79 lines
1.9 KiB
Markdown
79 lines
1.9 KiB
Markdown
# Visione CIE Auth Stack
|
|
|
|
This folder contains deployable CIE auth services for Visione:
|
|
- `federation-authority`
|
|
- `provider`
|
|
- `relying-party`
|
|
|
|
It is now structured to work with Docker Compose and Dokploy without host networking.
|
|
|
|
## Configuration
|
|
Copy [.env.example](/workspace/cie-auth/.env.example) to `.env` and set only what changes in real deploy:
|
|
- public domains / internal URLs
|
|
- Django secret keys
|
|
- shared secret between relying party and Visione backend
|
|
|
|
Main variables:
|
|
- `CIE_AUTH_ALLOWED_HOSTS`
|
|
- `DJANGO_TRUST_ANCHOR`
|
|
- `DJANGO_PROVIDER_ISSUER`
|
|
- `DJANGO_RP_BACKEND_EXCHANGE_URL`
|
|
- `DJANGO_RP_SHARED_SECRET`
|
|
- `FEDERATION_AUTHORITY_SECRET_KEY`
|
|
- `PROVIDER_SECRET_KEY`
|
|
- `RELYING_PARTY_SECRET_KEY`
|
|
|
|
## Deploy with Dokploy
|
|
Use [docker-compose.yml](/workspace/cie-auth/docker-compose.yml) as compose source.
|
|
Expose:
|
|
- `federation-authority` on port `8000`
|
|
- `provider` on port `8002`
|
|
- `relying-party` on port `8001`
|
|
|
|
Each service persists its own SQLite DB in a named volume.
|
|
|
|
## Local start
|
|
|
|
```bash
|
|
docker compose up --build -d
|
|
```
|
|
|
|
## Visione backend
|
|
Visione backend must expose exchange endpoint configured in `DJANGO_RP_BACKEND_EXCHANGE_URL`.
|
|
Shared secret must match backend `cie_auth.shared_secret`.
|
|
|
|
## Bootstrap behavior
|
|
On first boot, each Django service:
|
|
1. runs migrations
|
|
2. loads `dumps/example.json` only if DB is empty
|
|
|
|
Disable fixture import per service with:
|
|
- `FEDERATION_AUTHORITY_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
|
- `PROVIDER_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
|
- `RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
|
|
|
## Smoke test
|
|
|
|
```bash
|
|
curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
|
|
```
|
|
|
|
Then complete login and poll:
|
|
|
|
```bash
|
|
curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
|
|
```
|
|
|
|
## Reset data
|
|
|
|
```bash
|
|
docker compose down -v
|
|
```
|
|
|
|
## Logs
|
|
```bash
|
|
docker compose logs -f
|
|
```
|