Docker based Ruby on Rails App (hyku) CAS integration with Keycloack and ngnix/oauth2-proxy setup

Build a single-sign-on, docker based system with the following components:

- hyku
https://github.com/samvera/hyku#with-docker
Image: ghcr.io/samvera/hyku:latest
- Keycloack
Image: latest
- oauth2-proxy
https://oauth2-proxy.github.io/oauth2-proxy/
- PostgreSQL (v14.4)
- one instance for keycloack
- one instance for hyku
- nginx


Please note:
- We were able to run hyku on WIN10/WSL2/Ubuntu 20-04 using Docker Desktop. Here are some "lessons learned":
- Fix High Memory Use: https://www.koskila.net/how-to-solve-vmmem-consuming-ungodly-amounts-of-ram-when-running-docker-on-wsl/
- Run hyku in Linux Filesystem (~/..) instead of windows mount (/mount/...)
- If Zookeeper fails to start:
https://stackoverflow.com/questions/55087970/error-starting-userland-proxy-bind-for-0-0-0-02181-unexpected-error-permissio
https://github.com/docker/for-win/issues/9272
- if SOLR SELECT fails with 404:
Solr collection did not get created. you may try running the seed again: docker-compose exec web rake db:seed
https://samvera.slack.com/archives/C7E4KK8ER/p1607721248082100

Tasks to be done:
- Keycloak:
- Install CAS Module https://github.com/jacekkow/keycloak-protocol-cas
- hyku
- Authenticate against Keycloack using CAS
https://samvera.github.io/campus-auth-integrating.html#add-the-devise_cas_authenticatable-gem is NOT working anymore
See README of https://github.com/nbudin/devise_cas_authenticatable on how to integrate w/Devise
- Authentication should be done with email (not username)
- Single host configuration is sufficient (see .env)
- nginx
- Configure auto renewing LetsEncrypt SSL
- configure network set up and port exposures with high security standard in mind

- Single-sign off


HTTP User endpoints:
[DOMAIN_NAME]
- No Keycloak authorization required
hyku.[DOMAIN_NAME]
- Keycloak Authorization required - User needs be authenticated (logged in)
- Shows login page of keycloack in case user is not authenthicated
pub.[DOMAIN_NAME]
- No Keycloak authorization required
prot.[DOMAIN_NAME]
- Keycloak Authorization required - User needs be authenticated (logged in)
- Shows login page of keycloack in case user is not authenthicated
[[a-z]{4}].[DOMAIN_NAME] (private subdomain, only accessable by a particular user & Keycloack Admin role)
- Keycloack Authorization required
- User needs be authenticated (logged in) AND
- Newly to be defined keycloack user attribute (e.g. "initals") needs to match 4 letter combination OR
- User has "Keycloak Admin Role"

Deliverables:
a) One (or more) docker-compose.yml files to run the system in the following two environments
- TEST/DEV System deployable on Win10/WSL2/Ubuntu 20.04/Docker-Desktop
- PROD system deployable on a remote server (Ubuntu 20.04 LTS)

b) Adjusted Docker images
- Keycloack with CAS installed and at least two sample users
- Admin (as per default)
- User1
to demonstrate correct authorization and routing

- hyku with patches required for Keycloak integration

c) SysAdmin Documentation
- Installation (very basic, a list of commands to run on the server, provide only absolutely necessay other information)
- How to install on a remote server
- How to install on local WIN10/WSL2/Ubuntu 20.04
- Configuring auto renewal LetsEncrypt
- again, very basic

Deliverable Acceptance Criteria:
- Client can install system on remote server (Ubuntu 20.04 LTS with docker installed) based on SysAdmin Documentation provided [deliverable c)]
- Client can install system on local machine (WIN10/WSL2/Ubuntu 20.04) based on SysAdmin Documentation provided [deliverable c)]
- Routing/Authentication works as decribed above
- Auto renewal LetsEncrypt works