Niek Otten
9ff7937055
Root cause of the compose-smoke failure (found in the runner logs):
oz-init-1 | CommandError: Yaml file
`/app/setup_configuration/data.yaml` does not exist.
The ubuntu-latest runner runs the job inside a container, so
`docker compose up` starts the stack as SIBLING containers via the host
daemon. A relative bind mount (./openzaak/setup_configuration) resolves to
a path inside the job container that the daemon can't see, so Docker mounts
an empty dir and the init container can't find data.yaml. The same trap hit
nrc-init (data.yaml), flowable-init (the BPMN) and keycloak (realm import).
Fix: bake the assets into small derived images instead of bind-mounting:
- infra/openzaak/Dockerfile -> register-referentie/openzaak:dev
- infra/opennotificaties/Dockerfile-> register-referentie/opennotificaties:dev
- infra/keycloak/Dockerfile -> register-referentie/keycloak:dev
- flowable-init: build.dockerfile_inline bakes workflows/registratie.bpmn
Base versions stay build args (OPENZAAK_TAG / OPENNOTIFICATIES_TAG), so the
pinning is unchanged. Applied to both the consolidated compose and the
per-service composes, so local Podman and CI use one mechanism — no bind
mounts, no SELinux `:z`, no world-readable requirement.
Verified locally: `podman build` of the OpenZaak and BPMN images produces
the file at the expected in-container path.
Docs: docs/runbooks/gitea-actions-gotchas.md explains the DinD bind-mount
trap and the bake fix; openzaak.md and ci.md point at it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
80 lines
3.3 KiB
Markdown
80 lines
3.3 KiB
Markdown
# OpenZaak runbook
|
|
|
|
The OpenZaak stack (`infra/openzaak/docker-compose.yml`) is a lean adaptation of the
|
|
upstream open-zaak dev compose: PostGIS db, redis, a one-shot init that runs
|
|
migrations, the OpenZaak API, and a celery worker.
|
|
|
|
## Quick test (`make`)
|
|
|
|
```bash
|
|
make openzaak-up # start the stack (first run pulls images + migrates: 1-3 min)
|
|
make openzaak-smoke # start + assert it's up with auth enforced (403/302/200)
|
|
make openzaak-seed # start + seed the BIG catalogus (idempotent)
|
|
make openzaak-down # stop and wipe data
|
|
```
|
|
|
|
## Seed the BIG catalogus
|
|
|
|
`make openzaak-seed` brings the stack up and runs `infra/openzaak/seed_catalogus.py`,
|
|
which creates (idempotently, via the ZTC API):
|
|
|
|
- catalogus **BIG**
|
|
- a lean **BIG-REGISTRATIE** zaaktype (concept; only schema-mandatory fields)
|
|
- a **bsn** eigenschap on it
|
|
|
|
then confirms the JWT client can list it. See **ADR-0002** for the design (why the
|
|
zaaktype stays a concept, why notifications are disabled, why the API not a fixture).
|
|
|
|
**JWT client** (provisioned declaratively by `setup_configuration/data.yaml`, **dev only**):
|
|
|
|
| | |
|
|
|---|---|
|
|
| client_id | `big-reference-seed` |
|
|
| secret | `insecure-dev-secret-change-me` |
|
|
| authorizations | `heeft_alle_autorisaties` (all) |
|
|
|
|
The seed mints a ZGW JWT (HS256) from these and calls `/catalogi/api/v1/...`.
|
|
|
|
`make openzaak-smoke` polls until the API responds, then asserts:
|
|
|
|
| Check | Expected |
|
|
|---|---|
|
|
| `GET /zaken/api/v1/zaken` (no JWT) | **403** — `PermissionDenied` ZGW fout (auth enforced) |
|
|
| `GET /admin/` | **302** — admin login redirect |
|
|
| `GET /zaken/api/v1/` | **200** — ZGW API schema root |
|
|
|
|
> **403, not 401.** OpenZaak's ZGW APIs return `403 PermissionDenied` for a missing
|
|
> or invalid JWT. The S-01 acceptance text says "401" — that's inaccurate; 403 is the
|
|
> correct auth-enforced response.
|
|
|
|
The admin UI is at <http://localhost:8000/admin/>; the dev superuser is **admin /
|
|
admin** (from the compose env — dev only).
|
|
|
|
## Prerequisites (rootless Podman)
|
|
|
|
Same setup as the rest of the repo (see [ci.md](ci.md)):
|
|
|
|
```bash
|
|
systemctl --user start podman.socket # the Docker-API socket the shim talks to
|
|
```
|
|
|
|
The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so the
|
|
`make openzaak-*` targets work without extra env.
|
|
|
|
## Notes
|
|
|
|
- **Not in `make ci`.** The OpenZaak smoke is a separate, heavier check (large image
|
|
pull + migrations); it is intentionally kept out of `make ci` so the core gate
|
|
stays fast. Run `make openzaak-smoke` when you touch the OpenZaak stack.
|
|
- **Notifications disabled.** `NOTIFICATIONS_DISABLED=true` — otherwise ZTC writes 500
|
|
trying to notify. Open Notificaties is now up (see [opennotificaties.md](opennotificaties.md)),
|
|
but OZ→NRC delivery wiring + re-enabling lands with **S-06**.
|
|
- **Zaaktype is a concept**, not published (publishing needs roltypen/statustypen/
|
|
resultaattypen — beyond the lean seed). List with `?status=alles`.
|
|
- **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump
|
|
deliberately, not via `:latest`).
|
|
- **Config is baked, not mounted.** `setup_configuration/data.yaml` is `COPY`-ed into
|
|
a derived image (`infra/openzaak/Dockerfile`) rather than bind-mounted, so the
|
|
init container finds it on Gitea's containerized CI runner too. See
|
|
[gitea-actions-gotchas.md](gitea-actions-gotchas.md).
|