feat(altcha) #4543 : add altcha to hydra sql theme

components/hydra-oidc/kustomization.yaml

@@ -15,6 +15,7 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
   - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
   - OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -17,9 +17,52 @@ spec:
         app.kubernetes.io/name: hydra-oidc
     spec:
       containers:
-      - name: hydra-oidc
+      - name: hydra-oidc-php-fpm
-        image: reg.cadoles.com/gdupont/hydra-oidc-base:frankenphp20
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
         imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+              - sh
+              - -c
+              - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+              - php
+              - bin/console
+              - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        env:
+          - name: PHP_FPM_LISTEN
+            value: 127.0.0.1:9000
+          - name: PHP_MEMORY_LIMIT
+            value: 128m
+          - name: PHP_FPM_MEMORY_LIMIT
+            value: 128m
+        envFrom:
+          - configMapRef:
+              name: hydra-oidc-env
+        resources: {}
+        securityContext:
+          runAsNonRoot: true
+          runAsGroup: 1000
+          runAsUser: 1000
+
+      - name: hydra-oidc-caddy
+        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
+        imagePullPolicy: IfNotPresent
+        args:
+          [
+            "/usr/sbin/caddy",
+            "run",
+            "--adapter",
+            "caddyfile",
+            "--config",
+            "/etc/caddy/Caddyfile",
+          ]
         readinessProbe:
           httpGet:
             path: /healthy
@@ -41,6 +84,8 @@ spec:
           - configMapRef:
               name: hydra-oidc-env
         env:
+          - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+            value: 127.0.0.1:9000
           - name: CADDY_HTTPS_PORT
             value: "8443"
           - name: CADDY_HTTP_PORT
@@ -49,17 +94,9 @@ spec:
             value: "/tmp/caddy"
           - name: CADDY_APP_ROOT_PUBLIC
             value: "/app/public/"
-          - name: CADDY_LOG_FILTER
-            value: healthy|metrics
-          - name: CADDY_LOG_SKIP
-            value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true
           runAsGroup: 1000
           runAsUser: 1000
       restartPolicy: Always
-      volumes:
-        - name: oidc-tmp
-          emptyDir:
-            medium: Memory

components/hydra-sql/files/sql_login.yaml

@@ -0,0 +1,7 @@
+sql_login:
+  login_column_name: mail
+  password_column_name: password
+  salt_column_name: salt
+  table_name: user
+  data_to_fetch:
+  - mail

components/hydra-sql/kustomization.yaml

@@ -27,6 +27,9 @@ configMapGenerator:
   - ALTCHA_HOST=http://altcha:3333
   - ALTCHA_BASE_URL=/altcha
   - ALTCHA_ENABLED=true
+- name: sql-login-config
+  files:
+  - ./files/sql_login.yaml
 - name: hydra-sql-php-ini
   files:
   - ./files/03_base.ini

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -20,9 +20,57 @@ spec:
         app.kubernetes.io/name: hydra-sql
     spec:
       containers:
-      - name: hydra-sql
+      - name: hydra-sql-fpm
-        image: reg.cadoles.com/gdupont/hydra-sql-base:frankenphp20
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.3.7-develop.1415.7239d84
         imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        resources: {}
+        securityContext:
+          runAsNonRoot: true
+          runAsGroup: 1000
+          runAsUser: 1000
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_LOG_LEVEL
+          value: warning
+        - name: OPCACHE_VALIDATE_TIMESTAMP
+          value: "0"
+        - name: OPCACHE_REVALIDATE_FREQ
+          value: "0"
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
+        - name: hydra-sql-php-ini
+          mountPath: /etc/php81/conf.d/03_base.ini
+          subPath: 03_base.ini
+
+      - name: hydra-sql-caddy
+        image: reg.cadoles.com/cadoles/hydra-sql-base:2025.3.7-develop.1415.7239d84
+        imagePullPolicy: IfNotPresent
+        args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
         readinessProbe:
           httpGet:
             path: /health
@@ -41,6 +89,8 @@ spec:
         - configMapRef:
             name: hydra-sql-env
         env:
+        - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
         - name: CADDY_HTTPS_PORT
           value: "8443"
         - name: CADDY_HTTP_PORT
@@ -49,10 +99,6 @@ spec:
           value: "/tmp/caddy"
         - name: CADDY_APP_ROOT_PUBLIC
           value: "/app/public/"
-        - name: CADDY_LOG_FILTER
-          value: health|metrics
-        - name: CADDY_LOG_SKIP
-          value: "true"
         resources: {}
         securityContext:
           runAsNonRoot: true
@@ -61,12 +107,16 @@ spec:
         ports:
         - containerPort: 8080
           name: http
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
       volumes:
+      - name: sql-login-config
+        configMap:
+          name: sql-login-config
       - name: hydra-sql-php-ini
         configMap:
           name: hydra-sql-php-ini
-      - name: sql-tmp
-        emptyDir:
-          medium: Memory
 
