Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models - AES-256-GCM private key storage and full certificate/CSR/CRL domain logic - Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates - imports/exports, XCA .xdb migration, Docker Compose stack and tests
2026-10-23 02:06:55 +00:00
commit 4f3a632f4b
109 changed files with 21048 additions and 0 deletions
@@ -0,0 +1,104 @@
+services:
+  postgres:
+    image: postgres:18-alpine
+    environment:
+      POSTGRES_DB: kca
+      POSTGRES_USER: kca
+      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U kca"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  # Mock OIDC provider (navikt/mock-oauth2-server). Interactive login accepts
+  # any username; alice, bob, carol and dave carry profile claims.
+  # The issuer is http://mockoauth:8180/kca, so both the browser and the app
+  # need the /etc/hosts entry documented in README.md.
+  mockoauth:
+    build: ./server/dev/mockoauth
+    environment:
+      SERVER_PORT: "8180"
+      LOG_LEVEL: INFO
+    ports:
+      - "8180:8180"
+
+  mockoauth-init:
+    image: curlimages/curl
+    depends_on:
+      - mockoauth
+    entrypoint: >
+      /bin/sh -c "
+      until curl -sf http://mockoauth:8180/kca/.well-known/openid-configuration > /dev/null; do
+        echo 'waiting for mockoauth...'; sleep 2;
+      done
+      "
+
+  redis:
+    image: redis:8-alpine
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  db-migrate:
+    build:
+      context: .
+      dockerfile: server/Dockerfile
+    working_dir: /app
+    command: ["aerich", "upgrade"]
+    environment:
+      DATABASE_ENGINE: postgres
+      DATABASE_HOST: postgres
+      DATABASE_PORT: "5432"
+      DATABASE_NAME: kca
+      DATABASE_USER: kca
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  kca:
+    build:
+      context: .
+      dockerfile: server/Dockerfile
+    depends_on:
+      postgres:
+        condition: service_healthy
+      db-migrate:
+        condition: service_completed_successfully
+      mockoauth-init:
+        condition: service_completed_successfully
+      redis:
+        condition: service_healthy
+    environment:
+      DATABASE_ENGINE: postgres
+      DATABASE_HOST: postgres
+      DATABASE_PORT: "5432"
+      DATABASE_NAME: kca
+      DATABASE_USER: kca
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
+      OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
+      OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/kca}
+      OIDC_0_CLIENT_ID: ${OIDC_0_CLIENT_ID:-kca}
+      OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
+      OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
+      OIDC_0_POST_LOGIN_REDIRECT: ${OIDC_0_POST_LOGIN_REDIRECT:-http://localhost:8080/}
+      OIDC_0_POST_LOGOUT_REDIRECT: ${OIDC_0_POST_LOGOUT_REDIRECT:-http://localhost:8080/}
+      REDIS_URL: redis://redis:6379/0
+      # Development master key. Override for any real deployment:
+      #   openssl rand -base64 32
+      KCA_MASTER_KEY: ${KCA_MASTER_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
+      MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-20971520}
+    ports:
+      - "127.0.0.1:${APP_PORT:-8080}:8080"
+
+volumes:
+  pgdata: