ehoandClaude Sonnet 5
1e87997ea0
setup_configuration has no YAML field for granular autorisaties, so bigregister-test now starts at heeft_alle_autorisaties: false (dev + prod template) and bootstrap-catalogus.sh grants exactly the ztc/zrc scopes the harness needs via the Django ORM, sidestepping the zero-scope chicken-and-egg with the JWT-authenticated Autorisaties REST API. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
33 lines
1.5 KiB
Plaintext
33 lines
1.5 KiB
Plaintext
# Prod counterpart of data.yaml (WP-54's dev-only version, kept as-is for local iteration —
|
|
# see docker-compose.openzaak.yml's own comment on why it hardcodes a client secret). This
|
|
# template has no secret in it; render-prod-secrets.sh substitutes OPENZAAK_CLIENT_SECRET
|
|
# into it to produce the gitignored data.prod.yaml that docker-compose.openzaak.prod.yml
|
|
# mounts over the container's data.yaml.
|
|
#
|
|
# Least-privilege client scopes (WP-57): heeft_alle_autorisaties is false, matching the dev
|
|
# harness (setup_configuration has no YAML field for granular `autorisaties` — see
|
|
# data.yaml's comment). This template only covers infra config; a real deploy must grant this
|
|
# client's Autorisaties the same way bootstrap-catalogus.sh does for the dev harness — via
|
|
# `manage.py shell` (or the Autorisaties REST API from an already-privileged caller) against
|
|
# the production catalogus/zaaktype URLs, once, as part of standing up that environment.
|
|
sites_config_enable: true
|
|
sites_config:
|
|
items:
|
|
- domain: ${OPENZAAK_SITE_DOMAIN}
|
|
name: OpenZaak (production)
|
|
|
|
vng_api_common_credentials_config_enable: true
|
|
vng_api_common_credentials:
|
|
items:
|
|
- identifier: ${OPENZAAK_CLIENT_ID}
|
|
secret: ${OPENZAAK_CLIENT_SECRET}
|
|
|
|
vng_api_common_applicaties_config_enable: true
|
|
vng_api_common_applicaties:
|
|
items:
|
|
- uuid: ${OPENZAAK_APPLICATIE_UUID}
|
|
client_ids:
|
|
- ${OPENZAAK_CLIENT_ID}
|
|
label: BIG-register BFF (production)
|
|
heeft_alle_autorisaties: false
|