Skip to content

Commit 3f2bd1d

Browse files
Brutus5000Brutus5000
committed
Transition to Ory Hydra 2 (in parallel)
1 parent 3822d2c commit 3f2bd1d

12 files changed

+240
-0
lines changed

‎apps/faf-user-service/templates/config-hydra2.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: faf-user-service-hydra2
5+
labels:
6+
app: faf-user-service-hydra2
7+
data:
8+
# Only for testing environments
9+
FAF_ENVIRONMENT: {{ eq .Values.environment "prod" | ternary "" .Values.environment }}
10+
REAL_IP_HEADER: "Cf-Connecting-Ip"
11+
PASSWORD_RESET_URL: "https://www.{{.Values.baseDomain}}/account/password/reset"
12+
REGISTER_ACCOUNT_URL: "https://www.{{.Values.baseDomain}}/account/register"
13+
ACTIVATION_URL_FORMAT: "https://user.{{.Values.baseDomain}}/register/activate?token=%s"
14+
FAILED_LOGIN_ACCOUNT_THRESHOLD: "5"
15+
FAILED_LOGIN_ATTEMPT_THRESHOLD: "10"
16+
FAILED_LOGIN_THROTTLING_MINUTES: "5"
17+
FAILED_LOGIN_DAYS_TO_CHECK: "1"
18+
HYDRA_TOKEN_ISSUER: "https://login.{{.Values.baseDomain}}"
19+
HYDRA_JWKS_URL: "https://login.{{.Values.baseDomain}}/.well-known/jwks.json"
20+
HYDRA_BASE_ADMIN_URL: "http://ory-hydra2:4445"
21+
DB_URL: "jdbc:mariadb://mariadb:3306/faf_lobby?ssl=false"
22+
DB_USERNAME: "faf-user-service"
23+
DB_DATABASE: "faf_lobby" # for mariadb init script
24+
LOBBY_URL: "wss://ws.{{.Values.baseDomain}}"
25+
IRC_TOKEN_TTL: "300"
26+
JAVA_OPTS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"

‎apps/faf-user-service/templates/deployment-hydra2.yaml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: faf-user-service-hydra2
6+
labels:
7+
app: faf-user-service-hydra2
8+
annotations:
9+
reloader.stakater.com/auto: "true"
10+
spec:
11+
replicas: 1
12+
revisionHistoryLimit: 10
13+
selector:
14+
matchLabels:
15+
app: faf-user-service-hydra2
16+
template:
17+
metadata:
18+
labels:
19+
app: faf-user-service-hydra2
20+
annotations:
21+
prometheus.io/scrape: 'true'
22+
prometheus.io/port: '8081'
23+
prometheus.io/path: '/actuator/prometheus'
24+
spec:
25+
containers:
26+
- image: faforever/faf-user-service:3.2.0-RC2
27+
imagePullPolicy: Always
28+
name: faf-user-service
29+
envFrom:
30+
- configMapRef:
31+
name: faf-user-service-hydra2
32+
- secretRef:
33+
name: faf-user-service
34+
volumeMounts:
35+
- name: mail-templates
36+
mountPath: /config/mail/
37+
readOnly: true
38+
ports:
39+
- containerPort: 8080
40+
startupProbe:
41+
httpGet:
42+
port: 8080
43+
path: /q/health
44+
failureThreshold: 10
45+
periodSeconds: 3
46+
livenessProbe:
47+
httpGet:
48+
port: 8080
49+
path: /q/health
50+
failureThreshold: 3
51+
periodSeconds: 10
52+
restartPolicy: Always
53+
volumes:
54+
- name: mail-templates
55+
configMap:
56+
name: faf-user-service-mail-templates

‎apps/faf-user-service/templates/ingress.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,9 @@ spec:
1111
services:
1212
- name: faf-user-service
1313
port: 8080
14+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
15+
- match: Host(`user-nx.{{.Values.baseDomain}}`)
16+
kind: Rule
17+
services:
18+
- name: faf-user-service-hydra2
19+
port: 8080

‎apps/faf-user-service/templates/service-hydra2.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: faf-user-service-hydra2
6+
labels:
7+
app: faf-user-service-hydra2
8+
spec:
9+
selector:
10+
app: faf-user-service-hydra2
11+
ports:
12+
- port: 8080
13+
targetPort: 8080

‎apps/ory-hydra2/Chart.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: ory-hydra2
3+
version: 1.0.0

