add updates and security locks

.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = false
+insert_final_newline = false

.env.example

@@ -0,0 +1,37 @@
+# POSTGRES
+POSTGRES_PASSWORD=
+
+# KONG SETTING
+KONG_DB_NAME=
+KONG_DB_USERNAME=
+KONG_DB_PASSWORD=
+KONG_DB_HOST=db
+KONG_DB_PORT=
+KONG_API_TOKEN=
+ADMIN_ROUTE=admin-kong
+KONGA_CONSUMER_ID=
+
+KONG_DATABASE=postgres
+KONG_PROXY_ACCESS_LOG=/dev/stdout
+KONG_ADMIN_ACCESS_LOG=/dev/stdout
+KONG_PROXY_ERROR_LOG=/dev/stderr
+KONG_ADMIN_ERROR_LOG=/dev/stderr
+KONG_ADMIN_LISTEN=0.0.0.0:8001, 0.0.0.0:8444 ssl
+KONG_PROXY_ADMIN_API_PORT=8001
+
+KONG_PROXY_PORT=
+KONG_PROXY_SSL_PORT=
+
+# KONGA SETTING
+KONGA_DB_NAME=
+KONGA_DB_USERNAME=
+KONGA_DB_PASSWORD=
+KONGA_DB_HOST=db
+KONGA_DB_PORT=
+
+KONGA_TOKEN_SECRET=
+KONGA_ENV=production
+KONGA_PORT=
+
+
+

.gitignore

@@ -1 +1,4 @@
 .env
+
+*.sql
+!*.example.sql

README.md

@@ -1,3 +1 @@
 # Setup Kong + Konga using Docker compose
-This repository contains required file for running Kong + Konga using Docker
-you can checkout the article in [here](https://dev.to/vousmeevoyez/setup-kong-konga-part-2-dan)

docker-compose.production.yml

@@ -0,0 +1,26 @@
+version: "3.9"
+services:
+  kong:
+    image: kong:latest
+    restart: on-failure
+    environment:
+      KONG_DATABASE: ${KONG_DATABASE}
+      KONG_PG_HOST: ${KONG_DB_HOST}
+      KONG_PG_DATABASE: ${KONG_DB_NAME}
+      KONG_PG_USER: ${KONG_DB_USERNAME}
+      KONG_PG_PASSWORD: ${KONG_DB_PASSWORD}
+      KONG_PROXY_ACCESS_LOG: ${KONG_PROXY_ACCESS_LOG}
+      KONG_ADMIN_ACCESS_LOG: ${KONG_ADMIN_ACCESS_LOG}
+      KONG_PROXY_ERROR_LOG: ${KONG_PROXY_ERROR_LOG}
+      KONG_ADMIN_ERROR_LOG: ${KONG_ADMIN_ERROR_LOG}
+      KONG_ADMIN_LISTEN: 0.0.0.0:8001
+    ports:
+      - $KONG_PROXY_PORT:8000
+      - $KONG_PROXY_SSL_PORT:8443      
+    networks:
+      - kong-net
+
+networks:
+  kong-net:
+    external: true
+

docker-compose.yml

@@ -1,24 +1,28 @@
-version: '3.7'
+version: "3.9"
 services:
-    db:
+    database:
         build:
-          context: postgres
+          context: docker
+          dockerfile: postgres.dockerfile 
         environment:
-          POSTGRES_USERS: ${KONG_DB_USERNAME}:${KONG_DB_PASSWORD}|${KONGA_DB_USERNAME}:${KONGA_DB_PASSWORD}
-          POSTGRES_DATABASES: ${KONG_DB_NAME}:${KONG_DB_USERNAME}|${KONGA_DB_NAME}:${KONGA_DB_USERNAME}
+          POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
         healthcheck:
-          test: ["CMD", "pg_isready", "-U", "${KONG_DB_USERNAME}"]
-          interval: 30s
-          timeout: 30s
+          test: ["CMD", "pg_isready", "-U", "postgres"]
+          interval: 10s
+          timeout: 5s
           retries: 3
+          start_period: 30s
         restart: on-failure
         stdin_open: true
         tty: true
-        volumes:
-        - persist_volume:/var/lib/postgresql/data
+        volumes: 
+          - kong_persist_volume:/var/lib/postgresql/data
+        ports: 
+          - 5432:5432
         networks:
-        - kong-net
-
+          - kong-net
+          - konga-net
+
     kong-migrations:
       image: kong:latest
       entrypoint: sh -c "sleep 10 && kong migrations bootstrap -v"
@@ -29,13 +33,15 @@ services:
         KONG_PG_USER: ${KONG_DB_USERNAME}
         KONG_PG_PASSWORD: ${KONG_DB_PASSWORD}
       depends_on:
-      - db
+       database:
+          condition: service_healthy
       networks:
-      - kong-net
+        - kong-net
       restart: on-failure
 
