ory스택 버전업 및 하드코딩URL 제거

2026-05-07 10:27:31 +09:00
parent 13dee9ae9b
commit 45a14163bf
25 changed files with 1583 additions and 779 deletions
--- a/compose.ory.yaml
+++ b/compose.ory.yaml
@@ -23,20 +23,20 @@ services:

    # --- Kratos ---
    kratos-migrate:
-        image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+        image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
-            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL:-http://localhost:4433}
-            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
-            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}
-            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["http://localhost:5000","http://localhost:5000/"]}
-            - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error
-            - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error?error=settings_disabled
-            - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/recovery
-            - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/verification
-            - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
-            - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/registration
-            - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/"]}
+            - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
+            - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
+            - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
+            - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
+            - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
+            - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
+            - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
        volumes:
            - ./docker/ory/kratos:/etc/config/kratos
        command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
@@ -47,22 +47,22 @@ services:
            - ory-net

    kratos:
-        image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+        image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
        container_name: ory_kratos
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
            - COOKIE_SECRET=${COOKIE_SECRET:-localcookie123}
-            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL:-http://localhost:4433}
-            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
-            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}
-            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["http://localhost:5000","http://localhost:5000/"]}
-            - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error
-            - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error?error=settings_disabled
-            - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/recovery
-            - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/verification
-            - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
-            - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/registration
-            - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/"]}
+            - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
+            - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
+            - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
+            - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
+            - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
+            - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
+            - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
        volumes:
            - ./docker/ory/kratos:/etc/config/kratos
        command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
@@ -75,7 +75,7 @@ services:

    # --- Hydra ---
    hydra-migrate:
-        image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+        image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
        command: migrate sql up -e --yes
@@ -86,14 +86,14 @@ services:
            - ory-net

    hydra:
-        image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+        image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
        container_name: ory_hydra
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
-            - URLS_SELF_ISSUER=${USERFRONT_URL:-http://localhost:5000}/oidc
-            - URLS_LOGIN=${USERFRONT_URL:-http://localhost:5000}/login
-            - URLS_CONSENT=${USERFRONT_URL:-http://localhost:5000}/consent
-            - URLS_ERROR=${USERFRONT_URL:-http://localhost:5000}/error
+            - URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}
+            - URLS_LOGIN=${HYDRA_LOGIN_URL:-${USERFRONT_URL}/login}
+            - URLS_CONSENT=${HYDRA_CONSENT_URL:-${USERFRONT_URL}/consent}
+            - URLS_ERROR=${HYDRA_ERROR_URL:-${USERFRONT_URL}/error}
            - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
        volumes:
            - ./docker/ory/hydra:/etc/config/hydra
@@ -107,7 +107,7 @@ services:

    # --- Keto ---
    keto-migrate:
-        image: oryd/keto:${KETO_VERSION:-v25.4.0}
+        image: oryd/keto:${KETO_VERSION:-v26.2.0}
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
        volumes:
@@ -120,7 +120,7 @@ services:
            - ory-net

    keto:
-        image: oryd/keto:${KETO_VERSION:-v25.4.0}
+        image: oryd/keto:${KETO_VERSION:-v26.2.0}
        container_name: ory_keto
        environment:
            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
@@ -136,14 +136,19 @@ services:
    # --- Oathkeeper ---
    oathkeeper_logs_init:
        image: alpine:latest
-        command: ["sh", "-c", "mkdir -p /var/log/oathkeeper && chown -R ${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001} /var/log/oathkeeper"]
+        command:
+            [
+                "sh",
+                "-c",
+                "mkdir -p /var/log/oathkeeper && chown -R ${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001} /var/log/oathkeeper",
+            ]
        volumes:
            - oathkeeper_logs:/var/log/oathkeeper
        networks:
            - ory-net

    oathkeeper:
-        image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v25.4.0}
+        image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v26.2.0}
        container_name: ory_oathkeeper
        user: "${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001}"
        ports:
@@ -220,56 +225,56 @@ services:
            - /bin/sh
            - -ec
            - |
-              apk add --no-cache curl tar
-              HYDRA_CLI_VERSION="$${HYDRA_VERSION:-v26.2.0}"
-              HYDRA_CLI_VERSION="$${HYDRA_CLI_VERSION%-distroless}"
-              HYDRA_CLI_ARCHIVE_VERSION="$${HYDRA_CLI_VERSION#v}"
-              curl -fsSLo /tmp/hydra.tar.gz "https://github.com/ory/hydra/releases/download/$${HYDRA_CLI_VERSION}/hydra_$${HYDRA_CLI_ARCHIVE_VERSION}-linux_64bit.tar.gz"
-              tar -xzf /tmp/hydra.tar.gz -C /usr/local/bin hydra
-              rm /tmp/hydra.tar.gz
+                apk add --no-cache curl tar
+                HYDRA_CLI_VERSION="$${HYDRA_VERSION:-v26.2.0}"
+                HYDRA_CLI_VERSION="$${HYDRA_CLI_VERSION%-distroless}"
+                HYDRA_CLI_ARCHIVE_VERSION="$${HYDRA_CLI_VERSION#v}"
+                curl -fsSLo /tmp/hydra.tar.gz "https://github.com/ory/hydra/releases/download/$${HYDRA_CLI_VERSION}/hydra_$${HYDRA_CLI_ARCHIVE_VERSION}-linux_64bit.tar.gz"
+                tar -xzf /tmp/hydra.tar.gz -C /usr/local/bin hydra
+                rm /tmp/hydra.tar.gz

-              hydra delete oauth2-client --endpoint http://hydra:4445 adminfront >/dev/null 2>&1 || true
-              hydra delete oauth2-client --endpoint http://hydra:4445 devfront >/dev/null 2>&1 || true
-              hydra delete oauth2-client --endpoint http://hydra:4445 orgfront >/dev/null 2>&1 || true
-              hydra delete oauth2-client --endpoint http://hydra:4445 ${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect} >/dev/null 2>&1 || true
+                hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" adminfront >/dev/null 2>&1 || true
+                hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" devfront >/dev/null 2>&1 || true
+                hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" orgfront >/dev/null 2>&1 || true
+                hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" >/dev/null 2>&1 || true

-              hydra create oauth2-client \
-                --endpoint http://hydra:4445 \
-                --id adminfront \
-                --name "AdminFront" \
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id adminfront \
+                  --name "AdminFront" \
+                  --grant-type authorization_code,refresh_token \
+                  --response-type code \
+                  --scope openid,offline_access,profile,email \
+                  --token-endpoint-auth-method none \
+                  --redirect-uri ${ADMINFRONT_CALLBACK_URLS}
+
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id devfront \
+                  --name "DevFront" \
                --grant-type authorization_code,refresh_token \
                --response-type code \
                --scope openid,offline_access,profile,email \
                --token-endpoint-auth-method none \
-                --redirect-uri ${ADMINFRONT_CALLBACK_URLS:-http://localhost:5173/auth/callback}
+                --redirect-uri ${DEVFRONT_CALLBACK_URLS}

-              hydra create oauth2-client \
-                --endpoint http://hydra:4445 \
-                --id devfront \
-                --name "DevFront" \
-              --grant-type authorization_code,refresh_token \
-              --response-type code \
-              --scope openid,offline_access,profile,email \
-              --token-endpoint-auth-method none \
-              --redirect-uri ${DEVFRONT_CALLBACK_URLS:-http://localhost:5174/auth/callback}
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id orgfront \
+                  --name "OrgFront" \
+                --grant-type authorization_code,refresh_token \
+                --response-type code \
+                --scope openid,offline_access,profile,email \
+                --token-endpoint-auth-method none \
+                --redirect-uri ${ORGFRONT_CALLBACK_URLS}

-              hydra create oauth2-client \
-                --endpoint http://hydra:4445 \
-                --id orgfront \
-                --name "OrgFront" \
-              --grant-type authorization_code,refresh_token \
-              --response-type code \
-              --scope openid,offline_access,profile,email \
-              --token-endpoint-auth-method none \
-              --redirect-uri ${ORGFRONT_CALLBACK_URLS:-http://localhost:5175/auth/callback,https://baron-orgchart.hmac.kr/auth/callback}
-
-              hydra create oauth2-client \
-                --endpoint http://hydra:4445 \
-                --id ${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect} \
-                --secret ${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret} \
-                --grant-type client_credentials \
-                --response-type token \
-                --scope openid,offline_access,profile,email
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" \
+                  --secret "$${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}" \
+                  --grant-type client_credentials \
+                  --response-type token \
+                  --scope openid,offline_access,profile,email
        depends_on:
            ory_stack_check:
                condition: service_completed_successfully