opencue/rest-gateway repository overview

⁠OpenCue REST Gateway

OpenCue⁠ is an open source render management system for visual effects and animation production, hosted by the Academy Software Foundation⁠.

The REST Gateway puts an HTTP/JSON API in front of Cuebot's gRPC interface. Every Cuebot RPC becomes a POST /<service>/<Method> endpoint, authenticated with a JWT. OpenCueWeb uses it, and so can any script, pipeline tool, or web client that can't speak gRPC.

• Documentation: https://docs.opencue.io/docs/getting-started/deploying-rest-gateway/⁠
• Source: https://github.com/AcademySoftwareFoundation/OpenCue/tree/master/rest_gateway⁠
• Community: #opencue on the ASWF Slack⁠

⁠Tags

Release notes: https://github.com/AcademySoftwareFoundation/OpenCue/releases⁠

⁠Quick start

You need a running Cuebot (see opencue/cuebot⁠).

docker run -d --name opencue-rest-gateway \
  -p 8448:8448 \
  -e CUEBOT_ENDPOINT=<cuebot-host>:8443 \
  -e JWT_SECRET=<a-long-random-secret> \
  opencue/rest-gateway

Make a token signed with the same secret (HS256, with an exp claim) and call an endpoint:

JWT_TOKEN=$(python3 -c "
import base64, hmac, hashlib, json, time
b64 = lambda b: base64.urlsafe_b64encode(b).decode().rstrip('=')
h = b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())
p = b64(json.dumps({'sub': 'me', 'exp': int(time.time()) + 3600}).encode())
s = b64(hmac.new(b'<a-long-random-secret>', f'{h}.{p}'.encode(), hashlib.sha256).digest())
print(f'{h}.{p}.{s}')
")

curl -X POST http://localhost:8448/show.ShowInterface/GetShows \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

You can browse the full API in the Swagger UI at http://localhost:8448/swagger/.

For a complete local farm (database, Cuebot, RQD, OpenCueWeb, REST Gateway, and optional monitoring), use the docker-compose.yml sandbox in the repository.

⁠Configuration

⁠Security

• Set your own JWT_SECRET. The default value is public. OpenCueWeb must be configured with the same secret.
• The Swagger UI is not authenticated. Set SWAGGER_ENABLED=false wherever the gateway is reachable beyond a trusted network. Every other route requires a valid token.
• The connection to Cuebot is plaintext gRPC. Run the gateway on the same trusted network as Cuebot. Terminate TLS for HTTP clients at a reverse proxy or load balancer in front of the gateway.

⁠Ports

⁠License

Apache License 2.0. See LICENSE⁠.