     kong:
       image: kong:latest
+      restart: on-failure
       environment:
         KONG_DATABASE: ${KONG_DATABASE}
         KONG_PG_HOST: ${KONG_DB_HOST}
@@ -46,15 +52,44 @@ services:
         KONG_ADMIN_ACCESS_LOG: ${KONG_ADMIN_ACCESS_LOG}
         KONG_PROXY_ERROR_LOG: ${KONG_PROXY_ERROR_LOG}
         KONG_ADMIN_ERROR_LOG: ${KONG_ADMIN_ERROR_LOG}
-        #KONG_ADMIN_LISTEN: ${KONG_ADMIN_LISTEN}
-      restart: on-failure
+        KONG_ADMIN_LISTEN: 0.0.0.0:8001
+      depends_on: 
+        kong-migrations:
+          condition: service_completed_successfully
       ports:
-      - $KONG_PROXY_PORT:8000
-      - $KONG_PROXY_SSL_PORT:8443
-        #- $KONG_PROXY_ADMIN_API_PORT:8001
-        #- $KONG_PROXY_ADMIN_SSL_API_PORT:8444
+        - $KONG_PROXY_PORT:8000
+        - $KONG_PROXY_SSL_PORT:8443
+        - $KONG_PROXY_ADMIN_API_PORT:8001
+        #- $KONG_PROXY_ADMIN_SSL_API_PORT:8444      
+      networks:
+        - kong-net
+
+    setup:
+      build: 
+        context: docker
+        dockerfile: setup.dockerfile
+      restart: on-failure
+      environment:
+        KONG_HOST: kong
+        KONG_PORT: ${KONG_PROXY_ADMIN_API_PORT}
+        ADMIN_ROUTE: ${ADMIN_ROUTE}
+        KONGA_CONSUMER_ID: ${KONGA_CONSUMER_ID}
+        AUTH_KEY: ${KONG_API_TOKEN}
+      depends_on: 
+        kong:
+          condition: service_started
+      networks:
+        - kong-net
+
+    konga-prepare:
+      image: pantsel/konga
+      command: "-c prepare -a postgres -u postgresql://${KONGA_DB_USERNAME}:${KONGA_DB_PASSWORD}@${KONGA_DB_HOST}:5432/${KONGA_DB_NAME}"
       networks:
-      - kong-net
+        - konga-net
+      restart: on-failure
+      depends_on:
+        database:
+          condition: service_healthy
 
     konga:
       image: pantsel/konga
@@ -70,15 +105,21 @@ services:
         KONGA_HOOK_TIMEOUT: 10000
       restart: on-failure
       ports:
-      - $KONGA_PORT:1337
+        - $KONGA_PORT:1337
       depends_on:
-      - db
+        konga-prepare:
+          condition: service_completed_successfully
+        setup: 
+          condition: service_completed_successfully
       networks:
-      - kong-net
-
-volumes:
-  persist_volume:
-
+        - konga-net
+
 networks:
   kong-net:
     external: true
+  konga-net:
+    external: true
+
+volumes:
+  kong_persist_volume:
+

docker/postgres.dockerfile

@@ -0,0 +1,4 @@
+# vim:set ft=dockerfile:
+FROM postgres:9.6
+
+COPY scripts/init.sql /docker-entrypoint-initdb.d/

docker/scripts/file-env.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# usage: file_env VAR [DEFAULT]
+#    ie: file_env 'XYZ_DB_PASSWORD' 'example'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+#  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+
+file_env() {
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	export "$var"="$val"
+	unset "$fileVar"
+}

docker/scripts/init.example.sql

@@ -0,0 +1,7 @@
+CREATE USER any_user WITH PASSWORD 'any_password';
+CREATE DATABASE any_db;
+GRANT ALL PRIVILEGES ON DATABASE any_db TO any_user;
+
+CREATE USER any_user_2 WITH PASSWORD 'any_password';
+CREATE DATABASE any_db_2;
+GRANT ALL PRIVILEGES ON DATABASE any_db_2 TO any_user_2;

docker/scripts/setup-entrypoint.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+set -e
+
+source file-env.sh
+
+file_env 'KONG_HOST'
+file_env 'KONG_PORT'
+file_env 'ADMIN_ROUTE'
+file_env 'KONGA_CONSUMER_ID'
+file_env 'AUTH_KEY'
+
+
+# API heartcheck
+while ! curl "http://${KONG_HOST}:${KONG_PORT}" &> /dev/null
+do
+  echo "$(date) - still trying"
+  sleep 1
+done
+
+## MAKE ADM SERVICE
+curl -i -X POST "http://${KONG_HOST}:${KONG_PORT}/services" \
+  --data "name=${ADMIN_ROUTE}" \
+  --data "url=http://${KONG_HOST}:${KONG_PORT}"
+
+## MAKE ADM ROUTE IN SERVICE
+curl -i -X POST "http://${KONG_HOST}:${KONG_PORT}/services/${ADMIN_ROUTE}/routes" \
+     -H "Content-Type: application/json" \
+     -d "{\"name\": \"${ADMIN_ROUTE}\", \"paths\": [ \"/${ADMIN_ROUTE}\" ]}"
+
+## ADD KEY-AUTH PLUGIN TO SERVICE
+curl -X POST "http://${KONG_HOST}:${KONG_PORT}/services/${ADMIN_ROUTE}/plugins" \
+    --data "name=key-auth"  \
+    --data "config.key_names=apikey"
+
+## MAKE CONGA CONSUMER
+curl -X POST "http://${KONG_HOST}:${KONG_PORT}/consumers" \
+ --data 'username=konga' \
+ --data "custom_id=${KONGA_CONSUMER_ID}"
+
+## REGISTER PLUGIN IN CONSUMER
+curl -X POST \
+  "http://${KONG_HOST}:${KONG_PORT}/consumers/konga/key-auth" \
+  -d "key=${AUTH_KEY}"

docker/setup.dockerfile

@@ -0,0 +1,11 @@
+FROM ubuntu:latest
+
+RUN  apt update
+RUN  apt install curl -qy
+
+WORKDIR /home
+
+COPY --chown=755 scripts/file-env.sh /home
+COPY --chown=755 scripts/setup-entrypoint.sh /home
+
+ENTRYPOINT ["/home/setup-entrypoint.sh"]