Identity Lab Launch (#138)

* Identity Lab Launch

* feat(identitylab): add production Docker image and deployment configuration

* Add More Configuration

* Migration and Caddy Arrangements

* Improve Image Creation

Author: mckaragoz

.docker/.env.identitylab.example

@@ -0,0 +1,8 @@
+IDENTITYLAB_IMAGE=ghcr.io/codebeamorg/ultimateauth-identitylab:REPLACE_WITH_SHA
+
+CADDY_PROXY_IP=172.20.0.4
+IDENTITYLAB_CONNECTION_STRING=Host=postgres;Port=5432;Database=identitylab;Username=identitylab_user;Password=REPLACE_WITH_PASSWORD
+
+LAB_ADMIN_USERNAME=Ladmin
+LAB_ADMIN_EMAIL=REPLACE_WITH_EMAIL
+LAB_ADMIN_PASSWORD=REPLACE_WITH_PASSWORD

.docker/Dockerfile.identitylab

@@ -0,0 +1,29 @@
+# Build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+COPY . .
+
+RUN dotnet restore \
+    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj
+
+RUN dotnet publish \
+    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj \
+    -c Release \
+    --no-restore \
+    -o /app/publish
+
+# Runtime
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+
+ENV ASPNETCORE_HTTP_PORTS=8080
+ENV ASPNETCORE_ENVIRONMENT=Production
+
+COPY --from=build /app/publish .
+
+EXPOSE 8080
+
+USER $APP_UID
+
+ENTRYPOINT ["dotnet", "CodeBeam.UltimateAuth.IdentityLab.dll"]

.docker/docker-compose.identitylab.yml

@@ -0,0 +1,35 @@
+services:
+  identitylab:
+    image: ${IDENTITYLAB_IMAGE:?Identity Lab image is required}
+    container_name: identitylab
+    restart: unless-stopped
+
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      ASPNETCORE_HTTP_PORTS: "8080"
+
+      ReverseProxy__KnownProxy: ${CADDY_PROXY_IP:?Caddy proxy IP is required}
+      ConnectionStrings__IdentityLab: ${IDENTITYLAB_CONNECTION_STRING:?Connection string is required}
+
+      LabAdmin__Username: ${LAB_ADMIN_USERNAME:?Admin username is required}
+      LabAdmin__Email: ${LAB_ADMIN_EMAIL:?Admin email is required}
+      LabAdmin__Password: ${LAB_ADMIN_PASSWORD:?Admin password is required}
+
+      DataProtection__KeysPath: /app/keys
+
+    volumes:
+      - /opt/identitylab/keys:/app/keys
+
+    networks:
+      - edge
+      - postgres-internal
+
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  edge:
+    external: true
+
+  postgres-internal:
+    external: true

.github/workflows/identitylab-image.yml

@@ -0,0 +1,55 @@
+name: Identity Lab Docker Image
+
+on:
+  pull_request:
+    paths:
+      - "apps/identity-lab/**"
+      - "src/**"
+      - "samples/**"
+      - ".docker/Dockerfile.identitylab"
+      - ".github/workflows/identitylab-image.yml"
+
+  push:
+    branches:
+      - master
+    paths:
+      - "apps/identity-lab/**"
+      - "src/**"
+      - "samples/**"
+      - ".docker/Dockerfile.identitylab"
+      - ".github/workflows/identitylab-image.yml"
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        if: github.event_name != 'pull_request'
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Identity Lab
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: .docker/Dockerfile.identitylab
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ghcr.io/codebeamorg/ultimateauth-identitylab:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/Persistence/LabDatabaseMigrator.cs

@@ -0,0 +1,32 @@
+using CodeBeam.UltimateAuth.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore;
+
+namespace CodeBeam.UltimateAuth.IdentityLab.Persistence;
+
+public static class LabDatabaseMigrator
+{
+    public static async Task MigrateAsync(IServiceProvider services, CancellationToken cancellationToken = default)
+    {
+        await using var scope = services.CreateAsyncScope();
+
+        var logger = scope.ServiceProvider
+            .GetRequiredService<ILoggerFactory>()
+            .CreateLogger("IdentityLab.Migrations");
+
+        logger.LogInformation("Starting Identity Lab database migrations.");
+
+        var uauthDb = scope.ServiceProvider.GetRequiredService<UAuthDbContext>();
+
+        await uauthDb.Database.MigrateAsync(cancellationToken);
+
+        logger.LogInformation("UltimateAuth database migrations completed.");
+
+        var labDbFactory = scope.ServiceProvider.GetRequiredService<IDbContextFactory<LabDbContext>>();
+
+        await using var labDb = await labDbFactory.CreateDbContextAsync(cancellationToken);
+
+        await labDb.Database.MigrateAsync(cancellationToken);
+
+        logger.LogInformation("Identity Lab database migrations completed.");
+    }
+}

apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/Program.cs

@@ -16,6 +16,8 @@
 using CodeBeam.UltimateAuth.IdentityLab.Services;
 using CodeBeam.UltimateAuth.Sample.Shared.Infrastructure;
 using CodeBeam.UltimateAuth.Server.Extensions;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.EntityFrameworkCore;
 using MudBlazor.Services;
 using MudExtensions.Services;
@@ -108,6 +110,36 @@
 builder.Services.AddScoped<ISeedContributor, LabDemoRoleSeedContributor>();
 builder.Services.AddLogging();
 
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
+{
+    options.ForwardedHeaders =
+        ForwardedHeaders.XForwardedFor |
+        ForwardedHeaders.XForwardedProto;
+
+    if (builder.Environment.IsProduction())
+    {
+        var trustedProxy = builder.Configuration["ReverseProxy:KnownProxy"]
+            ?? throw new InvalidOperationException("ReverseProxy:KnownProxy must be configured in production.");
+
+        if (!System.Net.IPAddress.TryParse(trustedProxy, out var proxyAddress))
+        {
+            throw new InvalidOperationException("ReverseProxy:KnownProxy must be a valid IP address.");
+        }
+
+        options.KnownProxies.Add(proxyAddress);
+    }
+});
+
+if (builder.Environment.IsProduction())
+{
+    var keysPath = builder.Configuration["DataProtection:KeysPath"]
+        ?? throw new InvalidOperationException("DataProtection:KeysPath must be configured in production.");
+
+    builder.Services.AddDataProtection()
+        .SetApplicationName("UltimateAuth.IdentityLab")
+        .PersistKeysToFileSystem(new DirectoryInfo(keysPath));
+}
+
 var app = builder.Build();
 
 activityEventBridge.Initialize(app.Services);
@@ -120,6 +152,7 @@
     app.UseHsts();
 }
 app.UseStatusCodePagesWithReExecute("/not-found", createScopeForStatusCodePages: true);
+app.UseForwardedHeaders();
 app.UseHttpsRedirection();
 
 app.UseUltimateAuthWithAspNetCore();
@@ -133,6 +166,12 @@
     .AddInteractiveServerRenderMode()
     .AddUltimateAuthRoutes(UAuthAssemblies.BlazorClient());
 
+if (args.Contains("--migrate", StringComparer.OrdinalIgnoreCase))
+{
+    await LabDatabaseMigrator.MigrateAsync(app.Services);
+    return;
+}
+
 await app.SeedIdentityLabAsync();
 
 app.Run();