Skip to content

Commit 8b292c3

Browse files
RedjiJBRedjiJB
committed
feat(lab-05): FreeIPA integration -- FreeIPA+KC+PG+Redis full ecosystem
1 parent f01ff91 commit 8b292c3

3 files changed

Lines changed: 300 additions & 76 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,15 @@ jobs:
2525
echo "Validating: docker/docker-compose.lan.yml"
2626
docker compose -f docker/docker-compose.lan.yml config -q
2727
echo "OK: docker/docker-compose.lan.yml"
28-
for f in docker/docker-compose.advanced.yml \
29-
docker/docker-compose.sso.yml docker/docker-compose.integration.yml \
30-
docker/docker-compose.production.yml; do
28+
for f in docker/docker-compose.advanced.yml docker/docker-compose.sso.yml; do
29+
echo "Checking scaffold: $f"
30+
docker compose -f "$f" config --no-interpolate -q 2>&1 && echo "OK: $f" \
31+
|| echo "WARN: $f has placeholder variables (scaffold — not yet built out)"
32+
done
33+
echo "Validating: docker/docker-compose.integration.yml"
34+
docker compose -f docker/docker-compose.integration.yml config -q
35+
echo "OK: docker/docker-compose.integration.yml"
36+
for f in docker/docker-compose.production.yml; do
3137
echo "Checking scaffold: $f"
3238
docker compose -f "$f" config --no-interpolate -q 2>&1 && echo "OK: $f" \
3339
|| echo "WARN: $f has placeholder variables (scaffold — not yet built out)"
@@ -179,4 +185,29 @@ jobs:
179185
- name: ShellCheck test script
180186
run: |
181187
sudo apt-get install -y shellcheck -qq
182-
shellcheck tests/labs/test-lab-01-04.sh
188+
shellcheck tests/labs/test-lab-01-04.sh
189+
190+
lab-05-smoke:
191+
name: Lab 05 -- FreeIPA+KC+PG+Redis integration (syntax check only)
192+
runs-on: ubuntu-latest
193+
needs: validate
194+
continue-on-error: true
195+
steps:
196+
- uses: actions/checkout@v4
197+
198+
- name: Validate integration compose (pull images -- FreeIPA is privileged)
199+
run: |
200+
echo "NOTE: FreeIPA Lab 05 requires privileged + full IPA init (~5min); runs on real VMs"
201+
docker compose -f docker/docker-compose.integration.yml pull --quiet
202+
echo "Images pulled OK"
203+
204+
- name: Validate compose config
205+
run: docker compose -f docker/docker-compose.integration.yml config -q
206+
207+
- name: Verify test script syntax
208+
run: bash -n tests/labs/test-lab-01-05.sh
209+
210+
- name: ShellCheck test script
211+
run: |
212+
sudo apt-get install -y shellcheck -qq
213+
shellcheck tests/labs/test-lab-01-05.sh

