mirror of
https://github.com/samply/bridgehead.git
synced 2026-10-13 01:06:41 +02:00
Secret Sync for the config repo token, one-time enrollment code, check output (#401)
* cce: Fetch the config repository token via Secret Sync * Keep the Secret Sync GitLab token across reboots and outages * Install site configuration with a one-time enrollment code * Align the itcc and dhki cases in prepare-system.sh * Report an unreachable broker instead of a clock skew during install * Show bridgehead check results as OK, WARN or CRIT and run them during install * Refresh the config repo token before bridgehead check fetches * Skip Secret Sync until the private key and root certificate exist * Indent the case block in prepare-system.sh with tabs only * Hide the config repo URL, token and enrollment code from other local users * remove the unreachable second dhki case --------- Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>
This commit is contained in:
Pierre Delpy
co-authored by
Martin Lablans
Martin Lablans
parent
59a9fd688e
commit
00192eaefc
@@ -130,25 +130,29 @@ Mention:
|
|||||||
- site name (According to conventions listed above)
|
- site name (According to conventions listed above)
|
||||||
- operator name and email
|
- operator name and email
|
||||||
|
|
||||||
We will set the repository up for you. We will then send you:
|
We will set the repository up for you. We will then send you either:
|
||||||
|
|
||||||
- A Repository Short Name (RSN). Beware: this is distinct from your site name.
|
- Way A: a one-time enrollment code, or
|
||||||
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/<project>-bridgehead-configs/dummy.git
|
- Way B: a repository URL including access credentials.
|
||||||
|
|
||||||
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
|
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
|
||||||
|
|
||||||
|
|
||||||
### Base Installation
|
### Base Installation
|
||||||
|
|
||||||
First, download your site specific configuration repository:
|
Clone the bridgehead repository and run the installation script:
|
||||||
```shell
|
```shell
|
||||||
sudo mkdir -p /etc/bridgehead/
|
sudo mkdir -p /srv/docker/
|
||||||
sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
|
sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||||
|
cd /srv/docker/bridgehead
|
||||||
|
sudo ./bridgehead install <PROJECT>
|
||||||
```
|
```
|
||||||
|
|
||||||
|
When asked, choose Way A or Way B. For Way A, enter your one-time enrollment code and your site name; for Way B, enter your repository URL. The installation downloads your site configuration to `/etc/bridgehead`. If your server needs an HTTP proxy to reach the internet, pass it to the script, e.g. `sudo https_proxy=http://proxy.example.org:3128 ./bridgehead install <PROJECT>`.
|
||||||
|
|
||||||
Review the site configuration:
|
Review the site configuration:
|
||||||
```shell
|
```shell
|
||||||
sudo cat /etc/bridgehead/bbmri.conf
|
sudo cat /etc/bridgehead/<PROJECT>.conf
|
||||||
```
|
```
|
||||||
|
|
||||||
Pay special attention to:
|
Pay special attention to:
|
||||||
@@ -159,21 +163,10 @@ Pay special attention to:
|
|||||||
- OPERATOR_LAST_NAME
|
- OPERATOR_LAST_NAME
|
||||||
- OPERATOR_EMAIL
|
- OPERATOR_EMAIL
|
||||||
|
|
||||||
Clone the bridgehead repository:
|
|
||||||
```shell
|
|
||||||
sudo mkdir -p /srv/docker/
|
|
||||||
sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
|
||||||
```
|
|
||||||
|
|
||||||
Then, run the installation script:
|
|
||||||
|
|
||||||
```shell
|
|
||||||
cd /srv/docker/bridgehead
|
|
||||||
sudo ./bridgehead install <PROJECT>
|
|
||||||
```
|
|
||||||
|
|
||||||
### Register with Samply.Beam
|
### Register with Samply.Beam
|
||||||
|
|
||||||
|
If you installed with Way A, this has already been done for you; skip to the next step.
