patrick/Polaris

Watch

Fork 0

PH0.1 — Compose base: db, LDAP, Keycloak realm, nginx, OSRM #3

New issue

Closed

opened 2026-09-11 09:02:07 +00:00 by bart · 2 comments

bart commented

2026-09-11 09:02:07 +00:00

Collaborator

Parent

Row PH0.1 in docs/12-implementation-plan.md (branch, owned paths and doc section are defined there).

What to build

A fresh clone runs docker compose up and gets PostgreSQL+PostGIS, OpenLDAP with five users in five groups (admin, planner, technician, viewer, ingest), a Keycloak realm federated to that LDAP (group → realm role, locale mapper, no realm-local users), nginx, and an OSRM service behind a profile. The api/worker/web services are declared but behind --profile app until PH0.2/PH0.5 land.

Acceptance criteria

docker compose up from a fresh clone brings db, openldap, keycloak and nginx to healthy
Logging in to Keycloak as each of the five LDAP users yields exactly the realm role of that user's LDAP group
polaris and keycloak databases exist with PostGIS enabled
Clients polaris-web (PKCE), polaris-api (bearer) and fleetpulse (client-credentials) exist in the realm
OSRM and pgadmin/phpldapadmin only start with their profiles; .env.example and root README document the startup

Blocked by

None (can start immediately)

## Parent Row **PH0.1** in `docs/12-implementation-plan.md` (branch, owned paths and doc section are defined there). ## What to build A fresh clone runs `docker compose up` and gets PostgreSQL+PostGIS, OpenLDAP with five users in five groups (admin, planner, technician, viewer, ingest), a Keycloak realm federated to that LDAP (group → realm role, locale mapper, no realm-local users), nginx, and an OSRM service behind a profile. The api/worker/web services are declared but behind `--profile app` until PH0.2/PH0.5 land. ## Acceptance criteria - [x] `docker compose up` from a fresh clone brings db, openldap, keycloak and nginx to healthy - [x] Logging in to Keycloak as each of the five LDAP users yields exactly the realm role of that user's LDAP group - [x] `polaris` and `keycloak` databases exist with PostGIS enabled - [x] Clients `polaris-web` (PKCE), `polaris-api` (bearer) and `fleetpulse` (client-credentials) exist in the realm - [x] OSRM and pgadmin/phpldapadmin only start with their profiles; `.env.example` and root README document the startup ## Blocked by - None (can start immediately)

bart added the

ready-for-agent

label

2026-09-11 09:02:07 +00:00

bart referenced this issue

2026-09-11 09:02:21 +00:00

PH0.4 — Keycloak auth: JWKS bearer validation, require_role, GET /me, LDAP smoke test #7

bart added a new dependency

2026-09-11 09:02:21 +00:00

#7 PH0.4 — Keycloak auth: JWKS bearer validation, require_role, GET /me, LDAP smoke test

bart referenced this issue

2026-09-11 09:02:21 +00:00

PH0.6 — CI pipeline: backend, frontend, generated-file freshness, single Alembic head, commitlint #8

bart added a new dependency

2026-09-11 09:02:21 +00:00

#8 PH0.6 — CI pipeline: backend, frontend, generated-file freshness, single Alembic head, commitlint

bart referenced this issue

2026-09-11 09:02:33 +00:00

PH6.1 — OSRM travel provider with cache, degraded health and W_TRAVEL_FALLBACK #42

bart added a new dependency

2026-09-11 09:02:33 +00:00

#42 PH6.1 — OSRM travel provider with cache, degraded health and W_TRAVEL_FALLBACK

bart referenced this issue

2026-09-11 09:02:34 +00:00

PH6.6 — Observability and production compose profile #47

bart added a new dependency

2026-09-11 09:02:35 +00:00

#47 PH6.6 — Observability and production compose profile

patrick commented

2026-09-11 09:42:10 +00:00

Owner

🚧 Started — session working this on branch feature/infra-compose-base (owns: infra/**, root README.md, .env.example), in an isolated worktree off main. Will tick acceptance criteria live as they are met and open a PR (Closes #3) when done.

