Skip to content

Commit 5b3dc3a

Browse files
SpringjunkySpringjunky
committed
Keycloak
1 parent 25a119e commit 5b3dc3a

File tree

23 files changed

+507
-98
lines changed

23 files changed

+507
-98
lines changed

‎.gitignore‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,32 @@
1-
docker-compose.yml-*
21
*.jpi
32
*.war
43
.env-*
54
.env
5+
.project
6+
7+
.dbeaver*
8+
9+
target/
10+
!.mvn/wrapper/maven-wrapper.jar
11+
12+
### STS ###
13+
.apt_generated
14+
.classpath
15+
.factorypath
16+
.project
17+
.settings
18+
.springBeans
19+
20+
### IntelliJ IDEA ###
21+
.idea
22+
*.iws
23+
*.iml
24+
*.ipr
25+
26+
### NetBeans ###
27+
nbproject/private/
28+
build/
29+
nbbuild/
30+
dist/
31+
nbdist/
32+
.nb-gradle/

‎README.md‎

Lines changed: 78 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,42 @@
22

33
##### Tired of endless installation and configuration .... ?!
44

5-
My personal solution is a local, docker-based CI/CD Build Environment ready in a few minutes to offer you a reade-to-use convinience plaground with
6-
* Jenkins (with open-jdk-8, ansible, docker and maven inside)
7-
* Gitlab (with a docker based gitlab-runner registrated)
5+
My personal solution is a local, docker-based CI/CD Build Environment ready in a few minutes to offer you a reade-to-use convinience playground with
6+
* Jenkins
7+
* open-jdk
8+
* maven
9+
* ansible
10+
* docker
11+
* Gitlab
12+
* and a docker based gitlab-runner registrated
13+
* suecured docker-registry ready (openssh certificate)
14+
* push with ssh avialable at port 2222
815
* Nexus 3
9-
* Sonar (in future releases..)
16+
* Sonar
17+
* Keykloak (as Single Sign or JWT playground)
18+
* Postgres (used by sonar, keycloak and YOUR applications)
1019

20+
so you can be your own local "DevOp"; nearly every category of [periodic table of devoptools][4] has one tool in your local setup.
1121

12-
#### This is NOT for any cluster (Swarm / Kubernetes)
22+
## This is NOT for any cluster (Swarm/Kubernetes)
1323

1424
### System requirements
1525
* At least 8GB Memory with 3GB Swap and 10GB Disk-Space
1626
* docker version >= 17.06.0
1727
* docker-compose version >= 1.15.0
1828

29+
#### Listenports to be claimed
30+
31+
|Port | Why |
32+
|---|---|
33+
|80 |NGINX |
34+
|5432 |postgres standard |
35+
|2222 |ssh port of gitlab, used to push via ssh connection |
36+
|5555 |Gitlab Docker-registry |
37+
If your change the ports in the docker-compose.yml change them also in nginx-reverse/nginx.conf (stream {...} )
1938
## Installation
2039
### without sonar
21-
Bring up your own build environment ... just do a
40+
Bring up your own DevOp Playground ... just do a
2241
```
2342
git clone https://github.com/Springjunky/docker-local-build-environment.git
2443
cd docker-local-build-environment
@@ -27,21 +46,25 @@ Bring up your own build environment ... just do a
2746
docker-compose logs
2847
```
2948

30-
### with sonar
49+
### with sonar and/or Keycloak
3150
Warning: you need a lot of memory to use the full toolset (more than 10GB)
3251
```
3352
git clone https://github.com/Springjunky/docker-local-build-environment.git
3453
cd docker-local-build-environment
3554
sudo ./setupEnvironment.sh
36-
docker-compose -f docker-compose.yml -f docker-compose-sonar.yml up --build
37-
docker-compose logs
38-
```
39-
4055
56+
# Sonar only
57+
docker-compose -f docker-compose.yml -f docker-compose-sonar.yml up --build
4158
59+
# Sonar AND Keycloak
60+
docker-compose -f docker-compose.yml -f docker-compose-sonar.yml -f docker-compose-keycloak.yml up --build
4261
62+
# Keycloak only
63+
docker-compose -f docker-compose.yml -f docker-compose-keycloak.yml up --build
64+
65+
docker-compose logs
66+
```
4367
### The first startup takes a long time (especially gitlab), so be patient
44-
4568
open your favorite browser (_not_ at localhost, use the $(hostname)/jenkins )
4669
to prevent jenkins spit out "your reverse proxy is wrong")
4770

@@ -52,77 +75,39 @@ Now you are ready to go with a little CI/CD Environment:
5275
Jenkins http://<your-host-name>/jenkins
5376
Nexus http://<your-host-name>/nexus
5477
Gitlab http://<your-host-name>/gitlab
55-
in the next Release: Sonar http://<your-host-name>/sonar
78+
Sonar http://<your-host-name>/sonar
79+
Keycloak http://<your-host-name>/auth
80+
Postgres: At standard listenport 5432 for your jdbc-connection-string
81+
stream-passthrough to postgres-container.
5682
```
83+
5784
#### Security
5885
... not really, its all http .. don't worry about it! It's only local communication
5986

