refactor(docker-compose): expose and align all truststore/keystore options
MODIFY
docker-compose/src/docker/.env
docker-compose/src/docker/.env
@@ -37,7 +37,6 @@ ELASTICSEARCH_PORT=9200
#ELASTICSEARCH_PASSWORD=password
SELF_SIGNED=true
-TRUSTSTORE_KEYSTORE_PASSWORD=secret
# Do not change the following settings
COMPOSE_PROJECT_NAME=apiman
@@ -51,23 +50,31 @@ MAX_CACHE_SIZE_IN_MB=100
#TLS_ALLOWED_PROTOCOLS=TLSv1.1,TLSv1.2
## If you want to use different key/truststores uncomment all of the following block.
-## Change the keystore from apiman.jks to the name of your additional keystore
+## Change the keystore from apiman.jks to the name and path of your additional keystore
# Path to keystore inside docker, just uncomment
#KEYSTORE_TRUSTSTORE_PATH=
# Connection Gateway <-> Backend (Unmanaged APIs)
-#GATEWAY_BACKEND_KEYSTORE=apiman.jks
-#GATEWAY_BACKEND_TRUSTSTORE=apiman.jks
+#GATEWAY_BACKEND_KEYSTORE=
+#GATEWAY_BACKEND_KEYSTORE_PASSWORD=
+#GATEWAY_BACKEND_TRUSTSTORE=
+#GATEWAY_BACKEND_TRUSTSTORE_PASSWORD=
# Connection Gateway <-> Client (e.g. browser)
-#GATEWAY_CLIENT_KEYSTORE=apiman.jks
-#GATEWAY_CLIENT_TRUSTSTORE=apiman.jks
+#GATEWAY_CLIENT_KEYSTORE=
+#GATEWAY_CLIENT_KEYSTORE_PASSWORD=
+#GATEWAY_CLIENT_TRUSTSTORE=
+#GATEWAY_CLIENT_TRUSTSTORE_PASSWORD=
# Connection Gateway <-> Elasticsearch
-#GATEWAY_ES_KEYSTORE=apiman.jks
-#GATEWAY_ES_TRUSTSTORE=apiman.jks
+#GATEWAY_ES_KEYSTORE=
+#GATEWAY_ES_KEYSTORE_PASSWORD=
+#GATEWAY_ES_TRUSTSTORE=
+#GATEWAY_ES_TRUSTSTORE_PASSWORD=
# Connection Gateway <-> Keycloak
-#GATEWAY_KEYCLOAK_KEYSTORE=apiman.jks
-#GATEWAY_KEYCLOAK_TRUSTSTORE=apiman.jks
+#GATEWAY_KEYCLOAK_KEYSTORE=
+#GATEWAY_KEYCLOAK_KEYSTORE_PASSWORD=
+#GATEWAY_KEYCLOAK_TRUSTSTORE=
+#GATEWAY_KEYCLOAK_TRUSTSTORE_PASSWORD=

MODIFY
docker-compose/src/docker/data/conf-es.json
docker-compose/src/docker/data/conf-es.json
"allowSelfSigned": "${allowSelfSigned:-true}}",
"allowAnyHost": "${allowAnyHost:-true}}"
// "truststore": {
-// "path": "${apiman.gateway-es-truststore:-/opt/java/openjdk/lib/security/cacerts}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
// },
// "keystore": {
-// "path": "${apiman.gateway-es-keystore:-/opt/java/openjdk/lib/security/cacerts}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.keystore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.keystore.password:-changeit}"
// }
// "cache-polling-interval": 15
// "indexPrefix": ""
// Gateway error writer
// A "trace" version of the error writer - comment out/remove this to suppress stack traces
// in the JSON/XML payload returned by the gateway when an error occurs.
