Skip to content

Commit ecb686b

Browse files
b-longb-long
committed
WIP: buf build
1 parent 579fd3f commit ecb686b

File tree

8 files changed

+290
-139
lines changed

8 files changed

+290
-139
lines changed

‎.github/workflows/build-golang-ubuntu-buf.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
fail-fast: true
1313
matrix:
1414
go-version: [1.24.x]
15-
python3_version: [ "3.11", "3.12" ]
15+
python3_version: [ "3.11", "3.12", "3.13" ]
1616

1717
steps:
1818
- uses: actions/checkout@v4
@@ -50,6 +50,6 @@ jobs:
5050

5151
- name: Build using 'uv_buf_build_script.sh'
5252
run: |
53-
cd build-scripts/
53+
cd buf-build/
5454
chmod +x ./uv_buf_build_script.sh
5555
./uv_buf_build_script.sh

‎.python-version‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎build-scripts/buf.gen.python.yaml‎ renamed to ‎buf-build/buf.gen.python.yaml‎

File renamed without changes.

‎build-scripts/setup.py‎ renamed to ‎buf-build/setup.py‎

File renamed without changes.

‎build-scripts/uv_buf_build_script.sh‎ renamed to ‎buf-build/uv_buf_build_script.sh‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ loud_print(){
1919

2020
# Based on: https://stackoverflow.com/a/246128
2121
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
22-
BUILD_ROOT="${SCRIPT_DIR}/buf-build"
22+
BUILD_ROOT="${SCRIPT_DIR}/buf-build-generated"
23+
TEST_ROOT="${SCRIPT_DIR}/buf-build-test"
2324

2425
# Cleanup previous builds
2526
rm -rf .venv-wheel/
2627
rm -rf .venv/
2728
rm -rf dist/
2829
rm -rf "${BUILD_ROOT}"
30+
rm -rf "${TEST_ROOT}"
2931

3032
mkdir -p "${BUILD_ROOT}" || { echo "Unable to create build root directory" ; exit 1; }
3133
cd "${BUILD_ROOT}" || { echo "Unable to change to build root directory" ; exit 1; }
@@ -86,3 +88,12 @@ echo "Directory contents:"
8688
ls -lart
8789
echo "Dist directory contents:"
8890
ls -lart dist/
91+
92+
93+
loud_print "Testing new wheel"
94+
95+
mkdir -p "${TEST_ROOT}" || { echo "Unable to create test root directory" ; exit 1; }
96+
cd "${TEST_ROOT}" || { echo "Unable to change to test root directory" ; exit 1; }
97+
uv venv .venv-wheel
98+
source "${TEST_ROOT}/.venv-wheel/bin/activate"
99+
uv pip install ${BUILD_ROOT}/dist/*.whl || { echo "Failed to install wheel" ; exit 1; }

