basic config

config/hydra/hydra.yml

@@ -0,0 +1,22 @@
+serve:
+  cookies:
+    same_site_mode: Lax
+
+urls:
+  self:
+    issuer: http://127.0.0.1:4444
+  consent: http://id.logidex.ru/consent
+  login: http://id.logidex.ru/login
+  logout: http://id.logidex.ru/logout
+
+secrets:
+  system:
+    - youReallyNeedToChangeThis
+
+oidc:
+  subject_identifiers:
+    supported_types:
+      - pairwise
+      - public
+    pairwise:
+      salt: youReallyNeedToChangeThis

config/nginx/nginx.conf

@@ -0,0 +1,58 @@
+upstream hydra_public_api {
+        server hydra:4444;
+        server hydra:4444;
+}
+upstream hydra_admin_api {
+        server hydra:4445;
+        server hydra:4445;
+}
+upstream frontend {
+    server front:3000;
+    server front:3000;
+}
+
+server {
+    listen 80;
+    server_name oauth2.logidex.ru;
+    location ~ ^/(admin|clients|keys|health|metrics|version|oauth2/auth/requests|oauth2/introspect|oauth2/flush)/? {
+      set $allow 0;
+      if ($remote_addr ~* "172.28.0.*") {
+        set $allow 1;
+      }
+      if ($arg_secret = "CHANGE-ME-INSECURE-PASSWORD") {
+        set $allow 1;
+      }
+      if ($allow = 0) {
+        return 403;
+      }
+
+      proxy_pass http://hydra_admin_api;
+      proxy_redirect    off;
+      proxy_set_header  Host               $host;
+      proxy_set_header  X-Real-IP          $remote_addr;
+      proxy_set_header  X-Forwarded-For    $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Proto  $http_x_forwarded_proto;
+    }
+
+    location ~ ^/(.well-known|oauth2/auth|oauth2/token|oauth2/sessions|oauth2/revoke|oauth2/fallbacks/consent|oauth2/fallbacks/error|userinfo)/? {
+          proxy_pass http://hydra_public_api;
+          proxy_redirect    off;
+          proxy_set_header  Host              $host;
+          proxy_set_header  X-Real-IP         $remote_addr;
+          proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+          proxy_set_header  X-Forwarded-Proto $http_x_forwarded_proto;
+    }
+}
+
+server {
+    listen 80;
+    server_name id.logidex.ru;
+
+    location / {
+        proxy_pass http://frontend;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

docker-compose.yml

@@ -0,0 +1,59 @@
+services:
+  hydra:
+    image: oryd/hydra:v2.3.0
+    command: serve -c /etc/config/hydra/hydra.yml all --dev
+    depends_on:
+      - hydra-migrate
+      - postgres
+    volumes:
+      - type: bind
+        source: ./config/hydra
+        target: /etc/config/hydra
+    networks:
+      - appnet
+    environment:
+      - DSN=postgres://hydra:secret@postgres:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
+  hydra-migrate:
+    image: oryd/hydra:v2.3.0
+    command: migrate -c /etc/config/hydra/hydra.yml sql up -e --yes
+    volumes:
+      - type: bind
+        source: ./config/hydra
+        target: /etc/config/hydra
+    networks:
+      - appnet
+    environment:
+      - DSN=postgres://hydra:secret@postgres:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
+    depends_on:
+      - postgres
+  nginx:
+    image: nginx:latest
+    volumes:
+      - type: bind
+        source: ./config/nginx/nginx.conf
+        target: /etc/nginx/conf.d/default.conf
+        read_only: true
+    ports:
+      - "80:80"
+      - "443:443"
+    depends_on:
+      - hydra
+      - front
+    networks:
+      - appnet
+  postgres:
+    image: postgres:17
+    environment:
+      - POSTGRES_USER=hydra
+      - POSTGRES_PASSWORD=secret
+      - POSTGRES_DB=hydra
+    networks:
+      - appnet
+  front:
+    image: git.logidex.ru/aserbin/logidex-id-frontend:latest
+    environment:
+      - NODE_ENV=production
+    networks:
+      - appnet
+networks:
+  appnet: