65 lines
2.6 KiB
Bash
Executable File
65 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Start all four processes and wait until each answers.
|
|
#
|
|
# ./scripts/run.sh
|
|
# STRICT=true ./scripts/run.sh # downstream validates issuer and audience
|
|
# RS_LOG_LEVEL=DEBUG ./scripts/run.sh # resource-server decisions at DEBUG
|
|
#
|
|
# | Process | Port | Main class |
|
|
# |-------------|------|---------------------------|
|
|
# | authserver | 9000 | AuthServerApplication |
|
|
# | gateway | 8080 | GatewayApplication |
|
|
# | edge | 8081 | EdgeApplication |
|
|
# | downstream | 8082 | DownstreamApplication |
|
|
#
|
|
# These are launched with plain `java`, not `spring-boot:run`. Four Maven JVMs each forking an
|
|
# application JVM is eight processes, and on a small machine that is how you meet the OOM
|
|
# killer rather than the demo. `mvn dependency:build-classpath` once, then `java -cp` four
|
|
# times, is two hundred megabytes of heap instead of two gigabytes.
|
|
set -eu
|
|
cd "$(dirname "$0")/.."
|
|
|
|
./scripts/stop.sh
|
|
mvn -B -q compile
|
|
if [ ! -f target/cp.txt ]; then
|
|
mvn -B -q dependency:build-classpath -Dmdep.outputFile=target/cp.txt -Dmdep.includeScope=runtime
|
|
fi
|
|
CP="target/classes:$(cat target/cp.txt)"
|
|
|
|
start() { # start <main-class> <port> <health-path> <extra-jvm-args...>
|
|
local main="$1" port="$2" path="$3"
|
|
shift 3
|
|
setsid nohup java -Xmx192m -XX:TieredStopAtLevel=1 "$@" ${JVM_ARGS:-} \
|
|
-cp "$CP" "com.ankurm.s2s.$main" \
|
|
> "/tmp/s2s-${main##*.}.log" 2>&1 < /dev/null &
|
|
for _ in $(seq 1 60); do
|
|
if curl -s -o /dev/null "http://127.0.0.1:$port$path" 2>/dev/null; then
|
|
echo " ${main##*.} up on $port"
|
|
return 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
echo "${main##*.} did not start; see /tmp/s2s-${main##*.}.log" >&2
|
|
tail -20 "/tmp/s2s-${main##*.}.log" >&2
|
|
return 1
|
|
}
|
|
|
|
# STRICT=true turns on RFC 9068 end to end: the authorization server types its access tokens
|
|
# `at+jwt` and adds a client_id claim, and the downstream service validates issuer, audience
|
|
# and the required-claim set instead of only signature and expiry.
|
|
STRICT_ARGS=()
|
|
AS_ARGS=()
|
|
if [ "${STRICT:-false}" = "true" ]; then
|
|
STRICT_ARGS=(-DSTRICT=true)
|
|
AS_ARGS=(-DAT_JWT=true)
|
|
fi
|
|
|
|
# The authorization server must be first and must be READY before the others: `edge` is an
|
|
# OAuth2 client, and a client whose provider is configured with issuer-uri fetches the
|
|
# discovery document during context refresh. See docs/01-the-four-processes.md.
|
|
start authserver.AuthServerApplication 9000 /oauth2/jwks "${AS_ARGS[@]}"
|
|
start downstream.DownstreamApplication 8082 /orders "${STRICT_ARGS[@]}"
|
|
start edge.EdgeApplication 8081 /edge/naive
|
|
start gateway.GatewayApplication 8080 /edge/naive
|
|
echo "all four up"
|