|
||||||
|
|
||||||
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
|
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
|
||||||
|
|
||||||
``` shell
|
``` shell
|
||||||
|
|||||||
@@ -153,7 +153,13 @@ case "$ACTION" in
|
|||||||
exec ./lib/update-bridgehead.sh $PROJECT
|
exec ./lib/update-bridgehead.sh $PROJECT
|
||||||
;;
|
;;
|
||||||
check)
|
check)
|
||||||
|
# Ignore the caller's environment, e.g. proxy variables, like bridgehead@.service does
|
||||||
|
if [ "$(id -u)" -eq 0 ]; then
|
||||||
|
exec systemd-run --wait --pipe --quiet --collect -p User=bridgehead -p WorkingDirectory="$BASE" "$BASE/bridgehead" check $PROJECT
|
||||||
|
fi
|
||||||
|
trap 'log "ERROR" "Unable to load the configuration of $PROJECT"; exit 3' EXIT
|
||||||
loadVars &> /dev/null
|
loadVars &> /dev/null
|
||||||
|
trap - EXIT
|
||||||
exec ./lib/check-bridgehead.sh $PROJECT
|
exec ./lib/check-bridgehead.sh $PROJECT
|
||||||
;;
|
;;
|
||||||
install)
|
install)
|
||||||
|
|||||||
+90
-69
@@ -1,74 +1,95 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
source lib/functions.sh
|
source lib/functions.sh
|
||||||
|
|
||||||
log INFO "Running Bridgehead checks..."
|
if [ -t 1 ]; then
|
||||||
|
GREEN=$(printf '\033[32m')
|
||||||
# Directory ownership
|
YELLOW=$(printf '\033[33m')
|
||||||
log INFO "Checking directory ownership..."
|
RED=$(printf '\033[31m')
|
||||||
OWNERSHIP_OK=true
|
RESET=$(printf '\033[0m')
|
||||||
if ! checkOwner /srv/docker/bridgehead bridgehead &> /dev/null; then
|
|
||||||
log ERROR "Wrong ownership for /srv/docker/bridgehead."
|
|
||||||
log INFO "Hint: Run 'sudo chown -R bridgehead /srv/docker/bridgehead'."
|
|
||||||
OWNERSHIP_OK=false
|
|
||||||
fi
|
|
||||||
if ! checkOwner /etc/bridgehead bridgehead &> /dev/null; then
|
|
||||||
log ERROR "Wrong ownership for /etc/bridgehead."
|
|
||||||
log INFO "Hint: Run 'sudo chown -R bridgehead /etc/bridgehead'."
|
|
||||||
OWNERSHIP_OK=false
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$OWNERSHIP_OK" = true ]; then
|
|
||||||
log INFO "Directory ownership is correct."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Git repository status
|
|
||||||
log INFO "Checking Git repository status..."
|
|
||||||
GIT_OK=true
|
|
||||||
if [ -d "/etc/bridgehead/.git" ]; then
|
|
||||||
if [ -n "$(git -C "/etc/bridgehead" status --porcelain)" ]; then
|
|
||||||
log ERROR "The config repo at /etc/bridgehead is modified.\n$(git -C /etc/bridgehead status -s)"
|
|
||||||
log INFO "Hint: Review your changes with git diff if they are already upstreamed use git stash and git pull to update the repo"
|
|
||||||
GIT_OK=false
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [ -n "$(git -C "$(pwd)" status --porcelain)" ]; then
|
|
||||||
log ERROR "$(pwd) is modified. \n$(git -C "$(pwd)" status -s)"
|
|
||||||
log INFO "Hint: If these are site specific changes to docker compose files consider moving them to $PROJECT/docker-compose.override.yml which is ignored by git."
|
|
||||||
log INFO " If they are already upstreamed use git stash and git pull to update the repo"
|
|
||||||
GIT_OK=false
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$GIT_OK" = true ]; then
|
|
||||||
log INFO "Git repositories are clean."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Git remote connection
|
|
||||||
log INFO "Checking Git remote connection..."
|
|
||||||
GIT_REMOTE_OK=true
|
|
||||||
if [ -d "/etc/bridgehead/.git" ]; then
|
|
||||||
if ! git -C "/etc/bridgehead" fetch --dry-run >/dev/null 2>&1; then
|
|
||||||
log ERROR "Cannot connect to the Git remote for /etc/bridgehead."
|
|
||||||
log INFO "Hint: Check your network connection and Git remote configuration for /etc/bridgehead."
|
|
||||||
GIT_REMOTE_OK=false
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [ -d "$(pwd)/.git" ]; then
|
|
||||||
if ! git -C "$(pwd)" fetch --dry-run >/dev/null 2>&1; then
|
|
||||||
log ERROR "Cannot connect to the Git remote for $(pwd)."
