Files
btpxpress-backend/docker-compose.yml
DahoudG 7df5f346f1 Refactor: Backend Frontend-Centric Auth - Suppression OIDC, validation JWT
Architecture modifiée pour Frontend-Centric Authentication:

1. **Suppression des dépendances OIDC**
   - quarkus-oidc → quarkus-smallrye-jwt
   - quarkus-keycloak-authorization → quarkus-smallrye-jwt-build
   - Le backend ne gère plus l'authentification OAuth

2. **Configuration JWT simple**
   - Validation des tokens JWT envoyés par le frontend
   - mp.jwt.verify.publickey.location (JWKS de Keycloak)
   - mp.jwt.verify.issuer (Keycloak realm)
   - Authentification via Authorization: Bearer header

3. **Suppression configurations OIDC**
   - application.properties: Suppression %dev.quarkus.oidc.*
   - application.properties: Suppression %prod.quarkus.oidc.*
   - application-prod.properties: Remplacement par mp.jwt.*
   - Logging: io.quarkus.oidc → io.quarkus.smallrye.jwt

4. **Sécurité simplifiée**
   - quarkus.security.auth.proactive=false
   - @Authenticated sur les endpoints
   - CORS configuré pour le frontend
   - Endpoints publics: /q/*, /openapi, /swagger-ui/*

Flux d'authentification:
1️⃣ Frontend → Keycloak (OAuth login)
2️⃣ Frontend ← Keycloak (access_token)
3️⃣ Frontend → Backend (Authorization: Bearer token)
4️⃣ Backend valide le token JWT (signature + issuer)
5️⃣ Backend → Frontend (données API)

Avantages:
 Pas de secret backend à gérer
 Pas de client btpxpress-backend dans Keycloak
 Séparation claire frontend/backend
 Backend devient une API REST stateless
 Tokens gérés par le frontend (localStorage/sessionStorage)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-31 17:05:11 +00:00

139 lines
3.9 KiB
YAML

version: '3.8'
services:
# Base de données PostgreSQL
postgres:
image: postgres:15-alpine
container_name: btpxpress-postgres
environment:
POSTGRES_DB: ${POSTGRES_DB:-btpxpress}
POSTGRES_USER: ${POSTGRES_USER:-btpxpress_user}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
ports:
- "5433:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
- ./src/main/resources/db/migration:/docker-entrypoint-initdb.d
networks:
- btpxpress-network
healthcheck:
test: ["CMD-SHELL", "pg_isready -U btpxpress_user -d btpxpress"]
interval: 10s
timeout: 5s
retries: 5
# Application BTPXpress Server
btpxpress-server:
image: btpxpress-server:1.0.0
container_name: btpxpress-server
build:
context: .
dockerfile: src/main/docker/Dockerfile.jvm
environment:
# Configuration base de données
QUARKUS_DATASOURCE_JDBC_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-btpxpress}
QUARKUS_DATASOURCE_USERNAME: ${POSTGRES_USER:-btpxpress_user}
QUARKUS_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
# Configuration Hibernate
QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION: update
QUARKUS_HIBERNATE_ORM_LOG_SQL: false
# Configuration logs
QUARKUS_LOG_LEVEL: INFO
QUARKUS_LOG_CATEGORY_DEV_LIONS_BTPXPRESS_LEVEL: DEBUG
# Configuration sécurité (désactivée pour le développement)
QUARKUS_SECURITY_AUTH_ENABLED: false
QUARKUS_OIDC_ENABLED: false
# Configuration CORS
QUARKUS_HTTP_CORS: true
QUARKUS_HTTP_CORS_ORIGINS: "http://localhost:3000,http://localhost:4200"
# Configuration santé
QUARKUS_SMALLRYE_HEALTH_ROOT_PATH: /q/health
ports:
- "8080:8080"
depends_on:
postgres:
condition: service_healthy
networks:
- btpxpress-network
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080/q/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
restart: unless-stopped
# Redis pour le cache (optionnel)
redis:
image: redis:7-alpine
container_name: btpxpress-redis
ports:
- "6379:6379"
volumes:
- redis_data:/data
networks:
- btpxpress-network
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
restart: unless-stopped
# Prometheus pour les métriques (optionnel)
prometheus:
image: prom/prometheus:latest
container_name: btpxpress-prometheus
ports:
- "9090:9090"
volumes:
- ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
- prometheus_data:/prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/etc/prometheus/console_libraries'
- '--web.console.templates=/etc/prometheus/consoles'
- '--storage.tsdb.retention.time=200h'
- '--web.enable-lifecycle'
networks:
- btpxpress-network
restart: unless-stopped
# Grafana pour la visualisation (optionnel)
grafana:
image: grafana/grafana:latest
container_name: btpxpress-grafana
ports:
- "3000:3000"
environment:
GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-changeme}
volumes:
- grafana_data:/var/lib/grafana
- ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards
- ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources
networks:
- btpxpress-network
restart: unless-stopped
# Volumes persistants
volumes:
postgres_data:
driver: local
redis_data:
driver: local
prometheus_data:
driver: local
grafana_data:
driver: local
# Réseau dédié
networks:
btpxpress-network:
driver: bridge