Skip to content

Commit 637e3f7

Browse files
unteemunteem
committed
📝(doc): add documentation to install with compose
Signed-off-by: unteem <timothee@indie.host>
1 parent 393e7a0 commit 637e3f7

File tree

21 files changed

+847
-0
lines changed

21 files changed

+847
-0
lines changed

‎docker/files/production/etc/nginx/conf.d/default.conf.template

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
upstream docs_backend {
2+
server ${BACKEND_HOST}:8000 fail_timeout=0;
3+
}
4+
5+
upstream docs_frontend {
6+
server ${FRONTEND_HOST}:3000 fail_timeout=0;
7+
}
8+
9+
server {
10+
listen 8083;
11+
server_name localhost;
12+
charset utf-8;
13+
14+
# Disables server version feedback on pages and in headers
15+
server_tokens off;
16+
17+
proxy_ssl_server_name on;
18+
19+
location @proxy_to_docs_backend {
20+
proxy_set_header Host $http_host;
21+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
22+
23+
proxy_redirect off;
24+
proxy_pass http://docs_backend;
25+
}
26+
27+
location @proxy_to_docs_frontend {
28+
proxy_set_header Host $http_host;
29+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
30+
31+
proxy_redirect off;
32+
proxy_pass http://docs_frontend;
33+
}
34+
35+
location / {
36+
try_files $uri @proxy_to_docs_frontend;
37+
}
38+
39+
location /api {
40+
try_files $uri @proxy_to_docs_backend;
41+
}
42+
43+
location /admin {
44+
try_files $uri @proxy_to_docs_backend;
45+
}
46+
47+
# Proxy auth for collaboration server
48+
location /collaboration/ws/ {
49+
# Ensure WebSocket upgrade
50+
proxy_http_version 1.1;
51+
proxy_set_header Upgrade $http_upgrade;
52+
proxy_set_header Connection "Upgrade";
53+
54+
# Collaboration server
55+
proxy_pass http://${YPROVIDER_HOST}:4444;
56+
57+
# Set appropriate timeout for WebSocket
58+
proxy_read_timeout 86400;
59+
proxy_send_timeout 86400;
60+
61+
# Preserve original host and additional headers
62+
proxy_set_header X-Forwarded-Proto https;
63+
proxy_set_header Origin $http_origin;
64+
proxy_set_header Host $host;
65+
}
66+
67+
# Proxy auth for media
68+
location /media/ {
69+
# Auth request configuration
70+
auth_request /media-auth;
71+
auth_request_set $authHeader $upstream_http_authorization;
72+
auth_request_set $authDate $upstream_http_x_amz_date;
73+
auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
74+
75+
# Pass specific headers from the auth response
76+
proxy_set_header Authorization $authHeader;
77+
proxy_set_header X-Amz-Date $authDate;
78+
proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
79+
80+
# Get resource from Minio
81+
proxy_pass https://${S3_HOST}/${BUCKET_NAME}/;
82+
proxy_set_header Host ${S3_HOST};
83+
84+
proxy_ssl_name ${S3_HOST};
85+
86+
add_header Content-Security-Policy "default-src 'none'" always;
87+
}
88+
89+
location /media-auth {
90+
proxy_pass http://docs_backend/api/v1.0/documents/media-auth/;
91+
proxy_set_header X-Forwarded-Proto https;
92+
proxy_set_header Host $host;
93+
proxy_set_header X-Real-IP $remote_addr;
94+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
95+
proxy_set_header X-Original-URL $request_uri;
96+
97+
# Prevent the body from being passed
98+
proxy_pass_request_body off;
99+
proxy_set_header Content-Length "";
100+
proxy_set_header X-Original-Method $request_method;
101+
}
102+
}

‎docs/examples/compose/compose.yaml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
services:
2+
postgresql:
3+
image: postgres:16
4+
healthcheck:
5+
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
6+
interval: 1s
7+
timeout: 2s
8+
retries: 300
9+
env_file:
10+
- env.d/postgresql
11+
- env.d/common
12+
environment:
13+
- PGDATA=/var/lib/postgresql/data/pgdata
14+
volumes:
15+
- ./data/databases/backend:/var/lib/postgresql/data/pgdata
16+
17+
redis:
18+
image: redis:5
19+
20+
backend:
21+
image: lasuite/impress-backend:latest
22+
user: ${DOCKER_USER:-1000}
23+
restart: always
24+
environment:
25+
- DJANGO_CONFIGURATION=Production
26+
env_file:
27+
- env.d/common
28+
- env.d/backend
29+
- env.d/yprovider
30+
- env.d/postgresql
31+
healthcheck:
32+
test: ["CMD", "python", "manage.py", "check"]
33+
interval: 15s
34+
timeout: 30s
35+
retries: 20
36+
start_period: 10s
37+
depends_on:
38+
postgresql:
39+
condition: service_healthy
40+
restart: true
41+
redis:
42+
condition: service_started
43+
44+
y-provider:
45+
image: lasuite/impress-y-provider:latest
46+
user: ${DOCKER_USER:-1000}
47+
env_file:
48+
- env.d/common
49+
- env.d/yprovider
50+
51+
frontend:
52+
image: lasuite/impress-frontend:latest
53+
user: "101"
54+
entrypoint:
55+
- /docker-entrypoint.sh
56+
command: ["nginx", "-g", "daemon off;"]
57+
env_file:
58+
- env.d/common
59+
# Uncomment and set your values if using our nginx proxy example
60+
#environment:
61+
# - VIRTUAL_HOST=${DOCS_HOST} # used by nginx proxy
62+
# - VIRTUAL_PORT=8083 # used by nginx proxy
63+
# - LETSENCRYPT_HOST=${DOCS_HOST} # used by lets encrypt to generate TLS certificate
64+
volumes:
65+
- ./default.conf.template:/etc/nginx/templates/default.conf.template
66+
depends_on:
67+
backend:
68+
condition: service_healthy
69+
# Uncomment if using our nginx proxy example
70+
# networks:
71+
# - proxy-tier
72+
# - default
73+
74+
# Uncomment if using our nginx proxy example
75+
#networks:
76+
# proxy-tier:
77+
# external: true