|
|
||||||
log INFO "Hint: Check your network connection and Git remote configuration for $(pwd)."
|
|
||||||
GIT_REMOTE_OK=false
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$GIT_REMOTE_OK" = true ]; then
|
|
||||||
log INFO "Git remote connection successful."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$OWNERSHIP_OK" = true ] && [ "$GIT_OK" = true ] && [ "$GIT_REMOTE_OK" = true ]; then
|
|
||||||
log INFO "All checks passed."
|
|
||||||
exit 0
|
|
||||||
else
|
else
|
||||||
log ERROR "Some checks failed. Please review the hints and fix the issues."
|
GREEN=""
|
||||||
log ERROR "Without fixing these issues bridgehead updates may not work correctly."
|
YELLOW=""
|
||||||
exit 1
|
RED=""
|
||||||
|
RESET=""
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
WORST=0
|
||||||
|
|
||||||
|
report() {
|
||||||
|
local status=$1 message=$2 color level label
|
||||||
|
shift 2
|
||||||
|
case "$status" in
|
||||||
|
OK) color=$GREEN; level=0; label=" OK " ;;
|
||||||
|
WARN) color=$YELLOW; level=1; label="WARN" ;;
|
||||||
|
*) color=$RED; level=2; label="CRIT" ;;
|
||||||
|
esac
|
||||||
|
printf '[%s%s%s] %s\n' "$color" "$label" "$RESET" "$message"
|
||||||
|
local hint
|
||||||
|
for hint in "$@"; do
|
||||||
|
printf '%s\n' "$hint" | sed 's/^/ /'
|
||||||
|
done
|
||||||
|
if [ $level -gt $WORST ]; then
|
||||||
|
WORST=$level
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
GIT_PROXY_ARGS=()
|
||||||
|
if [ -n "$HTTPS_PROXY_FULL_URL" ]; then
|
||||||
|
GIT_PROXY_ARGS=(-c http.proxy=$HTTPS_PROXY_FULL_URL -c https.proxy=$HTTPS_PROXY_FULL_URL)
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Running Bridgehead checks for project $PROJECT ..."
|
||||||
|
|
||||||
|
if [ -n "$BROKER_URL_FOR_PREREQ" ]; then
|
||||||
|
if https_proxy=$HTTPS_PROXY_FULL_URL curl -m 10 -sS -o /dev/null "$BROKER_URL_FOR_PREREQ" 2>/dev/null; then
|
||||||
|
report OK "Network connection to $BROKER_URL_FOR_PREREQ"
|
||||||
|
else
|
||||||
|
report CRIT "Cannot connect to $BROKER_URL_FOR_PREREQ with the configured proxy \"$HTTPS_PROXY_URL\"" \
|
||||||
|
"Hint: If your server needs a proxy, HTTPS_PROXY_URL (and, if required, HTTPS_PROXY_USERNAME and HTTPS_PROXY_PASSWORD) must be set in /etc/bridgehead/$PROJECT.conf. Please ask ${SUPPORT_EMAIL:-the support team of your project} to add it to your site configuration."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
for DIR in /srv/docker/bridgehead /etc/bridgehead; do
|
||||||
|
if checkOwner $DIR bridgehead &> /dev/null; then
|
||||||
|
report OK "Ownership of $DIR"
|
||||||
|
else
|
||||||
|
report CRIT "Wrong ownership for $DIR" "Hint: Run 'sudo chown -R bridgehead $DIR'."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -d "/etc/bridgehead/.git" ]; then
|
||||||
|
if [ -z "$(git -C "/etc/bridgehead" status --porcelain)" ]; then
|
||||||
|
report OK "The config repo at /etc/bridgehead is clean"
|
||||||
|
else
|
||||||
|
report WARN "The config repo at /etc/bridgehead is modified:" \
|
||||||
|
"$(git -C /etc/bridgehead status -s)" \
|
||||||
|
"Hint: Review your changes with git diff if they are already upstreamed use git stash and git pull to update the repo"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -z "$(git -C "$(pwd)" status --porcelain)" ]; then
|
||||||
|
report OK "$(pwd) is clean"
|
||||||
|
else
|
||||||
|
report WARN "$(pwd) is modified:" \
|
||||||
|
"$(git -C "$(pwd)" status -s)" \
|
||||||
|
"Hint: If these are site specific changes to docker compose files consider moving them to $PROJECT/docker-compose.override.yml which is ignored by git." \
