65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
|
|
parameters:
|
|
keycloak.base_url: '%env(KEYCLOAK_BASE_URL)%'
|
|
keycloak.realm: '%env(KEYCLOAK_REALM)%'
|
|
keycloak.client_id: '%env(KEYCLOAK_CLIENT_ID)%'
|
|
keycloak.client_secret: '%env(KEYCLOAK_CLIENT_SECRET)%'
|
|
keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
|
|
keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'
|
|
|
|
# Allowlist of Appsmith apps this BFF will redirect back to. An app's
|
|
# permissions are the Keycloak roles on the bff client sharing its
|
|
# `role_prefix`; the prefix is stripped when they're reported to the app,
|
|
# so `app-sandbox-write` becomes "write". Adding a permission means
|
|
# creating the role in Keycloak — nothing to change here. `access_role`
|
|
# is the single role required to enter the app at all.
|
|
# Keep prefixes non-overlapping across apps, or roles bleed between them.
|
|
# Add one entry per app you build. Never accept a return URL from the
|
|
# request itself — always resolve through this map.
|
|
appsmith.apps:
|
|
app-hub:
|
|
url: '%env(APP_HUB_URL)%'
|
|
role_prefix: 'app-hub-'
|
|
access_role: 'app-hub-access'
|
|
|
|
# Named backends the proxy can forward to. A request picks one via the
|
|
# X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to
|
|
# .env and one entry here per backend. Any app may call any backend key
|
|
# — the backend is expected to do its own authorization off the roles
|
|
# claim in the forwarded access token (see README).
|
|
backends:
|
|
default:
|
|
url: '%env(BACKEND_BASE_URL)%'
|
|
|
|
services:
|
|
_defaults:
|
|
autowire: true
|
|
autoconfigure: true
|
|
bind:
|
|
$kcBaseUrl: '%keycloak.base_url%'
|
|
$kcRealm: '%keycloak.realm%'
|
|
$kcClientId: '%keycloak.client_id%'
|
|
$kcClientSecret: '%keycloak.client_secret%'
|
|
$kcRedirectUri: '%keycloak.redirect_uri%'
|
|
|
|
App\:
|
|
resource: '../src/'
|
|
exclude:
|
|
- '../src/Kernel.php'
|
|
|
|
App\Session\BffSessionStore:
|
|
arguments:
|
|
$cache: '@bff.session_cache'
|
|
|
|
App\Security\AppRegistry:
|
|
arguments:
|
|
$apps: '%appsmith.apps%'
|
|
|
|
App\Security\BackendRegistry:
|
|
arguments:
|
|
$backends: '%backends%'
|
|
|
|
App\Controller\AuthController:
|
|
arguments:
|
|
$postLogoutRedirect: '%keycloak.post_logout_redirect%'
|