Add OHDSI workspace service

templates/workspace_services/ohdsi/Dockerfile.tmpl

@@ -19,7 +19,7 @@ RUN apt-get update && apt-get install -y curl gnupg && \
 RUN --mount=type=cache,target=/var/cache/apt --mount=type=cache,target=/var/lib/apt \
     apt-get update && apt-get install -y git --no-install-recommends
 
-# PosgreSql is required by Atlas
+# PostgreSql is required by Atlas
 RUN --mount=type=cache,target=/var/cache/apt --mount=type=cache,target=/var/lib/apt \
     apt-get update && apt-get install -y postgresql-client gettext apache2-utils curl jq --no-install-recommends
 

templates/workspace_services/ohdsi/README.md

@@ -0,0 +1,17 @@
+# OHDSI Workspace Service
+
+### IMPORTANT
+- This workspace service does not work "out of the box". It requires additional networking configuration to work properly. See the [Networking configuration](#networking-configuration) section for more details.
+- Currently the only data source supported by the workspace service is Azure Synapse.
+
+# Networking configuration
+Deploying the OHDSI workspace is not enough for it to function properly, in order for it to work properly, the following networking configuration should be in place:
+
+### 1. The resource processor should be able to access the data source
+Multiple OHDSI workspace services cannot share the same schemas because each OHDSI instance is changing the schemas, which could potentially cause conflicts. To avoid this, every workspace service must work on its own schemas. To do this, we use golden copying. This means that the "main" schemas remain untouched, and every workspace service has its own copy of it, which it can modify.
+
+Since the resource processor is in charge of duplicating the schemas, the data source has to be accessible from the resource processor's VNet in order to be able to create them.
+
+
+### 2. The workspace should be able to access the data source
+In order to access the CDM from ATLAS, the data source should be accessible from the workspace's VNet.

templates/workspace_services/ohdsi/porter.yaml

@@ -1,8 +1,8 @@
 ---
 schemaVersion: 1.0.0
 name: tre-workspace-service-ohdsi
-version: 0.1.71
-description: "A OHDSI workspace service"
+version: 0.1.94
+description: "An OHDSI workspace service"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
 
@@ -50,12 +50,8 @@ parameters:
     default: false
   - name: arm_environment
     type: string
-    # TODO: remove the default value for arm_environment when the TRE version is 0.10.0 or higher
-    default: "public"
   - name: azure_environment
     type: string
-    # TODO: remove the default value for arm_environment when the TRE version is 0.10.0 or higher
-    default: "AzureCloud"
     description: "Used by Azure CLI to set the Azure environment"
 
