Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/keycloak/module.json

@@ -1,6 +1,7 @@
 {
   "module": "keycloak",
   "version": "1",
+  "moved": true,
   "upgrade": {
     "policy": "record",
     "why": "every person's sign-in to every site goes through it, and its new version migrates its database on start: a person takes each build, after a backup (hq ADR 0236)"
@@ -63,7 +64,7 @@
       "authorization-path": "/protocol/openid-connect/auth",
       "token-path": "/protocol/openid-connect/token",
       "userinfo-path": "/protocol/openid-connect/userinfo",
-      "issuer": "${setting:issuer}"
+      "issuer": "${config:issuer}"
     }
   },
   "receives": {
@@ -84,6 +85,32 @@
       }
     }
   },
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's provider reaches Keycloak's admin API at, as a URL; empty is this machine's Keycloak on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "user": {
+      "type": "string",
+      "description": "The Keycloak administrator the module's provider signs in as; empty is admin.",
+      "trusted": true,
+      "default": ""
+    },
+    "realm": {
+      "type": "string",
+      "description": "The realm the module's provider makes its consumers' clients in; empty is master.",
+      "trusted": true,
+      "default": ""
+    },
+    "issuer": {
+      "type": "string",
+      "description": "The issuer Keycloak's tokens name and oidc consumers are told, as the realm's URL, such as https://keycloak.example.org/realms/Example; the operator's, with no default (novox/hq ADR 0112, ADR 0155).",
+      "trusted": true,
+      "required": true
+    }
+  },
   "resources": [
     {
       "id": "mesh-state",
@@ -102,19 +129,26 @@
       "type": "directory",
       "mode": "0700"
     },
+    {
+      "id": "consumers",
+      "type": "file",
+      "path": "${dir:state}/consumers.json",
+      "mode": "0600",
+      "template": "files/consumers.json"
+    },
     {
       "id": "admin-env",
       "type": "file",
       "path": "${dir:state}/admin.env",
       "mode": "0600",
-      "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
+      "template": "files/admin.env"
     },
     {
       "id": "database-env",
       "type": "file",
       "path": "${dir:state}/database.env",
       "mode": "0600",
-      "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
+      "template": "files/database.env"
     },
     {
       "id": "net",
@@ -126,7 +160,7 @@
       "type": "file",
       "path": "${dir:state}/hostname.env",
       "mode": "0644",
-      "content": "KC_HOSTNAME=https://${bound:route:name}\n"
+      "template": "files/hostname.env"
     },
     {
       "id": "server",
@@ -161,9 +195,9 @@
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "template": "files/config.json",
       "merge": "json",
-      "takes-settings": [
+      "takes-config": [
         "url",
         "user",
         "realm",
@@ -188,9 +222,21 @@
           "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
           "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
           "MESH_RECEIVES": "${dir:grants}/mesh.json",
-          "MESH_KEYCLOAK_CONTAINER": "keycloak"
+          "MESH_KEYCLOAK_CONTAINER": "keycloak",
+          "MESH_CONSUMERS_FILE": "${dir:state}/consumers.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
-  }
+  },
+  "state": [
+    "bound"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ]
 }