added dependent docker compose file #2295
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,81 @@ | ||||||
| services: | ||||||
| database: | ||||||
| image: 'postgres:bookworm' | ||||||
| ports: | ||||||
| - 5455:5432 | ||||||
| environment: | ||||||
| - POSTGRES_USER=postgres | ||||||
| - POSTGRES_PASSWORD=postgres | ||||||
|
Comment on lines
+7
to
+8
There was a problem hiding this comment. 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win Hardcoded credentials and private keys committed to the compose file.
🔒 Proposed fix using environment variable references environment:
- POSTGRES_USER=postgres
- - POSTGRES_PASSWORD=postgres
+ - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
...
- SPRING_DATASOURCE_USERNAME=postgres
- - SPRING_DATASOURCE_PASSWORD=postgres
+ - SPRING_DATASOURCE_PASSWORD=${POSTGRES_PASSWORD}
...
- - CLIENT_PRIVATE_KEY=eyJrdHkiOiJSU0Ei...
+ - CLIENT_PRIVATE_KEY=${MOCK_RP_CLIENT_PRIVATE_KEY}
- - JWE_USERINFO_PRIVATE_KEY=ewogICAgInAiOi...
+ - JWE_USERINFO_PRIVATE_KEY=${MOCK_RP_JWE_USERINFO_PRIVATE_KEY}As per path instructions, "Flag any hardcoded values for: passwords, private keys, database credentials, API keys, or internal service IPs in non-dev configs. Must reference environment variables (e.g., Also applies to: 27-28, 43-44 🤖 Prompt for AI AgentsSource: Path instructions |
||||||
| volumes: | ||||||
| - ./init.sql:/docker-entrypoint-initdb.d/init.sql | ||||||
|
|
||||||
| redis: | ||||||
| image: redis:7.4 | ||||||
| ports: | ||||||
| - "6379:6379" | ||||||
| restart: always | ||||||
|
|
||||||
| mock-identity-system: | ||||||
| image: 'mosipdev/mock-identity-system:develop' | ||||||
| user: root | ||||||
| ports: | ||||||
| - 8082:8082 | ||||||
| environment: | ||||||
| - container_user=mosip | ||||||
| - active_profile_env=default,local | ||||||
| - SPRING_DATASOURCE_URL=jdbc:postgresql://database:5432/mosip_mockidentitysystem?currentSchema=mockidentitysystem | ||||||
| - SPRING_DATASOURCE_USERNAME=postgres | ||||||
| - SPRING_DATASOURCE_PASSWORD=postgres | ||||||
| - MOSIP_ESIGNET_HOST=localhost:8088 | ||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Description: Check for an existing esignet compose stack or networking config in this folder,
# and confirm no shared network/host-networking is declared for cross-stack resolution of "localhost".
fd . docker-compose --type f
rg -n 'network_mode|extra_hosts|networks:' docker-composeRepository: mosip/esignet Length of output: 284 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files docker-compose
echo
echo "== dependent YAML =="
cat -n docker-compose/dependent-docker-compose.yaml | sed -n '1,120p'
echo
echo "== main compose =="
cat -n docker-compose/docker-compose.yaml | sed -n '1,220p'
echo
echo "== local searches for environment variable usages =="
rg -n 'MOSIP_ESIGNET_HOST|ESIGNET_SERVICE_URL|ESIGNET_AUD_URL|ESIGNET_PAR_ENDPOINT|ESIGNET_PAR_AUD_URL|ESIGNET_UI_BASE_URL|login|redirect|callback|issuer|client_id|client_secret|authorize|token|userinfo|introspect|jwks|userinfo.*url|service.*url|aud.*url|par' docker-compose -S || trueRepository: mosip/esignet Length of output: 14936 🌐 Web query:
💡 Result: In the mosipdev/mock-relying-party-service, the environment variables ESIGNET_SERVICE_URL and ESIGNET_AUD_URL are used to configure the connection and authentication between the mock relying party and the MOSIP eSignet service [1]. ESIGNET_SERVICE_URL defines the base URL for the MOSIP eSignet API [1]. It is typically formatted as https://<ESIGNET_DOMAIN>/v1/esignet [1]. ESIGNET_AUD_URL defines the audience (aud) claim used for client assertions when calling the token endpoint [1]. This value must match the token endpoint URL configured in the eSignet service to avoid authentication errors, such as invalid_assertion [1][2]. A common format is https://<ESIGNET_DOMAIN>/v1/esignet/oauth/v2/token [1][3]. These variables are essential for the mock relying party service to correctly authenticate and request tokens from the eSignet environment [1][4][5]. They can be configured via environment variables in Docker or directly in the application configuration files [1][5][2]. Citations:
