Preparation

1
export SECRETS_SYSTEM=`export LC_CTYPE=C; cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
2
export HYDRA_VERSION=v2.2.0
3
export HYDRA_IMAGE=oryd/hydra:v2.2.0-distroless
4
export CONSENT_IMAGE=oryd/hydra-login-consent-node:$HYDRA_VERSION
5
export POSTGRESQL_IMAGE=postgres:16.3-alpine
6

7
export NETWORK_NAME=hydranet
8
export POSTGRESQL_NAME=ory-hydra-postgres
9
export HYDRA_ADMIN=hydra-admin
10
export HYDRA_PUBLIC=hydra-public
11

12
export DSN=postgres://hydra:secret@$POSTGRESQL_NAME:5432/hydra?sslmode=disable

Create network

1
docker network create $NETWORK_NAME

PostgreSQL

1
docker run \
2
  --network $NETWORK_NAME \
3
  --name $POSTGRESQL_NAME \
4
  -v ${PWD}/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql \
5
  -e POSTGRES_USER=hydra \
6
  -e POSTGRES_PASSWORD=secret \
7
  -e POSTGRES_DB=hydra \
8
  -d $POSTGRESQL_IMAGE

Hydra

Prepare Data in DB

1
docker run -it --rm \
2
  --network $NETWORK_NAME \
3
  $HYDRA_IMAGE \
4
  migrate sql --yes $DSN

Run Hydra

Consensus

Let’s have a consensus:

1
export PUBLIC_PORT=4444
2
export ADMIN_PORT=4445

Let’s pull:

1
docker pull $HYDRA_IMAGE

ALL IN ONE RUN

Run all in one:

1
docker run -d \
2
  --name hydra-all \
3
  --network $NETWORK_NAME \
4
  -p $PUBLIC_PORT:4444 \
5
  -p $ADMIN_PORT:4445 \
6
  -e SECRETS_SYSTEM=$SECRETS_SYSTEM \
7
  -e DSN=$DSN \
8
  -e URLS_SELF_ISSUER=https://localhost:4444/ \
9
  -e URLS_CONSENT=http://localhost:9020/consent \
10
  -e URLS_LOGIN=http://localhost:9020/login \
11
  $HYDRA_IMAGE serve all

Run Admin and Public separately

Admin

1
docker run -d \
2
  --name $HYDRA_ADMIN \
3
  --network $NETWORK_NAME \
4
  -p $ADMIN_PORT:4445 \
5
  -e SECRETS_SYSTEM=$SECRETS_SYSTEM \
6
  -e DSN=$DSN \
7
  -e URLS_SELF_ISSUER=https://localhost:4444/ \
8
  -e URLS_CONSENT=http://localhost:9020/consent \
9
  -e URLS_LOGIN=http://localhost:9020/login \
10
  $HYDRA_IMAGE serve admin

Public

1
docker run -d \
2
  --name $HYDRA_PUBLIC \
3
  --network $NETWORK_NAME \
4
  -p $PUBLIC_PORT:4444 \
5
  -e SECRETS_SYSTEM=$SECRETS_SYSTEM \
6
  -e DSN=$DSN \
7
  -e URLS_SELF_ISSUER=https://localhost:4444/ \
8
  -e URLS_CONSENT=http://localhost:9020/consent \
9
  -e URLS_LOGIN=http://localhost:9020/login \
10
  $HYDRA_IMAGE serve public

Let’s pull

1
docker pull $CONSENT_IMAGE

Run it:

1
docker run -d \
2
  --name hydra-consent \
3
  -p 9020:3000 \
4
  --network $NETWORK_NAME \
5
  -e HYDRA_ADMIN_URL=https://$HYDRA_ADMIN:$ADMIN_PORT \
6
  -e NODE_TLS_REJECT_UNAUTHORIZED=0 \
7
  $CONSENT_IMAGE

Example

Let’s make this simple

1
alias hydra="docker run --rm -it   -e HYDRA_ADMIN_URL=https://${HYDRA_ADMIN}:${ADMIN_PORT}   --network $NETWORK_NAME   ${HYDRA_IMAGE} create --help"

Create A Client

1
hydra create oauth2-client \
2
  -e http://${HYDRA_ADMIN}:${ADMIN_PORT} \
3
  --name "hydra-client-eg" \
4
  --redirect-uri http://127.0.0.1:9010/callback \
5
  --grant-type authorization_code,refresh_token,client_credentials,implicit \
6
  --response-type token,code,id_token \
7
  --scope openid,offline,photos.read \
8
  --skip-tls-verify

Get Client secret and ID. Put them in CLIENT_SECRET and CLIENT_ID accordingly.

Perform authentication

1
hydra perform client-credentials \
2
  --endpoint http://hydra-public:4444/ \
3
  --client-id "${CLIENT_ID}" \
4
  --client-secret "${CLIENT_SECRET}"

Delete All

1
for i in $(hydra ls oauth2-clients   -e http://${HYDRA_ADMIN}:${ADMIN_PORT} --format json | jq -r ".items[].client_id" ) ; do
2
  hydra -e http://$HYDRA_ADMIN:$HYDRA_PORT delete oauth2-client $i;
3
done

Troubleshooting

Hydra Help

1
docker run -it --rm $HYDRA_IMAGE help serve

Check ports

1
docker container ls --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}" -a

Install Hydra with PostgreSQL

Preparation

Create network

PostgreSQL

Hydra

Prepare Data in DB

Run Hydra

Consensus

ALL IN ONE RUN

Run Admin and Public separately

Admin

Public

Hydra Consent UI

Example

Let’s make this simple

Create A Client

Perform authentication

Delete All

Troubleshooting

Hydra Help

Check ports

Related Articles

Rootless Docker in Fedora

Installing Minikube to use KVM2 in Fedora

Install Podman Docker-compatible in Arch Linux