- // "writers": {
- // "error": {
- // "class": "io.apiman.gateway.engine.impl.TracePolicyErrorWriter",
- // "config": {}
- // }//,
+ "writers": {
+ "error": {
+ "class": "io.apiman.gateway.engine.impl.TracePolicyErrorWriter",
+ "config": {}
+ }
// "policy-failure": {
// "class": "",
// "config": {}
// }
- // },
+ },
"encrypter": {
"class": "io.apiman.gateway.engine.impl.DefaultDataEncrypter",
//"allowAnyHost": "${allowAnyHost:-true}",
// Trust store contains certificate(s) trusted by gateway.
- //"trustStore": "${apiman.gateway-backend-truststore:-/opt/java/openjdk/lib/security/cacerts}",
- //"trustStorePassword": "${apiman.truststore-password:-changeit}",
+ //"trustStore": "${apiman.gateway.backend-truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ //"trustStorePassword": "${apiman.gateway.backend-truststore.password:-changeit}",
// Key store contains gateway's keys (including private components: keep it safe).
- //"keyStore": "${apiman.gateway-backend-keystore:-/opt/java/openjdk/lib/security/cacerts}",
- //"keyStorePassword": "${apiman.truststore-password:-changeit}"
+ //"keyStore": "${apiman.gateway.backend-keystore:-/opt/java/openjdk/lib/security/cacerts}",
+ //"keyStorePassword": "${apiman.gateway.backend-keystore.password:-changeit}"
- // By default all keys can be used (will try all). If alias list provided, will only attempt to use listed keys.
+ // By default, all keys can be used (will try all). If alias list provided, will only attempt to use listed keys.
// "keyAliases": "mykey,myotherkey",
// Allowed TLS/SSL protocols and ciphers suites as CSV. Availability will vary depending on your JVM impl.
"allowSelfSigned": "${allowSelfSigned:-false}}",
"allowAnyHost": "${allowAnyHost:-false}}"
// "truststore": {
-// "path": "${apiman.gateway-es-truststore:-/opt/java/openjdk/lib/security/cacerts}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
// },
// "keystore": {
-// "path": "${apiman.gateway-es-keystore:-/opt/java/openjdk/lib/security/cacerts}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.keystore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.keystore.password:-changeit}"
// }
},
// You can collect custom headers into Elasticsearch!
"allowSelfSigned": "${allowSelfSigned:-false}}",
"allowAnyHost": "${allowAnyHost:-false}}"
//"truststore": {
- // "path": "${apiman.gateway-es-truststore:-/opt/java/openjdk/lib/security/cacerts}",
- // "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
//},
//"keystore": {
- // "path": "${apiman.gateway-es-keystore:-/opt/java/openjdk/lib/security/cacerts}",
- // "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.keystore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
//}
}
}
"allowSelfSigned": "${allowSelfSigned:-false}}",
"allowAnyHost": "${allowAnyHost:-false}}"
//"truststore": {
- // "path": "${apiman.gateway-es-truststore:-/opt/java/openjdk/lib/security/cacerts}",
- // "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
//},
//"keystore": {
- // "path": "${apiman.gateway-es-keystore:-/opt/java/openjdk/lib/security/cacerts}",
- // "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.es.keystore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.truststore.password:-changeit}"
//}
}
}
// You can force a particular endpoint to be reported here (e.g.
// if you have some clustered setup with exotic DNS setup)
- "publicEndpoint": "${apiman.public-endpoint}",
+ "publicEndpoint": "${apiman.gateway.public-endpoint}",
// Verticle configuration
// Port - The port a given verticle listens on (where relevant)
// Count - Number of given verticle type launched, or "auto" for automatic.
"verticles": {
"http": {
- "port": "${verticles.http.port:-8080}",
- "count": "${verticles.http.count:-auto}"
+ "port": "${apiman.gateway.http.port:-8080}",
+ "count": "${apiman.gateway.http.count:-auto}"
},
// Configure the following SSL section to enable SSL/TLS.