🌐 Web query:
💡 Result: The environment variable MOSIP_ESIGNET_HOST is used in the MOSIP mock-identity-system and related eSignet deployments to specify the domain or hostname of the eSignet service [1][2]. In the context of the mock-identity-system, this configuration informs the system about the location of the eSignet instance it is interacting with, which is essential for proper integration during local development and testing [3][2]. Usage details include: - Docker Compose: It is typically defined within the docker-compose.yml file under the environment section for the mock-identity-system service [2]. For example, it might be set to a value like localhost:8088 to point to a local eSignet container [2]. - Infrastructure/Helm Deployments: In Kubernetes or more complex infrastructure deployments, MOSIP_ESIGNET_HOST is often managed via ConfigMaps or environment variables passed to the containers to reflect the specific domain name of the eSignet service being used in that environment [1][4][5]. - Purpose: It ensures that components within the MOSIP/eSignet ecosystem can correctly route requests and identify the appropriate host for OIDC-related operations, such as token validation and client assertions [1][4]. When setting up or troubleshooting, ensure this value matches the accessible host and port where the eSignet service is running [4][5]. It should not be hardcoded in application property files but rather passed as an environment variable to allow for flexible environment-specific configuration [6]. Citations:
🌐 Web query:
💡 Result: In the MOSIP eSignet mock services repository, ESIGNET_PAR_ENDPOINT is an environment variable used to configure the Pushed Authorization Request (PAR) endpoint when setting up a PAR-enabled mock relying party service [1][2]. When configuring the mock-relying-party-service for a PAR-enabled setup, you must provide the following PAR-related environment variables [1][2]: - ESIGNET_PAR_ENDPOINT: The URL of the PAR endpoint on the eSignet server (e.g., https://<ESIGNET_DOMAIN>/v1/esignet/oauth/par) [2]. - ESIGNET_PAR_AUD_URL: The audience value for the PAR endpoint client assertions [2]. These variables are typically set within your docker-compose file or passed directly when running the Docker container [1][2]. Additionally, for the mock-relying-party-ui to interact correctly with this setup, you must set the PAR_CALLBACK_NAME environment variable (typically to get_requestUri) to enable the PAR feature flag [1][3]. For detailed configuration, refer to the official documentation provided in the mock-relying-party-service and mock-relying-party-ui README files within the mosip/esignet-mock-services repository [1][2][3]. Citations:
🌐 Web query:
💡 Result: The mock-relying-party-service within the MOSIP esignet-mock-services repository is a backend component designed to handle OIDC flows, specifically interacting with the eSignet identity provider to fetch user profiles using authorization code flows with private key JWT authentication [1]. Technical documentation for running this service, including Docker-based deployment, can be found in the service's own README [2] and the centralized docker-compose README [3]. Key Configuration and Usage: 1. Basic Docker Execution: The service requires several environment variables, including ESIGNET_SERVICE_URL, ESIGNET_AUD_URL, CLIENT_PRIVATE_KEY, and REDIRECT_URI [2]. 