6087
##### security paranoia
61-
All the exposed ports are reachable from outer world because docker creates and deletes dynamically iptables FORWARD rules with default policy ACCEPT on startup/shutdown containers wich have exported ports.
62-
63-
To deny acccess from outer world the DOCKER-USER Chain (since docker 17.06) ist the medium of choice for your own rules (this is the first target in the FORWARD-Chain and never touched by docker).
64-
65-
A little Script to deny all access from outer world to your local build environment could be the following (exposed port from nginx are 80,5555,2222)
66-
```
67-
#!/bin/bash
68-
if [ $# -lt 1 ] ; then
69-
echo "Need your external interface as one parameter"
70-
echo "Common names are eth0, enp...,"
71-
echo "List of your names"
72-
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d'
73-
exit
74-
fi
75-
76-
PORTS_TO_BLOCK="80,5555,2222"
77-
EXTERNAL_INTERFACE=$1
78-
79-
# Flush and delete custom Chains
80-
iptables -F DOCKER-USER
81-
iptables -F EXTERNAL-ACCESS-DENY
82-
iptables -X EXTERNAL-ACCESS-DENY
83-
84-
# Create a log-and-drop Chain
85-
iptables -N EXTERNAL-ACCESS-DENY
86-
iptables -A EXTERNAL-ACCESS-DENY -j LOG --log-prefix "DCKR-EXT-ACCESS-DENY:" --log-level 6
87-
iptables -A EXTERNAL-ACCESS-DENY -j DROP
88-
89-
# Block all incomming traffic for docker
90-
iptables -A DOCKER-USER -i $EXTERNAL_INTERFACE \
91-
-p tcp --match multiport \
92-
--dports $PORTS_TO_BLOCK \
93-
-j EXTERNAL-ACCESS-DENY
94-
95-
# Restore default rule to return all the rest back to the FORWARD-Chain
96-
iptables -A DOCKER-USER -j RETURN
97-
98-
echo "Rules created "
99-
iptables -v -L DOCKER-USER
100-
iptables -v -L EXTERNAL-ACCESS-DENY
101-
echo "See logs with prefix DCKR-EXT-ACCESS-DENY:"
102-
```
103-
88+
See Readme in folder security-paranoia if you want to have some hints how to configure your firewall.
10489

10590
### Logins and Passwords
106-
10791
|Image | User | Password |
10892
|---|---|---|
10993
|Jenkins| admin| admin |
11094
|Nexus | admin | admin123 |
11195
|Gitlab | root | gitlab4me |
96+
|Sonar | admin | admin |
97+
|Keycloak|admin|admin|
98+
|Postgres|postgres|admin|
11299

113100
## The Tools
114101
### Jenkins
115-
116102
* MAVEN_HOME is /opt/maven
117103
* JAVA_HOME is /usr/lib/jvm/java-8-openjdk-amd64
118104
* Blue Ocean is installed if you choose (M)uch mor plugins and works perfect with a GitHUB Account, not GitLab ... sorry, this is Jenkins.
119105
You need to be logged as a jenkins-user to use Blue Ocean
120106

121107
### Giltab
122-
123108
* the docker-registry from GitLab is at port 5555 (and secured with an openssl certificate ..thats part of
124-
prepareEnvironment.sh), just create a project in gitlab and click at the registry tab to show
125-
how to login to the project registry and how to tag your images
109+
setupEnvironment.sh), just create a project in gitlab and click at the registry tab to show
110+
how to login to the project registry and how to tag your images and upload them.
126111
* ssh cloning and pushing is at port 2222
127112

128113
#### gitlab-runner
@@ -138,34 +123,54 @@ Gitlab is very very fast with new releases and sometimes the api has breaking ch
138123
### Sonar
139124
You need to install some rules (Administration - System - Update Center - Available - Search: Java)
140125

