Updated docker build to create relevant postgres databases #62
Conversation
A sql init script is used for creating the keycloak and shlp database and users with correct permissions
WalkthroughThe pull request introduces significant updates across multiple configuration files, primarily focusing on the Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
BMartinos
requested review from
amaechichisom,
jacob-khoza-symb and
yassinedorbozgithub
| CREATE USER keycloak_user WITH PASSWORD 'keycloak_password'; | ||
| GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak_user; | ||
|
|
||
| CREATE USER shlp_user WITH PASSWORD 'shlp_password' CREATEDB; -- Primsa requires db create permission |
There was a problem hiding this comment.
Note: Ive hard coded the user passwords for now just to verify this works. These ideally need to be injected as variables configured via env
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Outside diff range and nitpick comments (2)
docker/init.sql (2)
1-3: Consider addingIF NOT EXISTSclause to handle existing databases.To prevent errors when running the script multiple times, consider adding the
IF NOT EXISTSclause to theCREATE DATABASEstatements. This will ensure that the databases are only created if they don't already exist.Apply this diff to add the
IF NOT EXISTSclause:-- Create databases if they don't exist -CREATE DATABASE keycloak; -CREATE DATABASE shlp; +CREATE DATABASE IF NOT EXISTS keycloak; +CREATE DATABASE IF NOT EXISTS shlp;
5-7: LGTM! Consider the principle of least privilege.The code segment correctly creates the
keycloak_userand grants the necessary privileges. However, consider applying the principle of least privilege and only granting the specific privileges that the user requires to perform their intended tasks. This helps to minimize potential security risks.
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (6)
- .env (1 hunks)
- .env.example (1 hunks)
- .env.production.example (1 hunks)
- docker-compose.yml (3 hunks)
- docker/init.sql (1 hunks)
- import/config/shlp/shlp-realm.json (1 hunks)
Additional comments not posted (39)
docker/init.sql (2)
9-10: LGTM!The code segment correctly creates the
shlp_userwith the necessary permissions and grants the required privileges on theshlpdatabase. TheCREATEDBpermission is appropriately justified by the comment.
12-14: LGTM!Changing the ownership of the databases to their respective users is a good practice. It ensures that the users have the necessary control over their databases and complements the previous segments by assigning the appropriate ownership.
.env.production.example (5)
4-4: Reminder: Set the value ofEXTERNAL_URL.Please ensure that you provide a valid URL for the
EXTERNAL_URLvariable before deploying the application to production.
11-13: LGTM! Remember to set the values for Keycloak PostgreSQL variables.The addition of
KEYCLOAK_POSTGRES_DB,KEYCLOAK_POSTGRES_USER, andKEYCLOAK_POSTGRES_PASSWORDvariables aligns with the PR objective of creating relevant PostgreSQL databases. Please ensure that you provide valid values for these variables before deploying the application to production.
18-19: Reminder: Set the value ofNEXT_LOCAL_KEYCLOAK_URL.Please ensure that you provide a valid URL for the
NEXT_LOCAL_KEYCLOAK_URLvariable before running the application locally.
20-23: LGTM! Remember to set the values for SHLP PostgreSQL variables.The addition of
SHLP_POSTGRES_HOST,SHLP_POSTGRES_DB,SHLP_POSTGRES_USERNAME, andSHLP_POSTGRES_PASSWORDvariables aligns with the PR objective of creating relevant PostgreSQL databases. Please ensure that you provide valid values for these variables before deploying the application to production.
24-26: LGTM! Remember to set the values for Prisma encryption variables.The
POSTGRES_PRISMA_URLvariable is correctly set using the SHLP PostgreSQL variables. The addition ofPRISMA_FIELD_ENCRYPTION_KEYandPRISMA_FIELD_ENCRYPTION_HASH_SALTvariables suggests enhanced security measures for data encryption. Please ensure that you provide valid values for these encryption variables before deploying the application to production..env (10)
9-9: LGTM!Using a placeholder value for the
KEYCLOAK_CLIENT_SECRETis a good practice to avoid exposing sensitive information. Ensure that the actual value is set in the deployment environment.
10-10: LGTM!The
KEYCLOAK_ISSUERURL has been updated to match the Keycloak service configuration in thedocker-compose.ymlfile.
11-13: LGTM!The new environment variables for Keycloak's PostgreSQL database configuration align with the Keycloak service configuration in the
docker-compose.ymlfile. Using a separate database for Keycloak is a good practice to isolate its data from other application data.
16-16: LGTM!Using a placeholder value for the
NEXTAUTH_SECRETis a good practice to avoid exposing sensitive information. Ensure that the actual value is set in the deployment environment.
17-17: LGTM!The
NEXT_CONTAINER_KEYCLOAK_ENDPOINTURL has been updated to use the Keycloak service name instead of localhost. This allows the Next.js container to communicate with the Keycloak container within the Docker network.
