refactor(infra): use upstream images verbatim, seed config via docker cp (refs #30)

Drops the inline-build images for the upstream services. The compose now references the published images directly (openzaak/open-zaak, openzaak/open-notificaties, keycloak, curl, flowable-rest) with no build for them, and the config they need is streamed into external named volumes by infra/seed-config.sh: rr-oz-config -> oz-init /app/setup_configuration (data.yaml) rr-kc-realms -> keycloak /opt/keycloak/data/import (realm exports) rr-fl-bpmn -> flowable-init /work (registratie.bpmn) How: the seeder creates each volume, `docker create`s a throwaway helper that mounts it, `docker cp`s the files in, and removes it. docker cp streams over the Docker API, so it works in Docker-in-Docker (the CI runner) where bind mounts mount empty. It uses plain `docker create`/`cp` — NOT `docker compose create`, which podman-compose (local dev) lacks. `external: true` fixed names keep the volumes identical across docker compose and podman-compose. Consequence: bare `docker compose up` no longer self-seeds, so use `make up` (seeds then starts). Every `*-up` target seeds first; `*-down` removes the external volume. acl/bff are still built (they're our apps, not upstream images). Verified end-to-end on podman-compose: `make keycloak-up` seeds rr-kc-realms, the upstream Keycloak mounts it, and --import-realm imports all four realms (digid realm returns 200). Seeder runs in ~2s. Docs updated: gitea-actions-gotchas.md, ci.md, openzaak.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25 10:22:14 +02:00
parent 6d8e1d0830
commit b349dff496
9 changed files with 182 additions and 100 deletions
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -47,17 +47,7 @@ services:
    networks: [cg]

  oz-init:
-    # Derived image: base OpenZaak + the setup_configuration YAML baked in. We use
-    # an inline Dockerfile (not a separate file, not a bind mount) because bind
-    # mounts don't reach sibling containers on the containerized CI runner.
-    # The ${OPENZAAK_TAG} below is interpolated by Compose. See
-    # docs/runbooks/gitea-actions-gotchas.md.
-    build:
-      context: ./openzaak
-      dockerfile_inline: |
-        FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-        COPY setup_configuration /app/setup_configuration
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: &oz-env
      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
@@ -78,6 +68,10 @@ services:
      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh
+    # before start (bind mounts don't reach sibling containers on the CI runner).
+    volumes:
+      - oz-config:/app/setup_configuration:ro
    depends_on:
      oz-db:
        condition: service_healthy
@@ -86,7 +80,7 @@ services:
    networks: [cg]

  openzaak:
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: *oz-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -102,7 +96,7 @@ services:
    networks: [cg]

  oz-celery:
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: *oz-env
    command: /celery_worker.sh
    depends_on:
@@ -193,14 +187,7 @@ services:

  # ── Keycloak (S-02) ──────────────────────────────────────────────────────
  keycloak:
-    # Derived image: base Keycloak + the realm exports baked into the import dir
-    # (inline Dockerfile, no bind mount — see docs/runbooks/gitea-actions-gotchas.md).
-    build:
-      context: ./keycloak
-      dockerfile_inline: |
-        FROM quay.io/keycloak/keycloak:26.1
-        COPY realms /opt/keycloak/data/import
-    image: register-referentie/keycloak:dev
+    image: quay.io/keycloak/keycloak:26.1
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
@@ -211,6 +198,9 @@ services:
      KC_HTTP_ENABLED: "true"
    ports:
      - "8180:8080"
+    # realm exports are streamed into this external volume by infra/seed-config.sh.
+    volumes:
+      - kc-realms:/opt/keycloak/data/import:ro
    networks: [cg]

  # ── Flowable (S-03) ──────────────────────────────────────────────────────
@@ -244,16 +234,11 @@ services:
    networks: [cg]

  flowable-init:
-    # The BPMN is baked into a tiny curl image (build context = repo-root
-    # workflows/) instead of bind-mounted, so the deploy works on Gitea's
-    # containerized runner too. See docs/runbooks/gitea-actions-gotchas.md.
-    build:
-      context: ../workflows
-      dockerfile_inline: |
-        FROM docker.io/curlimages/curl:latest
-        COPY registratie.bpmn /work/registratie.bpmn
-    image: register-referentie/flowable-init:dev
+    image: docker.io/curlimages/curl:latest
    restart: "no"
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
+    volumes:
+      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
@@ -318,6 +303,18 @@ volumes:
  oz-db:
  nrc-db:
  flowable-db:
+  # Config volumes — created and populated out-of-band by infra/seed-config.sh
+  # (docker cp), because bind mounts don't reach sibling containers on the CI
+  # runner. `external` keeps the names deterministic; the seed step manages them.
+  oz-config:
+    external: true
+    name: rr-oz-config
+  kc-realms:
+    external: true
+    name: rr-kc-realms
+  fl-bpmn:
+    external: true
+    name: rr-fl-bpmn

