Niek Otten
9ff7937055
Root cause of the compose-smoke failure (found in the runner logs):
oz-init-1 | CommandError: Yaml file
`/app/setup_configuration/data.yaml` does not exist.
The ubuntu-latest runner runs the job inside a container, so
`docker compose up` starts the stack as SIBLING containers via the host
daemon. A relative bind mount (./openzaak/setup_configuration) resolves to
a path inside the job container that the daemon can't see, so Docker mounts
an empty dir and the init container can't find data.yaml. The same trap hit
nrc-init (data.yaml), flowable-init (the BPMN) and keycloak (realm import).
Fix: bake the assets into small derived images instead of bind-mounting:
- infra/openzaak/Dockerfile -> register-referentie/openzaak:dev
- infra/opennotificaties/Dockerfile-> register-referentie/opennotificaties:dev
- infra/keycloak/Dockerfile -> register-referentie/keycloak:dev
- flowable-init: build.dockerfile_inline bakes workflows/registratie.bpmn
Base versions stay build args (OPENZAAK_TAG / OPENNOTIFICATIES_TAG), so the
pinning is unchanged. Applied to both the consolidated compose and the
per-service composes, so local Podman and CI use one mechanism — no bind
mounts, no SELinux `:z`, no world-readable requirement.
Verified locally: `podman build` of the OpenZaak and BPMN images produces
the file at the expected in-container path.
Docs: docs/runbooks/gitea-actions-gotchas.md explains the DinD bind-mount
trap and the bake fix; openzaak.md and ci.md point at it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3.3 KiB
OpenZaak runbook
The OpenZaak stack (infra/openzaak/docker-compose.yml) is a lean adaptation of the
upstream open-zaak dev compose: PostGIS db, redis, a one-shot init that runs
migrations, the OpenZaak API, and a celery worker.
Quick test (make)
make openzaak-up # start the stack (first run pulls images + migrates: 1-3 min)
make openzaak-smoke # start + assert it's up with auth enforced (403/302/200)
make openzaak-seed # start + seed the BIG catalogus (idempotent)
make openzaak-down # stop and wipe data
Seed the BIG catalogus
make openzaak-seed brings the stack up and runs infra/openzaak/seed_catalogus.py,
which creates (idempotently, via the ZTC API):
- catalogus BIG
- a lean BIG-REGISTRATIE zaaktype (concept; only schema-mandatory fields)
- a bsn eigenschap on it
then confirms the JWT client can list it. See ADR-0002 for the design (why the zaaktype stays a concept, why notifications are disabled, why the API not a fixture).
JWT client (provisioned declaratively by setup_configuration/data.yaml, dev only):
| client_id | big-reference-seed |
| secret | insecure-dev-secret-change-me |
| authorizations | heeft_alle_autorisaties (all) |
The seed mints a ZGW JWT (HS256) from these and calls /catalogi/api/v1/....
make openzaak-smoke polls until the API responds, then asserts:
| Check | Expected |
|---|---|
GET /zaken/api/v1/zaken (no JWT) |
403 — PermissionDenied ZGW fout (auth enforced) |
GET /admin/ |
302 — admin login redirect |
GET /zaken/api/v1/ |
200 — ZGW API schema root |
403, not 401. OpenZaak's ZGW APIs return
403 PermissionDeniedfor a missing or invalid JWT. The S-01 acceptance text says "401" — that's inaccurate; 403 is the correct auth-enforced response.
The admin UI is at http://localhost:8000/admin/; the dev superuser is admin / admin (from the compose env — dev only).
Prerequisites (rootless Podman)
Same setup as the rest of the repo (see ci.md):
systemctl --user start podman.socket # the Docker-API socket the shim talks to
The Makefile auto-points DOCKER_HOST at the Podman socket when it exists, so the
make openzaak-* targets work without extra env.
Notes
- Not in
make ci. The OpenZaak smoke is a separate, heavier check (large image pull + migrations); it is intentionally kept out ofmake ciso the core gate stays fast. Runmake openzaak-smokewhen you touch the OpenZaak stack. - Notifications disabled.
NOTIFICATIONS_DISABLED=true— otherwise ZTC writes 500 trying to notify. Open Notificaties is now up (see opennotificaties.md), but OZ→NRC delivery wiring + re-enabling lands with S-06. - Zaaktype is a concept, not published (publishing needs roltypen/statustypen/
resultaattypen — beyond the lean seed). List with
?status=alles. - Image tag. Pinned to
openzaak/open-zaak:1.28.2via${OPENZAAK_TAG}(bump deliberately, not via:latest). - Config is baked, not mounted.
setup_configuration/data.yamlisCOPY-ed into a derived image (infra/openzaak/Dockerfile) rather than bind-mounted, so the init container finds it on Gitea's containerized CI runner too. See gitea-actions-gotchas.md.