OIDC functional

.drone.yml

@@ -38,6 +38,7 @@ steps:
     - cd moneymgr_backend
     - rustup component add clippy
     - cargo clippy -- -D warnings
+    - cargo clippy --example api_curl -- -D warnings
 
 - name: backend_test
   image: rust
@@ -51,7 +52,7 @@ steps:
     - cargo test
 
 
-- name: backend_compile
+- name: backend_build
   image: rust
   volumes:
   - name: rust_registry
@@ -67,15 +68,16 @@ steps:
   - cd moneymgr_backend
   - mv /tmp/web_build/dist static
   - cargo build --release
-  - ls -lah target/release/moneymgr_backend
-  - cp target/release/moneymgr_backend /tmp/release
+  - cargo build --release --example api_curl
+  - ls -lah target/release/moneymgr_backend target/release/examples/api_curl
+  - cp target/release/moneymgr_backend target/release/examples/api_curl /tmp/release
 
 
 # Release
 - name: gitea_release
   image: plugins/gitea-release
   depends_on:
-  - backend_compile
+  - backend_build
   when:
     event:
       - tag

README.md

@@ -3,10 +3,46 @@
 
 Open Source web-based personal expenses tool.
 
+**Note :** This project does not handle authentication itself. Instead, it relies on OpenID to achieve users authentication.
+
+## Setup prod env
+1. Install prerequisites:
+   1. docker
+   2. docker compose
+   3. git
+
+2. Clone this git repository:
+```bash
+git clone https://gitea.communiquons.org/pierre/MoneyMgr
+cd MoneyMgr/docker_prod
+```
+
+3. Copy and adapt env values
+```bash
+cp .env.sample .env
+nano .env
+```
+
+4. Create required directories:
+
+```bash
+mkdir -p storage/{db,redis-data,redis-conf,minio}
+```
+
+5. Start containers
+
+```bash
+docker compose up
+```
+
+6. Checkout http://localhost:8000/
+
+> The default credentials are `admin` / `admin`
+
 ## Setup dev env
 1. Install prerequisites:
    1. docker
-   2. docker-compose
+   2. docker compose
    3. rust
    4. node
 

docker_prod/.env.sample

@@ -0,0 +1,10 @@
+MINIO_ROOT_USER=rootuser
+MINIO_ROOT_PASSWORD=rootpassword
+DB_USER=db_user
+DB_PASSWORD=db_password
+REDIS_PASS=redis_password
+WEBSITE_ORIGIN=http://localhost:8000
+APP_SECRET=secretsecretsecretsecretsecretsecretsecretsecretsecretsecretsecret
+AUTH_SECRET_KEY=secretsecretsecretsecretsecretsecretsecretsecretsecretsecretsecret
+OIDC_CLIENT_ID=bar
+OIDC_CLIENT_SECRET=foo

docker_prod/.gitignore

@@ -0,0 +1,3 @@
+.env
+storage
+auth/users.json

docker_prod/auth/clients.yaml

@@ -0,0 +1,5 @@
+- id: ${OIDC_CLIENT_ID}
+  name: MoneyMgr
+  description: Money management tool
+  secret: ${OIDC_CLIENT_SECRET}
+  redirect_uri: ${APP_ORIGIN}/oidc_cb