|
||||||
|
" If they are already upstreamed use git stash and git pull to update the repo"
|
||||||
|
fi
|
||||||
|
|
||||||
|
secret_sync_gitlab_token &> /dev/null
|
||||||
|
|
||||||
|
for DIR in /etc/bridgehead "$(pwd)"; do
|
||||||
|
if [ -d "$DIR/.git" ]; then
|
||||||
|
if git "${GIT_PROXY_ARGS[@]}" -C "$DIR" fetch --dry-run >/dev/null 2>&1; then
|
||||||
|
report OK "Git remote connection for $DIR"
|
||||||
|
else
|
||||||
|
report CRIT "Cannot connect to the Git remote for $DIR" "Hint: Check your network connection and Git remote configuration for $DIR."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
case $WORST in
|
||||||
|
0) echo "All checks passed." ;;
|
||||||
|
1) echo "Some checks reported warnings. Please review the hints." ;;
|
||||||
|
*) echo "Some checks failed. Please review the hints and fix the issues. Without fixing these issues bridgehead updates may not work correctly." ;;
|
||||||
|
esac
|
||||||
|
exit $WORST
|
||||||
|
|||||||
+126
-37
@@ -336,21 +336,57 @@ function sync_secrets() {
|
|||||||
set +a # Export variables in the regular way
|
set +a # Export variables in the regular way
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Map a GitLab URL to the prefix recognized by Secret Sync
|
||||||
|
function secret_sync_gitlab_instance() {
|
||||||
|
case "$1" in
|
||||||
|
*git.verbis.dkfz.de*) echo verbis;;
|
||||||
|
*gitlab.bbmri-eric.eu*) echo bbmri;;
|
||||||
|
*) return 1;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Use Secret Sync to validate the GitLab token in /var/cache/bridgehead/secrets/gitlab-token.
|
||||||
|
# If it is missing or expired, Secret Sync will create a new token and write it to the file.
|
||||||
|
# The git credential helper reads the token from the file during git pull.
|
||||||
|
function secret_sync_fetch_gitlab_token() {
|
||||||
|
local gitlab=$1 proxy_id=$2 broker_url=$3 broker_id=$4 privkey_file=$5 root_crt_file=$6
|
||||||
|
if [ ! -f "$privkey_file" ] || [ ! -f "$root_crt_file" ]; then
|
||||||
|
log "WARN" "Not running Secret Sync because $privkey_file or $root_crt_file is missing"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
local trusted_ca_args=()
|
||||||
|
if [ -d /etc/bridgehead/trusted-ca-certs ]; then
|
||||||
|
trusted_ca_args=(-v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro -e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs)
|
||||||
|
fi
|
||||||
|
mkdir -p /var/cache/bridgehead/secrets
|
||||||
|
chmod 700 /var/cache/bridgehead/secrets
|
||||||
|
log "INFO" "Running Secret Sync for the GitLab token (gitlab=$gitlab)"
|
||||||
|
docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
|
||||||
|
docker run --rm \
|
||||||
|
-v $privkey_file:/run/secrets/privkey.pem:ro \
|
||||||
|
-v $root_crt_file:/run/secrets/root.crt.pem:ro \
|
||||||
|
"${trusted_ca_args[@]}" \
|
||||||
|
-v /var/cache/bridgehead/secrets:/secret-sync/ \
|
||||||
|
-e CACHE_PATH=/secret-sync/gitlab-token \
|
||||||
|
-e NO_PROXY=localhost,127.0.0.1 \
|
||||||
|
-e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
|
||||||
|
-e PROXY_ID=$proxy_id \
|
||||||
|
-e BROKER_URL=$broker_url \
|
||||||
|
-e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
|
||||||
|
-e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN:$gitlab \
|
||||||
|
docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
|
||||||
|
}
|
||||||
|
|
||||||
function secret_sync_gitlab_token() {
|
function secret_sync_gitlab_token() {
|
||||||
if [[ "$PROJECT" != "ccp" && "$PROJECT" != "bbmri" ]]; then
