openbis/openbis-local repository overview

⁠Introduction

The openBIS Local is a basic implementation of "frontend / ingress / reverse proxy" for OpenBIS Application container (openbis-app⁠). It is provided with a valid TLS certificate to be functional example. The certificate is issued for domain "localhost.openbis.net" which resolves to local IP address.

$ host localhost.openbis.net
localhost.openbis.net has address 127.0.0.1
localhost.openbis.net has IPv6 address ::1

It is dedicated for local development as a pure reverse proxy (default HAProxy) on minimally functional system (default Alpine Linux).

⁠Documentation

• OpenBIS Docker Architecture⁠
• OpenBIS Docker Usage⁠
• OpenBIS Docker Configuration⁠

⁠Quickstart

Quickstart is provided for minimal, simplest possible setup for local development or local demo. Production system should be setup with experience and architecture decisions following complete openBIS documentation⁠ and production ready openbis-ingress⁠.

Run ingress container. Read more here ...⁠

$ docker run --detach \
  --name openbis-ingress \
  --hostname openbis-ingress \
  --network openbis-network \
  --pid host \
  -p 443:443 \
  -e OPENBIS_HOST="openbis-app" \
  openbis/openbis-local:latest;

⁠Description

⁠Port

The standard port for HTTPS protocol is 443. In the example above the container bind to port 443 and pass traffic to HAProxy inside (443). Changing a listening port to 8443 on local computer is possible.

Use:

-p 8443:443

⁠Certificates

TLS certificates included in the container are issued to work with following domains - localhost.openbis.net, local.openbis.net, localhost.openbis.ch and local.openbis.ch. This is workaround provided as a functional example. This container might be used on dedicated development host with own TLS certificate issued and added to HAProxy.

Bind volume:

-v openbis-ingress-ssl:/etc/ssl/private

and certificate issued for "dedicated-development.host.domain" place on Docker volume "openbis-ingress-ssl".

⁠Backend

In all examples isolated Docker virtual network "openbis-network" is used. openBIS Application in all examples use "openbis-app" container name. Developers can use the same openbis-local container with differently organized backends. For example there might be a need to have 2 openBIS Application instances "openbis-app-20.10.12" and "openbis-app-7.0" and "openbis-local" can use one or another backend.

Change:

-e OPENBIS_HOST="openbis-app-20.10.12"

to

-e OPENBIS_HOST="openbis-app-7.0"

and restart "openbis-local" container.

⁠Reverse proxy

openBIS Application processes use ports 8080, 8081 and 8085 at least. HAProxy reverse proxy is used to provide TLS termination and directing HTTP requests to correct ports.

frontend openbis_ingress
  bind *:443 ssl crt /etc/ssl/private
  acl is_as path_beg /openbis
  acl is_dss path_beg /datastore_server
  acl is_afs path_beg /afs-server
  use_backend openbis_as if is_as
  use_backend openbis_dss if is_dss
  use_backend openbis_afs if is_afs
  default_backend openbis_as

backend openbis_as
  option forwardfor
  option http-keep-alive
  server as openbis-app:8080 check

backend openbis_dss
  option forwardfor
  server dss openbis-app:8081 check

backend openbis_afs
  option forwardfor
  server afs openbis-app:8085 check

It is possible to extend this default minimal configuration with own version.

Bind HAProxy configuration file:

-v ~/haproxy.cfg:/tmp/haproxy.cfg

⁠Support

For any questions on openBIS you can contact our support desk⁠.

⁠License

Copyright 2007-2025 ETH Zurich Scientific IT Services

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0⁠

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.