Niek Otten
b349dff496
Drops the inline-build images for the upstream services. The compose now references the published images directly (openzaak/open-zaak, openzaak/open-notificaties, keycloak, curl, flowable-rest) with no build for them, and the config they need is streamed into external named volumes by infra/seed-config.sh: rr-oz-config -> oz-init /app/setup_configuration (data.yaml) rr-kc-realms -> keycloak /opt/keycloak/data/import (realm exports) rr-fl-bpmn -> flowable-init /work (registratie.bpmn) How: the seeder creates each volume, `docker create`s a throwaway helper that mounts it, `docker cp`s the files in, and removes it. docker cp streams over the Docker API, so it works in Docker-in-Docker (the CI runner) where bind mounts mount empty. It uses plain `docker create`/`cp` — NOT `docker compose create`, which podman-compose (local dev) lacks. `external: true` fixed names keep the volumes identical across docker compose and podman-compose. Consequence: bare `docker compose up` no longer self-seeds, so use `make up` (seeds then starts). Every `*-up` target seeds first; `*-down` removes the external volume. acl/bff are still built (they're our apps, not upstream images). Verified end-to-end on podman-compose: `make keycloak-up` seeds rr-kc-realms, the upstream Keycloak mounts it, and --import-realm imports all four realms (digid realm returns 200). Seeder runs in ~2s. Docs updated: gitea-actions-gotchas.md, ci.md, openzaak.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
46 lines
2.1 KiB
Bash
Executable File
46 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Populate the external named *config* volumes that the upstream services mount,
|
|
# by `docker cp`-ing files into a throwaway helper container that mounts each one.
|
|
#
|
|
# Why: the compose stack uses the upstream images verbatim (no build). On Gitea's
|
|
# containerized runner, `docker compose` starts the stack as SIBLING containers
|
|
# via the host daemon, so a workspace bind mount resolves to a path the daemon
|
|
# can't see and is mounted empty. `docker cp` instead streams bytes over the
|
|
# Docker API, so the files reach the volume regardless of where the daemon runs.
|
|
# We use plain docker primitives (volume create / run / cp / rm) rather than
|
|
# `docker compose create`, because podman-compose (local dev) lacks that
|
|
# subcommand. Fixed-name `external` volumes keep the names deterministic across
|
|
# both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
|
|
#
|
|
# Usage: seed-config.sh <key> [<key> ...] where key ∈ { oz, kc, fl }
|
|
set -euo pipefail
|
|
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
HELPER="${SEED_HELPER_IMAGE:-docker.io/library/busybox:stable}"
|
|
|
|
populate() { # volume source(file or dir/.)
|
|
local vol="$1" src="$2" cid
|
|
docker volume rm -f "$vol" >/dev/null 2>&1 || true
|
|
docker volume create "$vol" >/dev/null
|
|
# A *created* (never started) helper is enough: the volume is attached at create
|
|
# time, `docker cp` writes through to it, and `docker rm` is instant (nothing to
|
|
# stop). `docker create` is a container subcommand both docker and podman have —
|
|
# unlike `docker compose create`, which podman-compose lacks.
|
|
cid="$(docker create -v "$vol:/dest" "$HELPER" true)"
|
|
docker cp "$src" "$cid:/dest/"
|
|
docker rm "$cid" >/dev/null
|
|
echo " seeded $vol"
|
|
}
|
|
|
|
[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|kc|fl> ..." >&2; exit 2; }
|
|
|
|
for key in "$@"; do
|
|
case "$key" in
|
|
oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
|
|
kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
|
|
fl) populate rr-fl-bpmn "$here/../workflows/registratie.bpmn" ;;
|
|
*) echo "unknown seed key: $key" >&2; exit 2 ;;
|
|
esac
|
|
done
|