Architecture Documentation

---
setting:
  frequencyPerDay: 5
  combinedServiceIndicator: false
  scaApproaches:
    - REDIRECT
  tppSignatureRequired: false
  bankOfferedConsentSupport: true
  pisRedirectUrlToAspsp: http://localhost:8080/v1/online-banking/init/pis/{redirect-id}
  pisPaymentCancellationRedirectUrlToAspsp: http://localhost:8080/v1/online-banking/cancel/pis/{redirect-id}
  aisRedirectUrlToAspsp: http://localhost:8080/v1/online-banking/init/ais/{redirect-id}
  multicurrencyAccountLevel: SUBACCOUNT
  availableBookingStatuses:
    - BOOKED
    - PENDING
    - BOTH
  supportedAccountReferenceFields:
    - IBAN
  consentLifetime: 0
  transactionLifetime: 0
  allPsd2Support: true
  transactionsWithoutBalancesSupported: true
  signingBasketSupported: false
  paymentCancellationAuthorizationMandated: true
  piisConsentSupported: false
  redirectUrlExpirationTimeMs: 600000
  authorisationExpirationTimeMs: 86400000
  notConfirmedConsentExpirationPeriodMs: 86400000
  notConfirmedPaymentExpirationPeriodMs: 86400000
  supportedPaymentTypeAndProductMatrix:
    SINGLE:
      - sepa-credit-transfers
    PERIODIC:
      - sepa-credit-transfers
  paymentCancellationRedirectUrlExpirationTimeMs: 600000
  availableAccountsConsentSupported: false
  scaByOneTimeAvailableAccountsConsentRequired: true
  psuInInitialRequestMandated: false
  forceXs2aBaseUrl: false
  xs2aBaseUrl: http://myhost.com/
  scaRedirectFlow: REDIRECT
  deltaListSupported: false
  entryReferenceFromSupported: false
  supportedTransactionApplicationTypes:
    - application/json
  startAuthorisationMode: auto

<configuration>
  <include resource="org/springframework/boot/logging/logback/defaults.xml"/>

  <include resource="org/springframework/boot/logging/logback/console-appender.xml" />

  <root level="INFO">
    <appender-ref ref="CONSOLE"/>
  </root>

  <logger name="access-log" level="info" additivity="false">
    <appender-ref ref="CONSOLE"/>
  </logger>

</configuration>

$ docker run -it --rm -v $PWD/ojdbc8.jar:/opt/app-root/src/lib adorsys/psd2-sandbox:2.0.0-SNAPSHOT

$ ls lib
ojdbc8.jar
# adds all JARs in "./lib" to the classpath
$ java -jar -Dloader.path="lib" sandbox-2.0.0-SNAPSHOT.jar

version: "3.7"
services:
  service:
    build: service/sandbox-core
    image: adorsys/psd2-sandbox
    ports:
      - "8080:8080"
      - "8081:8081"
    environment:
      - SPRING_DATASOURCE_URL=jdbc:postgresql://db/consent
      - SPRING_PROFILES_ACTIVE=dev
    depends_on:
      - db
  db:
    image: centos/postgresql-10-centos7
    environment:
      - POSTGRESQL_USER=cms
      - POSTGRESQL_PASSWORD=cms
      - POSTGRESQL_DATABASE=consent
    ports:
      - "5432:5432"
  ssl-proxy:
    build: ssl-proxy
    image: adorsys/psd2-sandbox-ssl-proxy
    environment:
      - API_INTERNAL_URL=${API_INTERNAL_URL:-http://service:8080}
      - API_EXTERNAL_URL=${API_EXTERNAL_URL:-api.psd2-accelerator.vcap.me}
      - PORTAL_INTERNAL_URL=${PORTAL_INTERNAL_URL:-http://service:8081}
      - PORTAL_EXTERNAL_URL=${PORTAL_EXTERNAL_URL:-portal.psd2-accelerator.vcap.me}
    ports:
      - "8443:8443"
    depends_on:
      - service

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  annotations:
    openshift.io/generated-by: OpenShiftWebConsole
  labels:
    app: psd2-sandbox
  name: psd2-sandbox
  namespace: psd2-sandbox-dev
spec:
  replicas: 2
  selector:
    app: psd2-sandbox
    deploymentconfig: psd2-sandbox
  strategy:
    activeDeadlineSeconds: 21600
    resources: {}
    rollingParams:
      intervalSeconds: 1
      maxSurge: 25%
      maxUnavailable: 25%
      timeoutSeconds: 600
      updatePeriodSeconds: 1
    type: Rolling
  template:
    metadata:
      annotations:
        openshift.io/generated-by: OpenShiftWebConsole
      creationTimestamp: null
      labels:
        app: psd2-sandbox
        deploymentconfig: psd2-sandbox
    spec:
      containers:
        - env:
            - name: SPRING_DATASOURCE_URL
              value: 'jdbc:postgresql://db/consent'
            - name: CERTIFICATE_FILTER
              value: tab
            - name: SPRING_PROFILES_ACTIVE
              value: dev
            - name: SANDBOX_FEATURE_UI_ENABLED
              value: 'true'
            - name: BANK_PROFILE_PATH
              value: /data/bank_profile.yaml
          image: "psd2-sandbox-dev/psd2-sandbox-ssl-proxy:latest"
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /management/health
              port: 8081
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: psd2-sandbox
          ports:
            - containerPort: 8080
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /management/health
              port: 8081
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              memory: 768Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /data
              name: volume-vvjnf
        - env:
            - name: API_INTERNAL_URL
              value: 'http://localhost:8080'
            - name: API_EXTERNAL_URL
              value: sandbox-api.dev.adorsys.de
            - name: PORTAL_INTERNAL_URL
              value: 'http://localhost:8081'
            - name: PORTAL_EXTERNAL_URL
              value: sandbox-portal.dev.adorsys.de
          image: "psd2-sandbox-dev/psd2-sandbox-ssl-proxy:latest"
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8090
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: ssl-proxy
          ports:
            - containerPort: 8443
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8090
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              memory: 128Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/app-root/etc/nginx.pem
              name: nginx-certs
              readOnly: true
              subPath: tls.crt
            - mountPath: /opt/app-root/etc/nginx.key
              name: nginx-certs
              readOnly: true
              subPath: tls.key
            - mountPath: /data
              name: volume-vvjnf
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
        - name: nginx-certs
          secret:
            defaultMode: 420
            secretName: dev.adorsys.de
        - configMap:
            defaultMode: 420
            name: bank-profile
          name: volume-vvjnf
  test: false
  triggers:
    - imageChangeParams:
        automatic: true
        containerNames:
          - psd2-sandbox
        from:
          kind: ImageStreamTag
          name: 'psd2-sandbox:latest'
          namespace: psd2-sandbox-dev
      type: ImageChange
    - imageChangeParams:
        automatic: true
        containerNames:
          - ssl-proxy
        from:
          kind: ImageStreamTag
          name: 'psd2-sandbox-ssl-proxy:latest'
          namespace: psd2-sandbox-dev
      type: ImageChange
    - type: ConfigChange

apiVersion: v1
kind: Service
metadata:
  labels:
    app: psd2-sandbox
  name: psd2-sandbox
spec:
  ports:
  - name: 8443-tcp
    port: 8443
    protocol: TCP
    targetPort: 8443
  - name: 8080-tcp-api
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: 8081-tcp-portal
    port: 8081
    protocol: TCP
    targetPort: 8081
  selector:
    deploymentconfig: psd2-sandbox
  sessionAffinity: None
  type: ClusterIP

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  labels:
    app: psd2-sandbox
  name: api
spec:
  host: sandbox-api.dev.adorsys.de
  port:
    targetPort: 8443-tcp
  tls:
    insecureEdgeTerminationPolicy: Redirect
    termination: passthrough
  to:
    kind: Service
    name: psd2-sandbox
    weight: 100
  wildcardPolicy: None

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  labels:
    app: psd2-sandbox
  name: portal
spec:
  host: sandbox-portal.dev.adorsys.de
  port:
    targetPort: 8443-tcp
  tls:
    insecureEdgeTerminationPolicy: Redirect
    termination: passthrough
  to:
    kind: Service
    name: psd2-sandbox
    weight: 100
  wildcardPolicy: None

# sandbox-xs2a-server.conf
server {
  # The Sandbox HTTPS server, which proxies our requests
  listen 8443 ssl;
  server_name $API_EXTERNAL_URL;

  ssl_protocols TLSv1.1 TLSv1.2;
  # ssl certificate
  ssl_certificate /opt/app-root/etc/nginx.pem;
  ssl_certificate_key /opt/app-root/etc/nginx.key;

  # client certificate
  ssl_client_certificate /opt/app-root/etc/ca.crt;
  # make verification optional, so XS2A validates the incoming certificates
  ssl_verify_client optional;

  location / {

    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_set_header        tpp-qwac-certificate $ssl_client_cert;

    # Fix the "It appears that your reverse proxy set up is broken" error.
    proxy_pass          $API_INTERNAL_URL;

    # web sockets
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_redirect      $API_INTERNAL_URL $API_EXTERNAL_URL;
  }
}

# sandbox-portal-server.conf
server {
  # The Sandbox HTTPS server, which proxies our requests
  listen 8443 ssl;
  server_name $PORTAL_EXTERNAL_URL;

  ssl_protocols TLSv1.1 TLSv1.2;
  # ssl certificate
  ssl_certificate /opt/app-root/etc/nginx.pem;
  ssl_certificate_key /opt/app-root/etc/nginx.key;

  location / {

    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    # Fix the "It appears that your reverse proxy set up is broken" error.
    proxy_pass          $PORTAL_INTERNAL_URL;

    # web sockets
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_redirect      $PORTAL_INTERNAL_URL $PORTAL_EXTERNAL_URL;
  }
}