2. PAR-Enabled Setup: For setups requiring Pushed Authorization Requests (PAR), additional environment variables such as ESIGNET_PAR_ENDPOINT and ESIGNET_PAR_AUD_URL must be provided [2][3]. 3. Orchestration: The repository provides docker-compose files to orchestrate the service alongside the mock relying party UI [3]. You can start these services using commands such as: docker compose --file mock-relying-party-portal-docker-compose.yml up [3]. 4. Development: For local development, the service supports running with npm via npm run devstart [2]. The mock relying party ecosystem consists of two primary parts: the mock-relying-party-ui (a ReactJS frontend) and the mock-relying-party-service (the backend that handles token exchange and user info retrieval) [1]. Configuration details for the UI are maintained in its own separate README [4]. For production-like or Kubernetes-based environments, the repository also includes Helm charts and installation scripts [5]. Note: These mock services are intended for non-production use only [3][5]. Citations:
🌐 Web query:
💡 Result: The mosip/esignet-mock-services repository provides tools to test OIDC flows, including support for Pushed Authorization Requests (PAR) [1]. Regarding your query: 1. Docker Compose Configuration: To run the mock relying party portal with PAR enabled, you should use the Citations:
🌐 Web query:
💡 Result: The mosip/esignet-mock-services repository provides a mock implementation of the Identity Authentication (IDA) system for eSignet development and testing [1][2][3]. Regarding your specific query components: 1. Mock Identity System: This component facilitates local development of eSignet by simulating essential IDA functions [3]. It supports endpoints for creating and getting individual identities, authentication (via PIN, OTP, Biometric, Password, or WLA factors), and KYC exchange [1][3]. 2. MOSIP_ESIGNET_HOST: This environment variable is used within the MOSIP/eSignet ecosystem to define the base domain for eSignet services [4][5][6]. It is typically configured via Kubernetes ConfigMaps (often named esignet-global) [5][6]. Services use this variable to construct full URLs for various integration points, such as discovery endpoints and domain URIs [4][7][8]. 3. Token Introspect: The eSignet mock services repository itself focuses on the identity/authentication lifecycle (IDA) [1][2]. Standard OAuth2/OIDC token introspection is typically handled by the eSignet service or the underlying OIDC provider (e.g., Keycloak), rather than the mock-identity-system. Developers configuring eSignet environments often manage token and OIDC client configurations through the esignet-service properties and deployment scripts [9][5][7]. For technical implementation details, you can refer to the Swagger UI generally available on port 8082 of the running mock identity system [10]. Additional configuration properties and their mappings can be found in the eSignet configuration documentation [4][7][8]. Citations:
🌐 Web query:
💡 Result: There is no environment variable officially named MOSIP_ESIGNET_HOST in the MOSIP eSignet documentation or the esignet-mock-services repository [1][2][3]. The MOSIP eSignet configuration typically relies on different environment variables to define service and UI locations. Specifically, the following variables are commonly used in the eSignet mock services suite: - ESIGNET_SERVICE_URL: Used to define the base URL for the MOSIP eSignet API (e.g., https://<ESIGNET_DOMAIN>/v1/esignet) [2][3]. - ESIGNET_UI_BASE_URL: Used to define the base URL for the eSignet UI [1][3]. - ESIGNET_AUD_URL: Used for the audience value in token endpoint client assertions [2]. If you are attempting to configure an eSignet deployment or a relying party mock, you should use ESIGNET_SERVICE_URL or ESIGNET_UI_BASE_URL depending on whether you are configuring the API backend or the frontend interface [2][3]. Always refer to the specific README files within the MOSIP GitHub repositories for the most accurate configuration parameters for your version [1][2][3]. Citations:
