samply/bridgehead
1
0
Fork 0
mirror of https://github.com/samply/bridgehead.git synced 2026-10-13 03:16:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

Secret Sync for the config repo token, one-time enrollment code, check output (#401)

Browse Source 
* cce: Fetch the config repository token via Secret Sync

* Keep the Secret Sync GitLab token across reboots and outages

* Install site configuration with a one-time enrollment code

* Align the itcc and dhki cases in prepare-system.sh

* Report an unreachable broker instead of a clock skew during install

* Show bridgehead check results as OK, WARN or CRIT and run them during install

* Refresh the config repo token before bridgehead check fetches

* Skip Secret Sync until the private key and root certificate exist

* Indent the case block in prepare-system.sh with tabs only

* Hide the config repo URL, token and enrollment code from other local users

* remove the unreachable second dhki case

---------

Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>
This commit is contained in:
Pierre Delpy
2026-10-08 14:16:00 +02:00
committed by GitHub
co-authored by Martin Lablans
parent 59a9fd688e
commit 00192eaefc
8 changed files with 287 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -20
View File
@@ -130,25 +130,29 @@ Mention:
- site name (According to conventions listed above)
- operator name and email
We will set the repository up for you. We will then send you:
We will set the repository up for you. We will then send you either:
- A Repository Short Name (RSN). Beware: this is distinct from your site name.
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/<project>-bridgehead-configs/dummy.git
- Way A: a one-time enrollment code, or
- Way B: a repository URL including access credentials.
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
### Base Installation
First, download your site specific configuration repository:
Clone the bridgehead repository and run the installation script:
```shell
sudo mkdir -p /etc/bridgehead/
sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
sudo mkdir -p /srv/docker/
sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
cd /srv/docker/bridgehead
sudo ./bridgehead install <PROJECT>
```
When asked, choose Way A or Way B. For Way A, enter your one-time enrollment code and your site name; for Way B, enter your repository URL. The installation downloads your site configuration to `/etc/bridgehead`. If your server needs an HTTP proxy to reach the internet, pass it to the script, e.g. `sudo https_proxy=http://proxy.example.org:3128 ./bridgehead install <PROJECT>`.
Review the site configuration:
```shell
sudo cat /etc/bridgehead/bbmri.conf
sudo cat /etc/bridgehead/<PROJECT>.conf
```
Pay special attention to:
@@ -159,21 +163,10 @@ Pay special attention to:
- OPERATOR_LAST_NAME
- OPERATOR_EMAIL
Clone the bridgehead repository:
```shell
sudo mkdir -p /srv/docker/
sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
```
Then, run the installation script:
```shell
cd /srv/docker/bridgehead
sudo ./bridgehead install <PROJECT>
```
### Register with Samply.Beam
If you installed with Way A, this has already been done for you; skip to the next step.
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
``` shell