126+
### Keycloak
127+
There is a testproject in folder spring-boot-keycloak-sample, it is a standard Spring-Boot which you can start with
128+
```
129+
mv spring-boot:run
130+
```
131+
Use your browser and navigate to the "landing-page" at http://<your host>:8081 the "My products" link will redirect you to Keycloak (must be setup with settings from [this tutorial][3], but use your *REAL* hostname, not _localhost_ as Valid Redirect URI's )
132+
_tl;dr_
133+
* login as user:admin, password:admin
134+
* create realm "springboot"
135+
* create client "product-app" as openid-connect client with Valid Redirect URI's http://<your host>:8081/*
136+
* create role "user"
137+
* create user "testuser" and map the role "user" to testuser (tab Role Mappings)
138+
141139
### Nexus
142140
Some ToDo for me described here
143141
[Unsecure docker-registry in Nexus][1]
144142
use GitLab as a secured registry
145-
146143
..
147144
And _yes_ docker-plugin in jenkins works (docker in docker, usefull but not recommended)
145+
### Postgres
146+
You can use any tool to connect to the database at locahost:5432 this is a pass through to the container so any
147+
JDBC-Connection should work
148148

149149
## Troubleshooting
150-
151-
In most cases a wrong HOSTNAME:HOSTIP causes trouble, to check this try the follwing.
150+
##### check Hostname and IP
151+
In most cases a wrong HOSTNAME:HOSTIP causes trouble, to check this try the following.
152152
* log into the jenkins-fat container (with id)
153153
```
154154
docker container ls
155-
docker container exec -it dockerlocalbuildenvironment_jenkins-fat_1 bash
155+
docker container exec -it dockerlocalbuildenvironment_jenkins_1 bash
156156
apt-get update
157157
apt-get install -y --allow-unauthenticated iputils-ping
158158
ping google.de
159-
ping jenkins-fat
159+
ping jenkins
160160
ping gitlab
161161
ping <your local hostname>
162162
```
163-
every ping must work, if not, check extra_hosts in compose-file
163+
every ping must work, if not, check the .env file, is there the correct DC_HOSTNAME / DC_HOSTIP ?
164+
165+
##### changed networks ?
166+
If you change your network (switching between home/office/lan/wifi) your ip-address
167+
could be change and the container is not able to resolve your host any more
168+
Check the .env file or just run the setup-Script again.
164169

165-
* consider low memory:
166-
with an amount lower than 8GB sonar and eleastic search did not startup
170+
##### consider low memory:
171+
with an amount lower than 8GB sonar and embedded eleastic search did not startup and no message is displayed
167172

168-
* too many plugins to download:
173+
##### too many plugins to download:
169174
You can do an "pre download of the plugins", see the readme.md at jenkins-fat direcory
170175

171176

@@ -178,9 +183,12 @@ every ping must work, if not, check extra_hosts in compose-file
178183
* ~~apply a gitlab runner~~
179184
* ~~apply git-lfs~~
180185
* ~~apply sonar~~
186+
* ~~apply keycloak~~
181187
* apply a better registry
182188

183189

184190

185191
[1]: https://support.sonatype.com/hc/en-us/articles/217542177-Using-Self-Signed-Certificates-with-Nexus-Repository-Manager-and-Docker-Daemon
186192
[2]: https://hub.docker.com/r/gitlab/gitlab-runner/
193+
[3]: https://developers.redhat.com/blog/2017/05/25/easily-secure-your-spring-boot-applications-with-keycloak/
194+
[4]: https://xebialabs.com/periodic-table-of-devops-tools/

‎docker-compose-keycloak.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
2+
# docker-keycloak configuration,
3+
# add this to your docker-compose up if you want to have SSO Functions
4+
# docker-compose -f docker-xcompose.yml -f docker-compose-keykloak.yml up
5+
version: "3"
6+
services:
7+
keycloak:
8+
image: jboss/keycloak
9+
environment:
10+
- KEYCLOAK_USER=admin
11+
- KEYCLOAK_PASSWORD=admin
12+
- POSTGRES_USER=keycloak
13+
- POSTGRES_PASSWORD=keycloak
14+
- PROXY_ADDRESS_FORWARDING=true
15+
- KEYCLOAK_LOGLEVEL=DEBUG
16+
# Override command to enable docker protokoll
17+
command: ["-b", "0.0.0.0","-Dkeycloak.profile.feature.docker=enabled"]
18+
extra_hosts:
19+
- ${DC_HOSTNAME}:${DC_HOSTIP}
20+
networks:
21+
- devstacknetwork
22+
volumes:
23+
- /var/run/docker.sock:/var/run/docker.sock
24+