🌐 Web query:
💡 Result: In the context of the MOSIP eSignet project, ESIGNET_SERVICE_URL and the /fetchUserInfo endpoint are components used within the mock relying party service implementation for testing and integration [1][2]. ESIGNET_SERVICE_URL is an environment variable used to define the base URL for the MOSIP eSignet API [1]. It typically follows the format: https://<ESIGNET_DOMAIN>/v1/esignet [1]. The /fetchUserInfo endpoint is a POST service provided by the mock relying party service [1]. Its purpose is to exchange an authorization code (received after a user successfully authenticates and provides consent) for an access token and subsequently retrieve the user's information from the MOSIP eSignet services [1][2]. The request body for /fetchUserInfo requires the following parameters [1]: - code: The authorization code received from the authentication flow [1]. - client_id: The identifier for the relying party client [1]. - redirect_uri: The redirect URI used during the initial request [1]. - grant_type: Typically set to authorization_code [1]. - state: The state parameter for security verification [1]. This service facilitates testing OIDC flows in non-production environments by automating the interaction between a mock relying party and the eSignet authentication service [1][3]. Citations:
🌐 Web query:
💡 Result: The mock-relying-party-service is a component in the MOSIP eSignet ecosystem used to simulate an OpenID Connect (OIDC) relying party during local development [1][2]. The ESIGNET_SERVICE_URL is a critical configuration variable for this service, typically set to the base URL of the eSignet identity provider [1]. It generally follows the format https://<ESIGNET_DOMAIN>/v1/esignet [1][3]. The /fetchUserInfo endpoint is a backend API exposed by the mock-relying-party-service [1][4][2]. Its function is to facilitate the completion of the OIDC authorization code flow [2]: 1. The frontend UI, after receiving an authorization code from eSignet, invokes the /fetchUserInfo endpoint on the mock-relying-party-service backend [4][2]. 2. The mock-relying-party-service then uses this code to call the eSignet token endpoint (often configured via ESIGNET_AUD_URL) to exchange it for an access token and an ID token [1][2]. 3. Finally, the service uses the obtained access token to call the eSignet UserInfo endpoint (e.g., /v1/esignet/oidc/userinfo) to retrieve the user's profile information, which it then returns to the UI [2][5]. If you encounter issues where this endpoint fails, verify that the ESIGNET_SERVICE_URL and other related environment variables (like CLIENT_PRIVATE_KEY) are correctly configured in your deployment [3][6]. If you are seeing 400 or 404 errors, double-check that the eSignet service is running and that the endpoint paths match your specific eSignet version's requirements [3]. Citations:
🌐 Web query:
💡 Result: In the context of the eSignet mock-relying-party-service, ESIGNET_PAR_ENDPOINT is an environment variable used to configure the URL of the eSignet Authorization Server's Pushed Authorization Request (PAR) endpoint [1][2]. This configuration is essential for enabling the PAR flow, which is used to securely push authorization request parameters to the server [1][3]. Typically, this endpoint is configured with a path similar to https://<ESIGNET_DOMAIN>/v1/esignet/oauth/par [1][4]. When deploying or configuring the mock-relying-party-service, the following points are relevant: 1. Function: The ESIGNET_PAR_ENDPOINT variable tells the relying party where to send POST requests containing authorization parameters [1][5]. Upon successful verification, the server responds with a request_uri, which is then used in the subsequent authorization flow [5][6]. 