59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
|
|
parameters:
|
|
keycloak.base_url: '%env(KEYCLOAK_BASE_URL)%'
|
|
keycloak.realm: '%env(KEYCLOAK_REALM)%'
|
|
keycloak.client_id: '%env(KEYCLOAK_CLIENT_ID)%'
|
|
keycloak.client_secret: '%env(KEYCLOAK_CLIENT_SECRET)%'
|
|
keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
|
|
keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'
|
|
|
|
# Allowlist of Appsmith apps this BFF will redirect back to, each with
|
|
# the Keycloak client role (on the bff client) required to enter it.
|
|
# Add one entry per app you build. Never accept a return URL from the
|
|
# request itself — always resolve through this map.
|
|
appsmith.apps:
|
|
app-sandbox:
|
|
url: '%env(APP_SANDBOX_LOGIN_URL)%'
|
|
role: 'app-sandbox-access'
|
|
|
|
# Named backends the proxy can forward to. A request picks one via the
|
|
# X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to
|
|
# .env and one entry here per backend. Any app may call any backend key
|
|
# — the backend is expected to do its own authorization off the roles
|
|
# claim in the forwarded access token (see README).
|
|
backends:
|
|
default:
|
|
url: '%env(BACKEND_BASE_URL)%'
|
|
|
|
services:
|
|
_defaults:
|
|
autowire: true
|
|
autoconfigure: true
|
|
bind:
|
|
$kcBaseUrl: '%keycloak.base_url%'
|
|
$kcRealm: '%keycloak.realm%'
|
|
$kcClientId: '%keycloak.client_id%'
|
|
$kcClientSecret: '%keycloak.client_secret%'
|
|
$kcRedirectUri: '%keycloak.redirect_uri%'
|
|
|
|
App\:
|
|
resource: '../src/'
|
|
exclude:
|
|
- '../src/Kernel.php'
|
|
|
|
App\Session\BffSessionStore:
|
|
arguments:
|
|
$cache: '@bff.session_cache'
|
|
|
|
App\Security\AppRegistry:
|
|
arguments:
|
|
$apps: '%appsmith.apps%'
|
|
|
|
App\Security\BackendRegistry:
|
|
arguments:
|
|
$backends: '%backends%'
|
|
|
|
App\Controller\AuthController:
|
|
arguments:
|
|
$postLogoutRedirect: '%keycloak.post_logout_redirect%'
|