init: 클린 기반 auth 서버 설계

2026-07-24 14:30:18 +09:00
parent 471db0203d
commit 8a1ac1e769
3642 changed files with 275893 additions and 1 deletions
@@ -0,0 +1,75 @@
+# syntax=docker/dockerfile:1.7
+
+FROM eclipse-temurin:21-jdk-jammy@sha256:93916be89a15149f1d7e72f0fce69a468106ac918c2dc82f37f65d6819fa73e2 AS builder
+
+WORKDIR /workspace
+
+COPY gradlew gradlew
+COPY gradle gradle
+COPY settings.gradle build.gradle gradle.properties ./
+COPY bootstrap/build.gradle bootstrap/build.gradle
+COPY application/build.gradle application/build.gradle
+COPY domain/build.gradle domain/build.gradle
+COPY infrastructure/build.gradle infrastructure/build.gradle
+COPY presentation/build.gradle presentation/build.gradle
+
+RUN chmod +x gradlew
+RUN --mount=type=cache,target=/root/.gradle \
+    ./gradlew --no-daemon \
+        :bootstrap:dependencies --configuration runtimeClasspath \
+        :bootstrap:dependencies --configuration compileClasspath \
+        -q
+
+COPY bootstrap/src/main bootstrap/src/main
+COPY application/src/main application/src/main
+COPY domain/src/main domain/src/main
+COPY infrastructure/src/main infrastructure/src/main
+COPY presentation/src/main presentation/src/main
+
+RUN --mount=type=cache,target=/root/.gradle \
+    ./gradlew --no-daemon :bootstrap:bootJar -x test && \
+    JAR_PATH="$(find /workspace/bootstrap/build/libs -maxdepth 1 -type f -name '*.jar' ! -name '*-plain.jar' | head -n 1)" && \
+    test -n "$JAR_PATH" && \
+    cp "$JAR_PATH" /workspace/application.jar && \
+    java -Djarmode=tools -jar /workspace/application.jar extract --layers --destination /workspace/extracted
+
+FROM eclipse-temurin:21-jre-jammy@sha256:fcf98f8a669c2778b2a1a145c7dac92a1f8fc71e967734bd2a749d2f42572db1
+
+ARG GIT_SHA="unknown"
+ARG BUILD_DATE="unknown"
+ARG VERSION="dev"
+
+LABEL org.opencontainers.image.source="https://github.com/donghyeon-ka/Project-Auth-Server" \
+      org.opencontainers.image.revision="${GIT_SHA}" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.title="project-auth-server" \
+      org.opencontainers.image.description="OAuth2 resource server (Keycloak-mediated federation)" \
+      org.opencontainers.image.licenses="Apache-2.0"
+
+RUN groupadd --system --gid 10001 spring && \
+    useradd --system --uid 10001 --gid 10001 --create-home --home-dir /app spring
+
+WORKDIR /app
+
+ENV JAVA_TOOL_OPTIONS="\
+-XX:MaxRAMPercentage=75.0 \
+-XX:+ExitOnOutOfMemoryError \
+-XX:+HeapDumpOnOutOfMemoryError \
+-XX:HeapDumpPath=/tmp/heapdump.hprof \
+-XX:+UseG1GC \
+-Djava.security.egd=file:/dev/./urandom \
+-Duser.timezone=UTC"
+
+COPY --chown=spring:spring --from=builder /workspace/extracted/dependencies/ ./
+COPY --chown=spring:spring --from=builder /workspace/extracted/spring-boot-loader/ ./
+COPY --chown=spring:spring --from=builder /workspace/extracted/snapshot-dependencies/ ./
+COPY --chown=spring:spring --from=builder /workspace/extracted/application/ ./
+COPY --chown=spring:spring --from=builder /workspace/application.jar /app/application.jar
+
+EXPOSE 8080
+EXPOSE 8081
+
+USER 10001:10001
+
+ENTRYPOINT ["java", "-jar", "/app/application.jar"]
@@ -0,0 +1,136 @@
+name: project-auth-local
+
+x-defaults: &defaults
+  init: true
+  restart: unless-stopped
+  logging:
+    driver: json-file
+    options:
+      max-size: "10m"
+      max-file: "3"
+
+services:
+  postgres:
+    <<: *defaults
+    image: postgres:16-alpine
+    env_file:
+      - ../../.env.local
+    ports:
+      - "${POSTGRES_HOST_PORT:-5432}:5432"
+    environment:
+      POSTGRES_USER: ${POSTGRES_SUPERUSER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_SUPERUSER_PASSWORD:-postgres}
+      POSTGRES_DB: ${POSTGRES_DEFAULT_DB:-postgres}
+      AUTH_DB_NAME: ${AUTH_DB_NAME:-project_auth}
+      AUTH_DB_USER: ${AUTH_DB_USER:-project_auth}
+      AUTH_DB_PASSWORD: ${AUTH_DB_PASSWORD:-project_auth}