|
if [[ "$PROJECT" != "ccp" && "$PROJECT" != "bbmri" && "$PROJECT" != "cce" ]] && [ -z "$(git -C /etc/bridgehead config credential.helper)" ]; then
|
||||||
log "INFO" "Not running Secret Sync for project minimal"
|
log "INFO" "Not running Secret Sync for project $PROJECT"
|
||||||
return
|
return
|
||||||
fi
|
fi
|
||||||
# Map the origin of the git repository /etc/bridgehead to the prefix recognized by Secret Sync
|
|
||||||
local gitlab
|
local gitlab
|
||||||
case "$(git -C /etc/bridgehead remote get-url origin)" in
|
if ! gitlab=$(secret_sync_gitlab_instance "$(git -C /etc/bridgehead remote get-url origin)"); then
|
||||||
*git.verbis.dkfz.de*) gitlab=verbis;;
|
log "WARN" "Not running Secret Sync because the git repository /etc/bridgehead has unknown origin"
|
||||||
*gitlab.bbmri-eric.eu*) gitlab=bbmri;;
|
return
|
||||||
*)
|
fi
|
||||||
log "WARN" "Not running Secret Sync because the git repository /etc/bridgehead has unknown origin"
|
|
||||||
return
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
if [ "$PROJECT" == "bbmri" ]; then
|
if [ "$PROJECT" == "bbmri" ]; then
|
||||||
# If the project is BBMRI, use the BBMRI-ERIC broker and not the GBN broker
|
# If the project is BBMRI, use the BBMRI-ERIC broker and not the GBN broker
|
||||||
@@ -365,30 +401,7 @@ function secret_sync_gitlab_token() {
|
|||||||
root_crt_file="/srv/docker/bridgehead/$PROJECT/root.crt.pem"
|
root_crt_file="/srv/docker/bridgehead/$PROJECT/root.crt.pem"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Create a temporary directory for Secret Sync that is valid per boot
|
if secret_sync_fetch_gitlab_token "$gitlab" "$proxy_id" "$broker_url" "$broker_id" "$PRIVATEKEYFILENAME" "$root_crt_file"; then
|
||||||
secret_sync_tempdir="/tmp/bridgehead/secret-sync.boot-$(cat /proc/sys/kernel/random/boot_id)"
|
|
||||||
mkdir -p $secret_sync_tempdir
|
|
||||||
|
|
||||||
# Use Secret Sync to validate the GitLab token in $secret_sync_tempdir/cache.
|
|
||||||
# If it is missing or expired, Secret Sync will create a new token and write it to the file.
|
|
||||||
# The git credential helper reads the token from the file during git pull.
|
|
||||||
log "INFO" "Running Secret Sync for the GitLab token (gitlab=$gitlab)"
|
|
||||||
docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
|
|
||||||
docker run --rm \
|
|
||||||
-v $PRIVATEKEYFILENAME:/run/secrets/privkey.pem:ro \
|
|
||||||
-v $root_crt_file:/run/secrets/root.crt.pem:ro \
|
|
||||||
-v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro \
|
|
||||||
-v $secret_sync_tempdir:/secret-sync/ \
|
|
||||||
-e CACHE_PATH=/secret-sync/gitlab-token \
|
|
||||||
-e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs \
|
|
||||||
-e NO_PROXY=localhost,127.0.0.1 \
|
|
||||||
-e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
|
|
||||||
-e PROXY_ID=$proxy_id \
|
|
||||||
-e BROKER_URL=$broker_url \
|
|
||||||
-e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
|
|
||||||
-e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN:$gitlab \
|
|
||||||
docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
|
|
||||||
if [ $? -eq 0 ]; then
|
|
||||||
log "INFO" "Secret Sync was successful"
|
log "INFO" "Secret Sync was successful"
|
||||||
# In the past we used to hardcode tokens into the repository URL. We have to remove those now for the git credential helper to become effective.
|
# In the past we used to hardcode tokens into the repository URL. We have to remove those now for the git credential helper to become effective.
