Skip to content

Latest commit

 

History

History
146 lines (95 loc) · 7.45 KB

operational-environment.md

File metadata and controls

146 lines (95 loc) · 7.45 KB
Raw

Operational Environment

To run the Raido codebase in a non-AWS environment, you would need to consider how to provide equivalent services for each of the sections outlined below.

The below sections were mapped directly from the
raid-architecture.md.

ARDC RAiD Service environment in AWS

DNS

TLS certificates

External sign-in services

Raido uses Single sign-on. Raido is designed to use identity services OAuth2 / OIDC to allow users to sign-in with pre-existing credentials.
Note that Raido currently implements no direct sign-in method (i.e. storing username/email/password data in our DB).

Currently, we authenticate uses with the following providers:

Each of these authentication methods requires an agreement between the Relying Party (i.e. ARDC) and the Identity Provider.

See /doc/security/access-control/authentication for more detail about how sign-in and acess-control works.

app-client - front-end web server

The app-client is a React "Single Page App", built as a purely static set of files to be loaded by the web browser. It doesn't need much from the web server beyond just serving the static files and taking care of TLS.

Load balancing

Front-end Load balancing is completely encapsulated by the CloudFront service. CloudFront handles caching of files local to the end-user (if configured) and handles all routing of user traffic.

We also have some rules set up so that the CloudFront instances forward API traffic to the api-svc load balancer. This is not necessary (and incurs cost at the Cloudfront/networking level), but it removes the need for the browser to send pre-flight CORS requests.

See https://github.com/au-research/raido-v2-aws-private/blob/fd26c55ab476533e6c3d9c2cd6f712046b101ba1/raido-root/lib/prod/app-client/AppClientCloudFront.ts#L53

api-svc - back-end API service

Raido is a Java/Spring API server. It is completely stateless, designed for horizontal scalability.

Load balancing

We use AWS ALB in combination with ECS for routing API traffic to api-svc containers running in ECS.

External PID services

Currently, the api-svc validates PIDs (ORCID, ROR, DOI) with external services, but it does so using only publicly available HTTP endpoints that do not require authentication.

There are currently no API keys or other accounts/credentials that need to be set up to allow this.

Though the api-svc does requires network access to the internet so that http/https requests can be made.

Local Handle Service

We currently use the ARDC APIDS service for minting handles. It is operated in an "on-premises" fashion, on ARDC hardware and network services, by the ARDC DevOps team (separate from the Raid team).

Database

Postgres 15 database server operated by AWS RDS.

Log management and observability

The ECS task definition is configured to send logs to AWS Cloudwatch.

Metrics

Secrets management