docker-compose.yml

# TODO: BBMRI expects Traefik to already exist
services:
  traefik-forward-auth:
    image: quay.io/oauth2-proxy/oauth2-proxy:latest
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - OAUTH2_PROXY_PROVIDER=oidc
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.aai.lifescience-ri.eu/oidc/
      - OAUTH2_PROXY_CLIENT_ID=${OAUTH_CLIENT_ID}
      - OAUTH2_PROXY_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - OAUTH2_PROXY_COOKIE_SECRET=${AUTHENTICATION_SECRET}
      - OAUTH2_PROXY_COOKIE_DOMAINS=${GUI_HOST}
      - OAUTH2_PROXY_COOKIE_HTTPONLY=false
      - OAUTH2_PROXY_HTTP_ADDRESS=:4180
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_WHITELIST_DOMAINS=${GUI_HOST},login.bbmri-eric.eu
      - OAUTH2_PROXY_UPSTREAMS=static://202
      - OAUTH2_PROXY_EMAIL_DOMAINS=*
      - OAUTH2_PROXY_SCOPE=openid profile email
      # Pass Authorization Header and some user information to spot
      - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4180"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=Authorization, X-Forwarded-User, X-Auth-Request-User, X-Auth-Request-Email"
      - "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4180"
      - "traefik.http.routers.oauth2.rule=Host(`${GUI_HOST}`) && PathPrefix(`/oauth2/`)"
      - "traefik.http.routers.oauth2.tls=true"
    networks:
      - traefik
      - default

  landing:
    image: samply/bbmri-landingpage:main
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.landing.rule=Host(`${GUI_HOST}`)"
      - "traefik.http.routers.landing.tls=true"
    networks:
      - traefik
      - default

  lens:
    image: samply/bbmri-sample-locator:latest
    environment:
      PUBLIC_ENVIRONMENT: ${PUBLIC_ENVIRONMENT}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.lens.rule=Host(`${GUI_HOST}`) && PathPrefix(`/search/`)"
      - "traefik.http.routers.lens.tls=true"
      - "traefik.http.routers.lens.middlewares=traefik-forward-auth"
      - "traefik.http.services.lens.loadbalancer.server.port=3000"
    networks:
      - traefik
      - default

  spot:
    image: samply/rustyspot:latest
    ports:
      - "8055:8055"
    environment:
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: beam-proxy, prism
      BEAM_SECRET: "${LOCAL_BEAM_SECRET_SPOT}"
      BEAM_PROXY_URL: http://beam-proxy:8081
      BEAM_APP_ID: "spot.${LOCAL_BEAM_ID}.${BROKER_HOST}"
      CORS_ORIGIN: "https://${GUI_HOST}"
      SITES: ${SITES}
      TRANSFORM: LENS
      PROJECT: bbmri
      BIND_ADDR: 0.0.0.0:8055
      PRISM_URL: http://prism:8066
      RUST_LOG: "info"
      LOG_FILE: /logs/requests.log
      ALLOWED_LANG: "ast"
    volumes:
      - ./logs:/logs
    depends_on:
      - "beam-proxy"
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.spot.loadbalancer.server.port=8055"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowheaders=content-type"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolalloworiginlist=https://${GUI_HOST}"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolmaxage=-1"
      - "traefik.http.routers.spot.rule=Host(`${GUI_HOST}`) && PathPrefix(`/backend`)"
      - "traefik.http.middlewares.spot-stripprefix.stripprefix.prefixes=/backend"
      - "traefik.http.routers.spot.tls=true"
      - "traefik.http.routers.spot.middlewares=corsheaders,traefik-forward-auth,spot-stripprefix"
    networks:
      - traefik
      - default

  beam-proxy:
    image: samply/beam-proxy:main
    platform: linux/amd64
    environment:
      BROKER_URL: https://${BROKER_HOST}
      PROXY_ID: ${LOCAL_BEAM_ID}.${BROKER_HOST}
      APP_spot_KEY: ${LOCAL_BEAM_SECRET_SPOT}
      APP_prism_KEY: ${LOCAL_BEAM_SECRET_PRISM}
      PRIVKEY_FILE: /run/secrets/proxy.pem
      ALL_PROXY: ${http_proxy}
    secrets:
      - proxy.pem
      - root.crt.pem
    networks:
      - traefik
      - default

  prism:
    image: samply/prism:main
    environment:
      # TODO: Autogenerate this
      API_KEY: "${LOCAL_BEAM_SECRET_PRISM}"
      BEAM_PROXY_URL: http://beam-proxy:8081
      BEAM_APP_ID_LONG: "prism.${LOCAL_BEAM_ID}.${BROKER_HOST}"
      CORS_ORIGIN: "https://${GUI_HOST}"
      SITES: ${SITES}
      PROJECT: bbmri
      BIND_ADDR: 0.0.0.0:8066
      RUST_LOG: "debug,hyper=info"
    depends_on:
      - "beam-proxy"
    networks:
      - default

secrets:
  proxy.pem:
    # TODO: Key in BBMRI was directly stored in lens directory!
    file: /etc/lens/pki/${LOCAL_BEAM_ID}.priv.pem
  root.crt.pem:
    file: ./rootcerts/${BROKER_HOST}-root.crt.pem

networks:
  traefik:
    external: true