opensource/magistrala
1
0
Fork 0
mirror of https://github.com/absmach/magistrala.git synced 2026-08-07 07:14:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

MG-3537 - Migrate Magistrala to ATOM for identity & authorization (#3532)
Property Based Tests / api-test (push) Has been cancelled
Details
Continuous Delivery / lint-and-build (push) Has been cancelled
Details
Deploy GitHub Pages / swagger-ui (push) Has been cancelled
Details
CI Pipeline / Lint Proto (push) Has been cancelled
Details
CI Pipeline / Detect Changes (push) Has been cancelled
Details
Continuous Delivery / Build and Push Docker Images (push) Has been cancelled
Details
CI Pipeline / lint-and-build (push) Has been cancelled
Details
CI Pipeline / Test ${{ matrix.module }} (push) Has been cancelled
Details
CI Pipeline / Upload Coverage (push) Has been cancelled
Details

Browse Source 
Signed-off-by: Arvindh <arvindh91@gmail.com>
Signed-off-by: dusan <borovcanindusan1@gmail.com>
Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
Co-authored-by: Dušan Borovčanin <dusan.borovcanin@absmach.eu>
Co-authored-by: Rodney Osodo <socials@rodneyosodo.com>
Co-authored-by: dusan <borovcanindusan1@gmail.com>
This commit is contained in:
Arvindh
2026-06-27 01:36:57 +05:30
committed by GitHub
parent 19ed0de788
commit 16ba29cf4a
611 changed files with 10691 additions and 189916 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/.env
+82 -96
View File
@@ -31,7 +31,9 @@ MG_FLUXMQ_API_PORT_2=9082
MG_FLUXMQ_API_PORT_3=9083
## Message Broker
MG_MESSAGE_BROKER_URL=amqp://guest:guest@nginx:${MG_FLUXMQ_AMQP091_PORT}/
MG_MESSAGE_BROKER_URL=amqp://guest:guest@nginx:${MG_NGINX_AMQP_PORT}/
MG_FLUXMQ_PUBLISH_HTTP_HOST=fluxmq-auth
MG_FLUXMQ_PUBLISH_HTTP_PORT=9026
## Redis
MG_REDIS_TCP_PORT=6379
@@ -39,7 +41,7 @@ MG_REDIS_URL=redis://es-redis:${MG_REDIS_TCP_PORT}/0
## Event Store
MG_ES_TYPE=es_fluxmq
MG_ES_URL=amqp://guest:guest@nginx:5682/
MG_ES_URL=amqp://guest:guest@nginx:${MG_NGINX_AMQP_PORT}/
## Jaeger
MG_JAEGER_COLLECTOR_OTLP_ENABLED=true
@@ -138,6 +140,57 @@ MG_AUTH_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.crt}