‎docs/examples/compose/keycloak/README.md

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Deploy and Configure Keycloak for Docs
2+
3+
## Installation
4+
5+
> \[!CAUTION\]
6+
> We provide those instructions as an example, for production environments, you should follow the [official documentation](https://www.keycloak.org/documentation).
7+
8+
### Step 1: Prepare your working environment:
9+
10+
```bash
11+
mkdir keycloak
12+
curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/docs/refs/heads/main/docs/examples/compose/keycloak/compose.yaml
13+
curl -o env.d/kc_postgresql https://raw.githubusercontent.com/suitenumerique/docs/refs/heads/main/docs/env.d/production/kc_postgresql
14+
curl -o env.d/keycloak https://raw.githubusercontent.com/suitenumerique/docs/refs/heads/main/docs/env.d/production/keycloak
15+
```
16+
17+
### Step 2:. Update `env.d/` files
18+
19+
The following variables need to be updated with your own values, others can be left as is:
20+
21+
```env
22+
POSTGRES_PASSWORD=<generate postgres password>
23+
KC_HOSTNAME=https://id.yourdomain.tld # Change with your own URL
24+
KC_BOOTSTRAP_ADMIN_PASSWORD=<generate your password>
25+
```
26+
27+
### Step 3: Expose keycloak instance on https
28+
29+
> \[!NOTE\]
30+
> You can skip this section if you already have your own setup.
31+
32+
To access your Keycloak instance on the public network, it needs to be exposed on a domain with SSL termination. You can use our [example with nginx proxy and Let's Encrypt companion](../nginx-proxy/README.md) for automated creation/renewal of certificates using [acme.sh](http://acme.sh).
33+
34+
If following our example, uncomment the environment and network sections in compose file and update it with your values.
35+
36+
```yaml
37+
version: '3'
38+
services:
39+
keycloak:
40+
...
41+
# Uncomment and set your values if using our nginx proxy example
42+
# environment:
43+
# - VIRTUAL_HOST=id.yourdomain.tld # used by nginx proxy
44+
# - VIRTUAL_PORT=8080 # used by nginx proxy
45+
# - LETSENCRYPT_HOST=id.yourdomain.tld # used by lets encrypt to generate TLS certificate
46+
...
47+
# Uncomment if using our nginx proxy example
48+
# networks:
49+
# - proxy-tier
50+
# - default
51+
52+
# Uncomment if using our nginx proxy example
53+
#networks:
54+
# proxy-tier:
55+
# external: true
56+
```
57+
58+
### Step 4: Start the service
59+
60+
```bash
61+
`docker compose up -d`
62+
```
63+
64+
Your keycloak instance is now available on https://doc.yourdomain.tld
65+
66+
## Creating an OIDC Client for Docs Application
67+
68+
### Step 1: Create a New Realm
69+
70+
1. Log in to the Keycloak administration console.
71+
2. Navigate to the realm tab and click on the "Create realm" button.
72+
3. Enter the name of the realm - `docs`.
73+
4. Click "Create".
74+
75+
#### Step 2: Create a New Client
76+
77+
1. Navigate to the "Clients" tab.
78+
2. Click on the "Create client" button.
79+
3. Enter the client ID - e.g. `docs`.
80+
4. Enable "Client authentication" option.
81+
6. Set the "Valid redirect URIs" to the URL of your docs application suffixed with `/*` - e.g., "https://docs.example.com/*".
82+
1. Set the "Web Origins" to the URL of your docs application - e.g. `https://docs.example.com`.
83+
1. Click "Save".
84+
85+
#### Step 3: Get Client Credentials
86+
87+
1. Go to the "Credentials" tab.
88+
2. Copy the client ID (`docs` in this example) and the client secret.

‎docs/examples/compose/keycloak/compose.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
services:
2+
kc_postgresql:
3+
image: postgres:16
4+
healthcheck:
5+
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
6+
interval: 1s
7+
timeout: 2s
8+
retries: 300
9+
env_file:
10+
- env.d/kc_postgresql
11+
volumes:
12+
- ./data/keycloak:/var/lib/postgresql/data/pgdata
13+
14+
keycloak:
15+
image: quay.io/keycloak/keycloak:26.1.3
16+
command: ["start"]
17+
env_file:
18+
- env.d/kc_postgresql
19+
- env.d/keycloak
20+
# Uncomment and set your values if using our nginx proxy example
21+
# environment:
22+
# - VIRTUAL_HOST=id.yourdomain.tld # used by nginx proxy
23+
# - VIRTUAL_PORT=8080 # used by nginx proxy
24+
# - LETSENCRYPT_HOST=id.yourdomain.tld # used by lets encrypt to generate TLS certificate
25+
depends_on:
26+
kc_postgresql::
27+
condition: service_healthy
28+
restart: true
29+
# Uncomment if using our nginx proxy example
30+
# networks:
31+
# - proxy-tier
32+
# - default
33+
#
34+
#networks:
35+
# proxy-tier:
36+
# external: true

0 commit comments

Comments
 (0)