gnickensandClaude Opus 5
0526d34e42
Sets up the project skeleton: - FastAPI app factory with lifespan, request-id middleware, and RFC 9457 problem+json error handlers - Async SQLAlchemy 2.0 over MySQL (asyncmy), with a constraint naming convention in place before the first migration and async Alembic - Keycloak as a pure resource server: OIDC discovery, cached JWKS with rotation-aware refresh, and require_roles dependencies - Devcontainer running MySQL 8.4 and Keycloak 26.7 as compose siblings, with the realm (clients, roles, test users) imported on first boot - Test suite covering the endpoints plus the token validator itself, exercised against a locally generated RSA keypair - uv packaging, ruff, mypy --strict, pre-commit, Gitea CI, prod Dockerfile Two Keycloak-in-containers traps are handled explicitly and documented in the README: the issuer/internal-URL split (the browser sees localhost:8080, the API sees keycloak:8080) and the audience mapper that stops Keycloak issuing tokens with aud=account. The devices resource is a placeholder proving the routing -> auth -> ORM -> migration path end to end; replace it with the real domain. Co-Authored-By: Claude Opus 5 <[email protected]>
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
# Adds the development container to the stack defined in ../compose.yaml.
|
|
# Merged by devcontainer.json; not useful on its own.
|
|
|
|
services:
|
|
app:
|
|
build:
|
|
context: ..
|
|
dockerfile: .devcontainer/Dockerfile
|
|
command: sleep infinity
|
|
ports:
|
|
- "8000:8000"
|
|
volumes:
|
|
- ..:/workspaces/v2x-server:cached
|
|
# Keep the Linux venv out of the macOS/Windows bind mount. Without this,
|
|
# host-side tooling and platform-specific wheels collide.
|
|
- venv:/workspaces/v2x-server/.venv
|
|
environment:
|
|
APP_ENV: local
|
|
DEBUG: "true"
|
|
DATABASE_URL: mysql+asyncmy://v2x:v2xpassword@mysql:3306/v2x?charset=utf8mb4
|
|
TEST_DATABASE_URL: mysql+asyncmy://v2x:v2xpassword@mysql:3306/v2x_test?charset=utf8mb4
|
|
# Validated against the `iss` claim -- must match the URL the browser used
|
|
# to obtain the token, not the one this container dials.
|
|
KEYCLOAK_ISSUER: http://localhost:8080/realms/v2x
|
|
# Where this container actually reaches Keycloak for discovery + JWKS.
|
|
# KC_HOSTNAME_BACKCHANNEL_DYNAMIC makes discovery hand back a jwks_uri on
|
|
# this same host, so the fetch stays on the compose network.
|
|
KEYCLOAK_INTERNAL_URL: http://keycloak:8080
|
|
KEYCLOAK_REALM: v2x
|
|
KEYCLOAK_AUDIENCE: v2x-api
|
|
KEYCLOAK_SWAGGER_CLIENT_ID: v2x-swagger
|
|
CORS_ORIGINS: '["http://localhost:3000","http://localhost:8000"]'
|
|
depends_on:
|
|
# Migrations need a live database, so wait for MySQL properly.
|
|
mysql:
|
|
condition: service_healthy
|
|
# Keycloak is only contacted lazily, on the first token validation. Not
|
|
# blocking on its health keeps a slow or failed realm import from
|
|
# preventing the devcontainer from opening at all.
|
|
keycloak:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
venv:
|