost:8085/*" + ], + "webOrigins": [ + "http://localhost:3100", + "http://localhost:8171", + "http://localhost:8085" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": true, + "protocol": "openid-connect", + "attributes": { + "access.token.lifespan": "-1", + "client.secret.creation.time": "1707820779", + "user.info.response.signature.alg": "RS256", + "post.logout.redirect.uris": "http://localhost:3100/*##http://localhost:8171/*##http://localhost:8085/*", + "oauth2.device.authorization.grant.enabled": "false", + "use.jwks.url": "false", + "backchannel.logout.revoke.offline.tokens": "false", + "use.refresh.tokens": "true", + "tls-client-certificate-bound-access-tokens": "false", + "oidc.ciba.grant.enabled": "false", + "backchannel.logout.session.required": "true", + "client_credentials.use_refresh_token": "false", + "acr.loa.map": "{}", + "require.pushed.authorization.requests": "false", + "display.on.consent.screen": "false", + "client.session.idle.timeout": "-1", + "token.response.type.bearer.lower-case": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "defaultClientScopes": [ + "web-origins", + "acr", + "roles", + "profile", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] + }, + { + "clientId": "deploycenter", + "name": "", + "description": "", + "rootUrl": "", + "adminUrl": "", + "baseUrl": "", + "surrogateAuthRequired": false, + "enabled": true, + "alwaysDisplayInConsole": false, + "clientAuthenticatorType": "client-secret", + "secret": "ThisIsAnExampleKeyForDevPurposeOnly", + "redirectUris": [ + "http://localhost:3100/*", + "http://localhost:8171/*", + "http://localhost:8085/*" + ], + "webOrigins": [ + "http://localhost:3100", + "http://localhost:8171", + "http://localhost:8085" + ], + "notBefore": 0, + "bearerOnly": false, + "consentRequired": false, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "publicClient": false, + "frontchannelLogout": true, + "protocol": "openid-connect", + "attributes": { + "access.token.lifespan": "-1", + "client.secret.creation.time": "1707820779", + "user.info.response.signature.alg": "RS256", + "post.logout.redirect.uris": "http://localhost:3100/*##http://localhost:8171/*##http://localhost:8085/*", + "oauth2.device.authorization.grant.enabled": "false", + "use.jwks.url": "false", + "backchannel.logout.revoke.offline.tokens": "false", + "use.refresh.tokens": "true", + "tls-client-certificate-bound-access-tokens": "false", + "oidc.ciba.grant.enabled": "false", + "backchannel.logout.session.required": "true", + "client_credentials.use_refresh_token": "false", + "acr.loa.map": "{}", + "require.pushed.authorization.requests": "false", + "display.on.consent.screen": "false", + "client.session.idle.timeout": "-1", + "token.response.type.bearer.lower-case": "false" + }, + "authenticationFlowBindingOverrides": {}, + "fullScopeAllowed": true, + "nodeReRegistrationTimeout": -1, + "defaultClientScopes": [ + "web-origins", + "acr", + "roles", + "profile", + "email" + ], + "optionalClientScopes": [ + "address", + "phone", + "offline_access", + "microprofile-jwt" + ] } ], "clientScopes": [ @@ -1382,7 +1563,9 @@ }, "smtpServer": {}, "eventsEnabled": "false", - "eventsListeners": ["jboss-logging"], + "eventsListeners": [ + "jboss-logging" + ], "enabledEventTypes": [], "adminEventsEnabled": "false", "adminEventsDetailsEnabled": "false", @@ -1405,7 +1588,9 @@ "subType": "anonymous", "subComponents": {}, "config": { - "allow-default-scopes": ["true"] + "allow-default-scopes": [ + "true" + ] } }, { @@ -1415,7 +1600,9 @@ "subType": "anonymous", "subComponents": {}, "config": { - "max-clients": ["200"] + "max-clients": [ + "200" + ] } }, { @@ -1425,7 +1612,9 @@ "subType": "authenticated", "subComponents": {}, "config": { - "allow-default-scopes": ["true"] + "allow-default-scopes": [ + "true" + ] } }, { @@ -1481,8 +1670,12 @@ "subType": "anonymous", "subComponents": {}, "config": { - "host-sending-registration-request-must-match": ["true"], - "client-uris-must-match": ["true"] + "host-sending-registration-request-must-match": [ + "true" + ], + "client-uris-must-match": [ + "true" + ] } } ], @@ -1501,7 +1694,9 @@ "providerId": "aes-generated", "subComponents": {}, "config": { - "priority": ["100"] + "priority": [ + "100" + ] } }, { @@ -1510,8 +1705,12 @@ "providerId": "hmac-generated", "subComponents": {}, "config": { - "priority": ["100"], - "algorithm": ["HS256"] + "priority": [ + "100" + ], + "algorithm": [ + "HS256" + ] } }, { @@ -1520,8 +1719,12 @@ "providerId": "rsa-enc-generated", "subComponents": {}, "config": { - "priority": ["100"], - "algorithm": ["RSA-OAEP"] + "priority": [ + "100" + ], + "algorithm": [ + "RSA-OAEP" + ] } }, { @@ -1530,7 +1733,9 @@ "providerId": "rsa-generated", "subComponents": {}, "config": { - "priority": ["100"] + "priority": [ + "100" + ] } } ]