2. Related Configuration: Often used alongside ESIGNET_PAR_ENDPOINT is ESIGNET_PAR_AUD_URL, which specifies the audience value for client assertions sent to the PAR endpoint [1][2]. 3. Discovery: The actual PAR endpoint URL for an eSignet environment is also exposed via the server's.well-known/oauth-configuration (or OpenID configuration) metadata as pushed_authorization_request_endpoint [4]. For developers, these variables are typically set in the environment or within docker-compose files to override default behavior and point the mock service to the appropriate eSignet instance [1][2]. Citations:
🌐 Web query:
💡 Result: The mock-identity-system is a lightweight, mock implementation of the MOSIP Identity Authentication (IDA) system, designed specifically for local development, testing, and proof-of-concept (POC) purposes [1][2][3]. It allows developers to simulate core identity authentication workflows within the eSignet framework without requiring a full, production-grade MOSIP deployment [1][4]. Key technical aspects include: 1. Supported Functionality: The system provides API endpoints to create identities, retrieve identity data, perform KYC authentication (kyc-auth), share KYC tokens (kyc-exchange), and send OTPs [5][1][6]. It supports multiple authentication factors, including PIN, OTP, Biometric (BIO), Password (PWD), and WLA [5][1][6]. 2. Role in eSignet Integration: eSignet integrates with identity systems via an Authenticator plugin [7]. For development, developers can use the mock-plugin to interface with the mock-identity-system, whereas a production environment uses the MOSIP identity plugin to communicate with the actual MOSIP IDA service [8][7][4]. 3. Configuration and Host Identification: In eSignet configurations (such as esignet-default.properties), the identity system host is often referenced using placeholders like ${mosip.esignet.host} [9][10]. When using the mock-identity-system, the host URL is pointed to the local mock instance, whereas in production, it is configured to point to the internal MOSIP API host [9][10]. 4. Identity Schema: The mock-identity-system uses a JSON schema to validate identity data, ensuring that create and update operations adhere to defined structures [5][6]. Developers can configure this via properties like mosip.mock.ida.identity.schema.url [5][6]. This mock system is not intended to replace production IDA services but provides a controlled, self-contained environment to evaluate and debug eSignet integration flows [1][2]. Citations:
Use host-resolvable eSignet URLs for server-side OIDC calls.
🤖 Prompt for AI Agents |
||||||
| depends_on: | ||||||
| - database | ||||||
|
|
||||||
| mock-relying-party-service: | ||||||
| image: 'mosipdev/mock-relying-party-service:develop' | ||||||
| user: root | ||||||
| ports: | ||||||
| - 8888:8888 | ||||||
| environment: | ||||||
| - ESIGNET_SERVICE_URL=http://localhost:8088 | ||||||
| - ESIGNET_AUD_URL=http://localhost:8088/oauth2/token | ||||||
| - ESIGNET_PAR_ENDPOINT=https://localhost:8088/oauth2/par | ||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Scheme mismatch on
🐛 Proposed fix- - ESIGNET_PAR_ENDPOINT=https://localhost:8088/oauth2/par
+ - ESIGNET_PAR_ENDPOINT=http://localhost:8088/oauth2/par📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| - ESIGNET_PAR_AUD_URL=http://localhost:8088 | ||||||
