Issue #000 feat: User service docker compose file with postgres #415
Conversation
WalkthroughA new Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (5)
.env.docker (1)
13-13: Inconsistent quoting may sneak stray quote characters into runtime values
KEYCLOAK_PASSWORDandPOSTGRES_PASSWORDare wrapped in quotes while other sensitive fields aren’t. Shell parsers treat the quotes as part of the value when the file is consumed by Docker Compose (it does not strip them).Strip the quotes for consistency unless you rely on embedded spaces:
-KEYCLOAK_PASSWORD='**************' -POSTGRES_PASSWORD="*******" +KEYCLOAK_PASSWORD=************** +POSTGRES_PASSWORD=*******Also applies to: 20-24
Dockerfile (2)
3-6: Usenpm cifor repeatable production builds
npm installmay mutatepackage-lock.jsonand yields non-deterministic dependency trees.npm ciis faster and guarantees the lockfile is respected.-RUN npm install +RUN npm ci --omit=dev
10-12: Potentially overwriting optimisednode_moduleswith host copy
COPY . .runs after you copiednode_modulesfrom the first stage.
If the build context accidentally contains a localnode_modules(when.dockerignoreis missing or wrong), the layer will overwrite the optimised dependency tree and bloat image size.Ensure
.dockerignoreexcludesnode_modules, or copy source before the dependency layer:- COPY --from=dependencies /usr/src/app/node_modules ./node_modules - COPY . . + COPY . . + COPY --from=dependencies /usr/src/app/node_modules ./node_modulesdocker-compose.yml (2)
4-9: Image tag vs. local Dockerfile – build source of truth is unclear
user-servicepullsvaishali007/user-microservice:latest, but this PR ships a Dockerfile in the same repo. If developers expect local changes to be reflected, replaceimage:with abuild:context or pin the image tag to an immutable digest.user-service: - image: vaishali007/user-microservice:latest + build: + context: . + dockerfile: Dockerfile ports: - "3000:3000"
18-18: Publicly exposing Postgres on host port 15432 may be unnecessaryIf the database is only consumed by internal containers, omit the host mapping to reduce attack surface:
ports: - - "15432:5432" +# - "15432:5432" # comment out unless external access is required
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (3)
.env.docker(1 hunks)Dockerfile(1 hunks)docker-compose.yml(1 hunks)
🧰 Additional context used
🪛 dotenv-linter (3.3.0)
.env.docker
[warning] 2-2: [UnorderedKey] The PORT key should go before the SERVER_PORT key
[warning] 3-3: [UnorderedKey] The IMAGEPATH key should go before the PORT key
[warning] 4-4: [UnorderedKey] The ADAPTERSOURCE key should go before the IMAGEPATH key
[warning] 5-5: [UnorderedKey] The KEYCLOAK key should go before the PORT key
[warning] 6-6: [UnorderedKey] The KEYCLOAK_ADMIN key should go before the PORT key
[warning] 7-7: [DuplicatedKey] The KEYCLOAK_ADMIN key is duplicated
[warning] 7-7: [UnorderedKey] The KEYCLOAK_ADMIN key should go before the KEYCLOAK_ADMIN key
[warning] 7-7: [ValueWithoutQuotes] This value needs to be surrounded in quotes
[warning] 8-8: [UnorderedKey] The KEYCLOAK_USER_TOKEN key should go before the PORT key
[warning] 9-9: [UnorderedKey] The KEYCLOAK_CLIENT_ID key should go before the KEYCLOAK_USER_TOKEN key
[warning] 10-10: [UnorderedKey] The KEYCLOAK_REALM key should go before the KEYCLOAK_USER_TOKEN key
[warning] 11-11: [UnorderedKey] The KEYCLOAK_CLIENT_SECRET key should go before the KEYCLOAK_REALM key
[warning] 12-12: [UnorderedKey] The KEYCLOAK_USERNAME key should go before the KEYCLOAK_USER_TOKEN key
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
[warning] 13-13: [UnorderedKey] The KEYCLOAK_PASSWORD key should go before the KEYCLOAK_REALM key
[warning] 14-14: [UnorderedKey] The KEYCLOAK_ADMIN_TOKEN key should go before the KEYCLOAK_CLIENT_ID key
[warning] 15-15: [UnorderedKey] The RBAC_JWT_EXPIRES_IN key should go before the SERVER_PORT key
[warning] 16-16: [UnorderedKey] The RBAC_JWT_SECRET key should go before the SERVER_PORT key
[warning] 17-17: [TrailingWhitespace] Trailing whitespace detected
[warning] 17-17: [UnorderedKey] The KEYCLOAK_REALM_RSA_PUBLIC_KEY key should go before the KEYCLOAK_USERNAME key
[warning] 18-18: [UnorderedKey] The NOTIFICATION_URL key should go before the PORT key
[warning] 19-19: [UnorderedKey] The PASSWORD_RESET_JWT_EXPIRES_IN key should go before the PORT key
[warning] 20-20: [UnorderedKey] The POSTGRES_HOST key should go before the RBAC_JWT_EXPIRES_IN key
[warning] 20-20: [ValueWithoutQuotes] This value needs to be surrounded in quotes
[warning] 21-21: [UnorderedKey] The POSTGRES_PORT key should go before the RBAC_JWT_EXPIRES_IN key
[warning] 22-22: [UnorderedKey] The POSTGRES_DATABASE key should go before the POSTGRES_HOST key
[warning] 23-23: [UnorderedKey] The POSTGRES_USERNAME key should go before the RBAC_JWT_EXPIRES_IN key
[warning] 24-24: [EndingBlankLine] No blank line at the end of the file
[warning] 24-24: [QuoteCharacter] The value has quote characters (', ")
[warning] 24-24: [UnorderedKey] The POSTGRES_PASSWORD key should go before the POSTGRES_PORT key
🔇 Additional comments (2)
.env.docker (1)
20-24: Database name & credentials diverge from docker-compose defaults
docker-compose.ymlspins up Postgres with
POSTGRES_USER=postgres,POSTGRES_PASSWORD=postgres,POSTGRES_DB=oblf, yet this file declarestekdi / postgresdb.Unless the user-service rewrites these at runtime, migrations will target the wrong database, or auth will fail. Make the two files consistent (env-file takes precedence).
docker-compose.yml (1)
18-22: Keep Postgres credentials single-sourcedThe service sets
POSTGRES_USER=postgres,POSTGRES_PASSWORD=postgres, but.env.dockerpasses different values to the app. Mismatched credentials cause immediate auth failures.Align the compose file with the env file or vice-versa.
| KEYCLOAK_ADMIN=admin/realms/master/users | ||
| KEYCLOAK_ADMIN=admin/realms/tekdi/users #creation in realm | ||
| KEYCLOAK_USER_TOKEN=realms/tekdi/protocol/openid-connect/token |
There was a problem hiding this comment.
Duplicate KEYCLOAK_ADMIN silently overwrites the first value
Line 7 defines the same key a second time, so the first assignment on line 6 is discarded at runtime. This is extremely easy to miss and can break user-management calls that still expect the master-realm URL.
-KEYCLOAK_ADMIN=admin/realms/master/users
-KEYCLOAK_ADMIN=admin/realms/tekdi/users #creation in realm
+# KEYCLOAK_ADMIN points to the realm where users are managed.
+# If you need both, use separate, uniquely-named variables.
+KEYCLOAK_ADMIN=admin/realms/tekdi/users📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| KEYCLOAK_ADMIN=admin/realms/master/users | |
| KEYCLOAK_ADMIN=admin/realms/tekdi/users #creation in realm | |
| KEYCLOAK_USER_TOKEN=realms/tekdi/protocol/openid-connect/token | |
| # KEYCLOAK_ADMIN points to the realm where users are managed. | |
| # If you need both, use separate, uniquely-named variables. | |
| KEYCLOAK_ADMIN=admin/realms/tekdi/users | |
| KEYCLOAK_USER_TOKEN=realms/tekdi/protocol/openid-connect/token |
🧰 Tools
🪛 dotenv-linter (3.3.0)
[warning] 6-6: [UnorderedKey] The KEYCLOAK_ADMIN key should go before the PORT key
[warning] 7-7: [DuplicatedKey] The KEYCLOAK_ADMIN key is duplicated
[warning] 7-7: [UnorderedKey] The KEYCLOAK_ADMIN key should go before the KEYCLOAK_ADMIN key
[warning] 7-7: [ValueWithoutQuotes] This value needs to be surrounded in quotes
[warning] 8-8: [UnorderedKey] The KEYCLOAK_USER_TOKEN key should go before the PORT key
🤖 Prompt for AI Agents
In the .env.docker file between lines 6 and 8, there are duplicate definitions
of the KEYCLOAK_ADMIN variable, causing the first value to be overwritten and
lost. To fix this, remove or rename one of the duplicate KEYCLOAK_ADMIN entries
to ensure each environment variable key is unique and the intended value is
preserved for runtime usage.
| KEYCLOAK_CLIENT_SECRET=************* | ||
| KEYCLOAK_USERNAME=admin | ||
| KEYCLOAK_PASSWORD='**************' | ||
| KEYCLOAK_ADMIN_TOKEN=realms/master/protocol/openid-connect/token | ||
| RBAC_JWT_EXPIRES_IN=864000 | ||
| RBAC_JWT_SECRET=3609eeeab5d80e87****692139123****87872****** | ||
| KEYCLOAK_REALM_RSA_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\/l3ctlyzVq+8uiQMCW/**********++/+GHuPy+/\n-----END PUBLIC KEY-----" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Hard-coding secrets in VCS → high risk of credential leakage
Client secrets, JWT keys and database passwords are committed in plain text. Even in private repos this is dangerous and complicates rotation.
Move secrets to Docker/Swarm/K8s “secrets”, or at least mount an external, un-tracked env file:
# docker-compose.yml
secrets:
keycloak_client_secret:
file: ./secrets/keycloak_client_secret
...
env_file:
- .env.docker # non-sensitive values
secrets:
- keycloak_client_secretAlso applies to: 24-24
🧰 Tools
🪛 dotenv-linter (3.3.0)
[warning] 11-11: [UnorderedKey] The KEYCLOAK_CLIENT_SECRET key should go before the KEYCLOAK_REALM key
[warning] 12-12: [UnorderedKey] The KEYCLOAK_USERNAME key should go before the KEYCLOAK_USER_TOKEN key
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
[warning] 13-13: [UnorderedKey] The KEYCLOAK_PASSWORD key should go before the KEYCLOAK_REALM key
[warning] 14-14: [UnorderedKey] The KEYCLOAK_ADMIN_TOKEN key should go before the KEYCLOAK_CLIENT_ID key
[warning] 15-15: [UnorderedKey] The RBAC_JWT_EXPIRES_IN key should go before the SERVER_PORT key
[warning] 16-16: [UnorderedKey] The RBAC_JWT_SECRET key should go before the SERVER_PORT key
[warning] 17-17: [TrailingWhitespace] Trailing whitespace detected
[warning] 17-17: [UnorderedKey] The KEYCLOAK_REALM_RSA_PUBLIC_KEY key should go before the KEYCLOAK_USERNAME key
🤖 Prompt for AI Agents
In the .env.docker file around lines 11 to 17 and line 24, sensitive secrets
like client secrets, JWT keys, and passwords are hard-coded, which risks
credential leakage. To fix this, remove these secrets from the file and instead
store them securely using Docker secrets, Swarm secrets, or Kubernetes secrets.
Update your docker-compose.yml to reference these secrets via the secrets key
and mount them as external files, keeping the .env.docker file for non-sensitive
environment variables only.
| POSTGRES_HOST=postgres #Do not change this as postgres runs in a container with this name | ||
| POSTGRES_PORT=5431 | ||
| POSTGRES_DATABASE=postgresdb |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
POSTGRES_PORT is inconsistent with the running container → connection will fail
The compose service exposes the database on the default container port 5432, but this env file hard-codes 5431. Unless the application explicitly remaps, the connection will be refused.
-POSTGRES_PORT=5431
+POSTGRES_PORT=5432Verify the app’s datasource configuration after changing the port.
Update .env.docker to use the container’s internal Postgres port (5432)
When services communicate over Docker’s internal network, they use the container port (5432), not the host-published port. Please adjust the environment file accordingly:
• File: .env.docker (line 21)
-POSTGRES_PORT=5431
+POSTGRES_PORT=5432After updating, verify your application’s datasource configuration connects successfully to the postgres service.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| POSTGRES_HOST=postgres #Do not change this as postgres runs in a container with this name | |
| POSTGRES_PORT=5431 | |
| POSTGRES_DATABASE=postgresdb | |
| POSTGRES_HOST=postgres #Do not change this as postgres runs in a container with this name | |
| POSTGRES_PORT=5432 | |
| POSTGRES_DATABASE=postgresdb |
🧰 Tools
🪛 dotenv-linter (3.3.0)
[warning] 20-20: [UnorderedKey] The POSTGRES_HOST key should go before the RBAC_JWT_EXPIRES_IN key
[warning] 20-20: [ValueWithoutQuotes] This value needs to be surrounded in quotes
[warning] 21-21: [UnorderedKey] The POSTGRES_PORT key should go before the RBAC_JWT_EXPIRES_IN key
[warning] 22-22: [UnorderedKey] The POSTGRES_DATABASE key should go before the POSTGRES_HOST key
🤖 Prompt for AI Agents
In the .env.docker file at line 21, the POSTGRES_PORT is set to 5431, which is
the host-published port. Change this value to 5432 to use the container's
internal Postgres port for inter-container communication. After updating, verify
that the application's datasource configuration connects successfully to the
postgres service.
Summary by CodeRabbit
New Features
Refactor