18-18: LGTM!The
NEXT_LOCAL_KEYCLOAK_URLhas been updated to match the Keycloak service configuration in thedocker-compose.ymlfile. This URL is used for local development to access the Keycloak service from the host machine.
20-23: LGTM!The new environment variables for the SHLP application's PostgreSQL database configuration align with the PostgreSQL service configuration in the
docker-compose.ymlfile. Using a separate database for the SHLP application is a good practice to isolate its data from other application data.
24-24: LGTM!The
POSTGRES_PRISMA_URLis constructed using the SHLP application's PostgreSQL database configuration variables. This ensures that the URL is always in sync with the database configuration.
25-25: LGTM!Using a placeholder value for the
PRISMA_FIELD_ENCRYPTION_KEYis a good practice to avoid exposing sensitive information. Ensure that the actual value is set in the deployment environment.
26-26: LGTM!Using a placeholder value for the
PRISMA_FIELD_ENCRYPTION_HASH_SALTis a good practice to avoid exposing sensitive information. Ensure that the actual value is set in the deployment environment..env.example (16)
1-1: LGTM!Using the default database name
postgresis a common practice in development environments.
2-2: LGTM!Using the default database user
postgresis a common practice in development environments.
3-3: Reminder: Use a secure password in production.Using the default database password
postgresin a development environment is acceptable. However, ensure that a secure password is used in production environments.
4-4: LGTM!Setting the
EXTERNAL_URLto a local URL is appropriate for a development environment.
9-9: Reminder: Use a secure client secret in production.Using a placeholder value for the
KEYCLOAK_CLIENT_SECRETis acceptable in a development environment. However, ensure that a secure secret is used in production environments.
11-11: LGTM!Using a separate database for Keycloak is a good practice.
12-12: LGTM!Using a separate user for Keycloak is a good practice.
13-13: Reminder: Use a secure password for Keycloak in production.Using a placeholder password for Keycloak in a development environment is acceptable. However, ensure that a secure password is used in production environments.
16-16: Reminder: Use a secure NextAuth secret in production.Using a placeholder value for the
NEXTAUTH_SECRETis acceptable in a development environment. However, ensure that a secure secret is used in production environments.
20-20: LGTM!Using the
postgresservice as the database host is appropriate in a Docker environment.
21-21: LGTM!Using a separate database for the SHLP application is a good practice.
22-22: LGTM!Using a separate user for the SHLP application is a good practice.
23-23: Reminder: Use a secure password for the SHLP application in production.Using a placeholder password for the SHLP application in a development environment is acceptable. However, ensure that a secure password is used in production environments.
24-24: LGTM!Using environment variables to construct the Prisma database connection URL is a good practice. The connection URL follows the correct format for a PostgreSQL connection string.
25-25: Reminder: Use a secure Prisma field encryption key in production.Using a placeholder value for the
PRISMA_FIELD_ENCRYPTION_KEYis acceptable in a development environment. However, ensure that a secure key is used in production environments.
26-26: Reminder: Use a secure Prisma field encryption hash salt in production.Using a placeholder value for the
PRISMA_FIELD_ENCRYPTION_HASH_SALTis acceptable in a development environment. However, ensure that a secure salt is used in production environments.docker-compose.yml (5)
16-16: LGTM!The port mapping change simplifies the service access by aligning the external and internal ports.
29-29: LGTM!The addition of the SQL initialization script enhances the database setup process within the Docker container.
55-55: LGTM!The port mapping change simplifies the service access by aligning the external and internal ports for Keycloak.
51-51: Verify the environment variable change in the configuration files.The change in the database URL environment variable for Keycloak aligns with a more modular database configuration. However, ensure that the
KEYCLOAK_POSTGRES_DBvariable is correctly defined and used consistently across the configuration files.Run the following script to verify the environment variable usage:
Verification successful
Environment variable change verified and approved
The
KEYCLOAK_POSTGRES_DBenvironment variable is correctly defined in the.envfile and properly used in thedocker-compose.ymlfile. This change maintains consistency across the configuration files and allows for flexible database naming.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the usage of `KEYCLOAK_POSTGRES_DB` environment variable. # Test: Search for the variable definition. Expect: Occurrences in the configuration files. rg --type-add 'config:*.{env,yml}' --type config $'KEYCLOAK_POSTGRES_DB'Length of output: 193
52-53: Verify the environment variable changes in the configuration files.The changes in the database username and password environment variables for Keycloak align with a more modular database configuration. However, ensure that the
KEYCLOAK_POSTGRES_USERandKEYCLOAK_POSTGRES_PASSWORDvariables are correctly defined and used consistently across the configuration files.Run the following script to verify the environment variable usage:
Verification successful
Environment variable changes verified and consistent
The
KEYCLOAK_POSTGRES_USERandKEYCLOAK_POSTGRES_PASSWORDenvironment variables are correctly defined in the.envfile and properly referenced in thedocker-compose.ymlfile. The usage is consistent across both configuration files, ensuring proper database authentication for Keycloak.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the usage of `KEYCLOAK_POSTGRES_USER` and `KEYCLOAK_POSTGRES_PASSWORD` environment variables. # Test: Search for the variable definitions. Expect: Occurrences in the configuration files. rg --type-add 'config:*.{env,yml}' --type config $'KEYCLOAK_POSTGRES_USER' rg --type-add 'config:*.{env,yml}' --type config $'KEYCLOAK_POSTGRES_PASSWORD'Length of output: 381
import/config/shlp/shlp-realm.json (1)
526-526: Replacing the hardcoded client secret is a good security practice.Sourcing sensitive configuration values like secrets from the environment is recommended to avoid exposing them in code repositories.