| - CLIENT_PRIVATE_KEY=eyJrdHkiOiJSU0EiLCJuIjoid1djV1RyX1BmeHdMZVVmcFFXamFxNmxRekxqSjdfQUdTbnVlRXRxTFdHdEdNZlROSU9GZFhDTHF5WWRNbTRIdDRRNkJOQzhjTG91emRHazRsMWNXX0hVMWYza0pyMThOMUhQM2dRbGF2bkdWSFlJUnRlcTg0MFdmeHV0b3JaOHRIdWcwcWRJN1l3eEVSdk5OZlAyTHVkem8tSHZ0eDFtQ21IMDNUVHd1eDh0VElQaGZHUUFkRTFHSVlXY0Z3S1JLUjVoanR4OWtRcFNBNTNTVEZzbmR5bU1sRWdqMHBjQmhEZXZVRGZDd0k0SkFsZ0pHbHE0UjJGT09uTTVUbXhzZUJfaVRuVGNISHNxRkY2TTJMOWVYR2E5WWlRTC16R1RNZmFkM0RoNkZOWFFwWmtmMkpQMXVObGlZNVMzMlFQdnVRakFkUC1TOG5lTVRRWmQyTHpXT1J3IiwiZSI6IkFRQUIiLCJkIjoiQ3J1aTFFbjJ4UElVZk8yTnQxQ1BXaGx5WDNvZDBzXzZPV1gwMXMwRUVLc2JZU2hadmVwajJQb2pGMzRIdFZXWGt2YlFHc3BHZ1JyRm9iODVJY1QyaEpvb2x1TnJzeXpPUXEwUTNqdGJxdGY0MDRObFlqZ2R0V3NtdTg1U3A5Zi1sQW1FNnF1OUdma1RUUEN4cXk4Uzh3U2NkVFhEYzEyM1Rxa2NTWV8tZEozdVRzNTNFOWlfR0ZFRjBhaVZiaTBZUDdTNElJWHJUZGtmcnRrcmZMS3pXbWFjTzh1QzNYYXhDTGRHeHU0N3lwX2FHRmZ6LXdiSHQ5bVdneHZ2SGtfUjFHdmtuYnNfbUlYd1p0TVZSSE5DdG90Q1lnOFpyZ2hpVUJYRmYzVi1rTU9FaFlIZklTdEJab3FsVTVmUlh4aDAySFY4RnE3ZTV2TEtvaWJlZWtDSTZRIiwicCI6IjUyTkJVc0dzRGZJMzlqSU0zaG11VDgyQzdVUFdBSlBxMnNMeUNDT3o3T1U1X3kzTURVdVZsVFcwcEZYUzdOdGw0X0s4ZGVDUXZ4YXNidnhTeDltNEhuWGwzd3ZrOGNVREhrekY2SjlPc0FQZWk1Q28tcl9JVWUzSjBxZlNScWxiNkx0NEpudUtwNEk1TUtYT3htRDcwYTVZTFlOTTdSQWpoTUYwNWI4R3poVSIsInEiOiIxZmw5ZXFfamNXTFZiUnp6NEJXMno0M3ZkeEVYdFRVa3VEdjFtbC11UVo5b3U5dnpPMU9VLWV0NjNWbmR6TXRFcExOMVgtR2hoNEM3M01lb09lQ1NwQXkxT2xTbjd1OWlycHJCYkVsVjdqVkg1dG15N3hCNll3VDhKai1uMFNXSXRraUYyX29WNVE0VEswWm1nb1FvR0pKRmo5dGE5R0VTMnM0RTBQbW1IZXMiLCJkcCI6ImtORDlIRWRjWUtvZFBqZmE5OUtJMXlkZmJ4SEt5VGZLZ0RvTWN1MnRlWEdKMTl5WTNpVlZMRHFkb1ZDWm4yWTlJZXBVNjAydUtmcU4xelNTdHNQYnlTeXV2dWRaMWJzaEZZQ2xTTThUMTNQRWdBTDh6MXJpaS14UUtVaWhnVm9Uek5ndl9aM0tqTVlpOXdCX0pvZWljM3d6Y2VEQWI0cHZRSEkzc0diYlluVSIsImRxIjoicGxISVRCMzluM3ZnUTNEMnkxNTFlNzFxdmxVbDVXOUtmSDMydVNqWUxSXzRhOVZhcWVtYzZlbzAxV3R0OFNxcXo0N0NsR1d3aGJfMXhuWFctQzNzTGVIRzJIRkhHMzB0YW1UV0poS1czWkxDc2RqVHNlbFFDRG11dVJoUG5FMGRoX3ExT2JpWlhqTGppWWF1VlpMZUM4TmVtS1E3ZmFzYTJjSzdrYWdMakVNIiwicWkiOiJlNU16UjhPVDg1RHdNVm9zSkhQS2RMZS1ITTFuU1ozbGQwNWNtUkJVTEZiQ0VNcFZQNS0wWUtVdzRDN2htcDdvc1kxSlF2dFMwUnhhVjdneS1YSnl5TmtVMEIxRVVfeWRxMHVyUFlHaHN5TlJRdUY4dlFnQzB0b18xSEdwRUZQV3BwcklNZnRCWndpbEVqaDR3NkNxM0wyYlhTZmZ6dFhUYjg2UjNycFBkWWMiLCJraWQiOiJDUUlaVlNGM3Y5YkswTzVrejBpMXpfb2toZ2dnX1A1SFhHa2hNb1hNZ3FVIiwidXNlIjoic2lnIn0 | ||||||
| - JWE_USERINFO_PRIVATE_KEY=ewogICAgInAiOiAieF8zWXBZejI2aE1ZNVRleUhtRmVDeHFGMEotTzRIWnd4b0hsV3VkZlVDYV9vQktfeXJhQWxJOWtQYUF0Y1d1cV83S2V5SzFnS2FRQ005LWVUYnE4cnRGc3ZSRU15OW9ORk5scnlxMmVjTjVWSTBxMGMzM2gyd1NzM3FwWDBuVXNMMC13TTIzaWcyWkkzUkE1NWpWUzdEV3laTkJLdFF6TS1wRUVfU2RRTldrIiwKICAgICJrdHkiOiAiUlNBIiwKICAgICJxIjogInZJdnJtZE9wMEZUX3cxSUg0M2tjdG1VeEJWRUdScVdKcy1DZ0tuU1hTaFRmam93c3AtZ09CalVoRE1yNC13b0dyZVZyMkRaeDVPeGNtbDJ4eExHekJKSzMxLWZxQTFyYWN6S3F2M3RBbnpPMnhoOVJUSGtnZDR0c01CMGFlalAtTFVEajM4eGxhSWtyQlZ2b0NlN1ZpS29iSW12YVZweUdlM1hidV9hSWoxMCIsCiAgICAiZCI6ICJVQ0dCUTZ2aUtjWTVTc3E0YzdiTFUwbUVBWjAteXdrT3AteXpkWGppNGZ0LXlRRXpKMVdtQWp1dTlmcWh4ZVBKdkpWekZQLWduY0NVZzc0dEpiY2F3Q0IzMVIxUHJycDhKY1VnYk9fcFJmT3lwWFI3Zm1yYkpyWjRMc0ZkZURyUzVBdUFJS0NOVy1RQTRZajQxcnFBSEw4OEtOQXRvR01IdGQ5VDZ5dkhZUUVpMmtSbUUxZHQ4OXhqRjRHR2E2MFBzaml3RVJvdm9EUWxjWmtwekM5QXpPRm80NXZ6a2RtSWlLRlFVR1hkRWJjSFhVOVRmWFdSc3RhOFlsdGRWVWM3NHhsbk13MDJtNm4tWjU3VG5kdVFOSFJHMVhZd3lGZEh3RFI5S0pDU0lCR3htRDRDWVNVdTc1b0JRLWdVZUtYQ1Y2UENiQVRoT1J4ZG9sako2SkhtNFEiLAogICAgImUiOiAiQVFBQiIsCiAgICAidXNlIjogInNpZyIsCiAgICAicWkiOiAiSDRWd2JHQkR3UFJkenJzZVpYSFo4M29kakwwNnJhWnEybzZaQ1FnMzdTUFVpVHY4dWZNMHNJaHJGdEhKd0xUN1ZXVlRIMy0xZ00xOEZvcVBHekVUNGhnN252UE1FaVpaQmVzUGJ6NWpQb2VLeTFHczFfSWVxWVRjbkxKRzM0azZfck1KVXFzeUZWQ001bjY5Ykcyaml5SzEzcjFRVVNWcGdYOFJqX1RrMGRNIiwKICAgICJkcCI6ICJyQzN4SW42ZGFlTXRNTkxscC1BLUhpTWtoX3VHXzlzWXR0N0lmcDNxWWxBcDlILVAzYy1JSGQ3aDkyaDdGMFlSXzNoaDJmWGliNWREU2pQQXo3endpelhFZjNZNVpSd0MzU3RlOFN6TzF1LWpydkczTUNOMW1xR0l6MThxb3dlOEZiTnV5S2hYTnJlT0RielZqRXZtYTNURGRLWWJXNHA4dzFDdFVlSlIzTmsiLAogICAgImFsZyI6ICJSUzI1NiIsCiAgICAiZHEiOiAiRklNOGZKM1VpYl9WbTVCZkgxWmIwMVFyQXlNUGhid1l3U01kQ2NGcGZEdk5IcHNOZUs3OFo1eDhIZ0l2R0ZDODdVcGFjMGxwRnJqSVVsc0RMaDBQRnQ1SGRndmJIOFpRb2R2UFM4bkNfQThLUVhfQ3Zva25DUnA0Q0x3QjEyMjBwNE81eHUxYjB3V3BVb252TXJWek1jMGY2cHpGUWtzQkxvbGlBSThQeUZrIiwKICAgICJuIjogImswdTVfR2RhTkRRbXNlS240UWgxYlhTblV1ODhvOHZpRFAza1NRTVJqRG9xaG9RYXpRRUItVWJxREI0UnhKS1A0Y2VFWnJLemVaQnl6U0hqN0pZU2Nxb0Q3b3V4RXY0X1FxMnQxREFuR21GYTUycGVjU29VclIxbFBvQmZGRE5LTndFSzJiS25TbEdsVXRhYnJudjNsRXBkck1EM2xOX1RYNlJrVjJXT0k5NF9PT09tU29mTEFuWVlkUGN0QmVGLW0tb0JOczBCcklSRUVqRkc3Y2dZYlpIVE55Y0lnNnJnVVVMVVNTeVE4blhFSFNRUy1DWUF6ek9HTlFvTUdGdmMyazNwLTgya1pZNHY2NXowX2s3RWVlZjU4UDI3TDhVY1plVEh5YUp3LUJjYjFXMThQNGJRakU1dVVybFEtUjBZNGdBeGE5d3dSaGtrQVFXUFc4RU9KUSIKfQ== | ||||||
| - USERINFO_RESPONSE_TYPE=jwt | ||||||
| - SCOPE_USER_PROFILE=openid profile | ||||||
| - REDIRECT_URI=http://localhost:3000/userprofile | ||||||
| - ACRS=mosip:idp:acr:linked-wallet mosip:idp:acr:knowledge mosip:idp:acr:generated-code mosip:idp:acr:password | ||||||
| - CLAIMS_USER_PROFILE={"userinfo":{"name":{"essential":true},"phone_number":{"essential":true},"verified_claims":[{"verification":{"trust_framework":{"value":"ABC TF"}},"claims":{"phone_number":{"essential":true}}},{"verification":{"trust_framework":{"value":"XYZ TF"}},"claims":{"name":{"essential":true}}}]},"id_token":{}} | ||||||
|
|
||||||
| mock-relying-party-ui: | ||||||
| image: 'mosipdev/mock-relying-party-ui:develop' | ||||||
| user: root | ||||||
| ports: | ||||||
| - 3000:3000 | ||||||
| depends_on: | ||||||
| - mock-relying-party-service | ||||||
| environment: | ||||||
| - container_user=mosip | ||||||
| - ESIGNET_UI_BASE_URL=http://localhost:8088 | ||||||
| - MOCK_RELYING_PARTY_SERVER_URL=http://localhost:8888 | ||||||
| - REDIRECT_URI=http://localhost:3000/userprofile | ||||||
| - CLIENT_ID=pm-client-1785757353349 | ||||||
| - ACRS=mosip:idp:acr:static-code%20mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge | ||||||
| - REDIRECT_URI_REGISTRATION=http://localhost:3000/registration | ||||||
| - SIGN_IN_BUTTON_PLUGIN_URL=http://localhost:8088/plugins/sign-in-button-plugin.js | ||||||
| - DISPLAY=page | ||||||
| - GRANT_TYPE=authorization_code | ||||||
| - CLAIMS_LOCALES=en | ||||||
| - SCOPE_USER_PROFILE=openid profile | ||||||
| - CLAIMS_USER_PROFILE=%7B%22userinfo%22%3A%7B%22birthdate%22%3A%7B%22essential%22%3Atrue%7D%2C%22verified_claims%22%3A%5B%7B%22verification%22%3A%7B%22trust_framework%22%3A%7B%22value%22%3A%22ABC%20TF%22%7D%2C%22verification_process%22%3Anull%7D%2C%22claims%22%3A%7B%22phone_number%22%3A%7B%22essential%22%3Atrue%7D%7D%7D%2C%7B%22verification%22%3A%7B%22trust_framework%22%3A%7B%22value%22%3A%22XYZ%20TF%22%7D%7D%2C%22claims%22%3A%7B%22name%22%3A%7B%22essential%22%3Atrue%7D%7D%7D%5D%7D%2C%22id_token%22%3A%7B%7D%7D | ||||||
| - CLAIMS_REGISTRATION=%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D | ||||||
| - DEFAULT_LANG=en | ||||||
| - FALLBACK_LANG=%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D | ||||||
| - PAR_CALLBACK_NAME=get_requestUri1 | ||||||
| - PAR_CALLBACK_TIMEOUT=5000 | ||||||
| - DPOP_CALLBACK_NAME=get_dpop_jkt1 | ||||||
| - CODE_CHALLENGE=get_code_challenge | ||||||
| - AUTHORIZE_ENDPOINT=/oauth2/authorize | ||||||
| volumes: | ||||||
| - ./rp-nginx.conf:/etc/nginx/nginx.conf | ||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,55 @@ | ||||||||||||||||
| worker_processes 1; | ||||||||||||||||
|
|
||||||||||||||||
| events { | ||||||||||||||||
| worker_connections 1024; | ||||||||||||||||
| } | ||||||||||||||||
|
|
||||||||||||||||
| http { | ||||||||||||||||
| access_log /var/log/nginx/access.log; | ||||||||||||||||
| error_log /var/log/nginx/error.log; | ||||||||||||||||
| server { | ||||||||||||||||
| listen 3000; | ||||||||||||||||
| server_name localhost; | ||||||||||||||||
|
|
||||||||||||||||
| root /usr/share/nginx/html; | ||||||||||||||||