‎docker-compose-sonar.yml‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,16 @@
55
version: "3"
66

77
services:
8-
postgres:
9-
image: postgres
10-
extra_hosts:
11-
- ${DC_HOSTNAME}:${DC_HOSTIP}
12-
networks:
13-
- devstacknetwork
14-
environment:
15-
- POSTGRES_USER=sonar
16-
- POSTGRES_PASSWORD=sonar
17-
volumes:
18-
- ${DC_BASE_DATA_DIR}/postgres-db/postgresql:/var/lib/postgresql
19-
# This needs explicit mapping due to
20-
# https://github.com/docker-library/postgres/blob/4e48e3228a30763913ece952c611e5e9b95c8759/Dockerfile.template#L52
21-
- ${DC_BASE_DATA_DIR}/postgres-db/postgresql_data:/var/lib/postgresql/data
22-
238
sonar:
249
image: sonarqube
10+
depends_on: # start proxy after all the others
11+
- postgres
2512
extra_hosts:
2613
- ${DC_HOSTNAME}:${DC_HOSTIP}
2714
networks:
2815
- devstacknetwork
2916
environment:
17+
# the Default User and Passwort for Postgress is sonar/sonar in the
3018
- SONARQUBE_JDBC_URL=jdbc:postgresql://postgres:5432/sonar
3119
volumes:
3220
- ${DC_BASE_DATA_DIR}/sonar/sonarqube_conf:/opt/sonarqube/conf

‎docker-compose.yml‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,36 @@ services:
1616
ngnix:
1717
build: nginx-reverse
1818
ports:
19-
- "80:80" #http://
20-
# SSH Bypassing into gitlab, if you want to change this edit nginx.conf also
21-
- "2222:2222" #ssh port of gitlab (ssh://git@myHOST:2222/scott/foo.git)
22-
- "5555:5555" #Gitlab Docker Registry do NOT use 5000, this is an internal PORT of the gitlab-ce Image
19+
- "80:80" #http://
20+
- "5432:5432" # Default-Port of the Postges DB passing jdbc-Connections to the postgres-Container
21+
- "2222:2222" #ssh port of gitlab (ssh://git@myHOST:2222/scott/foo.git)
22+
- "5555:5555" #Gitlab Docker Registry do NOT use 5000, this is an internal PORT of the gitlab-ce Image
23+
command: ["nginx-debug", "-g", "daemon off;"] # Start nginx in debug to see whats going on
2324
depends_on: # start proxy after all the others
2425
- gitlab
2526
- jenkins
2627
- nexus
2728
networks:
2829
- devstacknetwork
29-
3030
# ------------------------------------------------------------------------------
31+
postgres:
32+
build: postgres
33+
extra_hosts:
34+
- ${DC_HOSTNAME}:${DC_HOSTIP}
35+
environment:
36+
- POSTGRES_PASSWORD=admin
37+
- POSTGRES_USER=postgres
38+
networks:
39+
- devstacknetwork
40+
volumes:
41+
- ${DC_BASE_DATA_DIR}/postgres-db/postgresql:/var/lib/postgresql
42+
# This needs explicit mapping due to
43+
# https://github.com/docker-library/postgres/blob/4e48e3228a30763913ece952c611e5e9b95c8759/Dockerfile.template#L52
44+
# there is ENV PGDATA /var/lib/postgresql/data
45+
- ${DC_BASE_DATA_DIR}/postgres-db/postgresql_data:/var/lib/postgresql/data
46+
47+
# ------------------------------------------------------------------------------
48+
3149
jenkins:
3250
build: jenkins-fat
3351
extra_hosts:
@@ -93,3 +111,7 @@ services:
93111
volumes:
94112
- ${DC_BASE_DATA_DIR}/gitlab-runner/config:/etc/gitlab-runner
95113
- /var/run/docker.sock:/var/run/docker.sock
114+
115+
116+
117+

‎nginx-reverse/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ RUN rm /etc/nginx/nginx.conf
66
COPY reverse-proxy.conf /etc/nginx/conf.d/reverse-proxy.conf
77
COPY nginx.* /etc/nginx/ssl/
88
COPY nginx.conf /etc/nginx/nginx.conf
9-
COPY proxy-settings.conf /etc/nginx/conf.d/proxy-settings.conf
9+
COPY proxy-settings.conf /etc/nginx/conf.d/proxy-settings.conf
10+

0 commit comments

Comments
 (0)