|
||||||
CLEAN_REPO="$(git -C /etc/bridgehead remote get-url origin | sed -E 's|https://[^@]+@|https://|')"
|
CLEAN_REPO="$(git -C /etc/bridgehead remote get-url origin | sed -E 's|https://[^@]+@|https://|')"
|
||||||
@@ -397,8 +410,6 @@ function secret_sync_gitlab_token() {
|
|||||||
git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
|
git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
|
||||||
else
|
else
|
||||||
log "WARN" "Secret Sync failed"
|
log "WARN" "Secret Sync failed"
|
||||||
# Remove the git credential helper
|
|
||||||
git -C /etc/bridgehead config --unset credential.helper
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
|
# In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
|
||||||
@@ -407,6 +418,84 @@ function secret_sync_gitlab_token() {
|
|||||||
git -C /srv/docker/bridgehead config --unset credential.helper
|
git -C /srv/docker/bridgehead config --unset credential.helper
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function bootstrap_site_configuration() {
|
||||||
|
local site=$1 enrollment_code=$2 repository_url=$3
|
||||||
|
local SITE_ID=$site BROKER_ID="" BROKER_URL="" PROXY_ID="" PRIVATEKEYFILENAME=""
|
||||||
|
local HTTPS_PROXY_FULL_URL=${HTTPS_PROXY_FULL_URL:-${https_proxy:-${HTTPS_PROXY:-}}}
|
||||||
|
eval "$(grep -E '^(BROKER_ID|BROKER_URL|PROXY_ID|PRIVATEKEYFILENAME)=' "$PROJECT/vars")"
|
||||||
|
if [ -z "$BROKER_ID" ]; then
|
||||||
|
log "ERROR" "Project $PROJECT has no Samply.Beam broker to enroll with."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
local gitlab
|
||||||
|
if ! gitlab=$(secret_sync_gitlab_instance "$repository_url"); then
|
||||||
|
log "ERROR" "Secret Sync does not support the GitLab server of $repository_url."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local enroll_dir
|
||||||
|
enroll_dir=$(mktemp -d /run/bridgehead-enrollment.XXXXXX)
|
||||||
|
local key_file="$enroll_dir/$SITE_ID.priv.pem"
|
||||||
|
log "INFO" "Enrolling Beam Proxy Id $PROXY_ID"
|
||||||
|
if ! docker run --rm -v "$enroll_dir:/pki" docker.verbis.dkfz.de/cache/samply/beam-enroll:latest --output-file "/pki/$SITE_ID.priv.pem" --proxy-id "$PROXY_ID" > "$enroll_dir/enroll.out"; then
|
||||||
|
log "ERROR" "Unable to generate the private key for $PROXY_ID."
|
||||||
|
rm -rf "$enroll_dir"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
local csr
|
||||||
|
csr=$(sed -n '/BEGIN CERTIFICATE REQUEST/,/END CERTIFICATE REQUEST/p' "$enroll_dir/enroll.out")
|
||||||
|
printf '%s' "$enrollment_code" > "$enroll_dir/enrollment-code"
|
||||||
|
local response
|
||||||
|
response=$(curl -sS --data-urlencode "csr=$csr" --data-urlencode "token@$enroll_dir/enrollment-code" "$BROKER_URL/csr" 2>&1)
|
||||||
|
if [[ "$response" != *"Successfully registered CSR"* ]]; then
|
||||||
|
log "ERROR" "$BROKER_URL did not accept the certificate request with your one-time enrollment code: $(echo "$response" | sed -e 's/<[^>]*>//g' | tr -s '[:space:]' ' ' | head -c 300)"
|
||||||
|
rm -rf "$enroll_dir"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local answer
|
||||||
|
until retry 3 secret_sync_fetch_gitlab_token "$gitlab" "$PROXY_ID" "$BROKER_URL" "$BROKER_ID" "$key_file" "/srv/docker/bridgehead/$PROJECT/root.crt.pem" \
|
||||||
|
&& git -c credential.helper=/srv/docker/bridgehead/lib/gitlab-token-helper.sh clone "$repository_url" /etc/bridgehead; do
|
||||||
|
log "ERROR" "Unable to download $repository_url."
|
||||||
|
read -r -p "Fix the cause and retry? If you don't, you will need a new one-time enrollment code. [Y/n] " answer || answer=n
|
||||||
|
if [[ "$answer" == [Nn]* ]]; then
|
||||||
|
rm -rf "$enroll_dir"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
local configured_site_id
|
||||||
|
configured_site_id=$(grep -m1 -E '^SITE_ID=' "/etc/bridgehead/$PROJECT.conf" | cut -d= -f2- | tr -d "\"'")
|
||||||
|
if [ "$configured_site_id" != "$SITE_ID" ]; then
|
||||||
|
log "ERROR" "Your configuration repository is for site '$configured_site_id', but you entered '$SITE_ID'. Ask for a one-time enrollment code for '$configured_site_id' and run the installation again."
