Really wanted to use Fief... using KeyCloak instead

[brent-stone]

Bottom Line: Even with a seemingly ideal setup, Fief self-hosted failed to support a simple logout and login to its own Admin page. "Invalid login session" would persist unless the entire postgres and redis volumes were wiped. Instead of investing more time, I'm shifting to KeyCloak for my self-hosted IAM service.

I really do hope this project gets to a better place to serve as a reference implementation of IAM in FastAPI if nothing else.

For any other new folks trying out Fief, I figured I'd share a couple of tips for a Docker Compose based self-hosted setup to hopefully save someone time.

docker-compose.yml

version: "3.9"

services:
  fief-server:
    image: ghcr.io/fief-dev/fief:latest
    command: fief run-server
    ports:
      - target: 8000
        published: 8000
        mode: host
    expose:
      - 8000
    env_file:
      - .env
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  fief-worker:
    image: ghcr.io/fief-dev/fief:latest
    command: fief run-worker -p 1 -t 1
    env_file:
      - .env
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
  db:
    container_name: postgres
    build:
      context: ./postgres
      dockerfile: Dockerfile
      target: production
    environment:
      POSTGRES_USER: "${POSTGRES_USER:?missing .env file with POSTGRES_USER}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?missing .env file with POSTGRES_PASSWORD}"
      POSTGRES_DB: "${POSTGRES_DB:?missing .env file with POSTGRES_DB}"
      # Non-standard environment variables not directly expected by the postgres docker
      # image but called by the scripts mounted from /postgres to create additional
      # users and databases at initialization.
      DATABASE_NAME: "${DATABASE_NAME:?missing .env file with DATABASE_NAME}"
      DATABASE_USERNAME: "${DATABASE_USERNAME:?missing .env file with DATABASE_USERNAME}"
      DATABASE_PASSWORD: "${DATABASE_PASSWORD:?missing .env file with DATABASE_PASSWORD}"
    volumes:
      - postgres-db-volume:/var/lib/postgresql/data
      - ./postgres/scripts:/docker-entrypoint-initdb.d/
    ports:
      - target: 5432
        published: "${POSTGRES_PORT:?missing .env file with POSTGRES_PORT}"
        mode: host
    healthcheck:
      test: [ "CMD", "pg_isready", "-U", "${POSTGRES_USER}" ]
      interval: 5s
      timeout: 30s
      retries: 5
    restart: always

  redis:
    container_name: fief-redis
    image: redis:7-alpine
    ports:
      - target: 6379
        published: ${REDIS_PORT:?missing .env file with REDIS_PORT}
        mode: host
    volumes:
      - type: volume
        source: redis-volume
        target: /data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 30s
      retries: 10
    restart: always
    
volumes:
  postgres-db-volume:
  redis-volume:

The mildly tweaked postgres Dockerfile to enable expect to enable auto creation of the Fief database and username if they don't exist prior to Fief starting up

FROM postgres:14-alpine as production
USER root
RUN apk add expect

The script to autocreate Fief database and user based on environment variables from .env. With the compose spec above, would need to be in /postgres/scripts/init-fief-db.sh relative to the docker-compose.yml.

#!/bin/bash

expect << END
        spawn createuser --username "$POSTGRES_USER" --echo --encrypted --pwprompt "$DATABASE_USERNAME"
        expect "Enter password for new role:"
        send "$DATABASE_PASSWORD\r"
        expect "Enter it again:"
        send "$DATABASE_PASSWORD\r"
        expect eof
        spawn createdb --username "$POSTGRES_USER" -O "$DATABASE_USERNAME" "$DATABASE_NAME"
        expect eof
END

and finally, a draft .env file stored alongside docker-compose.yml

# Postgres Settings (also used by myapp FastAPI container)
POSTGRES_USER=myapp
POSTGRES_PASSWORD=H3aIbjpu'-jj9vsX(Z?DJ%*3S+xcYxR_g
POSTGRES_DB=myapp_db
POSTGRES_SERVER=db
POSTGRES_PORT=5432
#### Extended Fief Environment Variables ####
# https://docs.fief.dev/self-hosting/environment-variables/
# ENVIRONMENT options: development, staging, production
ENVIRONMENT=production
LOG_LEVEL=INFO
PORT=8000
ROOT_DOMAIN=localhost:8000
# Domain of your main Fief workspace
FIEF_DOMAIN=localhost:8000