🚧 Started — session working this on branch `feature/infra-compose-base` (owns: infra/**, root README.md, .env.example), in an isolated worktree off `main`. Will tick acceptance criteria live as they are met and open a PR (`Closes #3`) when done.

patrick self-assigned this

2026-09-11 09:45:08 +00:00

patrick started working

2026-09-11 09:45:08 +00:00

patrick stopped working

2026-09-11 09:45:08 +00:00

patrick referenced this issue from a commit

2026-09-11 10:01:09 +00:00

feat(infra): compose base with LDAP, Keycloak and OSRM profiles

patrick referenced this issue from a pull request that will close it,

2026-09-11 10:01:34 +00:00

feat(infra): compose base with LDAP, Keycloak and OSRM profiles #49

patrick commented

2026-09-11 10:02:08 +00:00

Owner

Implemented in #49 (feature/infra-compose-base). All acceptance criteria verified live (fresh docker compose up, down -v, and re-run from scratch — not just docker compose config): db/openldap/keycloak/nginx reach healthy automatically; a full LDAP sync imports all 5 users with 0 failures and each logs in with exactly their own realm role (checked by decoding the issued JWT, aud includes polaris-api); polaris/keycloak databases exist with postgis/postgis_topology enabled; polaris-web/polaris-api/fleetpulse clients all present with the right auth types; osrm/pgadmin/phpldapadmin/api/worker/web stay off without their profile flag.

Two things the ticket didn't foresee, both documented inline where they matter:

LDAP bootstrap can't use osixia's own custom-ldif mechanism as a straight bind mount. That image chowns then deletes each file under bootstrap/ldif/custom/ after importing it — fatal ("Device or resource busy") against a single bind-mounted file, and if you instead bind-mount the directory it silently deletes the real repo file from the host. Went with a one-shot ldap-init compose service that runs ldapadd -c against the running directory instead (idempotent: a second run just logs "already exists" per entry and still exits 0). Commented in docker-compose.yml.
docs/07-architecture.md's ${env.VAR} placeholders for the LDAP bind DN/password aren't something Keycloak's realm importer or plain LDIF actually resolve — that's envsubst-style templating neither format supports natively, and wiring up an entrypoint wrapper to do it felt like scope creep for M0. Went with fixed, clearly-commented dev-only credentials baked into bootstrap.ldif / realm-polaris.json instead (documented in infra/compose/.env.example and root README.md — same password for all five bootstrap users, fixed LDAP bind password, fixed fleetpulse client secret). Rotating these for anything beyond a local compose stack is a small follow-up, not blocking M0.

Also touched the root .gitignore (one line, infra/osrm/data/) since prepare.sh writes multi-GB extract/dataset files there and no infra/**-scoped ignore exists yet.

Implemented in #49 (`feature/infra-compose-base`). All acceptance criteria verified live (fresh `docker compose up`, `down -v`, and re-run from scratch — not just `docker compose config`): db/openldap/keycloak/nginx reach healthy automatically; a full LDAP sync imports all 5 users with 0 failures and each logs in with exactly their own realm role (checked by decoding the issued JWT, `aud` includes `polaris-api`); `polaris`/`keycloak` databases exist with `postgis`/`postgis_topology` enabled; `polaris-web`/`polaris-api`/`fleetpulse` clients all present with the right auth types; `osrm`/`pgadmin`/`phpldapadmin`/`api`/`worker`/`web` stay off without their profile flag. Two things the ticket didn't foresee, both documented inline where they matter: 1. **LDAP bootstrap can't use osixia's own custom-ldif mechanism as a straight bind mount.** That image chowns then deletes each file under `bootstrap/ldif/custom/` after importing it — fatal ("Device or resource busy") against a single bind-mounted file, and if you instead bind-mount the *directory* it silently deletes the real repo file from the host. Went with a one-shot `ldap-init` compose service that runs `ldapadd -c` against the running directory instead (idempotent: a second run just logs "already exists" per entry and still exits 0). Commented in `docker-compose.yml`. 2. **`docs/07-architecture.md`'s `${env.VAR}` placeholders for the LDAP bind DN/password aren't something Keycloak's realm importer or plain LDIF actually resolve** — that's envsubst-style templating neither format supports natively, and wiring up an entrypoint wrapper to do it felt like scope creep for M0. Went with fixed, clearly-commented **dev-only** credentials baked into `bootstrap.ldif` / `realm-polaris.json` instead (documented in `infra/compose/.env.example` and root `README.md` — same password for all five bootstrap users, fixed LDAP bind password, fixed `fleetpulse` client secret). Rotating these for anything beyond a local compose stack is a small follow-up, not blocking M0. Also touched the root `.gitignore` (one line, `infra/osrm/data/`) since `prepare.sh` writes multi-GB extract/dataset files there and no `infra/**`-scoped ignore exists yet.

patrick started working

2026-09-11 10:02:55 +00:00

patrick stopped working

2026-09-11 10:03:10 +00:00

15 seconds

patrick deleted spent time

2026-09-11 10:03:27 +00:00

patrick deleted spent time

2026-09-11 10:03:27 +00:00

- 15 seconds

bart referenced this issue from a commit

2026-09-11 10:14:39 +00:00