MG_AUTH_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.key}
MG_AUTH_GRPC_CLIENT_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
### Atom Integration
ATOM_URL=http://atom:8080
ATOM_PUBLIC_URL=http://nginx:80
ATOM_JWKS_URL=http://atom:8080/.well-known/jwks.json
ATOM_JWT_ISSUER=http://nginx:80
ATOM_JWT_AUDIENCE=magistrala
ATOM_SIGNUP_ENABLED=true
ATOM_ALLOW_UNVERIFIED_EMAIL_LOGIN=true
ATOM_DEV_ALLOW_UNVERIFIED_EMAIL_LOGIN=true
ATOM_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost
ATOM_UI_HTTP_PORT=3005
ATOM_SERVICE_TOKEN=
ATOM_SERVICE_USERNAME=admin
ATOM_SERVICE_SECRET=12345678
ATOM_ADMIN_TOKEN=
ATOM_ADMIN_USERNAME=admin
ATOM_TIMEOUT=5s
ATOM_HTTP_PORT=8080
ATOM_GRPC_ADDR=0.0.0.0:8081
ATOM_DB_PORT=6010
ATOM_DB_USER=atom
ATOM_DB_PASSWORD=atom
ATOM_DB_NAME=atom
ATOM_JWT_SECRET=change-me-in-production
ATOM_JWT_EXPIRY_SECS=3600
ATOM_KEY_ENCRYPTION_KEY=6uQzr7tCp9cupO8anzo0i6XtfVocixzIK78lB4o6S3E=
ATOM_KEY_ENCRYPTION_KEY_ID=local:v1
ATOM_ALLOW_PLAINTEXT_SIGNING_KEYS=false
ATOM_ADMIN_SECRET=12345678
ATOM_MIN_PASSWORD_CHARS=8
ATOM_CERTS_ENABLED=true
ATOM_CERTS_CA_MODE=file_root_issuer
ATOM_CERTS_ROOT_CA_CERT_PATH=/certs/ca.crt
ATOM_CERTS_ROOT_CA_KEY_PATH=/certs/ca.key
ATOM_CERTS_CA_DIR=./ssl/certs
ATOM_CERTS_LEAF_DEFAULT_TTL_SECS=2592000
ATOM_CERTS_LEAF_MAX_TTL_SECS=2592000
# Local compose runs the server-rendered UI and GraphQL traffic through shared
# Docker peer IPs, which can trip Atom's default per-IP GraphQL limits.
ATOM_RATE_LIMIT_ENABLED=false
ATOM_TRUSTED_PROXY_CIDRS=
ATOM_RUST_LOG=info
ATOM_INVITATION_REDIRECT=http://localhost:3000/invitations/accept
ATOM_INVITATION_EXPIRY_SECS=604800
ATOM_SMTP_HOST=host.docker.internal
ATOM_SMTP_PORT=2525
ATOM_SMTP_USERNAME=
ATOM_SMTP_PASSWORD=
ATOM_SMTP_FROM=from@example.com
ATOM_SMTP_TLS=none
### Domains
MG_DOMAINS_LOG_LEVEL=debug
MG_DOMAINS_HTTP_HOST=domains
@@ -163,26 +216,14 @@ MG_DOMAINS_CACHE_URL=redis://domains-redis:${MG_REDIS_TCP_PORT}/0
MG_DOMAINS_CACHE_KEY_DURATION=10m
#### Domains Client Config
MG_DOMAINS_URL=http://domains:9003
MG_DOMAINS_GRPC_URL=domains:7003
MG_DOMAINS_URL=http://atom:8080/tenants
MG_DOMAINS_GRPC_URL=
MG_DOMAINS_GRPC_TIMEOUT=300s
MG_DOMAINS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.crt}
MG_DOMAINS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.key}
MG_DOMAINS_GRPC_CLIENT_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
### SpiceDB Datastore config
MG_SPICEDB_DB_USER=magistrala
MG_SPICEDB_DB_PASS=magistrala
MG_SPICEDB_DB_NAME=spicedb
MG_SPICEDB_DB_PORT=5432
### SpiceDB config
MG_SPICEDB_PRE_SHARED_KEY="12345678"
MG_SPICEDB_SCHEMA_FILE="/schema.zed"
MG_PERMISSIONS_FILE="/permission.yaml"
MG_SPICEDB_HOST=spicedb
MG_SPICEDB_PORT=50051
MG_SPICEDB_DATASTORE_ENGINE=postgres
### Users
MG_USERS_LOG_LEVEL=debug
@@ -223,8 +264,8 @@ MG_VERIFICATION_URL_PREFIX=http://localhost/verify-email
MG_VERIFICATION_EMAIL_TEMPLATE=verification-email.tmpl
#### Users Client Config
MG_USERS_URL=http://users:9002
MG_USERS_GRPC_URL=users:7002
MG_USERS_URL=http://atom:8080/entities
MG_USERS_GRPC_URL=
MG_USERS_GRPC_TIMEOUT=300s
MG_USERS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.crt}
MG_USERS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.key}
@@ -237,6 +278,7 @@ MG_EMAIL_USERNAME=from@example.com