"https": {
- "port": "${verticles.https.port:-8443}",
- "count": "${verticles.https.count:-0}"
+ "port": "${apiman.gateway.https.port:-8443}",
+ "count": "${apiman.gateway.https.count:-0}"
},
// The Gateway API; this will be the port to set in the UI.
// e.g. http://localhost:8081 or https://gateway.machine:8081
// Configure the following SSL section to enable SSL/TLS.
"api": {
- "protocol": "${verticles.api.protocol:-http}",
- "port": 8081,
+ "protocol": "${apiman.gateway-api.protocol:-http}",
+ "port": "${apiman.gateway-api.port:-8081}",
"count": 1
}
},
// SSL configuration to the gateway's *front end* (i.e. client <-> gateway).
// "ssl": {
// "keystore": {
-// "path": "${apiman.gateway-client-keystore:-/your/keystore/here}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.gateway.client-keystore:-/your/keystore/here}",
+ // "password": "${apiman.gateway.client-keystore.password:-changeit}"
// },
// "truststore": {
-// "path": "${apiman.gateway-client-truststore:-/opt/java/openjdk/lib/security/cacerts}",
-// "password": "${apiman.truststore-password:-changeit}"
+ // "path": "${apiman.gateway.client-truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "password": "${apiman.gateway.client-truststore.password:-changeit}"
// },
-// "allowedProtocols": "${apiman.gateway-allowedProtocols}"
+ // "allowedProtocols": "${apiman.gateway.allowedProtocols}"
// },
- // Gateway API Authentication. See documentation for further possibilities..
+ // Gateway API Authentication. See documentation for further possibilities.
"auth": {
"type": "keycloak",
"config": {
"flowType": "PASSWORD",
"requiredRole": "realm:apipublisher",
- // Paste and overwrite your Keycloak config here.
- "realm": "${keycloak.realm:-apiman}",
- "realm-public-key": "${keycloak.realm-public-key}",
- "auth-server-url": "${keycloak.auth.url}",
- "ssl-required": "external",
- "disable-trust-manager": true,
- "allow-any-hostname" : "${allowAnyHost:-true}",
+ // Override with System Properties, or paste and overwrite your Client Keycloak config here.
+ "auth-server-url": "${apiman.auth.url:-http://localhost:8085}", // Location of your keycloak server.
+ "realm": "${apiman.auth.realm:-apiman}",
"resource": "apiman-gateway-api",
- // A limitation in the current OAuth2 implementation means a credentials section is required
- // even if your client is not set to "confidential". Leave this dummy section if you're using non-confidential.
"credentials": {
- "secret": "${keycloak.gateway.secret}"
+ "secret": "${apiman.auth.gateway.secret:-password}"
},
- "truststore": "${apiman.gateway-keycloak-truststore:-/opt/java/openjdk/lib/security/cacerts}",
- "truststore-password": "${apiman.truststore-password:-changeit}"
-// "client-keystore": "${apiman.gateway-keycloak-keystore:-/your/keystore/here}",
-// "client-keystore-password": "${apiman.truststore-password:-changeit}"
+ // End paste here
+ // "truststore": "${apiman.keycloak.truststore:-/opt/java/openjdk/lib/security/cacerts}",
+ // "truststore-password": "${apiman.keycloak.truststore.password:-changeit}"
+ // "client-keystore": "${apiman.keycloak.keystore:-/your/keystore/here}",
+ // "client-keystore-password": "${apiman.keycloak.keystore.password:-changeit}"
+ "ssl-required": "none",
+ "disable-trust-manager": true,
+ "allow-any-hostname" : true
}
},

MODIFY
docker-compose/src/docker/docker-compose.yml
docker-compose/src/docker/docker-compose.yml
@@ -51,7 +51,7 @@ services:
- traefik.http.routers.apimanui-router.service=apimanui-service
- traefik.http.services.apimanui-service.loadbalancer.server.port=8080
- restart: always
+ restart: unless-stopped
healthcheck:
# Double $$ sign in health-check predicate is to escape first $ in docker-compose syntax (prevent expansion here).
test: curl -s -f http://apiman-manager:8080/apiman/system/status &>/dev/null; if [[ $$? == 0 ]]; then echo 0; else echo 1; fi
@@ -73,24 +73,30 @@ services:
-Dapiman.es.username=
-Dapiman.es.password=
-Dapiman.es.timeout=10000
- -Dapiman.truststore-password=${TRUSTSTORE_KEYSTORE_PASSWORD}
- -Dapiman.public-endpoint=${APIMAN_GATEWAY_PUBLIC_ENDPOINT}
- -Dkeycloak.auth.url=${KEYCLOAK_URL}
- -Dkeycloak.realm=${KEYCLOAK_REALM}
+ -Dapiman.auth.url=${KEYCLOAK_URL}
+ -Dapiman.auth.realm=${KEYCLOAK_REALM}
+ -Dapiman.auth.gateway.secret=${KEYCLOAK_GATEWAY_SECRET}
-DallowSelfSigned=${SELF_SIGNED}
-DallowAnyHost=${SELF_SIGNED}
- -Dkeycloak.realm-public-key=${KEYCLOAK_REALM_PUBLIC_KEY}
- -Dkeycloak.gateway.secret=${KEYCLOAK_GATEWAY_SECRET}
+ -Dapiman.public-endpoint=${APIMAN_GATEWAY_PUBLIC_ENDPOINT}
-DcachingPolicy.maxCacheSize=${MAX_CACHE_SIZE_IN_MB}
-Dapiman.gateway-allowedProtocols=${TLS_ALLOWED_PROTOCOLS:-}
- -Dapiman.gateway-backend-keystore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_BACKEND_KEYSTORE:-}
- -Dapiman.gateway-backend-truststore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_BACKEND_TRUSTSTORE:-}
- -Dapiman.gateway-client-keystore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_CLIENT_KEYSTORE:-}
- -Dapiman.gateway-client-truststore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_CLIENT_TRUSTSTORE:-}
- -Dapiman.gateway-es-keystore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_ES_KEYSTORE:-}
- -Dapiman.gateway-es-truststore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_ES_TRUSTSTORE:-}
- -Dapiman.gateway-keycloak-keystore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_KEYCLOAK_KEYSTORE:-}
- -Dapiman.gateway-keycloak-truststore=${KEYSTORE_TRUSTSTORE_PATH:-}${GATEWAY_KEYCLOAK_TRUSTSTORE:-}
+ -Dapiman.es.keystore=${GATEWAY_ES_KEYSTORE}
+ -Dapiman.es.keystore.password=${GATEWAY_ES_KEYSTORE_PASSWORD}
+ -Dapiman.es.truststore=${GATEWAY_ES_TRUSTSTORE}
+ -Dapiman.es.truststore.password=${GATEWAY_ES_TRUSTSTORE_PASSWORD}
+ -Dapiman.keycloak.keystore=${GATEWAY_KEYCLOAK_KEYSTORE}
+ -Dapiman.keycloak.keystore.password=${GATEWAY_KEYCLOAK_KEYSTORE_PASSWORD}
+ -Dapiman.keycloak.truststore=${GATEWAY_KEYCLOAK_TRUSTSTORE}
+ -Dapiman.keycloak.truststore.password=${GATEWAY_KEYCLOAK_TRUSTSTORE_PASSWORD}
+ -Dapiman.gateway.client-keystore=${GATEWAY_CLIENT_KEYSTORE}
+ -Dapiman.gateway.client-keystore.password=${GATEWAY_CLIENT_KEYSTORE_PASSWORD}
+ -Dapiman.gateway.client-truststore=${GATEWAY_CLIENT_TRUSTSTORE}
+ -Dapiman.gateway.client-truststore.password=${GATEWAY_CLIENT_TRUSTSTORE_PASSWORD}
+ -Dapiman.gateway.backend-keystore=${GATEWAY_BACKEND_KEYSTORE}
+ -Dapiman.gateway.backend-keystore.password=${GATEWAY_BACKEND_KEYSTORE_PASSWORD}
+ -Dapiman.gateway.backend-truststore=${GATEWAY_BACKEND_KEYSTORE}
