Feat/keycloak authentication

.env.example

@@ -1,56 +1,46 @@
-ENV = 'dev' # 'prod' or 'dev'
-
-# API URLs for frontend
-RAGDOLL_CONFIG_API_URL = 'http://localhost:3000'
-RAGDOLL_CHAT_API_URL = 'http://localhost:3001'
-
-# LLM api keys and models
-
-# OpenAI
-OPENAI_API_KEY='your_api_key_here'
-GPT_MODEL = 'gpt-4o-mini'
-
-# Google Gemini
-GEMINI_API_KEY='your_api_key_here'
-GEMINI_MODEL='gemini-2.0-flash-lite'
-
-# Idun provider
-IDUN_MODEL='openai/gpt-oss-120b'
-IDUN_API_URL='https://idun-llm.hpc.ntnu.no/api/chat/completions'
-IDUN_API_KEY='your_idun_api_key_here'
-
-
-# Database Configuration
-# Production: Use MongoDB Atlas (supports vector search)
-MONGODB_URI='mongodb+srv://username:password@cluster.mongodb.net/?retryWrites=true&w=majority'
-
-# Database and Collections
-MONGODB_DATABASE='database'
-MONGODB_AGENT_COLLECTION='agents'
-MONGODB_CONTEXT_COLLECTION='contexts'
-MONGODB_DOCUMENTS_COLLECTION='documents'
-
-# TODO: Both the context and agent DAOs share the RAG_DATABASE_SYSTEM.
-# Fix this by separating it into two variables
-RAG_DATABASE_SYSTEM='mongodb' 
-
-# Testing/Mock database settings
-# Use MongoDB Atlas for testing with different database name
-MOCK_RAG_DATABASE_SYSTEM = 'mongodb'
-MOCK_MONGODB_URI='mongodb+srv://username:password@cluster.mongodb.net/?retryWrites=true&w=majority'
-MOCK_MONGODB_DATABASE='test_database'
-
-# AccessService, handles access keys, authorizes use of agents
-# Set to "mock" to deactivate access, service removes auth from agent usage
-ACCESS_SERVICE = 'service' 
-
-## Set google api-key
-GOOGLE_CLIENT_ID="your-google-api-key.apps.googleusercontent.com"
-# for encrypting access keys
-FERNET_KEY='your_fernet_key_here'
-
-# for authentication
-SESSION_JWT_TOKEN_SECRET="your secret here"
-
-GOOGLE_CLIENT_ID="your id"
-GOOGLE_CLIENT_SECRET="your secret here"
+ENV=prod
+PUBLIC_BASE_URL=https://iplvr.it.ntnu.no
+
+# TLS files on the Docker host. Override these if the server stores certs elsewhere.
+SSL_CERT_PATH=/root/iplvr.it.ntnu.no.crt
+SSL_KEY_PATH=/root/iplvr.it.ntnu.no.key
+
+# Local MongoDB container used by docker-compose.yml.
+MONGODB_ROOT_USERNAME=admin
+MONGODB_ROOT_PASSWORD=replace-with-a-long-random-password
+MONGODB_DATABASE=ragdoll_prod
+MONGODB_AGENT_COLLECTION=agents
+MONGODB_CONTEXT_COLLECTION=context
+MONGODB_DOCUMENTS_COLLECTION=documents
+MONGODB_USER_COLLECTION=users
+RAG_DATABASE_SYSTEM=mongodb
+
+# Auth
+AUTH_SERVICE=service
+DISABLE_AUTH=false
+AUTH_BOOTSTRAP_ENABLED=false
+KEYCLOAK_ADMIN_USERNAME=admin
+KEYCLOAK_ADMIN_PASSWORD=replace-with-a-long-random-password
+KEYCLOAK_REALM=ragdoll
+KEYCLOAK_CLIENT_ID=ragdoll-config
+KEYCLOAK_CLIENT_SECRET=replace-with-keycloak-client-secret
+KEYCLOAK_VERIFY_AUDIENCE=false
+KEYCLOAK_ISSUER=https://iplvr.it.ntnu.no/realms/ragdoll
+KEYCLOAK_JWKS_URL=https://iplvr.it.ntnu.no/realms/ragdoll/protocol/openid-connect/certs
+NEXTAUTH_SECRET=replace-with-a-long-random-secret
+JWT_SECRET=replace-with-a-long-random-secret
+SESSION_TOKEN_TTL=15
+REFRESH_TOKEN_TTL=14
+
+# Encryption. Generate with:
+# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+FERNET_KEY=replace-with-fernet-key
+
+# LLM providers. Agent-level stored API keys are managed in the UI, but defaults are still useful.
+OPENAI_API_KEY=replace-with-openai-key
+GPT_MODEL=gpt-4o-mini
+GEMINI_API_KEY=
+GEMINI_MODEL=gemini-2.0-flash-lite
+IDUN_API_KEY=
+IDUN_MODEL=openai/gpt-oss-120b
+IDUN_API_URL=https://idun-llm.hpc.ntnu.no/api/chat/completions

docker-compose.local.yml

@@ -6,6 +6,7 @@
 #
 # Services:
 #   - mongodb: Local MongoDB database
+#   - keycloak: Local identity provider
 #   - backend: FastAPI application
 #
 # Features:
@@ -43,6 +44,31 @@ services:
       retries: 5
       start_period: 10s
 
+  # Keycloak Identity Provider
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.0
+    container_name: ragdoll-keycloak
+    restart: unless-stopped
+    command: start-dev --import-realm
+    environment:
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: admin
+      KC_HTTP_PORT: 8080
+      KC_HOSTNAME: localhost
+    ports:
+      - "8080:8080"
+    volumes:
+      - keycloak_data:/opt/keycloak/data
+      - ./keycloak/realm-ragdoll.json:/opt/keycloak/data/import/realm-ragdoll.json:ro
+    networks:
+      - ragdoll-network
+    healthcheck:
+      test: ["CMD-SHELL", "timeout 5 bash -c '</dev/tcp/localhost/8080'"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
+
   # FastAPI Backend Service
   backend:
     build: 
@@ -65,11 +91,21 @@ services:
       # Override MongoDB URI to use local container
       - MONGODB_URI=mongodb://admin:changeme@mongodb:27017/ragdoll_dev?authSource=admin
       - MONGODB_DATABASE=ragdoll_dev
+      - KEYCLOAK_BASE_URL=http://keycloak:8080
+      - KEYCLOAK_REALM=${KEYCLOAK_REALM:-ragdoll}
+      - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-ragdoll-config}
+      - KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET:-ragdoll-config-secret}
+      - KEYCLOAK_VERIFY_AUDIENCE=${KEYCLOAK_VERIFY_AUDIENCE:-false}
+      - KEYCLOAK_ISSUER=${KEYCLOAK_ISSUER:-http://localhost:8080/realms/ragdoll}
+      - KEYCLOAK_JWKS_URL=http://keycloak:8080/realms/ragdoll/protocol/openid-connect/certs
+      - AUTH_BOOTSTRAP_ENABLED=${AUTH_BOOTSTRAP_ENABLED:-true}
     networks:
       - ragdoll-network
     depends_on:
       mongodb:
         condition: service_healthy
+      keycloak:
+        condition: service_healthy
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/ping"]
       interval: 30s
@@ -85,6 +121,9 @@ volumes:
   mongodb_config:
     driver: local
     name: ragdoll_mongodb_config
+  keycloak_data:
+    driver: local
+    name: ragdoll_keycloak_data
   faiss_indices:
     driver: local
     name: ragdoll_faiss_indices