not
448896206f
CI / build (pull_request) Successful in 4m31s
CI / lint (pull_request) Successful in 4m46s
CI / unit (pull_request) Successful in 1m35s
CI / frontend (pull_request) Successful in 4m0s
CI / mutation (pull_request) Successful in 6m47s
CI / verify-stack (pull_request) Failing after 17m35s
Builds the four pieces ADR-0028 deliberately left absent, and turns
`NOTIFICATIONS_DISABLED` back off:
- `objecten-celery`, a worker on the Objecten image (mirrors `oz-celery`), plus
`CELERY_BROKER_URL`/`RESULT_BACKEND` on objecten-redis db 1 (db 0 is the cache).
Without it `notifications_api_common` queues the send and nothing ever ships it.
- An `nrc` service + `notifications_config` in Objecten's setup_configuration,
reusing the `big-reference-seed` credential OpenZaak publishes with.
- The `objecten` kanaal in NRC's setup_configuration — the name is fixed by the
Objects API (`NOTIFICATIONS_KANAAL`), and publishing to an unregistered kanaal is
what the failing check reported first.
- `SITE_DOMAIN: objecten.local:8000` + an `objecten.local` network alias: NRC
validates `hoofdObject`/`resourceUrl` with Django's URLValidator, which rejects a
single-label host, so `objecten:8000` is refused with "Voer een geldige URL in."
The alias keeps the dotted host resolvable so the URL still dereferences.
ADR-0029 records it; ADR-0028's ceiling now points there.
Makes `make verify-objecten-notifications` (dc9ca2c) pass.
60 lines
2.7 KiB
YAML
60 lines
2.7 KiB
YAML
# Objecten API setup_configuration (S-18b). Streamed into the external rr-objecten-config volume by
|
|
# infra/seed-config.sh and applied by objecten-init (RUN_SETUP_CONFIG). Declarative + idempotent.
|
|
#
|
|
# Two things: (1) register the Objecttypen API (S-18a) as a trusted service so an object can
|
|
# reference its objecttype — authenticating with the dev static token Objecttypen provisioned; and
|
|
# (2) a dev static token so peers (the ACL, S-19) can write objects here. Dev-only, not for prod.
|
|
|
|
# (1) Trust the Objecttypen API. `orc` = overige RESTful component (how zgw_consumers classifies the
|
|
# Objecttypen API). The RegisterRecord objecttype (S-18c) will reference an objecttype under this
|
|
# service by uuid.
|
|
zgw_consumers_config_enable: true
|
|
zgw_consumers:
|
|
services:
|
|
- identifier: objecttypen
|
|
label: Objecttypen API
|
|
api_type: orc
|
|
api_root: http://objecttypen:8000/api/v2/
|
|
auth_type: api_key
|
|
header_key: Authorization
|
|
header_value: Token 0123456789abcdef0123456789abcdef01234567
|
|
# (1b) The NRC Objecten publishes register-record events to (S-19b-1, ADR-0029). Same shape and
|
|
# same big-reference-seed credential OpenZaak publishes with — NRC verifies the JWT and
|
|
# authorizes it via OpenZaak's AC, which grants that client heeft_alle_autorisaties.
|
|
- identifier: nrc
|
|
label: Open Notificaties
|
|
api_type: nrc
|
|
api_root: http://nrc-web:8000/api/v1/
|
|
auth_type: zgw
|
|
client_id: big-reference-seed
|
|
secret: insecure-dev-secret-change-me
|
|
|
|
# (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
|
|
# objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
|
|
# identifies one by uuid — which is why infra/objecttypen-registerrecord/register.py pins that uuid
|
|
# instead of letting Objecttypen assign one. Keep the two in step.
|
|
objecttypes_config_enable: true
|
|
objecttypes:
|
|
items:
|
|
- uuid: 1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01
|
|
name: RegisterRecord
|
|
service_identifier: objecttypen
|
|
|
|
# (3) Static API token peers use to write/read objects.
|
|
tokenauth_config_enable: true
|
|
tokenauth:
|
|
items:
|
|
- identifier: register-referentie
|
|
token: 1234567890abcdef1234567890abcdef12345678
|
|
contact_person: Register Referentie
|
|
email: admin@localhost
|
|
organization: Respellion
|
|
is_superuser: true
|
|
|
|
# (4) Point Objecten's notifications at that NRC service (S-19b-1, ADR-0029). Requires
|
|
# NOTIFICATIONS_DISABLED=false plus a celery broker + worker — without the worker the message is
|
|
# queued and never sent, which is exactly the half-wired state S-19a refused to ship (ADR-0028).
|
|
notifications_config_enable: true
|
|
notifications_config:
|
|
notifications_api_service_identifier: nrc
|