MG_EMAIL_PASSWORD=password
MG_EMAIL_FROM_ADDRESS=from@example.com
MG_EMAIL_FROM_NAME=Example
MG_EMAIL_TEMPLATE=
MG_EMAIL_INVITATION_TEMPLATE=invitation-sent-email.tmpl
MG_EMAIL_ACCEPTANCE_TEMPLATE=invitation-accepted-email.tmpl
MG_EMAIL_REJECTION_TEMPLATE=invitation-rejected-email.tmpl
@@ -274,8 +316,8 @@ MG_GROUPS_DB_SSL_ROOT_CERT=
MG_GROUPS_INSTANCE_ID=
#### Groups Client Config
MG_GROUPS_URL=groups:9004
MG_GROUPS_GRPC_URL=groups:7004
MG_GROUPS_URL=http://atom:8080/groups
MG_GROUPS_GRPC_URL=
MG_GROUPS_GRPC_TIMEOUT=300s
MG_GROUPS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/groups-grpc-client.crt}
MG_GROUPS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/groups-grpc-client.key}
@@ -306,8 +348,8 @@ MG_CLIENTS_DB_SSL_ROOT_CERT=
MG_CLIENTS_INSTANCE_ID=
#### Clients Client Config
MG_CLIENTS_URL=http://clients:9006
MG_CLIENTS_GRPC_URL=clients:7006
MG_CLIENTS_URL=http://atom:8080/entities
MG_CLIENTS_GRPC_URL=
MG_CLIENTS_GRPC_TIMEOUT=300s
MG_CLIENTS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/clients-grpc-client.crt}
MG_CLIENTS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/clients-grpc-client.key}
@@ -336,8 +378,8 @@ MG_CHANNELS_CACHE_URL=redis://channels-redis:${MG_REDIS_TCP_PORT}/0
MG_CHANNELS_CACHE_KEY_DURATION=10m
#### Channels Client Config
MG_CHANNELS_URL=http://channels:9005
MG_CHANNELS_GRPC_URL=channels:7005
MG_CHANNELS_URL=http://atom:8080/resources
MG_CHANNELS_GRPC_URL=
MG_CHANNELS_GRPC_TIMEOUT=300s
MG_CHANNELS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/channels-grpc-client.crt}
MG_CHANNELS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/channels-grpc-client.key}
@@ -357,60 +399,8 @@ MG_FLUXMQ_CACHE_BUFFER_ITEMS=64
MG_COAP_PORT=5683
## Addons Services
# Certs
MG_CERTS_LOG_LEVEL=debug
MG_CERTS_HTTP_HOST=certs
MG_CERTS_HTTP_PORT=9019
MG_CERTS_GRPC_HOST=certs
MG_CERTS_GRPC_PORT=7012
# WARNING: This is a development/testing secret only.
# NEVER use this weak secret in production! Generate a strong random secret for production deployments.
MG_CERTS_SECRET=12345678
## Certs Database Configuration
MG_CERTS_DB_HOST=certs-db
MG_CERTS_DB_PORT=5432
MG_CERTS_DB_USER=absmach
MG_CERTS_DB_PASS=absmach
MG_CERTS_DB=certs
MG_CERTS_DB_SSL_MODE=disable
MG_CERTS_DB_MAX_CONNECTIONS=100
## OpenBao Configuration for Certs
MG_CERTS_OPENBAO_HOST=http://openbao:8200
MG_CERTS_OPENBAO_APP_ROLE=absmach
MG_CERTS_OPENBAO_APP_SECRET=absmach
MG_CERTS_OPENBAO_NAMESPACE=
MG_CERTS_OPENBAO_PKI_PATH=pki
MG_CERTS_OPENBAO_ROLE=absmach
MG_CERTS_OPENBAO_SECRET_ID_TTL=720h
MG_CERTS_SERVICE_TOKEN_PATH=/openbao/service_token
MG_CERTS_SECRET_ID_PATH=/openbao/secret_id
MG_CERTS_SECRET_RENEW_THRESHOLD=24h
MG_CERTS_SECRET_CHECK_INTERVAL=1h
## OpenBao PKI CA Configuration
MG_CERTS_OPENBAO_PKI_CA_CN=Abstract Machines Certificate Authority
MG_CERTS_OPENBAO_PKI_CA_OU=Abstract Machines
MG_CERTS_OPENBAO_PKI_CA_O=AbstractMachines
MG_CERTS_OPENBAO_PKI_CA_C=FRANCE
MG_CERTS_OPENBAO_PKI_CA_L=PARIS
MG_CERTS_OPENBAO_PKI_CA_ST=PARIS
MG_CERTS_OPENBAO_PKI_CA_ADDR=5 Av. Anatole
MG_CERTS_OPENBAO_PKI_CA_PO=75007
MG_CERTS_OPENBAO_PKI_CA_DNS_NAMES=localhost
MG_CERTS_OPENBAO_PKI_CA_IP_ADDRESSES=127.0.0.1,::1
MG_CERTS_OPENBAO_PKI_CA_URI_SANS=
MG_CERTS_OPENBAO_PKI_CA_EMAIL_ADDRESSES=info@abstractmachines.rs