# Secret value used to sign reset password tokens.
SECRET=XXX
# Client ID in your main Fief workspace
FIEF_CLIENT_ID=XXX
# Client secret in your main Fief workspace
FIEF_CLIENT_SECRET=XXX
# Key used to encrypt the external databases credentials inside the main database
# A valid Fernet key encoded in UTF-8
ENCRYPTION_KEY=XXX=
# Size in bits of the generated RSA key pair used to sign JWT.
#GENERATED_JWK_SIZE=4096
# Optional RSA key used to encrypt the JWT tokens
#FIEF_ENCRYPTION_KEY=???

FIEF_MAIN_USER_EMAIL=[email protected]
FIEF_MAIN_USER_PASSWORD=H3aIbjpu-jj9vsX(Z?DJ%*3S+xcYxR_g

DATABASE_TYPE=POSTGRESQL
DATABASE_HOST=db
DATABASE_PORT=5432
DATABASE_USERNAME=fief
DATABASE_PASSWORD=H3aIbjpu'-jj9vsX(Z?DJ%*3S+xcYxR_g
DATABASE_NAME=fief

REDIS_URL=redis://redis:6379

CSRF_CHECK_ENABLED=False
#CSRF_COOKIE_NAME=csrftoken
# HTTPS must be turned on for the Secure flag to work and this should be true
CSRF_COOKIE_SECURE=False

LOGIN_SESSION_COOKIE_NAME=login_session
LOGIN_SESSION_COOKIE_DOMAIN=localhost:8000
# HTTPS must be turned on for the Secure flag to work and this should be true
LOGIN_SESSION_COOKIE_SECURE=False

REGISTRATION_SESSION_COOKIE_NAME=registration_session
REGISTRATION_SESSION_COOKIE_DOMAIN=localhost:8000
# HTTPS must be turned on for the Secure flag to work and this should be true
REGISTRATION_SESSION_COOKIE_SECURE=False

SESSION_COOKIE_NAME=session
SESSION_COOKIE_DOMAIN=localhost:8000
# HTTPS must be turned on for the Secure flag to work and this should be true
SESSION_COOKIE_SECURE=False

FIEF_ADMIN_SESSION_COOKIE_NAME=admin_session
FIEF_ADMIN_SESSION_COOKIE_DOMAIN=localhost:8000
# HTTPS must be turned on for the Secure flag to work and this should be true
FIEF_ADMIN_SESSION_COOKIE_SECURE=False

# Type of email provider -- NULL or POSTMARK
EMAIL_PROVIDER=NULL
# Configuration dictionary of the email provider -- {"server_token": "XXX-XXX"}
EMAIL_PROVIDER_PARAMS={}

[fief-bailiff[bot]]

Hail, @brent-stone 👋

I've noticed you shared secret values: SECRET, FIEF_CLIENT_ID, FIEF_CLIENT_SECRET, ENCRYPTION_KEY. Those are highly sensitive and you should keep them secret.

For your security, I've taken the liberty to replace them with dummy values.

[fief-bailiff[bot]]

Hail, @brent-stone 👋 Welcome to Fief's kingdom!

Our team will get back to you very soon to help.

In the meantime, take a minute to star our repository ⭐️

Farewell!

[frankie567]

Hi @brent-stone 👋

I'm sorry to hear that 😞

There's probably something wrong with the configuration. My guess is that you customized the cookie domains:

LOGIN_SESSION_COOKIE_DOMAIN=localhost:8000
REGISTRATION_SESSION_COOKIE_DOMAIN=localhost:8000
SESSION_COOKIE_DOMAIN=localhost:8000
FIEF_ADMIN_SESSION_COOKIE_DOMAIN=localhost:8000

There are some quirks with cookies and localhost — behaviors can even be different from a browser to another —.

If you're willing to try again, I would suggest you leave out those parameters and keep the default; which should work correctly.