‎build-scripts/docker-compose.yml‎

Lines changed: 276 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
name: opentdf
2+
volumes:
3+
configs:
4+
keys:
5+
caddy_data:
6+
configs:
7+
caddy_config:
8+
content: |
9+
{
10+
log {
11+
level INFO
12+
output stdout
13+
}
14+
}
15+
https://keycloak.opentdf.local:9443 {
16+
tls internal
17+
reverse_proxy keycloak:8888
18+
}
19+
https://platform.opentdf.local:8443 {
20+
tls internal
21+
reverse_proxy {
22+
to h2c://platform:8080
23+
transport http {
24+
versions h2c 2 1.1 # Enable gRPC proxying
25+
}
26+
}
27+
28+
}
29+
services:
30+
caddy:
31+
#image: cgr.dev/chainguard/caddy:latest-dev #@sha256:20e31e59503a775f28e7eb0d724384055236a35c52ff4e5aca6caac8390d61dc
32+
image: caddy:alpine
33+
command: ['caddy','run', '--config', '/etc/caddy/Caddyfile']
34+
configs:
35+
- source: caddy_config
36+
target: /etc/caddy/Caddyfile
37+
ports:
38+
- '9443:9443'
39+
- '8443:8443'
40+
volumes:
41+
- caddy_data:/data
42+
restart: unless-stopped
43+
healthcheck:
44+
test: ["CMD-SHELL", "wget -q --server-response --tries=1 http://127.0.0.1:2019/metrics 2>&1 | awk '/^ HTTP/{print $2}' | grep -q '200'"]
45+
interval: 5s
46+
timeout: 5s
47+
retries: 3
48+
check-certs:
49+
image: cgr.dev/chainguard/bash:latest@sha256:553a2674ec4f7d8a701873c1dcb43138f83e787ac1d17043cba0085ae3bd7038
50+
volumes:
51+
- type: volume
52+
source: caddy_data
53+
target: /etc/ssl/certs
54+
volume:
55+
subpath: caddy/certificates/local/keycloak.opentdf.local/
56+
command:
57+
- |
58+
echo "Checking certificates"
59+
ls -alh /etc/ssl/certs
60+
cat /etc/ssl/certs/keycloak.opentdf.local.crt
61+
depends_on:
62+
caddy:
63+
condition: service_healthy
64+
ensure-permissions:
65+
condition: service_completed_successfully
66+
ensure-permissions:
67+
image: alpine
68+
command:
69+
- 'sh'
70+
- '-c'
71+
- |
72+
chmod -R 665 /configs
73+
ls -alh /configs
74+
chmod -R 665 /keys
75+
ls -alh /keys
76+
chmod -R 665 /data
77+
ls -alh /data
78+
volumes:
79+
- configs:/configs
80+
- keys:/keys
81+
- caddy_data:/data
82+
83+
#================================================================
84+
85+
# Start Keycloak
86+
87+
#----------------------------------------------------------------
88+
keycloak:
89+
image: cgr.dev/chainguard/keycloak:latest@sha256:7e06ca655329cb8256ee2d226e32d48377a1d0e436de4fb10bdd428ed4848afa # 25.0.1
90+
restart: unless-stopped
91+
command: ['start-dev']
92+
environment:
93+
KC_DB: postgres
94+
KC_DB_URL_HOST: keycloak-db
95+
KC_DB_URL_PORT: 5432
96+
KC_DB_URL_DATABASE: keycloak
97+
KC_DB_USERNAME: postgres
98+
KC_DB_PASSWORD: changeme
99+
KC_HOSTNAME: '<https://keycloak.opentdf.local:9443>'
100+
KC_HOSTNAME_ADMIN: '<https://keycloak.opentdf.local:9443>'
101+
KC_HTTP_ENABLED: 'true'
102+
KC_HTTP_PORT: 8888
103+
KEYCLOAK_ADMIN: admin
104+
KEYCLOAK_ADMIN_PASSWORD: changeme
105+
KC_FEATURES: 'preview,token-exchange'
106+
KC_HEALTH_ENABLED: 'true'
107+
healthcheck:
108+
test: ['CMD-SHELL', '[ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { public static void main(String[] args) throws java.lang.Throwable { System.exit(java.net.HttpURLConnection.HTTP_OK == ((java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection()).getResponseCode() ? 0 : 1); } }" > /tmp/HealthCheck.java && java /tmp/HealthCheck.java http://localhost:9000/health/ready']
109+
interval: 5s
110+
timeout: 10s
111+
retries: 3
112+
start_period: 5m
113+
depends_on:
114+
keycloak-db:
115+
condition: service_healthy
116+
restart: true
117+
keycloak-db:
118+
image: cgr.dev/chainguard/postgres:latest@sha256:f359eed58238db0c9dc24b791e11b197e997e799eb42455f31099fc1492617e7
119+
restart: unless-stopped
120+
environment:
121+
POSTGRES_PASSWORD: changeme
122+
POSTGRES_USER: postgres
123+
POSTGRES_DB: keycloak
124+
healthcheck:
125+
test: ["CMD-SHELL", "pg_isready"]
126+
interval: 5s
127+
timeout: 5s
128+
retries: 10
129+
start_period: 2m
130+
download-keycloak-config:
131+
image: cgr.dev/chainguard/curl:latest-dev@sha256:8afd56d4c8692ddfdc0ed2b54da2d1e02c0946433cb318700645f9cd70ccdb3a
132+
volumes:
133+
- configs:/configs
134+
command: ['-o', '/configs/keycloak-config.yaml', 'https://raw.githubusercontent.com/opentdf/platform/main/service/cmd/keycloak_data.yaml']
135+
depends_on:
136+
ensure-permissions:
137+
condition: service_completed_successfully
138+
#================================================================
139+
140+
# Provisioning Keycloak with expected realm, clients, and users
141+
142+
#----------------------------------------------------------------
143+
keycloak-provisioning:
144+
image: registry.opentdf.io/platform:nightly
145+
volumes:
146+
- configs:/configs
147+
command:
148+
[
149+
'provision',
150+
'keycloak',
151+
'-e',
152+
'http://keycloak:8888',
153+
'-f',
154+
'/configs/keycloak-config.yaml',
