feat(infra): Objecttypen API up in compose with a seeded static token (closes #139) (#142)

## What & why

S-18a, first of the S-18 (#19) split. Stands up the upstream Maykin **Objecttypen API** in the compose stack — the objecttype catalogue the register record (S-18b/S-18c, S-19) will build on.

Closes #139

### What

- **Compose** (main + local): `objecttypen-db` (Postgres), `objecttypen-redis`, `objecttypen-init` (RUN_SETUP_CONFIG → migrate + provision token), `objecttypen` web (health on `/admin/`, host `:8020`). Verbatim upstream image `maykinmedia/objecttypes-api` pinned to `3.4.2`.
- **Seed**: `infra/seed-config.sh objecttypen` streams `infra/objecttypen/setup_configuration/data.yaml` into the external `rr-objecttypen-config` volume — same pattern as OpenZaak/NRC. The data.yaml provisions a dev **static API token** (`tokenauth` setup_configuration step) so peers (Objecten, ACL) can authenticate.
- **Wiring**: added to `WAIT_SVCS`, `CFG_VOLS`, the `SEED` invocations, and the CI log-dump.
- **Smoke**: `verify-objecttypen` (`infra/run-objecttypen-check.sh` + `objecttypen-check.py`) asserts unauth → 401, token → 200; added as a verify-stack step + a row in the #136 check-summary table.

### Split note

#19 was oversized (two CG modules + config + objecttype) → split (§13) into **S-18a** (this), **S-18b** (#140, Objecten wired to Objecttypen), **S-18c** (#141, RegisterRecord objecttype).

## Verified locally (end to end, real compose)

Seeded + brought up the real `infra/docker-compose.yml` objecttypen chain: `objecttypen-init` ran setup_configuration (`token_configuration_success`), the web reached healthy, and `make verify-objecttypen` → **"OK — no-auth 401, token 200"**. YAML (both compose files + ci.yaml) + shell + python all validated.

## Definition of Done

- [x] Smoke check validates the outcome (live, against the running stack).
- [x] Conventional Commits referencing #139.
- [ ] CI green — see note.
- [x] `docker compose up` reaches health (objecttypen healthy on first poll locally).
- [x] Demo note in `docs/demo-script.md`.

## Note on CI

Additive (a new service + its own smoke step). The fast jobs are unaffected. The **verify-stack** job still can't go green until the pre-existing 1.27/act_runner-2.0.0 bring-up P0 is resolved (fails on plain `main` too) — but the objecttypen bring-up itself is validated locally above. No new ADR: this follows the established verbatim-image + seed-config CG-module pattern (ADR-0023-era).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #142

infra/docker-compose.local.yml

@@ -560,11 +560,73 @@ services:
         condition: service_started
     networks: [cg]
 
+  # ── Objecttypen API (S-18a) — bind-mounted config (local variant) ──────────
+  objecttypen-db:
+    image: docker.io/library/postgres:17-alpine
+    environment:
+      POSTGRES_USER: objecttypes
+      POSTGRES_PASSWORD: objecttypes
+      POSTGRES_DB: objecttypes
+    volumes:
+      - objecttypen-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecttypen-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecttypen-init:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: &objecttypen-env-local
+      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
+      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecttypen-db
+      DB_NAME: objecttypes
+      DB_USER: objecttypes
+      DB_PASSWORD: objecttypes
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecttypen-redis:6379/0
+      CACHE_AXES: objecttypen-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    volumes:
+      - ./objecttypen/setup_configuration:/app/setup_configuration:ro,z
+    depends_on:
+      objecttypen-db:
+        condition: service_healthy
+      objecttypen-redis:
+        condition: service_started
+    networks: [cg]
+
+  objecttypen:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: *objecttypen-env-local
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8020:8000"
+    depends_on:
+      objecttypen-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
 volumes:
   oz-db:
   nrc-db:
   flowable-db:
   projection-db:
+  objecttypen-db:
   # Carries the seed-generated acl.env (server-assigned zaaktype URLs) from local-seed to the ACL.
   seed-env:
 

infra/docker-compose.yml

@@ -569,6 +569,72 @@ services:
         condition: service_started
     networks: [cg]
 