|
||||||
|
rm -rf /etc/bridgehead "$enroll_dir"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
|
||||||
|
mkdir -p "$(dirname "$PRIVATEKEYFILENAME")"
|
||||||
|
mv "$key_file" "$PRIVATEKEYFILENAME"
|
||||||
|
chmod 600 "$PRIVATEKEYFILENAME"
|
||||||
|
rm -rf "$enroll_dir"
|
||||||
|
}
|
||||||
|
|
||||||
|
function read_masked() {
|
||||||
|
local prompt=$1 char value=""
|
||||||
|
local -n read_masked_result=$2
|
||||||
|
printf '%s' "$prompt"
|
||||||
|
while IFS= read -r -s -n1 char && [ -n "$char" ]; do
|
||||||
|
if [[ "$char" == $'\x7f' || "$char" == $'\b' ]]; then
|
||||||
|
if [ -n "$value" ]; then
|
||||||
|
value=${value%?}
|
||||||
|
printf '\b \b'
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
value+=$char
|
||||||
|
printf '*'
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
read_masked_result=$value
|
||||||
|
}
|
||||||
|
|
||||||
capitalize_first_letter() {
|
capitalize_first_letter() {
|
||||||
input="$1"
|
input="$1"
|
||||||
capitalized="$(tr '[:lower:]' '[:upper:]' <<< ${input:0:1})${input:1}"
|
capitalized="$(tr '[:lower:]' '[:upper:]' <<< ${input:0:1})${input:1}"
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[ "$1" = "get" ] || exit
|
[ "$1" = "get" ] || exit
|
||||||
|
|
||||||
source "/tmp/bridgehead/secret-sync.boot-$(cat /proc/sys/kernel/random/boot_id)/gitlab-token"
|
source /var/cache/bridgehead/secrets/gitlab-token
|
||||||
|
|
||||||
# Any non-empty username works, only the token matters
|
# Any non-empty username works, only the token matters
|
||||||
cat << EOF
|
cat << EOF
|
||||||
|
|||||||
@@ -63,6 +63,16 @@ cp -v \
|
|||||||
|
|
||||||
systemctl daemon-reload
|
systemctl daemon-reload
|
||||||
|
|
||||||
|
fixPermissions
|
||||||
|
|
||||||
|
log "INFO" "Checking your bridgehead ..."
|
||||||
|
CHECK_RESULT=0
|
||||||
|
/srv/docker/bridgehead/bridgehead check "${PROJECT}" || CHECK_RESULT=$?
|
||||||
|
if [ $CHECK_RESULT -ge 2 ]; then
|
||||||
|
log "ERROR" "Some checks failed. Fix them and run the installation again."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
log INFO "Trying to update your bridgehead ..."
|
log INFO "Trying to update your bridgehead ..."
|
||||||
|
|
||||||
systemctl start bridgehead-update@"${PROJECT}".service
|
systemctl start bridgehead-update@"${PROJECT}".service
|
||||||
|
|||||||
+39
-16
@@ -60,16 +60,13 @@ case "$PROJECT" in
|
|||||||
;;
|
;;
|
||||||
itcc)
|
itcc)
|
||||||
site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
|
site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
|
||||||
;;
|
|
||||||
dhki)
|
|
||||||
site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
|
|
||||||
;;
|
|
||||||
kr)
|
|
||||||
site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
|
|
||||||
;;
|
;;
|
||||||
dhki)
|
dhki)
|
||||||
site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
|
site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
|
||||||
;;
|
;;
|
||||||
|
kr)
|
||||||
|
site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
|
||||||
|
;;
|
||||||
nngm)
|
nngm)
|
||||||
site_configuration_repository_middle="git.verbis.dkfz.de/nngm/"
|
site_configuration_repository_middle="git.verbis.dkfz.de/nngm/"
|
||||||
;;
|
;;
|
||||||
@@ -78,7 +75,7 @@ case "$PROJECT" in
|
|||||||
;;
|
;;
|
||||||
*)
|
*)
|
||||||
log ERROR "Internal error, this should not happen."
|
log ERROR "Internal error, this should not happen."
