Opensearch for document queries + generic case search

backend/apps/dev/build.gradle

@@ -51,6 +51,9 @@ dependencies {
     implementation "org.springframework.boot:spring-boot-starter-webflux"
     implementation "org.springframework.boot:spring-boot-starter-security"
 
+    // OpenSearch client for InsecureSslOpenSearchClientConfig
+    implementation "org.opensearch.client:spring-data-opensearch-starter:${springDataOpenSearchVersion}"
+
     // Spring cloud stream RabbitMQ
     implementation "org.springframework.cloud:spring-cloud-starter-stream-rabbit:${springCloudStreamVersion}"
     implementation "com.rabbitmq:amqp-client:$amqpCLientVersion"

backend/apps/dev/docker-compose.yaml

@@ -82,6 +82,24 @@ services:
         volumes:
             - gzac-database-data-mysql:/var/lib/mysql # persist data even if container shuts down
 
+    gzac-opensearch:
+        container_name: gzac-docker-compose-gzac-opensearch
+        image: opensearchproject/opensearch:2.19.2
+        ports:
+            - "9200:9200"
+        environment:
+            - discovery.type=single-node
+            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=2cr8zkOoEXQJ3xUk!Aa1
+            - OPENSEARCH_JAVA_OPTS=-Xms256m -Xmx256m
+        volumes:
+            - gzac-opensearch-data:/usr/share/opensearch/data
+        healthcheck:
+            test: [ "CMD-SHELL", "curl -sf -u admin:2cr8zkOoEXQJ3xUk!Aa1 https://localhost:9200/_cluster/health -k || exit 1" ]
+            interval: 10s
+            timeout: 5s
+            retries: 12
+            start_period: 30s
+
     gzac-rabbitmq:
         image: rabbitmq:4.1.0-management
         container_name: gzac-docker-compose-gzac-rabbitmq
@@ -733,3 +751,4 @@ services:
 volumes:
     gzac-database-data:
     gzac-database-data-mysql:
+    gzac-opensearch-data:

backend/apps/dev/src/main/kotlin/com/ritense/gzac/opensearch/InsecureSslOpenSearchClientConfig.kt

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2015-2026 Ritense BV, the Netherlands.
+ *
+ * Licensed under EUPL, Version 1.2 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.ritense.gzac.opensearch
+
+import org.apache.http.auth.AuthScope
+import org.apache.http.auth.UsernamePasswordCredentials
+import org.apache.http.conn.ssl.NoopHostnameVerifier
+import org.apache.http.conn.ssl.TrustAllStrategy
+import org.apache.http.impl.client.BasicCredentialsProvider
+import org.apache.http.ssl.SSLContextBuilder
+import org.opensearch.client.RestClientBuilder
+import org.opensearch.spring.boot.autoconfigure.RestClientBuilderCustomizer
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+
+/**
+ * Dev-only configuration that disables SSL certificate verification for OpenSearch
+ * and configures basic authentication.
+ * Allows connecting to OpenSearch with self-signed certificates in local development.
+ *
+ * DO NOT use this configuration in production.
+ */
+@Configuration
+class InsecureSslOpenSearchClientConfig {
+
+    @Value("\${opensearch.username:}")
+    private lateinit var username: String
+
+    @Value("\${opensearch.password:}")
+    private lateinit var password: String
+
+    @Bean
+    fun insecureSslRestClientBuilderCustomizer(): RestClientBuilderCustomizer {
+        return object : RestClientBuilderCustomizer {
+            override fun customize(builder: RestClientBuilder) {
+                builder.setHttpClientConfigCallback { httpClientBuilder ->
+                    val sslContext = SSLContextBuilder.create()
+                        .loadTrustMaterial(TrustAllStrategy.INSTANCE)
+                        .build()
+
+                    httpClientBuilder
+                        .setSSLContext(sslContext)
+                        .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE)
+
+                    if (username.isNotBlank() && password.isNotBlank()) {
+                        val credentialsProvider = BasicCredentialsProvider()
+                        credentialsProvider.setCredentials(
+                            AuthScope.ANY,
+                            UsernamePasswordCredentials(username, password)
+                        )
+                        httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider)
+                    }
+
+                    httpClientBuilder
+                }
+            }
+        }
+    }
+}

backend/apps/dev/src/main/resources/config/application.yml

@@ -175,7 +175,14 @@ mailing:
     whitelistedDomains:
     sendRedirectedMailsTo:
 
+opensearch:
+    uris: https://localhost:9200
+    username: admin
+    password: 2cr8zkOoEXQJ3xUk!Aa1
+
 valtimo:
+    opensearch:
+        enabled: true
     app:
         scheme: http
         hostname: ${VALTIMO_APP_HOSTNAME}

backend/apps/dev/src/main/resources/logback-spring.xml

@@ -63,6 +63,7 @@
     <logger name="springfox" level="WARN"/>
     <logger name="sun.rmi" level="WARN"/>
     <logger name="sun.rmi.transport" level="WARN"/>
+    <logger name="org.opensearch.client.RestClient" level="WARN"/>
 
     <contextListener class="ch.qos.logback.classic.jul.LevelChangePropagator">
         <resetJUL>true</resetJUL>

backend/apps/evenementenvergunning/src/main/resources/config/application.yml

@@ -137,6 +137,11 @@ server:
         mime-types: text/html,text/xml,text/plain,text/css, application/javascript, application/json
         min-response-size: 1024
 
+opensearch:
+    uris: ${OPENSEARCH_URIS:}
+    username: ${OPENSEARCH_USERNAME:}
+    password: ${OPENSEARCH_PASSWORD:}
+
 mailing:
     onlyAllowWhitelistedRecipients: true
     redirectAllMails: false
@@ -145,6 +150,8 @@ mailing:
     sendRedirectedMailsTo:
 
 valtimo:
+    opensearch:
+        enabled: ${VALTIMO_OPENSEARCH_ENABLED:false}
     app:
         scheme: http
         hostname: ${VALTIMO_APP_HOSTNAME}

backend/apps/evenementenvergunning/src/main/resources/logback-spring.xml

@@ -1,5 +1,21 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
+<!--
+  ~ Copyright 2015-2026 Ritense BV, the Netherlands.
+  ~
+  ~ Licensed under EUPL, Version 1.2 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" basis,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
 <configuration scan="true">
     <include resource="config/logging/logback/valtimo-defaults.xml" />
     <include resource="org/springframework/boot/logging/logback/console-appender.xml" />
@@ -44,6 +60,7 @@
     <logger name="okhttp3" level="WARN"/>
     <logger name="org.hibernate.engine.jdbc.spi" level="INFO"/>
     <logger name="com.vladmihalcea.hibernate" level="WARN"/>
+    <logger name="org.opensearch.client.RestClient" level="WARN"/>
 
     <contextListener class="ch.qos.logback.classic.jul.LevelChangePropagator">
         <resetJUL>true</resetJUL>

backend/apps/gzac/src/main/resources/config/application.yml

@@ -137,6 +137,11 @@ server:
         mime-types: text/html,text/xml,text/plain,text/css, application/javascript, application/json
         min-response-size: 1024
 
+opensearch:
+    uris: ${OPENSEARCH_URIS:}
+    username: ${OPENSEARCH_USERNAME:}
+    password: ${OPENSEARCH_PASSWORD:}
+
 mailing:
     onlyAllowWhitelistedRecipients: true
     redirectAllMails: false
@@ -145,6 +150,8 @@ mailing:
     sendRedirectedMailsTo:
 
 valtimo:
+    opensearch:
+        enabled: ${VALTIMO_OPENSEARCH_ENABLED:false}
     app:
         scheme: http
         hostname: ${VALTIMO_APP_HOSTNAME}

backend/apps/gzac/src/main/resources/logback-spring.xml

@@ -1,5 +1,21 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
+<!--
+  ~ Copyright 2015-2026 Ritense BV, the Netherlands.
+  ~
+  ~ Licensed under EUPL, Version 1.2 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" basis,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
 <configuration scan="true">
     <include resource="config/logging/logback/valtimo-defaults.xml" />
     <include resource="org/springframework/boot/logging/logback/console-appender.xml" />
@@ -44,6 +60,7 @@
     <logger name="okhttp3" level="WARN"/>
     <logger name="org.hibernate.engine.jdbc.spi" level="INFO"/>
     <logger name="com.vladmihalcea.hibernate" level="WARN"/>
+    <logger name="org.opensearch.client.RestClient" level="WARN"/>
 
     <contextListener class="ch.qos.logback.classic.jul.LevelChangePropagator">
         <resetJUL>true</resetJUL>

backend/apps/valtimo/src/main/resources/config/application.yml

@@ -18,6 +18,8 @@ logging:
 management:
     endpoint:
         health:
+            probes:
+                enabled: true
             group:
                 # readiness (and a dedicated startup group) only report UP once the bootstrap
                 # health indicator is UP, i.e. after migrations + autodeployments have finished.
@@ -137,6 +139,11 @@ server:
         mime-types: text/html,text/xml,text/plain,text/css, application/javascript, application/json
         min-response-size: 1024
 
+opensearch:
+    uris: ${OPENSEARCH_URIS:}
+    username: ${OPENSEARCH_USERNAME:}
+    password: ${OPENSEARCH_PASSWORD:}
+
 mailing:
     onlyAllowWhitelistedRecipients: true
     redirectAllMails: false
@@ -145,6 +152,8 @@ mailing:
     sendRedirectedMailsTo:
 
 valtimo:
+    opensearch:
+        enabled: ${VALTIMO_OPENSEARCH_ENABLED:false}
     app:
         scheme: http
         hostname: ${VALTIMO_APP_HOSTNAME}

backend/apps/valtimo/src/main/resources/logback-spring.xml

@@ -1,5 +1,21 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
+<!--
+  ~ Copyright 2015-2026 Ritense BV, the Netherlands.
+  ~
+  ~ Licensed under EUPL, Version 1.2 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" basis,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
 <configuration scan="true">
     <include resource="config/logging/logback/valtimo-defaults.xml" />
     <include resource="org/springframework/boot/logging/logback/console-appender.xml" />
@@ -44,6 +60,7 @@
     <logger name="okhttp3" level="WARN"/>
     <logger name="org.hibernate.engine.jdbc.spi" level="INFO"/>
     <logger name="com.vladmihalcea.hibernate" level="WARN"/>
+    <logger name="org.opensearch.client.RestClient" level="WARN"/>
 
     <contextListener class="ch.qos.logback.classic.jul.LevelChangePropagator">
         <resetJUL>true</resetJUL>

backend/case-opensearch/build.gradle

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2015-2024 Ritense BV, the Netherlands.
+ *
+ * Licensed under EUPL, Version 1.2 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+dockerCompose {
+    projectName = "case-opensearch"
+    integrationTestingPostgresql {
+        isRequiredBy(project.tasks.integrationTestingPostgresql)
+        useComposeFiles.addAll(
+            "../docker-resources/docker-compose-base-test-postgresql.yml",
+            "docker-compose-override-postgresql.yml"
+        )
+    }
+}
+
+dependencies {
+    implementation project(":backend:admin-settings")
+    implementation project(":backend:authorization")
+    implementation project(":backend:case")
+    implementation project(":backend:inbox")
+    implementation project(":backend:outbox")
+
+    // ShedLock for cross-instance coordination of the re-index job. The LockProvider bean itself
+    // is supplied at runtime by core's SchedulerAutoConfiguration; here we only need the API.
+    implementation "net.javacrumbs.shedlock:shedlock-spring:${shedlockVersion}"
+
+    implementation "org.springframework.boot:spring-boot-starter-data-jpa"
+    implementation "org.springframework.boot:spring-boot-starter-web"
+    implementation "org.springframework.boot:spring-boot-starter-security"
+    implementation "org.springframework.boot:spring-boot-autoconfigure"
+    implementation "com.fasterxml.jackson.module:jackson-module-kotlin"
+    implementation "io.github.oshai:kotlin-logging:${kotlinLoggingVersion}"
+
+    // OpenSearch via spring-data-opensearch (Apache 2.0 licensed)
+    implementation "org.opensearch.client:spring-data-opensearch-starter:${springDataOpenSearchVersion}"
+
+    annotationProcessor "org.springframework.boot:spring-boot-autoconfigure-processor"
+
+    testImplementation project(':backend:test-utils-common')
+    testImplementation project(':backend:core')
+    testImplementation(project(':backend:audit')) {
+        exclude(group: "com.ritense.valtimo", module: "case")
+    }
+    testImplementation "org.springframework.boot:spring-boot-starter-test"
+    testImplementation "org.mockito.kotlin:mockito-kotlin:${mockitoKotlinVersion}"
+    testImplementation "org.postgresql:postgresql"
+    testImplementation "org.springframework.security:spring-security-test"
+
+    jar {
+        enabled = true
+        manifest {
+            attributes("Implementation-Title": "Ritense Case OpenSearch module")
+            attributes("Implementation-Version": projectVersion)
+        }
+    }
+}
+
+tasks.named("integrationTestingPostgresql") {
+    systemProperty("liquibase.duplicateFileMode", "WARN")
+}
+
+apply from: "gradle/publishing.gradle"

backend/case-opensearch/docker-compose-override-postgresql.yml

@@ -0,0 +1,20 @@
+services:
+    db:
+        ports:
+            - "3365:5432"
+        environment:
+            - POSTGRES_DB=case-opensearch-test
+    opensearch:
+        image: opensearchproject/opensearch:2.19.2
+        environment:
+            - discovery.type=single-node
+            - DISABLE_SECURITY_PLUGIN=true
+            - DISABLE_INSTALL_DEMO_CONFIG=true
+        ports:
+            - "39200:9200"
+        healthcheck:
+            test: ["CMD-SHELL", "curl -sf http://localhost:9200/_cluster/health || exit 1"]
+            interval: 5s
+            timeout: 10s
+            retries: 40
+            start_period: 15s