feat: add control panel

2026-07-08 19:07:35 +09:00
parent a07b15e489
commit 3be9970c15
104 changed files with 3639 additions and 461 deletions
@@ -0,0 +1,91 @@
+# Local production-like smoke for Plan-13 Control Panel:
+# self-signed TLS + mock OIDC IdP + oauth2-proxy + nginx auth_request.
+
+services:
+  control-panel-api:
+    build:
+      context: .
+      dockerfile: Dockerfile.control-panel-api
+    image: casan-control-panel-api:local
+    restart: unless-stopped
+    environment:
+      CASAN_PROFILE: prod
+      CASAN_CP_STRICT: "1"
+      CASAN_CP_TRUST_AUTH_PROXY: "1"
+      CP_BIND: 0.0.0.0
+      CP_PORT: "3010"
+      CASAN_APP_ROOT: /app
+      CASAN_DASHBOARD_STALE_S: "315360000"
+    volumes:
+      - ./.specify:/app/.specify
+      - ./docs/output:/app/docs/output:ro
+    expose:
+      - "3010"
+    networks:
+      - casan-control-local
+
+  control-panel-ui:
+    build:
+      context: .
+      dockerfile: Dockerfile.control-panel-ui
+    image: casan-control-panel-ui:local
+    restart: unless-stopped
+    depends_on:
+      - control-panel-api
+      - oauth2-proxy
+    ports:
+      - "18443:443"
+    volumes:
+      - ./tmp/control-panel-local/tls:/etc/nginx/tls:ro
+    networks:
+      - casan-control-local
+
+  oauth2-proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+    restart: unless-stopped
+    command:
+      - --http-address=0.0.0.0:4180
+      - --provider=oidc
+      - --skip-oidc-discovery=true
+      - --oidc-issuer-url=http://localhost:18082
+      - --login-url=http://localhost:18082/authorize
+      - --redeem-url=http://idp:8080/token
+      - --profile-url=http://idp:8080/userinfo
+      - --oidc-jwks-url=http://idp:8080/.well-known/jwks.json
+      - --client-id=casan-control-panel
+      - --client-secret=local-secret
+      - --redirect-url=https://localhost:18443/oauth2/callback
+      - --whitelist-domain=localhost:18443
+      - --cookie-secret=0123456789abcdef0123456789abcdef
+      - --cookie-secure=true
+      - --email-domain=*
+      - --scope=openid email profile groups
+      - --oidc-groups-claim=groups
+      - --reverse-proxy=true
+      - --set-xauthrequest=true
+      - --pass-access-token=false
+      - --pass-authorization-header=false
+      - --skip-provider-button=true
+      - --ssl-insecure-skip-verify=true
+    expose:
+      - "4180"
+    networks:
+      - casan-control-local
+
+  idp:
+    build:
+      context: ./infra/local-prod/idp
+    environment:
+      CASAN_IDP_PORT: "8080"
+      CASAN_IDP_ISSUER: http://localhost:18082
+      CASAN_IDP_SUB: oidc-ops
+      CASAN_IDP_EMAIL: oidc-ops@example.com
+      CASAN_IDP_GROUPS: casan-org-admin,casan-approver
+    ports:
+      - "18082:8080"
+    networks:
+      - casan-control-local
+
+networks:
+  casan-control-local:
+    driver: bridge