Kong routes and authentication

Service / route	Upstream	Plugins created by script
fhir-api / /fhir-api	http://hapi-fhir-jpaserver-start:8080/fhir	Basic Auth, CORS
fhir-api-key-auth / /fhir-api-key-auth	Same HAPI URL	Key Auth
admin-api / /admin-api	http://kong:8001	Basic Auth, CORS

The scripts create services, routes, and plugins, but do not create Kong consumers or credentials. Provision those separately and store credentials as secrets.

Administrative access

The scripts address http://localhost:8001, but Compose does not expose host port 8001. Run scripts and Admin API checks inside the Kong container. Host port 8444 maps to Kong container port 8444; whether it is usable depends on KONG_ADMIN_LISTEN and must be firewall-restricted.

Path behavior

The scripts do not explicitly configure strip_path; confirm the effective Kong default and test the upstream request path for the deployed Kong version. Treat the route names and paths above as repository configuration, not proof that an authenticated request succeeds.

Verify

docker compose exec kong curl --fail --silent http://localhost:8001/services
docker compose exec kong curl --fail --silent http://localhost:8001/routes
docker compose exec kong curl --fail --silent http://localhost:8001/plugins

For production, remove the admin-api proxy route unless there is a documented administrative need; never make it generally accessible.