Please ensure that:
- The application code is updated to read the secret from the correct environment variable.
- The deployment process is updated to populate the environment variable with the actual secret value.
| KEYCLOAK_ADMIN=admin | ||
| KEYCLOAK_ADMIN_PASSWORD=password | ||
| KEYCLOAK_CLIENT_ID="nextjs" | ||
| KEYCLOAK_CLIENT_SECRET="gX0nfIp57bO3bY68br3kdTXung2Auwpr" | ||
| KEYCLOAK_ISSUER="http://localhost:8082/realms/shlp" | ||
| KEYCLOAK_CLIENT_SECRET="keycloak_client_secret" |
There was a problem hiding this comment.
Use a secure secret management solution for sensitive values.
Storing sensitive values like the Keycloak client secret directly in the .env file is not recommended, as it may lead to the secret being accidentally committed to version control.
Consider using a secure secret management solution, such as HashiCorp Vault or AWS Secrets Manager, to store and retrieve sensitive values.
| KEYCLOAK_POSTGRES_DB=keycloak | ||
| KEYCLOAK_POSTGRES_USER=keycloak_user | ||
| KEYCLOAK_POSTGRES_PASSWORD=keycloak_password | ||
|
|
There was a problem hiding this comment.
LGTM! Consider using a secure secret management solution for the database credentials.
The addition of dedicated PostgreSQL database configuration for Keycloak is a good practice, as it separates Keycloak's data from the main application database.
However, storing the database credentials directly in the .env file is not recommended. Consider using a secure secret management solution, such as HashiCorp Vault or AWS Secrets Manager, to store and retrieve the database credentials.
| NEXTAUTH_SECRET="nextauth_secret" | ||
| NEXT_CONTAINER_KEYCLOAK_ENDPOINT="http://keycloak:8080" | ||
| NEXT_LOCAL_KEYCLOAK_URL="http://localhost:8080" |
There was a problem hiding this comment.
Use a secure secret management solution for the NextAuth secret. The Keycloak endpoint update looks good!
The NEXTAUTH_SECRET value should not be stored directly in the .env file. Consider using a secure secret management solution, such as HashiCorp Vault or AWS Secrets Manager, to store and retrieve the secret value.
The update to NEXT_CONTAINER_KEYCLOAK_ENDPOINT to use the keycloak service name instead of localhost is correct, as it will be accessible within the Docker network.
| SHLP_POSTGRES_HOST=postgres | ||
| SHLP_POSTGRES_DB=shlp | ||
| SHLP_POSTGRES_USERNAME=shlp_user | ||
| SHLP_POSTGRES_PASSWORD=shlp_password | ||
| POSTGRES_PRISMA_URL=postgresql://${SHLP_POSTGRES_USERNAME}:${SHLP_POSTGRES_PASSWORD}@${SHLP_POSTGRES_HOST}:5432/${SHLP_POSTGRES_DB} |
There was a problem hiding this comment.
LGTM! Consider using a secure secret management solution for the database credentials.
The addition of dedicated PostgreSQL database configuration for the SHLP application is a good practice, as it separates the application's data from other databases.
However, storing the database credentials directly in the .env file is not recommended. Consider using a secure secret management solution, such as HashiCorp Vault or AWS Secrets Manager, to store and retrieve the database credentials.
| PRISMA_FIELD_ENCRYPTION_KEY=k1.aesgcm256.DbQoar8ZLuUsOHZNyrnjlskInHDYlzF3q6y1KGM7DUN= | ||
| PRISMA_FIELD_ENCRYPTION_HASH_SALT=0be97e77063ea3f7a0f128b06ef9b1eg |
There was a problem hiding this comment.
The Prisma PostgreSQL URL construction looks good! Consider using a secure secret management solution for the encryption key and hash salt.
The construction of the POSTGRES_PRISMA_URL using the SHLP database configuration is correct and will allow Prisma to connect to the dedicated SHLP database.
However, the PRISMA_FIELD_ENCRYPTION_KEY and PRISMA_FIELD_ENCRYPTION_HASH_SALT values are sensitive and should not be stored directly in the .env file. Consider using a secure secret management solution, such as HashiCorp Vault or AWS Secrets Manager, to store and retrieve these values.
A sql init script is used for creating the keycloak and shlp database and users with correct permissions
Summary by CodeRabbit
New Features
Bug Fixes
Documentation