Secret Sync for the config repo token, one-time enrollment code, check output (#401)

* cce: Fetch the config repository token via Secret Sync

* Keep the Secret Sync GitLab token across reboots and outages

* Install site configuration with a one-time enrollment code

* Align the itcc and dhki cases in prepare-system.sh

* Report an unreachable broker instead of a clock skew during install

* Show bridgehead check results as OK, WARN or CRIT and run them during install

* Refresh the config repo token before bridgehead check fetches

* Skip Secret Sync until the private key and root certificate exist

* Indent the case block in prepare-system.sh with tabs only

* Hide the config repo URL, token and enrollment code from other local users

* remove the unreachable second dhki case

---------

Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>

lib/prepare-system.sh

@@ -60,16 +60,13 @@ case "$PROJECT" in
 		;;
 	itcc)
 		site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
-        ;;
-    dhki)
-        site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
-		;;
-	kr)
-		site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
 		;;
 	dhki)
 		site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
 		;;
+	kr)
+		site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
+		;;
 	nngm)
 		site_configuration_repository_middle="git.verbis.dkfz.de/nngm/"
 		;;
@@ -78,7 +75,7 @@ case "$PROJECT" in
 		;;
 	*)
 		log ERROR "Internal error, this should not happen."
-        exit 1
+		exit 1
 		;;
 esac
 
@@ -92,16 +89,42 @@ if [ -d /etc/bridgehead ]; then
     fi
 elif [[ "$DEV_MODE" == "NODEV" ]]; then
     log "INFO" "Now cloning your site configuration repository for you."
-    if [ -z "$site" ]; then
-        read -p "Please enter your site: " site
+    if [ -z "$access_token" ] && [ -z "$enrollment_code" ]; then
+        echo "Way A: You received a one-time enrollment code."
+        echo "Way B: You received a repository URL including access credentials."
+        read -p "Please choose your way of installation [A/B]: " way
+        case "$way" in
+            [Aa])
+                read -p "Please enter your one-time enrollment code: " enrollment_code
+                ;;
+            [Bb])
+                read_masked "Please enter your repository URL: " site_configuration_repository_url
+                ;;
+            *)
+                log "ERROR" "Please choose A or B."
+                exit 1
+                ;;
+        esac
     fi
-    if [ -z "$access_token" ]; then
-        read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
+    if [ -z "$site_configuration_repository_url" ]; then
+        if [ -z "$site" ]; then
+            read -p "Please enter your site: " site
+        fi
+        site=$(echo $site | tr '[:upper:]' '[:lower:]')
     fi
-    site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}$(echo $site | tr '[:upper:]' '[:lower:]').git"
-    git clone $site_configuration_repository_url /etc/bridgehead
-    if [ $? -gt 0 ]; then
-        log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
+    if [ -z "$access_token" ] && [ -n "$enrollment_code" ]; then
+        if ! bootstrap_site_configuration "$site" "$enrollment_code" "https://${site_configuration_repository_middle}${site}.git"; then
+            log "ERROR" "Unable to set up your configuration repository with your one-time enrollment code (Way A)."
+            exit 1
+        fi
+    else
+        if [ -n "$access_token" ]; then
+            site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}${site}.git"
+        fi
+        git clone $site_configuration_repository_url /etc/bridgehead
+        if [ $? -gt 0 ]; then
+            log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
+        fi
     fi
 elif [[ "$DEV_MODE" == "DEV" ]]; then
     log "INFO" "Now cloning your developer configuration repository for you."
@@ -109,7 +132,7 @@ elif [[ "$DEV_MODE" == "DEV" ]]; then
     git clone "$url" /etc/bridgehead
 fi
 
-chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
+fixPermissions
 mkdir -p /tmp/bridgehead /var/cache/bridgehead
 chown -R bridgehead:docker /tmp/bridgehead /var/cache/bridgehead
 chmod -R g+wr /var/cache/bridgehead /tmp/bridgehead