‎apps/ory-hydra2/templates/config.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra2
8+
data:
9+
URLS_SELF_ISSUER: "https://login.{{.Values.baseDomain}}"
10+
URLS_LOGIN: "https://user-nx.{{.Values.baseDomain}}/oauth2/login"
11+
URLS_CONSENT: "https://user-nx.{{.Values.baseDomain}}/oauth2/consent"
12+
STRATEGIES_ACCESS_TOKEN: "jwt"
13+
OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE: "true"
14+
# These are only used for postgres init script, it is redundant in the DSN secret! Don't forget to also create a secret for DB_PASSWORD
15+
DB_USER: "hydra"
16+
DB_NAME: "ory-hydra"

‎apps/ory-hydra2/templates/deployment.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra2
8+
annotations:
9+
reloader.stakater.com/auto: "true"
10+
spec:
11+
replicas: 1
12+
revisionHistoryLimit: 10
13+
selector:
14+
matchLabels:
15+
app: ory-hydra2
16+
template:
17+
metadata:
18+
labels:
19+
app: ory-hydra2
20+
annotations:
21+
prometheus.io/scrape: 'false'
22+
spec:
23+
containers:
24+
- image: oryd/hydra:v2.2.0
25+
imagePullPolicy: Always
26+
name: ory-hydra2
27+
envFrom:
28+
- configMapRef:
29+
name: ory-hydra2
30+
- secretRef:
31+
name: ory-hydra2
32+
ports:
33+
- containerPort: 4444
34+
- containerPort: 4445
35+
restartPolicy: Always

‎apps/ory-hydra2/templates/ingress.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: traefik.io/v1alpha1
2+
kind: IngressRoute
3+
metadata:
4+
name: ory-hydra2
5+
spec:
6+
entryPoints:
7+
- websecure
8+
routes:
9+
- match: Host(`login.{{.Values.baseDomain}}`)
10+
kind: Rule
11+
services:
12+
- name: ory-hydra2
13+
port: 4444

‎apps/ory-hydra2/templates/migration-cronjob.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
kind: CronJob
2+
apiVersion: batch/v1
3+
metadata:
4+
name: ory-hydra2-migration
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra-migration
8+
spec:
9+
# Disabled because triggered manually
10+
schedule: "0 0 31 2 *"
11+
suspend: true
12+
concurrencyPolicy: Forbid
13+
jobTemplate:
14+
metadata:
15+
labels:
16+
app: ory-hydra2-migration
17+
annotations:
18+
prometheus.io/scrape: 'false'
19+
spec:
20+
template:
21+
spec:
22+
containers:
23+
- image: oryd/hydra:v2.2.0
24+
imagePullPolicy: Always
25+
name: ory-hydra
26+
envFrom:
27+
- configMapRef:
28+
name: ory-hydra2
29+
- secretRef:
30+
name: ory-hydra2
31+
ports:
32+
- containerPort: 4444
33+
- containerPort: 4445
34+
args: [ "migrate", "sql", "--read-from-env", "--yes"]
35+
restartPolicy: Never

‎apps/ory-hydra2/templates/secret.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: secrets.infisical.com/v1alpha1
2+
kind: InfisicalSecret
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
spec:
7+
authentication:
8+
universalAuth:
9+
credentialsRef:
10+
secretName: infisical-machine-identity
11+
secretNamespace: faf-ops
12+
secretsScope:
13+
projectSlug: {{.Values.infisical.projectSlug}}
14+
envSlug: {{.Values.infisical.envSlug}}
15+
secretsPath: "/ory-hydra2"
16+
managedSecretReference:
17+
secretName: ory-hydra2
18+
secretNamespace: faf-apps
19+
creationPolicy: "Owner"

‎apps/ory-hydra2/templates/service.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra2
8+
spec:
9+
selector:
10+
app: ory-hydra2
11+
ports:
12+
- name: public-port
13+
port: 4444
14+
targetPort: 4444
15+
- name: admin-port
16+
port: 4445
17+
targetPort: 4445

‎scripts/init-postgres.sh

+1
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,6 @@ create_user_and_db() {
5050
}
5151

5252
create_user_and_db faf-apps wikijs DB_USER DB_PASS DB_NAME
53+
create_user_and_db faf-apps ory-hydra2 DB_USER DB_PASSWORD DB_NAME
5354

5455
echo "All users and databases have been processed."

0 commit comments

Comments
 (0)