+      KEYCLOAK_DB_NAME: ${KEYCLOAK_DB_NAME:-keycloak}
+      KEYCLOAK_DB_USER: ${KEYCLOAK_DB_USER:-keycloak}
+      KEYCLOAK_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-keycloak}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./resources/postgres/init:/docker-entrypoint-initdb.d:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_SUPERUSER:-postgres} -d ${POSTGRES_DEFAULT_DB:-postgres}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks: [auth_net]
+
+  keycloak:
+    <<: *defaults
+    image: quay.io/keycloak/keycloak:26.5.5
+    env_file:
+      - ../../.env.local
+    command:
+      - start-dev
+      - --import-realm
+      - --http-port=8080
+      - --http-management-port=9000
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "${KEYCLOAK_HOST_PORT:-8081}:8080"
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://postgres:5432/${KEYCLOAK_DB_NAME:-keycloak}
+      KC_DB_USERNAME: ${KEYCLOAK_DB_USER:-keycloak}
+      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-keycloak}
+      KC_HEALTH_ENABLED: "true"
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN:-admin}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
+    volumes:
+      - keycloak_data:/opt/keycloak/data
+      - ../../docs/development/keycloak/realm:/opt/keycloak/data/import:ro
+    healthcheck:
+      # Keycloak image ships no curl/wget; use bash /dev/tcp against the management port.
+      test:
+        - "CMD-SHELL"
+        - |
+          exec 3<>/dev/tcp/127.0.0.1/9000 && \
+          printf 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && \
+          grep -q '200 OK' <&3
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+    networks: [auth_net]
+
+  vault:
+    <<: *defaults
+    image: hashicorp/vault:1.18
+    env_file:
+      - ../../.env.local
+    command:
+      - vault
+      - server
+      - -dev
+      - -dev-root-token-id=${VAULT_DEV_ROOT_TOKEN_ID:-project-auth-root-token}
+      - -dev-listen-address=0.0.0.0:8200
+    ports:
+      - "${VAULT_HOST_PORT:-8200}:8200"
+    environment:
+      # 127.0.0.1 here is correct: it scopes the in-container `vault` CLI used by the healthcheck.
+      VAULT_ADDR: http://127.0.0.1:8200
+      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID:-project-auth-root-token}
+      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
+    healthcheck:
+      test: ["CMD", "vault", "status", "-address=http://127.0.0.1:8200"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks: [auth_net]
+
+  vault-init:
+    image: hashicorp/vault:1.18
+    init: true
+    restart: "no"
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    env_file:
+      - ../../.env.local
+    depends_on:
+      vault:
+        condition: service_healthy
+    environment:
+      VAULT_ADDR: http://vault:8200
+      VAULT_TOKEN: ${VAULT_DEV_ROOT_TOKEN_ID:-project-auth-root-token}
+      VAULT_TRANSIT_KEY_NAME: ${VAULT_TRANSIT_KEY_NAME:-project-auth-jwt}
+    entrypoint:
+      - /bin/sh
+      - /vault-init/01-init-transit.sh
+    volumes:
+      - ./resources/vault/init:/vault-init:ro
+    networks: [auth_net]
+
+volumes:
+  postgres_data:
+  keycloak_data:
+
+networks:
+  auth_net:
+    name: project-auth-local
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER}" --dbname "${POSTGRES_DB}" <<-EOSQL
+  CREATE USER ${AUTH_DB_USER} WITH PASSWORD '${AUTH_DB_PASSWORD}';
+  CREATE DATABASE ${AUTH_DB_NAME} OWNER ${AUTH_DB_USER};
+
+  CREATE USER ${KEYCLOAK_DB_USER} WITH PASSWORD '${KEYCLOAK_DB_PASSWORD}';
+  CREATE DATABASE ${KEYCLOAK_DB_NAME} OWNER ${KEYCLOAK_DB_USER};
+EOSQL
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -eu
+
+vault secrets enable transit || true
+vault write "transit/keys/${VAULT_TRANSIT_KEY_NAME}" type="rsa-2048" || true
+vault read "transit/keys/${VAULT_TRANSIT_KEY_NAME}"