‎docker/docker-compose.integration.yml‎

Lines changed: 135 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,143 @@
1-
# Lab 05 — Advanced Integration: freeipa with full IT-Stack ecosystem
2-
---
31
services:
2+
3+
# ── FreeIPA identity directory ────────────────────────────────────
44
freeipa:
5-
image: freeipa/freeipa-server:rocky-9
6-
container_name: it-stack-freeipa
7-
restart: unless-stopped
5+
image: freeipa/freeipa-server:fedora-41
6+
container_name: freeipa-lab05
7+
hostname: ipa.lab.local
8+
privileged: true
9+
tty: true
10+
stdin_open: true
11+
environment:
12+
IPA_SERVER_IP: 172.21.0.10
13+
IPA_SERVER_HOSTNAME: ipa.lab.local
14+
command:
15+
- ipa-server-install
16+
- --unattended
17+
- --realm=LAB.LOCAL
18+
- --domain=lab.local
19+
- --ds-password=Lab05Password!
20+
- --admin-password=Lab05Password!
21+
- --no-ntp
22+
- --no-host-dns
23+
- --setup-dns
24+
- --auto-forwarders
25+
volumes:
26+
- freeipa-int:/data
27+
- /sys/fs/cgroup:/sys/fs/cgroup:ro
28+
tmpfs:
29+
- /run
30+
- /tmp
831
ports:
9-
- "389:$firstPort"
32+
- "389:389"
33+
- "636:636"
34+
- "88:88/tcp"
35+
- "88:88/udp"
36+
networks:
37+
ipa-int-net:
38+
ipv4_address: 172.21.0.10
39+
sysctls:
40+
- net.ipv6.conf.all.disable_ipv6=0
41+
healthcheck:
42+
test: ["CMD", "ipa", "user-find", "--all"]
43+
interval: 30s
44+
timeout: 10s
45+
retries: 20
46+
start_period: 300s
47+
48+
# ── Keycloak DB ───────────────────────────────────────────────────
49+
kc-db:
50+
image: postgres:16-alpine
1051
environment:
11-
- IT_STACK_ENV=lab-05-integration
12-
- KEYCLOAK_URL=
13-
- DB_HOST=
14-
- REDIS_HOST=
15-
- SMTP_HOST=
16-
- GRAYLOG_HOST=
17-
extra_hosts:
18-
- "lab-id1:10.0.50.11"
19-
- "lab-db1:10.0.50.12"
20-
- "lab-proxy1:10.0.50.15"
52+
POSTGRES_DB: keycloak
53+
POSTGRES_USER: kcadmin
54+
POSTGRES_PASSWORD: Lab05Password!
2155
networks:
22-
- it-stack-net
56+
- kc-db-net
57+
volumes:
58+
- kc-db-int:/var/lib/postgresql/data
59+
healthcheck:
60+
test: ["CMD-SHELL", "pg_isready -U kcadmin"]
61+
interval: 5s
62+
timeout: 3s
63+
retries: 20
64+
65+
# ── Keycloak: federates FreeIPA users via LDAP ────────────────────
66+
keycloak:
67+
image: quay.io/keycloak/keycloak:24.0
68+
command: start-dev
69+
depends_on:
70+
kc-db:
71+
condition: service_healthy
72+
environment:
73+
KC_BOOTSTRAP_ADMIN_USERNAME: admin
74+
KC_BOOTSTRAP_ADMIN_PASSWORD: Lab05Password!
75+
KC_DB: postgres
76+
KC_DB_URL: "jdbc:postgresql://kc-db:5432/keycloak"
77+
KC_DB_USERNAME: kcadmin
78+
KC_DB_PASSWORD: Lab05Password!
79+
KC_HTTP_PORT: "8080"
80+
KC_HOSTNAME_STRICT: "false"
81+
KC_PROXY: edge
82+
ports:
83+
- "8080:8080"
84+
networks:
85+
- ipa-int-net
86+
- kc-db-net
87+
healthcheck:
88+
test: ["CMD-SHELL", "curl -sf http://localhost:8080/health/ready || exit 1"]
89+
interval: 10s
90+
timeout: 5s
91+
retries: 30
92+
start_period: 60s
93+
94+
# ── PostgreSQL: app database with LDAP auth attempted ─────────────
95+
postgres:
96+
image: postgres:16-alpine
97+
environment:
98+
POSTGRES_DB: labapp
99+
POSTGRES_USER: labadmin
100+
POSTGRES_PASSWORD: Lab05Password!
101+
ports:
102+
- "5432:5432"
103+
networks:
104+
- ipa-int-net
105+
volumes:
106+
- pg-int:/var/lib/postgresql/data
107+
healthcheck:
108+
test: ["CMD-SHELL", "pg_isready -U labadmin"]
109+
interval: 5s
110+
timeout: 3s
111+
retries: 15
112+
113+
# ── Redis: shared session store ────────────────────────────────────
114+
redis:
115+
image: redis:7.2-alpine
116+
command: redis-server --requirepass Lab05Password! --appendonly yes
117+
ports:
118+
- "6379:6379"
119+
networks:
120+
- ipa-int-net
121+
volumes:
122+
- redis-int:/data
123+
healthcheck:
124+
test: ["CMD", "redis-cli", "-a", "Lab05Password!", "--no-auth-warning", "PING"]
125+
interval: 5s
126+
timeout: 3s
127+
retries: 15
23128

24129
networks:
25-
it-stack-net:
130+
ipa-int-net:
26131
driver: bridge
132+
ipam:
133+
config:
134+
- subnet: 172.21.0.0/24
135+
kc-db-net:
136+
driver: bridge
137+
internal: true
138+
139+
volumes:
140+
freeipa-int:
141+
kc-db-int:
142+
pg-int:
143+
redis-int:

0 commit comments

Comments
 (0)