|
||||||
exit 1
|
exit 1
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
|
|
||||||
@@ -92,16 +89,42 @@ if [ -d /etc/bridgehead ]; then
|
|||||||
fi
|
fi
|
||||||
elif [[ "$DEV_MODE" == "NODEV" ]]; then
|
elif [[ "$DEV_MODE" == "NODEV" ]]; then
|
||||||
log "INFO" "Now cloning your site configuration repository for you."
|
log "INFO" "Now cloning your site configuration repository for you."
|
||||||
if [ -z "$site" ]; then
|
if [ -z "$access_token" ] && [ -z "$enrollment_code" ]; then
|
||||||
read -p "Please enter your site: " site
|
echo "Way A: You received a one-time enrollment code."
|
||||||
|
echo "Way B: You received a repository URL including access credentials."
|
||||||
|
read -p "Please choose your way of installation [A/B]: " way
|
||||||
|
case "$way" in
|
||||||
|
[Aa])
|
||||||
|
read -p "Please enter your one-time enrollment code: " enrollment_code
|
||||||
|
;;
|
||||||
|
[Bb])
|
||||||
|
read_masked "Please enter your repository URL: " site_configuration_repository_url
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
log "ERROR" "Please choose A or B."
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
fi
|
fi
|
||||||
if [ -z "$access_token" ]; then
|
if [ -z "$site_configuration_repository_url" ]; then
|
||||||
read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
|
if [ -z "$site" ]; then
|
||||||
|
read -p "Please enter your site: " site
|
||||||
|
fi
|
||||||
|
site=$(echo $site | tr '[:upper:]' '[:lower:]')
|
||||||
fi
|
fi
|
||||||
site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}$(echo $site | tr '[:upper:]' '[:lower:]').git"
|
if [ -z "$access_token" ] && [ -n "$enrollment_code" ]; then
|
||||||
git clone $site_configuration_repository_url /etc/bridgehead
|
if ! bootstrap_site_configuration "$site" "$enrollment_code" "https://${site_configuration_repository_middle}${site}.git"; then
|
||||||
if [ $? -gt 0 ]; then
|
log "ERROR" "Unable to set up your configuration repository with your one-time enrollment code (Way A)."
|
||||||
log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [ -n "$access_token" ]; then
|
||||||
|
site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}${site}.git"
|
||||||
|
fi
|
||||||
|
git clone $site_configuration_repository_url /etc/bridgehead
|
||||||
|
if [ $? -gt 0 ]; then
|
||||||
|
log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
elif [[ "$DEV_MODE" == "DEV" ]]; then
|
elif [[ "$DEV_MODE" == "DEV" ]]; then
|
||||||
log "INFO" "Now cloning your developer configuration repository for you."
|
log "INFO" "Now cloning your developer configuration repository for you."
|
||||||
@@ -109,7 +132,7 @@ elif [[ "$DEV_MODE" == "DEV" ]]; then
|
|||||||
git clone "$url" /etc/bridgehead
|
git clone "$url" /etc/bridgehead
|
||||||
fi
|
fi
|
||||||
|
|
||||||
chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
|
fixPermissions
|
||||||
mkdir -p /tmp/bridgehead /var/cache/bridgehead
|
mkdir -p /tmp/bridgehead /var/cache/bridgehead
|
||||||
chown -R bridgehead:docker /tmp/bridgehead /var/cache/bridgehead
|
chown -R bridgehead:docker /tmp/bridgehead /var/cache/bridgehead
|
||||||
chmod -R g+wr /var/cache/bridgehead /tmp/bridgehead
|
chmod -R g+wr /var/cache/bridgehead /tmp/bridgehead
|
||||||
|
|||||||
@@ -72,6 +72,7 @@ source ${PROJECT}/vars
|
|||||||
if [ "${PROJECT}" != "minimal" ]; then
|
if [ "${PROJECT}" != "minimal" ]; then
|
||||||
set +e
|
set +e
|
||||||
SERVERTIME="$(https_proxy=$HTTPS_PROXY_FULL_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
|
SERVERTIME="$(https_proxy=$HTTPS_PROXY_FULL_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
|
||||||
|
[ -n "$SERVERTIME" ]
|
||||||
RET=$?
|
RET=$?
|
||||||
set -e
|
set -e
|
||||||
if [ $RET -ne 0 ]; then
|
if [ $RET -ne 0 ]; then
|
||||||
|
|||||||
Reference in New Issue
Block a user