Docker improvements.

Add env variables to help with running in docker.
Add example docker compose file.
Add Dockerfile for building a container.

docker/build.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+docker build -t fedservice -f ./fedservice.Dockerfile .. --no-cache

docker/docker-compose.yml

@@ -0,0 +1,66 @@
+services:
+  wallet_provider:
+    image: fedservice
+    command: "wallet_provider"
+    ports:
+      - "5001:5001"
+    environment:
+      FEDSERVICE_ENTITYID: https://example.com:5001
+      FEDSERVICE_WEBCERT_KEY: /cert/privkey.pem
+      FEDSERVICE_WEBCERT_CHAIN: /cert/chain.pem
+      FEDSERVICE_SECRET_KEY: 12345678909987654321
+      FEDSERVICE_DEBUG: true
+      FEDSERVICE_PORT: 5001
+      FEDSERVICE_BIND: 0.0.0.0
+    volumes:
+    - ./wallet_provider:/wallet_provider:rw
+    - ./certificates:/certs:ro
+  trust_mark_issuer:
+    image: fedservice
+    command: "trust_mark_issuer"
+    ports:
+      - "6001:6001"
+    environment:
+      FEDSERVICE_ENTITYID: https://example.com:5005
+      FEDSERVICE_WEBCERT_KEY: /cert/privkey.pem
+      FEDSERVICE_WEBCERT_CHAIN: /cert/chain.pem
+      FEDSERVICE_SECRET_KEY: 12345678909987654321
+      FEDSERVICE_DEBUG: true
+      FEDSERVICE_PORT: 6001
+      FEDSERVICE_BIND: 0.0.0.0
+    volumes:
+    - ./trust_mark_issuer:/trust_mark_issuer:rw
+    - ./certificates:/certs:ro
+  trust_anchor:
+    image: fedservice
+    command: "trust_anchor"
+    ports:
+      - "7001:7001"
+    environment:
+      FEDSERVICE_ENTITYID: https://example.com:7001
+      FEDSERVICE_WEBCERT_KEY: /cert/privkey.pem
+      FEDSERVICE_WEBCERT_CHAIN: /cert/chain.pem
+      FEDSERVICE_SECRET_KEY: 12345678909987654321
+      FEDSERVICE_DEBUG: true
+      FEDSERVICE_PORT: 7001
+      FEDSERVICE_BIND: 0.0.0.0
+    volumes:
+    - ./trust_anchor:/trust_anchor:rw
+    - ./certificates:/certs:ro
+  flask_wallet:
+    image: fedservice
+    command: "flask_wallet"
+    ports:
+      - "5005:5005"
+    environment:
+      FEDSERVICE_ENTITYID: https://example.com:5005
+      FEDSERVICE_WEBCERT_KEY: /cert/privkey.pem
+      FEDSERVICE_WEBCERT_CHAIN: /cert/chain.pem
+      FEDSERVICE_SECRET_KEY: 12345678909987654321
+      FEDSERVICE_DEBUG: true
+      FEDSERVICE_PORT: 5005
+      FEDSERVICE_BIND: 0.0.0.0
+    volumes:
+    - ./flask_wallet:/flask_wallet:rw
+    - ./certificates:/certs:ro
+

docker/fedservice.Dockerfile

@@ -0,0 +1,21 @@
+FROM python:3.12-bookworm
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    python3-dev \
+    build-essential \
+    python3-pip \
+    libffi-dev \
+    libssl-dev \
+    xmlsec1 \
+    libyaml-dev
+RUN pip3 install --upgrade pip setuptools
+COPY . /fedservice
+RUN pip3 install -r fedservice/docker/requirements.docker
+RUN pip3 install /fedservice
+COPY docker/start.sh .
+ENTRYPOINT ["/start.sh"]
+#RUN cp /src/fedservice/setup_federation/entity.py /
+#RUN sed -e "s@'templates'@'data/templates'@" -e "s@sys.path.insert(0, dir_path)@sys.path.insert(0, dir_path)\n    app.config['SECRET_KEY'] = os.urandom(12).hex()@" /src/fedservice/setup_federation/entity.py > /entity.py && \
+#        chmod u+x /entity.py
+

docker/requirements.docker

@@ -0,0 +1,4 @@
+-e git+https://github.com/IdentityPython/idpy-oidc.git@dpop_add#egg=idpyoidc
+-e git+https://github.com/rohe/openid4v.git#egg=openid4v
+-e git+https://github.com/rohe/idpy-sdjwt.git#egg=idpysdjwt
+flask

docker/start.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+for file in conf.json views.py; do
+	if [ ! -f /"${1}"/"${file}" ]; then
+		echo "No ${file} found, copying to /wallet_provider/"
+		cp /fedservice/setup_federation/"${1}"/"${file}" /"${1}"/
+	else
+		echo "${file} found, leaving alone. Beware when upgrading."
+
+	fi
+done
+echo "Starting wallet_provider."
+/fedservice/setup_federation/entity.py "$@"

setup_federation/entity.py

@@ -24,12 +24,16 @@ def init_app(dir_name, **kwargs) -> Flask:
 
     # Session key for the application session
     app.config['SECRET_KEY'] = os.urandom(12).hex()
-
+    app.config.from_prefixed_env(prefix="FEDSERVICE")
     entity = importer(f"{dir_name}.views.entity")
     app.register_blueprint(entity)
 
     # Initialize the oidc_provider after views to be able to set correct urls
     app.cnf = load_config_file(f"{dir_name}/conf.json")
+    if os.environ.get('FEDSERVICE_ENTITYID'):
+        entity_id = os.environ.get('FEDSERVICE_ENTITYID')
+        print(f"Setting entity_id to {entity_id} from env")
+        app.cnf['entity']['entity_id'] = entity_id
     app.cnf["cwd"] = dir_path
     app.server = make_federation_combo(**app.cnf["entity"])
     if isinstance(app.server, FederationCombo):
@@ -48,12 +52,18 @@ def init_app(dir_name, **kwargs) -> Flask:
     if "logging" in app.cnf:
         configure_logging(config=app.cnf["logging"])
     _web_conf = app.cnf["webserver"]
+    if os.environ.get('FEDSERVICE_WEBCERT_KEY'):
+        _web_conf['server_key'] = os.environ.get('FEDSERVICE_WEBCERT_KEY')
+        _web_conf['server_chain'] = os.environ.get('FEDSERVICE_WEBCERT_CHAIN')
+        _web_conf['server_cert'] = os.environ.get('FEDSERVICE_WEBCERT_CERT')
     context = create_context(dir_path, _web_conf)
     _cert = "{}/{}".format(dir_path, lower_or_upper(_web_conf, "server_cert"))
 
     print('Listening on {}:{}'.format(_web_conf.get('domain'), _web_conf.get('port')))
     _trust_anchors = {k:v for k,v in app.federation_entity.function.trust_chain_collector.trust_anchors.items()}
     print(f"Trust Anchors: {_trust_anchors}")
     # app.rph.federation_entity.collector.web_cert_path = _cert
-    app.run(host=_web_conf.get('domain'), port=_web_conf.get('port'),
+    domain = os.environ.get('FEDSERVICE_BIND') or _web_conf.get('domain')
+    port = os.environ.get('FEDSERVICE_PORT') or _web_conf.get('port')
+    app.run(host=domain, port=port,
             debug=_web_conf.get("debug"), ssl_context=context)