Skip to content

feat: add transaction extension with auth stack #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pantierra wants to merge 1 commit into
base: main
Choose a base branch
from
+492 −14
Draft

feat: add transaction extension with auth stack #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,15 +86,20 @@ cd eoapi-workshop
docker compose up
```

This will start up 6 services:
This will start up 10 services:

- pgstac: postgres database with pgstac installed, running on port 5439
- stac-fastapi-pgstac: STAC API available on port 8081
- stac-fastapi-pgstac: upstream STAC API available directly on port 8081
- stac-auth-proxy: primary STAC API entry point available on port 8084
- mock-oidc-server: local test identity provider available on port 8085
- titiler-pgstac: dynamic tiler available on port 8082
- tipg: vector feature/tile server available on port 8083
- stac-browser: beautiful interface for browsing a STAC API available on port 8085
- stac-browser: beautiful interface for browsing a STAC API available on port 8080
- stac-manager: web UI for editing STAC metadata via authenticated transactions on port 8086
- Jupyter Hub: interactive compute environment where you can browse the tutorial materials interactively, available on port 8888

The local STAC API is available at `http://localhost:8084` through stac-auth-proxy. Read operations are public; transaction writes require a bearer token from the mock OIDC server (any username such as `test-user`). See [chapter 3](./docs/03-stac_fastapi_pgstac.ipynb) for read-only STAC API exploration and [chapter 6](./docs/06-stac_transactions_auth.ipynb) for authenticated transactions. [STAC Manager](http://localhost:8086) uses the same API.

4. Open the Jupyter Hub in your web browser at `http://localhost:8888` and go through the tutorials in the `/docs` folder!

## Deploying to AWS
Expand Down
51 changes: 48 additions & 3 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ services:
- POSTGRES_PORT=5432
- DB_MIN_CONN_SIZE=1
- DB_MAX_CONN_SIZE=1
- ENABLE_TRANSACTIONS_EXTENSIONS=1
depends_on:
database:
condition: service_started
Expand All @@ -83,6 +84,29 @@ services:
volumes:
- ./dockerfiles/scripts:/tmp/scripts

mock-oidc:
image: ghcr.io/alukach/mock-oidc-server:latest
ports:
- 8085:8888
environment:
- ISSUER=http://localhost:8085
- PORT=8888
- SCOPES=stac:read,stac:write

stac-auth-proxy:
image: ghcr.io/developmentseed/stac-auth-proxy:latest
ports:
- 8084:8000
environment:
- UPSTREAM_URL=http://stac-fastapi:8081
- OIDC_DISCOVERY_URL=http://localhost:8085/.well-known/openid-configuration
- OIDC_DISCOVERY_INTERNAL_URL=http://mock-oidc:8888/.well-known/openid-configuration
- DEFAULT_PUBLIC=true
- WAIT_FOR_UPSTREAM=true
depends_on:
- stac-fastapi
- mock-oidc

titiler-pgstac:
platform: linux/amd64
image: ghcr.io/stac-utils/titiler-pgstac:1.9.0
Expand Down Expand Up @@ -150,11 +174,29 @@ services:
ports:
- 8080:8080
environment:
SB_catalogUrl: "http://0.0.0.0:8081"
SB_catalogUrl: "http://localhost:8084"
depends_on:
- stac-fastapi
- stac-auth-proxy
- database

stac-manager:
# no arm64 manifest published — run the amd64 image under emulation
platform: linux/amd64
image: ghcr.io/developmentseed/stac-manager:1.0.3
ports:
- 8086:8080
environment:
- PUBLIC_URL=http://localhost:8086
- REACT_APP_STAC_API=http://localhost:8084
- REACT_APP_STAC_BROWSER=http://localhost:8080
- REACT_APP_OIDC_AUTHORITY=http://localhost:8085
- REACT_APP_OIDC_CLIENT_ID=stac-manager
- APP_TITLE=STAC Manager
- APP_DESCRIPTION=Manage STAC collections and items in the eoAPI workshop stack
depends_on:
- stac-auth-proxy
- mock-oidc

jupyterhub:
build:
context: .
Expand All @@ -169,10 +211,13 @@ services:
- PGPASSWORD=password
- PGDATABASE=postgis
- PGPORT=5432
- STAC_API_ENDPOINT=http://stac-fastapi:8081
- STAC_API_ENDPOINT=http://stac-auth-proxy:8000
- STAC_AUTH_PROXY_ENDPOINT=http://stac-auth-proxy:8000
- MOCK_OIDC_ENDPOINT=http://mock-oidc:8888
- TITILER_PGSTAC_API_ENDPOINT=http://titiler-pgstac:8082
- TIPG_API_ENDPOINT=http://tipg:8083
- STAC_BROWSER_ENDPOINT=http://localhost:8080
- STAC_MANAGER_ENDPOINT=http://localhost:8086

volumes:
pgdata:
Expand Down
23 changes: 15 additions & 8 deletions docs/00-introduction.ipynb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"## Workshop Infrastructure:\n",
"\n",
"* Project homepage: <https://github.com/developmentseed/eoapi-workshop>\n",
"* For the workshop we have deployed an eoAPI stack to AWS using eoapi-cdk (see [DEPLOYMENT.md](../DEPLOYMENT.md) for details) \n",
"* For the workshop we have deployed an eoAPI stack to a cluster using eoapi-k8s\n",
" * eoAPI API endpoints: \n",
" * titiler-pgstac: <https://workshop-raster.eoapi.dev>\n",
" * stac-fastapi-pgstac: <https://workshop-stac.eoapi.dev>\n",
Expand Down Expand Up @@ -401,22 +401,29 @@
"source": [
"### 5.1 Local Development with Docker\n",
"\n",
"For testing and development, eoAPI provides a Docker compose setup:\n",
"This workshop includes a Docker Compose setup for running a full eoAPI stack and JupyterHub locally. See the [README](../README.md#local-development) for Docker installation and GitHub Container Registry authentication.\n",
"\n",
"```bash\n",
"git clone https://github.com/developmentseed/eoAPI.git\n",
"cd eoAPI\n",
"git clone https://github.com/developmentseed/eoapi-workshop.git\n",
"cd eoapi-workshop\n",
"docker compose up\n",
"```\n",
"\n",
"This creates a local environment with all services running in containers on your laptop which you can interact with via any http client.\n",
"This starts the following services:\n",
"\n",
"- stac-fastapi-pgstac: <http://localhost:8081>\n",
"- pgstac (PostgreSQL): port 5439\n",
"- **STAC API** (stac-auth-proxy): <http://localhost:8084> — primary entry point; reads are public, writes require authentication\n",
"- stac-fastapi-pgstac: <http://localhost:8081> — upstream API (debugging only)\n",
"- mock-oidc-server: <http://localhost:8085>\n",
"- titiler-pgstac: <http://localhost:8082>\n",
"- tipg: <http://localhost:8083>\n",
"- stac-browser: <http://localhost:8085>\n",
"- stac-browser: <http://localhost:8080>\n",
"- stac-manager: <http://localhost:8086> — web UI for authenticated STAC edits\n",
"- JupyterHub: <http://localhost:8888> — run these notebooks interactively\n",
"\n",
"The pgstac database will be accessible via `psql` on port 5439:\n",
"Open JupyterHub and work through the notebooks in `/docs`. Chapter 3 covers read-only STAC API access; [chapter 6](./06-stac_transactions_auth.ipynb) exercises authenticated transactions.\n",
"\n",
"The pgstac database is accessible via `psql` on port 5439:\n",
"```bash\n",
"psql postgresql://username:password@localhost:5439/postgis\n",
"```"
Expand Down
Loading