 networks:
  cg:
--- a/infra/flowable/docker-compose.yml
+++ b/infra/flowable/docker-compose.yml
@@ -38,16 +38,11 @@ services:
  # Deploys workflows/registratie.bpmn via the REST API once flowable-rest is up.
  # Idempotent: skips if a deployment named "registratie" already exists.
  flowable-init:
-    # The BPMN is baked into a tiny curl image (build context = repo-root
-    # workflows/) instead of bind-mounted, so the deploy works on Gitea's
-    # containerized runner too. See docs/runbooks/gitea-actions-gotchas.md.
-    build:
-      context: ../../workflows
-      dockerfile_inline: |
-        FROM docker.io/curlimages/curl:latest
-        COPY registratie.bpmn /work/registratie.bpmn
-    image: register-referentie/flowable-init:dev
+    image: docker.io/curlimages/curl:latest
    restart: "no"
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
+    volumes:
+      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
@@ -66,6 +61,10 @@ services:

 volumes:
  flowable-db:
+  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
+  fl-bpmn:
+    external: true
+    name: rr-fl-bpmn

 networks:
  cg:
--- a/infra/keycloak/docker-compose.yml
+++ b/infra/keycloak/docker-compose.yml
@@ -9,14 +9,7 @@
 # Admin console: http://localhost:8180/  (admin / admin — dev only)
 services:
  keycloak:
-    # Derived image: base Keycloak + realm exports baked into the import dir via an
-    # inline Dockerfile. See docs/runbooks/gitea-actions-gotchas.md.
-    build:
-      context: .
-      dockerfile_inline: |
-        FROM quay.io/keycloak/keycloak:26.1
-        COPY realms /opt/keycloak/data/import
-    image: register-referentie/keycloak:dev
+    image: quay.io/keycloak/keycloak:26.1
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
@@ -28,7 +21,15 @@ services:
      KC_HTTP_ENABLED: "true"
    ports:
      - "8180:8080"
+    # realm exports are streamed into this external volume by infra/seed-config.sh.
+    volumes:
+      - kc-realms:/opt/keycloak/data/import:ro
    networks: [cg]

+volumes:
+  kc-realms:
+    external: true
+    name: rr-kc-realms
+
 networks:
  cg:
--- a/infra/openzaak/docker-compose.yml
+++ b/infra/openzaak/docker-compose.yml
@@ -32,14 +32,7 @@ services:
    networks: [cg]

  oz-init:
-    # Derived image: base OpenZaak + setup_configuration baked in via an inline
-    # Dockerfile. See docs/runbooks/gitea-actions-gotchas.md for why not a mount.
-    build:
-      context: .
-      dockerfile_inline: |
-        FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-        COPY setup_configuration /app/setup_configuration
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: &oz-env
      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
@@ -62,6 +55,9 @@ services:
      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh.
+    volumes:
+      - oz-config:/app/setup_configuration:ro
    depends_on:
      oz-db:
        condition: service_healthy
@@ -70,7 +66,7 @@ services:
    networks: [cg]

  openzaak:
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: *oz-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -86,7 +82,7 @@ services:
    networks: [cg]

  oz-celery:
-    image: register-referentie/openzaak:dev
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: *oz-env
    command: /celery_worker.sh
    depends_on:
@@ -96,6 +92,10 @@ services:

 volumes:
  oz-db:
+  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
+  oz-config:
+    external: true
+    name: rr-oz-config

 networks:
  cg:
--- a/infra/seed-config.sh
+++ b/infra/seed-config.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+#
+# Populate the external named *config* volumes that the upstream services mount,
+# by `docker cp`-ing files into a throwaway helper container that mounts each one.
+#
+# Why: the compose stack uses the upstream images verbatim (no build). On Gitea's
+# containerized runner, `docker compose` starts the stack as SIBLING containers
+# via the host daemon, so a workspace bind mount resolves to a path the daemon
+# can't see and is mounted empty. `docker cp` instead streams bytes over the
+# Docker API, so the files reach the volume regardless of where the daemon runs.
+# We use plain docker primitives (volume create / run / cp / rm) rather than
+# `docker compose create`, because podman-compose (local dev) lacks that
+# subcommand. Fixed-name `external` volumes keep the names deterministic across
+# both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
+#
+# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, kc, fl }
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HELPER="${SEED_HELPER_IMAGE:-docker.io/library/busybox:stable}"
+
+populate() {  # volume  source(file or dir/.)
+  local vol="$1" src="$2" cid
+  docker volume rm -f "$vol" >/dev/null 2>&1 || true
+  docker volume create "$vol" >/dev/null
+  # A *created* (never started) helper is enough: the volume is attached at create
+  # time, `docker cp` writes through to it, and `docker rm` is instant (nothing to
+  # stop). `docker create` is a container subcommand both docker and podman have —
+  # unlike `docker compose create`, which podman-compose lacks.
+  cid="$(docker create -v "$vol:/dest" "$HELPER" true)"
+  docker cp "$src" "$cid:/dest/"
+  docker rm "$cid" >/dev/null
+  echo "  seeded $vol"
+}
+
+[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|kc|fl> ..." >&2; exit 2; }
+
+for key in "$@"; do
+  case "$key" in
+    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
+    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
+    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
+    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
+  esac
+done