OIDC functional

.drone.yml

@@ -38,6 +38,7 @@ steps:
     - cd moneymgr_backend
     - rustup component add clippy
     - cargo clippy -- -D warnings
+    - cargo clippy --example api_curl -- -D warnings
 
 - name: backend_test
   image: rust
@@ -51,7 +52,7 @@ steps:
     - cargo test
 
 
-- name: backend_compile
+- name: backend_build
   image: rust
   volumes:
   - name: rust_registry
@@ -67,15 +68,16 @@ steps:
   - cd moneymgr_backend
   - mv /tmp/web_build/dist static
   - cargo build --release
-  - ls -lah target/release/moneymgr_backend
+  - cargo build --release --example api_curl
-  - cp target/release/moneymgr_backend /tmp/release
+  - ls -lah target/release/moneymgr_backend target/release/examples/api_curl
+  - cp target/release/moneymgr_backend target/release/examples/api_curl /tmp/release
 
 
 # Release
 - name: gitea_release
   image: plugins/gitea-release
   depends_on:
-  - backend_compile
+  - backend_build
   when:
     event:
       - tag

README.md

@@ -3,10 +3,46 @@
 
 Open Source web-based personal expenses tool.
 
+**Note :** This project does not handle authentication itself. Instead, it relies on OpenID to achieve users authentication.
+
+## Setup prod env
+1. Install prerequisites:
+   1. docker
+   2. docker compose
+   3. git
+
+2. Clone this git repository:
+```bash
+git clone https://gitea.communiquons.org/pierre/MoneyMgr
+cd MoneyMgr/docker_prod
+```
+
+3. Copy and adapt env values
+```bash
+cp .env.sample .env
+nano .env
+```
+
+4. Create required directories:
+
+```bash
+mkdir -p storage/{db,redis-data,redis-conf,minio}
+```
+
+5. Start containers
+
+```bash
+docker compose up
+```
+
+6. Checkout http://localhost:8000/
+
+> The default credentials are `admin` / `admin`
+
 ## Setup dev env
 1. Install prerequisites:
    1. docker
-   2. docker-compose
+   2. docker compose
    3. rust
    4. node
 

docker_prod/.env.sample

@@ -0,0 +1,10 @@
+MINIO_ROOT_USER=rootuser
+MINIO_ROOT_PASSWORD=rootpassword
+DB_USER=db_user
+DB_PASSWORD=db_password
+REDIS_PASS=redis_password
+WEBSITE_ORIGIN=http://localhost:8000
+APP_SECRET=secretsecretsecretsecretsecretsecretsecretsecretsecretsecretsecret
+AUTH_SECRET_KEY=secretsecretsecretsecretsecretsecretsecretsecretsecretsecretsecret
+OIDC_CLIENT_ID=bar
+OIDC_CLIENT_SECRET=foo

docker_prod/.gitignore

@@ -0,0 +1,3 @@
+.env
+storage
+auth/users.json

docker_prod/auth/clients.yaml

@@ -0,0 +1,5 @@
+- id: ${OIDC_CLIENT_ID}
+  name: MoneyMgr
+  description: Money management tool
+  secret: ${OIDC_CLIENT_SECRET}
+  redirect_uri: ${APP_ORIGIN}/oidc_cb

docker_prod/docker-compose.yml

@@ -0,0 +1,79 @@
+services:
+  minio:
+    image: minio/minio
+    user: "1000"
+    environment:
+      - MINIO_ROOT_USER=$MINIO_ROOT_USER
+      - MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD
+    volumes:
+      - ./storage/minio:/data
+    command: [ "minio", "server", "/data", "--console-address", ":9090" ]
+    ports:
+      - 9000:9000
+      - 9090:9090
+    expose:
+      - 9000
+
+  db:
+    image: postgres
+    user: "1000"
+    ports:
+      - "5432:5432"
+    expose:
+      - 5432
+    environment:
+      - POSTGRES_USER=$DB_USER
+      - POSTGRES_PASSWORD=$DB_PASSWORD
+      - POSTGRES_DB=moneymgr
+    volumes:
+      - ./storage/db:/var/lib/postgresql/data
+
+  oidc:
+    image: pierre42100/basic_oidc
+    user: "1000"
+    environment:
+      - LISTEN_ADDRESS=0.0.0.0:9001
+      - STORAGE_PATH=/storage
+      - TOKEN_KEY=$AUTH_SECRET_KEY
+      - WEBSITE_ORIGIN=http://localhost:9001
+      - OIDC_CLIENT_ID=$OIDC_CLIENT_ID
+      - OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET
+      - APP_ORIGIN=$WEBSITE_ORIGIN
+    expose:
+      - 9001
+    ports:
+      - 9001:9001
+    volumes:
+      - ./auth:/storage
+
+  redis:
+    image: redis:alpine
+    user: "1000"
+    command: redis-server --requirepass ${REDIS_PASS:-secretredis}
+    expose:
+      - 6379
+    volumes:
+      - ./storage/redis-data:/data
+      - ./storage/redis-conf:/usr/local/etc/redis/redis.conf
+
+  moneymgr:
+    image: pierre42100/moneymgr_backend
+    user: "1000"
+    ports:
+      - 8000:8000
+    environment:
+      - WEBSITE_ORIGIN=${WEBSITE_ORIGIN}
+      - SECRET=${APP_SECRET}
+      - DB_HOST=db
+      - DB_USERNAME=$DB_USER
+      - DB_PASSWORD=$DB_PASSWORD
+      - DB_NAME=moneymgr
+      - OIDC_CONFIGURATION_URL=http://oidc:9001/.well-known/openid-configuration
+      - OIDC_PROVIDER_NAME=OIDC
+      - OIDC_CLIENT_ID=$OIDC_CLIENT_ID
+      - OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET
+      - S3_ENDPOINT=http://minio:9000
+      - S3_ACCESS_KEY=$MINIO_ROOT_USER
+      - S3_SECRET_KEY=$MINIO_ROOT_PASSWORD
+      - REDIS_HOSTNAME=redis
+      - REDIS_PASSWORD=${REDIS_PASS:-secretredis}

moneymgr_backend/Cargo.toml

@@ -27,7 +27,7 @@ light-openid = "1.0.4"
 rand = "0.9.1"
 ipnet = { version = "2.11.0", features = ["serde"] }
 lazy-regex = "3.4.1"
-jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
+jwt-simple = { version = "0.12.11", default-features = false, features = ["pure-rust"] }
 mime_guess = "2.0.5"
 rust-embed = { version = "8.7.2" }
 sha2 = "0.11.0-pre.5"

moneymgr_backend/examples/api_curl.rs

@@ -14,7 +14,7 @@ use std::process::Command;
 struct Args {
     /// URL to Money manager API
     #[arg(short('U'), long, env, default_value = "http://localhost:8000/api")]
-    matrix_gw_url: String,
+    moneymgr_url: String,
 
     /// Token ID
     #[arg(short('i'), long, env)]
@@ -39,7 +39,8 @@ struct Args {
 fn main() {
     let args: Args = Args::parse();
 
-    let full_url = format!("{}{}", args.matrix_gw_url, args.uri);
+    let full_url = format!("{}{}", args.moneymgr_url, args.uri);
+
     log::debug!("Full URL: {full_url}");
 
     let key = HS256Key::from_bytes(args.token_secret.as_bytes());