   # parameters for configuring the data source

templates/workspace_services/ohdsi/template_schema.json

@@ -82,7 +82,7 @@
           "data_source_daimons": {
             "type": "object",
             "title": "Source Daimons",
-            "description": "Optionally configure source daimons",
+            "description": "Configure source daimons",
             "default": null,
             "properties": {
               "daimon_cdm": {
@@ -109,7 +109,12 @@
                 "type": "string",
                 "title": "Temp Schema to copy"
               }
-            }
+            },
+            "required": [
+              "daimon_cdm",
+              "daimon_vocabulary",
+              "daimon_results"
+            ]
           }
         }
       }
@@ -149,6 +154,78 @@
             }
           }
         ]
+      },
+      {
+        "stepId": "37d7fbde-fd61-4096-ac4d-741960474995",
+        "stepTitle": "Add firewall rules for AAD",
+        "resourceTemplateName": "tre-shared-service-firewall",
+        "resourceType": "shared-service",
+        "resourceAction": "upgrade",
+        "properties": [
+          {
+            "name": "network_rule_collections",
+            "type": "array",
+            "arraySubstitutionAction": "replace",
+            "arrayMatchField": "name",
+            "value": {
+              "name": "nrc_svc_{{ resource.id }}",
+              "action": "Allow",
+              "rules": [
+                {
+                  "name": "AzureAD",
+                  "description": "Allow access to AAD",
+                  "source_addresses": "{{ resource.parent.properties.address_spaces }}",
+                  "destination_addresses": [
+                    "AzureActiveDirectory"
+                  ],
+                  "destination_ports": [
+                    "*"
+                  ],
+                  "protocols": [
+                    "TCP"
+                  ]
+                }
+              ]
+            }
+          },
+          {
+            "name": "rule_collections",
+            "type": "array",
+            "arraySubstitutionAction": "replace",
+            "arrayMatchField": "name",
+            "value": {
+              "name": "arc_svc_{{ resource.id }}",
+              "action": "Allow",
+              "rules": [
+                {
+                  "name": "microsoft-aad",
+                  "description": "Allow AAD FQDNs",
+                  "source_addresses": "{{ resource.parent.properties.address_spaces }}",
+                  "target_fqdns": [
+                    "*.msftauth.net",
+                    "*.msauth.net",
+                    "login.microsoftonline.com",
+                    "aadcdn.msftauthimages.net",
+                    "aadcdn.msauthimages.net",
+                    "*.login.live.com",
+                    "*.microsoftonline-p.com",
+                    "msft.sts.microsoft.com"
+                  ],
+                  "protocols": [
+                    {
+                      "port": "80",
+                      "type": "Http"
+                    },
+                    {
+                      "port": "443",
+                      "type": "Https"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        ]
       }
     ],
     "upgrade": [
@@ -179,6 +256,78 @@
             }
           }
         ]
+      },
+      {
+        "stepId": "3329d760-3e09-4721-8722-f369b123ca77",
+        "stepTitle": "Add firewall rules for AAD",
+        "resourceTemplateName": "tre-shared-service-firewall",
+        "resourceType": "shared-service",
+        "resourceAction": "upgrade",
+        "properties": [
+          {
+            "name": "network_rule_collections",
+            "type": "array",
+            "arraySubstitutionAction": "replace",
+            "arrayMatchField": "name",
+            "value": {
+              "name": "nrc_svc_{{ resource.id }}",
+              "action": "Allow",
+              "rules": [
+                {
+                  "name": "AzureAD",
+                  "description": "Allow access to AAD",
+                  "source_addresses": "{{ resource.parent.properties.address_spaces }}",
+                  "destination_addresses": [
+                    "AzureActiveDirectory"
+                  ],
+                  "destination_ports": [
+                    "*"
+                  ],
+                  "protocols": [
+                    "TCP"
+                  ]
+                }
+              ]
+            }
+          },
+          {
+            "name": "rule_collections",
+            "type": "array",
+            "arraySubstitutionAction": "replace",
+            "arrayMatchField": "name",
+            "value": {
+              "name": "arc_svc_{{ resource.id }}",
+              "action": "Allow",
+              "rules": [
+                {
+                  "name": "microsoft-aad",
+                  "description": "Allow AAD FQDNs",
+                  "source_addresses": "{{ resource.parent.properties.address_spaces }}",
+                  "target_fqdns": [
+                    "*.msftauth.net",
+                    "*.msauth.net",
+                    "login.microsoftonline.com",
+                    "aadcdn.msftauthimages.net",
+                    "aadcdn.msauthimages.net",
+                    "*.login.live.com",
+                    "*.microsoftonline-p.com",
+                    "msft.sts.microsoft.com"
+                  ],
+                  "protocols": [
+                    {
+                      "port": "80",
+                      "type": "Http"
+                    },
+                    {
+                      "port": "443",
+                      "type": "Https"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        ]
       }
     ],
     "uninstall": [

templates/workspace_services/ohdsi/terraform/atlas_database.tf

@@ -150,6 +150,7 @@ resource "azurerm_postgresql_flexible_server" "postgres" {
   administrator_login    = local.postgres_admin_username
   administrator_password = azurerm_key_vault_secret.postgres_admin_password.value
   storage_mb             = var.postgres_storage_size_in_mb
+  zone                   = "1"
   tags                   = local.tre_workspace_service_tags
 
   timeouts {

templates/workspace_services/ohdsi/terraform/data_source.tf

@@ -32,7 +32,7 @@ resource "terraform_data" "add_data_source" {
   depends_on = [terraform_data.deployment_atlas_security]
 }
 
-resource "terraform_data" "init_schemas" {
+resource "terraform_data" "init_synapse_schemas" {
   count = local.is_synapse_data_source && local.daimon_results != null && local.daimon_temp != null ? 1 : 0
 
   provisioner "local-exec" {