not
448896206f
CI / build (pull_request) Successful in 4m31s
CI / lint (pull_request) Successful in 4m46s
CI / unit (pull_request) Successful in 1m35s
CI / frontend (pull_request) Successful in 4m0s
CI / mutation (pull_request) Successful in 6m47s
CI / verify-stack (pull_request) Failing after 17m35s
Builds the four pieces ADR-0028 deliberately left absent, and turns
`NOTIFICATIONS_DISABLED` back off:
- `objecten-celery`, a worker on the Objecten image (mirrors `oz-celery`), plus
`CELERY_BROKER_URL`/`RESULT_BACKEND` on objecten-redis db 1 (db 0 is the cache).
Without it `notifications_api_common` queues the send and nothing ever ships it.
- An `nrc` service + `notifications_config` in Objecten's setup_configuration,
reusing the `big-reference-seed` credential OpenZaak publishes with.
- The `objecten` kanaal in NRC's setup_configuration — the name is fixed by the
Objects API (`NOTIFICATIONS_KANAAL`), and publishing to an unregistered kanaal is
what the failing check reported first.
- `SITE_DOMAIN: objecten.local:8000` + an `objecten.local` network alias: NRC
validates `hoofdObject`/`resourceUrl` with Django's URLValidator, which rejects a
single-label host, so `objecten:8000` is refused with "Voer een geldige URL in."
The alias keeps the dotted host resolvable so the URL still dereferences.
ADR-0029 records it; ADR-0028's ceiling now points there.
Makes `make verify-objecten-notifications` (dc9ca2c) pass.
52 lines
2.2 KiB
YAML
52 lines
2.2 KiB
YAML
# Open Notificaties (NRC) setup_configuration (S-01-c, #56).
|
|
# Wires NRC so OpenZaak can publish notifications:
|
|
# - the JWT credential OpenZaak authenticates with,
|
|
# - delegation of authorization checks to OpenZaak's Autorisaties API (AC),
|
|
# - the `zaken` kanaal OpenZaak publishes zaak events on.
|
|
# Dev-only credentials — not for production. Steps from nrc.setup_configuration.
|
|
|
|
# 1. JWT credential NRC uses to verify the token OpenZaak presents.
|
|
vng_api_common_credentials_config_enable: true
|
|
vng_api_common_credentials:
|
|
items:
|
|
- identifier: big-reference-seed
|
|
secret: insecure-dev-secret-change-me
|
|
|
|
# 2. The Autorisaties API (OpenZaak's AC) NRC consults to authorize publishers.
|
|
zgw_consumers_config_enable: true
|
|
zgw_consumers:
|
|
services:
|
|
- identifier: openzaak-ac
|
|
label: OpenZaak Autorisaties API
|
|
api_type: ac
|
|
api_root: http://openzaak:8000/autorisaties/api/v1/
|
|
auth_type: zgw
|
|
client_id: big-reference-seed
|
|
secret: insecure-dev-secret-change-me
|
|
|
|
# 3. Delegate authorization to that AC.
|
|
autorisaties_api_config_enable: true
|
|
autorisaties_api:
|
|
authorizations_api_service_identifier: openzaak-ac
|
|
|
|
# 4. The kanalen publishers announce on: `zaken` (OpenZaak) and `objecten` (Objecten, S-19b-1).
|
|
# Both authenticate with the big-reference-seed credential above, which OpenZaak's AC grants
|
|
# heeft_alle_autorisaties — so no separate publisher authorization is needed for Objecten.
|
|
notifications_kanalen_config_enable: true
|
|
notifications_kanalen_config:
|
|
items:
|
|
- naam: zaken
|
|
documentatie_link: https://github.com/VNG-Realisatie/gemma-zaken
|
|
filters:
|
|
- bronorganisatie
|
|
- zaaktype
|
|
- vertrouwelijkheidaanduiding
|
|
# 5. The kanaal Objecten publishes register-record events on (S-19b-1, ADR-0029). Its name is
|
|
# fixed by the Objects API itself (NOTIFICATIONS_KANAAL = "objecten"), not chosen here. The
|
|
# filter set matches what the Objects API sends as kenmerken, so an abonnement can narrow by
|
|
# objecttype rather than receiving every object write in the register.
|
|
- naam: objecten
|
|
documentatie_link: https://objects-and-objecttypes-api.readthedocs.io/
|
|
filters:
|
|
- object_type
|