## OpenBao Unseal Keys and Token
MG_CERTS_OPENBAO_UNSEAL_KEY_1=
MG_CERTS_OPENBAO_UNSEAL_KEY_2=
MG_CERTS_OPENBAO_UNSEAL_KEY_3=
MG_CERTS_OPENBAO_ROOT_TOKEN=
#### Auth Client Config for Certs Service
#### Auth gRPC client config for addons
MG_ADDONS_CERTS_PATH_PREFIX=../../
MG_AUTH_GRPC_URL=auth:7001
MG_AUTH_GRPC_TIMEOUT=300s
@@ -418,16 +408,13 @@ MG_AUTH_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.crt}
MG_AUTH_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.key}
MG_AUTH_GRPC_SERVER_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
#### Domains Client Config for Certs Service
MG_DOMAINS_GRPC_URL=domains:7003
#### Domains gRPC client config for addons
MG_DOMAINS_GRPC_URL=
MG_DOMAINS_GRPC_TIMEOUT=300s
MG_DOMAINS_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.crt}
MG_DOMAINS_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/domains-grpc-client.key}
MG_DOMAINS_GRPC_SERVER_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
MG_CERTS_JAEGER_FRONTEND=16687
MG_CERTS_JAEGER_OLTP_HTTP=4319
### Postgres
MG_POSTGRES_HOST=postgres
MG_POSTGRES_PORT=5432
@@ -516,10 +503,9 @@ MG_PROVISION_HTTP_PORT=9016
MG_PROVISION_ENV_CLIENTS_TLS=false
MG_PROVISION_SERVER_CERT=
MG_PROVISION_SERVER_KEY=
MG_PROVISION_USERS_URL=http://users:9002
MG_PROVISION_CHANNELS_URL=http://channels:9005
MG_PROVISION_CLIENTS_URL=http://clients:9006
MG_PROVISION_CERTS_URL=http://certs:9019
MG_PROVISION_USERS_URL=http://atom:8080/entities
MG_PROVISION_CHANNELS_URL=http://atom:8080/resources
MG_PROVISION_CLIENTS_URL=http://atom:8080/entities
MG_PROVISION_USER=
MG_PROVISION_USERNAME=
MG_PROVISION_PASS=
@@ -529,8 +515,6 @@ MG_PROVISION_BS_SVC_URL=http://bootstrap:9013
MG_PROVISION_BS_CONFIG_PROVISIONING=true
MG_PROVISION_BS_AUTO_WHITELIST=true
MG_PROVISION_BS_CONTENT=
MG_PROVISION_CERTS_HOURS_VALID=2400h
MG_PROVISION_CERTS_RSA_BITS=2048
MG_PROVISION_INSTANCE_ID=
### Postgres Writer
@@ -687,7 +671,7 @@ MG_UI_BACKEND_URL=http://ui-backend:9097
MG_UI_VERIFICATION_TLS=false
MG_UI_CONTENT_TYPE=application/senml+json
# Set to yes to accept the EULA for the UI services. To view the EULA visit: https://github.com/absmach/eula
MG_UI_DOCKER_ACCEPT_EULA=no
MG_UI_DOCKER_ACCEPT_EULA=yes
OTEL_SERVICE_NAME=ui-mg
OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4318
@@ -715,20 +699,22 @@ MG_UI_BACKEND_DB_SSL_KEY=
MG_UI_BACKEND_DB_SSL_ROOT_CERT=
## UI
MG_AUTH_URL=http://auth:9001
MG_DOMAINS_URL=http://domains:9003
MG_USERS_URL=http://users:9002
MG_CLIENTS_URL=http://clients:9006
MG_CHANNELS_URL=http://channels:9005
MG_GROUPS_URL=http://groups:9004
MG_AUTH_URL=http://nginx:80/auth
MG_ATOM_URL=http://nginx:80
MG_DOMAINS_URL=http://nginx:80/tenants
MG_USERS_URL=http://nginx:80/entities
MG_CLIENTS_URL=http://nginx:80/entities
MG_CHANNELS_URL=http://nginx:80/resources
MG_GROUPS_URL=http://nginx:80/groups
MG_BOOTSTRAP_URL=http://bootstrap:9013
MG_CERTS_URL=http://certs:9019
MG_HTTP_ADAPTER_URL=http://nginx:80/http
MG_PUBLISH_PROXY_URL=http://nginx:80
MG_READER_URL=http://timescale-reader:9011
MG_JOURNAL_URL=http://journal:9021
### UI Configuration
MG_UI_TYPE=mg
MG_UI_CLIENT_TYPE=client
MG_UI_BASE_PATH=/
MG_NEXTAUTH_BASE_PATH=/api/auth
NEXTAUTH_SECRET=4WdW0Z0tAOyQ/ZAI3YLVV/wNu+yUZXBLDDQ3AGrgfJ4=