| index index.html index.htm; | ||||||||||||||||
| include /etc/nginx/mime.types; | ||||||||||||||||
|
|
||||||||||||||||
| gzip on; | ||||||||||||||||
| gzip_min_length 1000; | ||||||||||||||||
| gzip_proxied expired no-cache no-store private auth; | ||||||||||||||||
| gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript; | ||||||||||||||||
|
|
||||||||||||||||
| location /mock-relying-party-service/fetchUserInfo { | ||||||||||||||||
| proxy_pass http://mock-relying-party-service:8888/fetchUserInfo; | ||||||||||||||||
| proxy_redirect off; | ||||||||||||||||
| proxy_set_header Host $host; | ||||||||||||||||
| proxy_set_header X-Real-IP $remote_addr; | ||||||||||||||||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||||||||||||||
| proxy_set_header X-Forwarded-Host $server_name; | ||||||||||||||||
| } | ||||||||||||||||
| location /mock-relying-party-service/requestUri { | ||||||||||||||||
| proxy_pass http://mock-relying-party-service:8888/requestUri; | ||||||||||||||||
| proxy_redirect off; | ||||||||||||||||
| proxy_set_header Host $host; | ||||||||||||||||
| proxy_set_header X-Real-IP $remote_addr; | ||||||||||||||||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||||||||||||||
| proxy_set_header X-Forwarded-Host $server_name; | ||||||||||||||||
| proxy_http_version 1.1; | ||||||||||||||||
| } | ||||||||||||||||
| location /mock-relying-party-service/dpopJKT { | ||||||||||||||||
| proxy_pass http://mock-relying-party-service:8888/dpopJKT ; | ||||||||||||||||
| proxy_redirect off; | ||||||||||||||||
| proxy_set_header Host $host; | ||||||||||||||||
| proxy_set_header X-Real-IP $remote_addr; | ||||||||||||||||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||||||||||||||
| proxy_set_header X-Forwarded-Host $server_name; | ||||||||||||||||
| proxy_http_version 1.1; | ||||||||||||||||
| } | ||||||||||||||||
|
|
||||||||||||||||
| location / { | ||||||||||||||||
| # alias /usr/share/nginx/html; | ||||||||||||||||
| try_files $uri $uri/ /index.html; | ||||||||||||||||
| } | ||||||||||||||||
|
Comment on lines
+50
to
+53
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value Remove the dead commented-out Line 51 ( 🧹 Proposed cleanup location / {
- # alias /usr/share/nginx/html;
try_files $uri $uri/ /index.html;
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||
| } | ||||||||||||||||
| } | ||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does the official postgres Docker image on Docker Hub have a standalone "bookworm" tag (without a version number)?💡 Result:
Yes, the official Postgres Docker image on Docker Hub includes a standalone "bookworm" tag [1][2]. As of August 3, 2026, the image documentation lists "bookworm" as a valid tag, which typically points to the most recent supported PostgreSQL version on the Debian Bookworm distribution [1][3]. For example, current tags include "18.4-bookworm", "18-bookworm", and the standalone "bookworm" [1][2]. It is important to note that the maintainers of the Docker Official Images have periodically discussed or implemented the deprecation of such generic, version-agnostic tags (e.g., "latest", "bookworm", "alpine") to encourage users to pin specific versions for better stability [4]. While the "bookworm" tag is currently listed, it is recommended to use version-specific tags (such as "18-bookworm") to avoid unexpected upgrades when the underlying PostgreSQL version updates [3].
Citations:
🏁 Script executed:
Repository: mosip/esignet
Length of output: 2731
Pin the Postgres Docker image to a version tag.
postgres:bookwormis supported, but version-agnostic Docker tags move over time. For reproducible and GDPR/MOSIP-compliant builds, use a specific tag such aspostgres:16-bookwormindocker-compose/dependent-docker-compose.yaml.🤖 Prompt for AI Agents