+  # ── Objecttypen API (S-18a) — upstream Maykin image, verbatim ──────────────
+  # The register's objecttype catalogue. Same shape as the other CG modules: own DB + redis, an
+  # `-init` that runs setup_configuration (RUN_SETUP_CONFIG → migrate + provision a static API token)
+  # from the external config volume streamed in by infra/seed-config.sh, and a health-checked web
+  # service that depends on init completing.
+  objecttypen-db:
+    image: docker.io/library/postgres:17-alpine
+    environment:
+      POSTGRES_USER: objecttypes
+      POSTGRES_PASSWORD: objecttypes
+      POSTGRES_DB: objecttypes
+    volumes:
+      - objecttypen-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecttypen-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecttypen-init:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: &objecttypen-env
+      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
+      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecttypen-db
+      DB_NAME: objecttypes
+      DB_USER: objecttypes
+      DB_PASSWORD: objecttypes
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecttypen-redis:6379/0
+      CACHE_AXES: objecttypen-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
+    volumes:
+      - objecttypen-config:/app/setup_configuration:ro
+    depends_on:
+      objecttypen-db:
+        condition: service_healthy
+      objecttypen-redis:
+        condition: service_started
+    networks: [cg]
+
+  objecttypen:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: *objecttypen-env
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8020:8000"
+    depends_on:
+      objecttypen-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── Observability backplane (S-16a, ADR-0023) ──────────────────────────────
   # Grafana-native stack: Tempo ingests OTLP traces (the .NET services export
   # straight to it — no collector hop, S-16b), Prometheus scrapes service
@@ -618,6 +684,7 @@ volumes:
   nrc-db:
   flowable-db:
   projection-db:
+  objecttypen-db:
   # Config volumes — created and populated out-of-band by infra/seed-config.sh
   # (docker cp), because bind mounts don't reach sibling containers on the CI
   # runner. `external` keeps the names deterministic; the seed step manages them.
@@ -633,6 +700,9 @@ volumes:
   fl-bpmn:
     external: true
     name: rr-fl-bpmn
+  objecttypen-config:
+    external: true
+    name: rr-objecttypen-config
 
 networks:
   cg:

infra/objecttypen-check.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""S-18a (#139): prove the Objecttypen API is up and its static token authenticates.
+
+Assert an unauthenticated call to /api/v2/objecttypes is 401 and an authenticated one (the seeded
+dev token) is 200 — i.e. the service migrated, booted, and setup_configuration provisioned the token.
+Stdlib only so it runs in a bare python:3-slim container on the compose network.
+"""
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+
+BASE = os.environ["OBJECTTYPEN"]          # http://<ip>:8000
+TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
+TIMEOUT = int(os.environ.get("OBJECTTYPEN_TIMEOUT", "60"))
+
+
+def status(url, token=None):
+    req = urllib.request.Request(url)
+    if token:
+        req.add_header("Authorization", f"Token {token}")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+    except Exception:
+        return 0
+
+
+def main():
+    url = f"{BASE}/api/v2/objecttypes"
+    deadline = time.time() + TIMEOUT
+    while time.time() < deadline:
+        unauth = status(url)
+        authed = status(url, TOKEN)
+        if unauth == 401 and authed == 200:
+            print(f"OK — {url}: no-auth {unauth}, token {authed}")
+            return 0
+        time.sleep(3)
+    print(f"FAIL — {url}: expected no-auth 401 + token 200, got {status(url)} / {status(url, TOKEN)}",
+          file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

infra/objecttypen/setup_configuration/data.yaml

@@ -0,0 +1,11 @@
+# Objecttypen API setup_configuration (S-18a). Streamed into the external rr-objecttypen-config
+# volume by infra/seed-config.sh and applied by objecttypen-init (RUN_SETUP_CONFIG). Declarative +
+# idempotent. Dev-only static token so peers (Objecten S-18b, the ACL) can authenticate.
+tokenauth_config_enable: true
+tokenauth:
+  items:
+    - identifier: register-referentie
+      token: 0123456789abcdef0123456789abcdef01234567
+      contact_person: Register Referentie
+      email: admin@localhost
+      organization: Respellion

infra/run-objecttypen-check.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+#
+# S-18a (#139): assert the Objecttypen API is healthy + its static token authenticates, against an
+# ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack network (the
+# service is reached by container IP; the runner can't reach published ports — gitea-actions-gotchas.md
+# §5/§6). Does NOT manage the stack lifecycle.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The dev token provisioned by infra/objecttypen/setup_configuration/data.yaml.
+TOKEN="${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}"
+
+ot="$(docker ps -q --filter 'name=objecttypen' --filter 'health=healthy' | head -1)"
+[ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecttypen[-_]' | head -1)"
+[ -n "$ot" ] || { echo "ERROR: no running objecttypen container — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
+ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
+echo ">> network=$net objecttypen=$ip"
+
+cid="$(docker create --network "$net" \
+  -e "OBJECTTYPEN=http://$ip:8000" -e "OBJECTTYPEN_TOKEN=$TOKEN" \
+  -e "OBJECTTYPEN_TIMEOUT=${OBJECTTYPEN_TIMEOUT:-60}" \
+  python:3-slim python /objecttypen-check.py)"
+docker cp "$here/objecttypen-check.py" "$cid:/objecttypen-check.py" >/dev/null
+rc=0; docker start -a "$cid" || rc=$?
+docker rm -f "$cid" >/dev/null
+exit $rc

infra/seed-config.sh

@@ -33,7 +33,7 @@ populate() {  # volume  source(file or dir/.)
   echo "  seeded $vol"
 }
 
-[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
+[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl|objecttypen> ..." >&2; exit 2; }
 
 # The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
 # deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
@@ -49,6 +49,7 @@ for key in "$@"; do
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
+    objecttypen) populate rr-objecttypen-config "$here/objecttypen/setup_configuration/." ;;
     fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac