Skip to content

Install

DTaaS logo DTaaS logo

This guide installs a secure, multi-user DTaaS deployment that uses an integrated GitLab instance for OAuth 2.0 authorisation.

Download dtaas-secure-server-integrated-gitlab-xx.zip from the latest release / pre-release page.

For the configuration reference, see config.md.

Important

This guide uses the hostname intocps.org as an example. Replace it with the hostname of your server.

Overview

This package installs DTaaS as a multi-user web application with an integrated GitLab CE instance. GitLab is both the OAuth 2.0 authorisation provider and the DevOps backend for digital twin projects.

DTaaS on Server DTaaS on Server

A path such as /user1 is the URL route of that service, for example https://intocps.org/user1. The thick arrow is the forward-auth check: Traefik asks traefik-forward-auth to authorise each request before it routes it.

The docker-compose.yml starts the following services:

Service Purpose
traefik Reverse proxy with TLS termination
client DTaaS React frontend
logger-ms Logger microservice
user1 / user2 JupyterLab user workspaces
libms Library management microservice
traefik-forward-auth OAuth 2.0 authorisation middleware
gitlab Integrated GitLab CE (OAuth 2.0 provider)

Prerequisites

Requirement Details
Docker Engine v28 or later with Compose plugin
Domain name A domain name (e.g. intocps.org) or IP address
TLS certificate fullchain.pem and privkey.pem for the domain. Obtain via certbot or a certificate provider

Quick Start

1. Create Configuration Files

1
2
3
cp config/.env.example       config/.env
cp config/conf.server.example config/conf.server
cp config/client.js.example     config/client.js

Edit config/.env and set SERVER_DNS, USERNAME1 and USERNAME2. Leave the OAUTH_* variables as placeholders for now; you fill them in once the GitLab instance is running (see step 5).

See config.md for a reference of every variable.

2. Create User Workspace Directories

1
2
3
cp -R files/template files/<USERNAME1>
cp -R files/template files/<USERNAME2>
sudo chown -R 1000:100 files/*

The logger microservice writes its events to logs/logger. Create the directory and give it to uid 1000, the user that runs the logger:

1
2
mkdir -p logs/logger
sudo chown -R 1000:1000 logs/logger

logs/ itself holds the GitLab logs, so change the owner of logs/logger only.

3. Add TLS Certificates

1
2
cp /path/to/fullchain.pem certs/fullchain.pem
cp /path/to/privkey.pem   certs/privkey.pem

Traefik falls back to self-signed certificates if these files are absent or invalid.

4. Start Services

1
docker compose --env-file config/.env up -d

GitLab takes a few minutes to become healthy. Watch its status with:

1
watch docker ps

5. Configure GitLab

Once the GitLab container shows as healthy:

  1. Log in to https://intocps.org/gitlab as root. The initial password is in config/gitlab/initial_root_password.

    Warning

    GitLab deletes this file 24 hours after the first start. Save the password immediately.

  2. Create user accounts (see GitLab docs). The usernames must match USERNAME1/USERNAME2 in config/.env.

  3. Register two OAuth 2.0 applications in GitLab, signed in as root, in root's User Settings → Applications:

  4. DTaaS Client Authorization for the React SPA frontend. See the client auth docs.

  5. DTaaS Server Authorization for the Traefik forward-auth backend. See the server auth docs.

  6. Put the generated OAuth 2.0 credentials into the configuration files:

  7. Set REACT_APP_CLIENT_ID and REACT_APP_AUTH_AUTHORITY in config/client.js.

  8. Set OAUTH_URL, OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET in config/.env.

  9. Update the user permissions in config/conf.server.

  10. Reload the services:

1
docker compose --env-file config/.env up -d --force-recreate client traefik-forward-auth

6. Verify

URL Expected result
https://intocps.org DTaaS web interface (redirects to GitLab sign-in)
https://intocps.org/gitlab Integrated GitLab instance
https://intocps.org/user1 User 1 workspace (after sign-in)
https://intocps.org/user2 User 2 workspace (after sign-in)

Stop

1
docker compose --env-file config/.env down

Directory Layout

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
.
├── certs/                 # TLS certificates (fullchain.pem, privkey.pem)
├── config/
│   ├── .env               # Docker compose environment variables
│   ├── conf.server        # Traefik forward-auth authorisation rules
│   ├── client.js          # DTaaS React client configuration
│   ├── gitlab/            # GitLab config (mounted as /etc/gitlab)
│   └── tls.yml            # Traefik TLS provider configuration
├── data/                  # GitLab persistent data (/var/opt/gitlab)
├── files/
│   ├── common/            # Shared files across all workspaces
│   └── template/          # sample user workspace files
├── logs/                  # GitLab logs (/var/log/gitlab)
│   └── logger/            # Logger microservice events
├── docker-compose.yml     # Service definitions
├── CONFIG.md              # Detailed configuration reference
└── README.md              # This file — quick-start guide

References

Image sources: Traefik logo, GitLab