       restartPolicy: Always

resources/hydra-dispatcher/files/hydra/default.yaml

@@ -0,0 +1,16 @@
+parameters:
+  env(HYDRA_DISPATCHER_WEBHOOK_ENABLED): false
+  env(HYDRA_DISPATCHER_WEBHOOK_API_URL): ""
+  env(HYDRA_DISPATCHER_WEBHOOK_API_KEY): ""
+  env(HYDRA_DISPATCHER_WEBHOOK_API_METHOD): POST
+  env(HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES): true
+
+hydra:
+  apps: []
+  webhook:
+    enabled: "%env(bool:HYDRA_DISPATCHER_WEBHOOK_ENABLED)%"
+    api_url: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_URL)%"
+    api_key: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_KEY)%"
+    api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
+  webhook_post_login:
+    enabled: false

resources/hydra-dispatcher/kustomization.yaml

@@ -14,6 +14,7 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
   - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_BASE_URL=http://hydra:4444
   - HYDRA_ADMIN_BASE_URL=http://hydra:4445
@@ -25,6 +26,9 @@ configMapGenerator:
   - DEFAULT_LOCALE=fr
   - APP_LOCALES=fr,en
   - REDIS_DSN="redis://redis:6379"
+- name: hydra-dispatcher-apps
+  files:
+  - apps.yaml=./files/hydra/default.yaml
 - name: hydra-dispatcher-php-ini
   files:
   - ./files/03_base.ini

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -18,9 +18,60 @@ spec:
         app.kubernetes.io/name: hydra-dispatcher
     spec:
       containers:
-        - name: hydra-dispatcher
+        - name: hydra-dispatcher-php-fpm
-          image: reg.cadoles.com/gdupont/hydra-dispatcher-base:frankenphp20
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.3.18-develop.1401.4646fbb
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+                - php
+                - bin/console
+                - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+            - name: PHP_FPM_LISTEN
+              value: 127.0.0.1:9000
+            - name: PHP_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_MEMORY_LIMIT
+              value: 128m
+            - name: OPCACHE_VALIDATE_TIMESTAMP
+              value: "0"
+            - name: OPCACHE_REVALIDATE_FREQ
+              value: "0"
+          envFrom:
+            - configMapRef:
+                name: hydra-dispatcher-env
+          volumeMounts:
+            - mountPath: /app/config/hydra
+              name: hydra-dispatcher-apps
+            - name: hydra-dispatcher-php-ini
+              mountPath: /etc/php81/conf.d/03_base.ini
+              subPath: 03_base.ini
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+        - name: hydra-dispatcher-caddy
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2025.3.18-develop.1401.4646fbb
           imagePullPolicy: IfNotPresent
+          args:
+            [
+              "/usr/sbin/caddy",
+              "run",
+              "--adapter",
+              "caddyfile",
+              "--config",
+              "/etc/caddy/Caddyfile",
+            ]
           readinessProbe:
             httpGet:
               path: /health
@@ -39,6 +90,8 @@ spec:
             - configMapRef:
                 name: hydra-dispatcher-env
           env:
+            - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+              value: 127.0.0.1:9000
             - name: CADDY_HTTPS_PORT
               value: "8443"
             - name: CADDY_HTTP_PORT
@@ -47,23 +100,19 @@ spec:
               value: "/tmp/caddy"
             - name: CADDY_APP_ROOT_PUBLIC
               value: "/app/public/"
-            - name: CADDY_LOG_FILTER
-              value: health|metrics
-            - name: CADDY_LOG_SKIP
-              value: "true"
-          securityContext:
-            runAsNonRoot: true
-            runAsGroup: 1000
-            runAsUser: 1000
           ports:
             - containerPort: 8080
               name: http
           resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
       restartPolicy: Always
       volumes:
+        - name: hydra-dispatcher-apps
+          configMap:
+            name: hydra-dispatcher-apps
         - name: hydra-dispatcher-php-ini
           configMap:
             name: hydra-dispatcher-php-ini
-        - name: dispatcher-tmp
-          emptyDir:
-            medium: Memory