docker_prod/docker-compose.yml

@@ -0,0 +1,79 @@
+services:
+  minio:
+    image: minio/minio
+    user: "1000"
+    environment:
+      - MINIO_ROOT_USER=$MINIO_ROOT_USER
+      - MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD
+    volumes:
+      - ./storage/minio:/data
+    command: [ "minio", "server", "/data", "--console-address", ":9090" ]
+    ports:
+      - 9000:9000
+      - 9090:9090
+    expose:
+      - 9000
+
+  db:
+    image: postgres
+    user: "1000"
+    ports:
+      - "5432:5432"
+    expose:
+      - 5432
+    environment:
+      - POSTGRES_USER=$DB_USER
+      - POSTGRES_PASSWORD=$DB_PASSWORD
+      - POSTGRES_DB=moneymgr
+    volumes:
+      - ./storage/db:/var/lib/postgresql/data
+
+  oidc:
+    image: pierre42100/basic_oidc
+    user: "1000"
+    environment:
+      - LISTEN_ADDRESS=0.0.0.0:9001
+      - STORAGE_PATH=/storage
+      - TOKEN_KEY=$AUTH_SECRET_KEY
+      - WEBSITE_ORIGIN=http://localhost:9001
+      - OIDC_CLIENT_ID=$OIDC_CLIENT_ID
+      - OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET
+      - APP_ORIGIN=$WEBSITE_ORIGIN
+    expose:
+      - 9001
+    ports:
+      - 9001:9001
+    volumes:
+      - ./auth:/storage
+
+  redis:
+    image: redis:alpine
+    user: "1000"
+    command: redis-server --requirepass ${REDIS_PASS:-secretredis}
+    expose:
+      - 6379
+    volumes:
+      - ./storage/redis-data:/data
+      - ./storage/redis-conf:/usr/local/etc/redis/redis.conf
+
+  moneymgr:
+    image: pierre42100/moneymgr_backend
+    user: "1000"
+    ports:
+      - 8000:8000
+    environment:
+      - WEBSITE_ORIGIN=${WEBSITE_ORIGIN}
+      - SECRET=${APP_SECRET}
+      - DB_HOST=db
+      - DB_USERNAME=$DB_USER
+      - DB_PASSWORD=$DB_PASSWORD
+      - DB_NAME=moneymgr
+      - OIDC_CONFIGURATION_URL=http://oidc:9001/.well-known/openid-configuration
+      - OIDC_PROVIDER_NAME=OIDC
+      - OIDC_CLIENT_ID=$OIDC_CLIENT_ID
+      - OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET
+      - S3_ENDPOINT=http://minio:9000
+      - S3_ACCESS_KEY=$MINIO_ROOT_USER
+      - S3_SECRET_KEY=$MINIO_ROOT_PASSWORD
+      - REDIS_HOSTNAME=redis
+      - REDIS_PASSWORD=${REDIS_PASS:-secretredis}

moneymgr_backend/examples/api_curl.rs

@@ -14,7 +14,7 @@ use std::process::Command;
 struct Args {
     /// URL to Money manager API
     #[arg(short('U'), long, env, default_value = "http://localhost:8000/api")]
-    matrix_gw_url: String,
+    moneymgr_url: String,
 
     /// Token ID
     #[arg(short('i'), long, env)]
@@ -39,7 +39,8 @@ struct Args {
 fn main() {
     let args: Args = Args::parse();
 
-    let full_url = format!("{}{}", args.matrix_gw_url, args.uri);
+    let full_url = format!("{}{}", args.moneymgr_url, args.uri);
+
     log::debug!("Full URL: {full_url}");
 
     let key = HS256Key::from_bytes(args.token_secret.as_bytes());

moneymgr_web/package-lock.json

@@ -30,7 +30,7 @@
         "ts-pattern": "^5.7.0"
       },
       "devDependencies": {
-        "@eslint/js": "^9.27.0",
+        "@eslint/js": "^9.26.0",
         "@types/react": "^19.1.4",
         "@types/react-dom": "^19.1.5",
         "@vitejs/plugin-react": "^4.4.1",
@@ -1145,16 +1145,13 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.27.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.27.0.tgz",
-      "integrity": "sha512-G5JD9Tu5HJEu4z2Uo4aHY2sLV64B7CDMXxFzqzjl3NKd6RVzSXNoE80jk7Y0lJkTTkjiIhBAqmlYwjuBY3tvpA==",
+      "version": "9.26.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.26.0.tgz",
+      "integrity": "sha512-I9XlJawFdSMvWjDt6wksMCrgns5ggLNfFwFvnShsleWruvXM514Qxk8V246efTw+eo9JABvVz+u3q2RiAowKxQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
       }
     },
     "node_modules/@eslint/object-schema": {
@@ -3497,16 +3494,6 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/eslint/node_modules/@eslint/js": {
-      "version": "9.26.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.26.0.tgz",
-      "integrity": "sha512-I9XlJawFdSMvWjDt6wksMCrgns5ggLNfFwFvnShsleWruvXM514Qxk8V246efTw+eo9JABvVz+u3q2RiAowKxQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
     "node_modules/espree": {
       "version": "10.3.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-10.3.0.tgz",

moneymgr_web/package.json

@@ -32,7 +32,7 @@
     "ts-pattern": "^5.7.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.27.0",
+    "@eslint/js": "^9.26.0",
     "@types/react": "^19.1.4",
     "@types/react-dom": "^19.1.5",
     "@vitejs/plugin-react": "^4.4.1",