155+
]
156+
depends_on:
157+
keycloak:
158+
condition: service_healthy
159+
restart: true
160+
download-keycloak-config:
161+
condition: service_completed_successfully
162+
restart: true
163+
#================================================================
164+
165+
# Start the OpenTDF service
166+
167+
#----------------------------------------------------------------
168+
download-platform-config:
169+
image: cgr.dev/chainguard/curl:latest-dev@sha256:8afd56d4c8692ddfdc0ed2b54da2d1e02c0946433cb318700645f9cd70ccdb3a
170+
volumes:
171+
- configs:/configs
172+
command: ['-o', '/configs/.opentdf.yaml', 'https://raw.githubusercontent.com/opentdf/platform/main/opentdf-dev.yaml']
173+
depends_on:
174+
ensure-permissions:
175+
condition: service_completed_successfully
176+
modify-platform-config:
177+
image: cgr.dev/chainguard/bash:latest@sha256:553a2674ec4f7d8a701873c1dcb43138f83e787ac1d17043cba0085ae3bd7038
178+
volumes:
179+
- configs:/configs
180+
command:
181+
- |
182+
echo "Modifying /configs/.opentdf.yaml"
183+
echo "$(</configs/.opentdf.yaml )"
184+
sed -i 's|kas-private.pem|/keys/kas-private.pem|g' /configs/.opentdf.yaml
185+
sed -i 's|kas-cert.pem|/keys/kas-cert.pem|g' /configs/.opentdf.yaml
186+
sed -i 's|kas-ec-private.pem|/keys/kas-ec-private.pem|g' /configs/.opentdf.yaml
187+
sed -i 's|kas-ec-cert.pem|/keys/kas-ec-cert.pem|g' /configs/.opentdf.yaml
188+
sed -i 's|# db:|db: |g' /configs/.opentdf.yaml
189+
sed -i 's|# host: localhost| host: |g' /configs/.opentdf.yaml
190+
sed -i 's|issuer: http://localhost:8888/auth/realms/opentdf|issuer: http://keycloak:8888/realms/opentdf|g' /configs/.opentdf.yaml
191+
sed -i 's|tokenendpoint: http://localhost:8888/auth/realms/opentdf/protocol/openid-connect/token|tokenendpoint: http://keycloak:8888/realms/opentdf/protocol/openid-connect/token|g' /configs/.opentdf.yaml
192+
sed -i 's|url: http://localhost:8888/auth|url: http://keycloak:8888|g' /configs/.opentdf.yaml
193+
echo "$(</configs/.opentdf.yaml )"
194+
depends_on:
195+
download-platform-config:
196+
condition: service_completed_successfully
197+
generate-kas-rsa-keys:
198+
image: alpine/openssl
199+
volumes:
200+
- keys:/keys
201+
entrypoint: ["/bin/sh", "-c"]
202+
command:
203+
- |
204+
echo "Generating RSA keys"
205+
openssl req -x509 -nodes -newkey RSA:2048 -subj "/CN=kas" -keyout /keys/kas-private.pem -out /keys/kas-cert.pem -days 365
206+
chmod 444 /keys/kas-private.pem
207+
chmod 444 /keys/kas-cert.pem
208+
depends_on:
209+
ensure-permissions:
210+
condition: service_completed_successfully
211+
generate-kas-ec-keys:
212+
image: alpine/openssl
213+
volumes:
214+
- keys:/keys
215+
entrypoint: ["/bin/sh", "-c"]
216+
command:
217+
- |
218+
echo "Generating EC keys"
219+
openssl ecparam -name secp256r1 -out /keys/secp256r1.pem && \
220+
openssl req -x509 -nodes -newkey ec:/keys/secp256r1.pem -subj "/CN=kas" -keyout /keys/kas-ec-private.pem -out /keys/kas-ec-cert.pem -days 365
221+
chmod 444 /keys/kas-ec-private.pem
222+
chmod 444 /keys/kas-ec-cert.pem
223+
depends_on:
224+
ensure-permissions:
225+
condition: service_completed_successfully
226+
platform:
227+
image: registry.opentdf.io/platform:nightly
228+
volumes:
229+
- configs:/configs
230+
- keys:/keys
231+
- type: volume
232+
source: caddy_data
233+
target: /etc/ssl/certs
234+
volume:
235+
subpath: caddy/certificates/local/keycloak.opentdf.local
236+
extra_hosts:
237+
- "keycloak.opentdf.local:host-gateway"
238+
command: ['start','--config-file','/configs/.opentdf.yaml','--config-key','opentdf']
239+
restart: always
240+
environment:
241+
OPENTDF_DB_HOST: platform-db
242+
OPENTDF_DB_USER: postgres
243+
OPENTDF_DB_PASSWORD: changeme2
244+
depends_on:
245+
keycloak:
246+
condition: service_healthy
247+
restart: true
248+
keycloak-provisioning:
249+
condition: service_completed_successfully
250+
platform-db:
251+
condition: service_healthy
252+
restart: true
253+
download-platform-config:
254+
condition: service_completed_successfully
255+
generate-kas-rsa-keys:
256+
condition: service_completed_successfully
257+
generate-kas-ec-keys:
258+
condition: service_completed_successfully
259+
modify-platform-config:
260+
condition: service_completed_successfully
261+
caddy:
262+
condition: service_healthy
263+
check-certs:
264+
condition: service_completed_successfully
265+
platform-db:
266+
image: cgr.dev/chainguard/postgres:latest@sha256:f359eed58238db0c9dc24b791e11b197e997e799eb42455f31099fc1492617e7
267+
restart: unless-stopped
268+
environment:
269+
POSTGRES_USER: postgres
270+
POSTGRES_PASSWORD: changeme
271+
POSTGRES_DB: opentdf
272+
healthcheck:
273+
test: ["CMD-SHELL", "pg_isready"]
274+
interval: 5s
275+
timeout: 5s
276+
retries: 10

‎setup.py‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

0 commit comments

Comments
 (0)