Docker-Compose 中的 HASURA_GRAPHQL_JWT_SECRET 配置问题

Question

我在 Docker 上自托管的虚拟机上运行 Hasura。我遇到以下问题：我按照指南使用 Amazon Cognito 进行身份验证，但是当我将 HASURA_GRAPHQL_JWT_SECRET 变量添加到我的 docker-compose.yaml 文件时，控制台无法启动。当我删除此变量并再次运行它时，控制台可以工作。

这是我的 docker-compose.yaml 文件：

services:
  postgres:
    image: postgres:15
    restart: always
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: postgrespassword
  graphql-engine:
    image: hasura/graphql-engine:v2.40.0
    ports:
      - "8080:8080"
    restart: always
    environment:
      HASURA_GRAPHQL_METADATA_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      PG_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      HASURA_GRAPHQL_ENABLE_CONSOLE: "true"
      HASURA_GRAPHQL_DEV_MODE: "true"
      HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, webhook-log, websocket-log, query-log
      HASURA_GRAPHQL_METADATA_DEFAULTS: '{"backend_configs":{"dataconnector":{"athena":{"uri":"http://data-connector-agent:8081/api/v1/athena"},"mariadb":{"uri":"http://data-connector-agent:8081/api/v1/mariadb"},"mysql8":{"uri":"http://data-connector-agent:8081/api/v1/mysql"},"oracle":{"uri":"http://data-connector-agent:8081/api/v1/oracle"},"snowflake":{"uri":"http://data-connector-agent:8081/api/v1/snowflake"}}}}'
      HASURA_GRAPHQL_JWT_SECRET: '{"claims_format": "stringified_json","jwk_url": "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_*********/.well-known/jwks.json","type": "RS256"}'
    depends_on:
      data-connector-agent:
        condition: service_healthy
  data-connector-agent:
    image: hasura/graphql-data-connector:v2.40.0
    restart: always
    ports:
      - 8081:8081
    environment:
      QUARKUS_LOG_LEVEL: ERROR
      QUARKUS_OPENTELEMETRY_ENABLED: "false"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/api/v1/athena/health"]
      interval: 5s
      timeout: 10s
      retries: 5
      start_period: 5s
volumes:
  db_data:

Answer 1

为了让 Hasura 使用 HS256 对称密钥正确验证 JWT，您需要使用长度至少为 32 个字符的密钥。以下是如何在 Docker Compose 文件中构造 HS256 的 HASURA_GRAPHQL_JWT_SECRET，确保密钥满足所需的长度：