+ -Dapiman.gateway.backend-truststore.password=${GATEWAY_BACKEND_KEYSTORE_PASSWORD}
volumes:
- type: bind
source: "$PWD/data/conf-es.json"
@@ -105,6 +111,7 @@ services:
max-size: "10m"
max-file: "10"
mode: non-blocking
+ restart: unless-stopped
labels:
# - traefik.http.routers.gateway-router.tls=true
- traefik.http.routers.gateway-router.entrypoints=http
@@ -116,7 +123,6 @@ services:
# - traefik.http.routers.gateway-management-router.rule=Host(`gateway-management.${APIMAN_HOSTNAME}`)
# - traefik.http.routers.gateway-management-router.service=gateway-management-service
# - traefik.http.services.gateway-management-service.loadbalancer.server.port=8081
- restart: always
postgres:
image: postgres:14.5
@@ -142,13 +148,13 @@ services:
max-size: "10m"
max-file: "10"
mode: non-blocking
+ restart: unless-stopped
#labels:
# - traefik.http.routers.postgres-router.tls=true
# - traefik.http.routers.postgres-router.entrypoints=https
# - traefik.http.routers.postgres-router.rule=Host(`postgres.${APIMAN_HOSTNAME}`)
# - traefik.http.routers.postgres-router.service=postgres-service
# - traefik.http.services.postgres-service.loadbalancer.server.port=5432
- restart: always
elasticsearch:
image: elasticsearch:7.17.6
@@ -179,12 +185,12 @@ services:
max-size: "10m"
max-file: "10"
mode: non-blocking
- restart: always
healthcheck:
test: curl -s http://elasticsearch:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
interval: 30s
timeout: 10s
retries: 5
+ restart: unless-stopped
labels:
- traefik.http.routers.elasticsearch-router.tls=true
- traefik.http.routers.elasticsearch-router.entrypoints=https
@@ -218,7 +224,9 @@ services:
- 'KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN_USERNAME}'
- 'KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD}'
# Keycloak networking config
- - 'KC_HOSTNAME=auth.${APIMAN_HOSTNAME}'
+ #- 'KC_HOSTNAME=auth.${APIMAN_HOSTNAME}'
+ - 'KC_HOSTNAME_STRICT=false'
+ - 'KC_HTTP_ENABLED=true'
- 'KC_HTTP_PORT=8080'
- 'KC_HOSTNAME_PORT=8080'
- 'KC_PROXY=edge'
@@ -244,16 +252,17 @@ services:
max-size: "10m"
max-file: "10"
mode: non-blocking
+ restart: unless-stopped
labels:
#- traefik.http.routers.keycloak-router.tls=true
- traefik.http.routers.keycloak-router.entrypoints=http
- traefik.http.routers.keycloak-router.rule=Host(`auth.${APIMAN_HOSTNAME}`)
- traefik.http.routers.keycloak-router.service=keycloak-service
- traefik.http.services.keycloak-service.loadbalancer.server.port=8080
- restart: always
mock-mail-server:
image: maildev/maildev:2.0.5
+ restart: unless-stopped
labels:
- traefik.http.routers.mailserver-router.entrypoints=http
- traefik.http.routers.mailserver-router.rule=Host(`mail.${APIMAN_HOSTNAME}`)
@@ -278,6 +287,7 @@ services:
# - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
# # middleware redirect
# - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
volumes:
ui_logs:
driver: local

refactor(docker-compose): expose and align all truststore/keystore options