From 33ffecb3a2e2d9f205a6d1ffb5c0161b20e51f0e Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Mon, 5 Sep 2022 16:01:56 +0200 Subject: [PATCH 01/92] feat: WIP! Added Samply Beam and Spot to CCP --- ccp/docker-compose.yml | 71 +++++++++++++++++++++++++----------------- start-bridgehead.sh | 2 +- 2 files changed, 44 insertions(+), 29 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index e3ef2e4..75a06c3 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -7,8 +7,7 @@ services: command: - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 - - --providers.docker=true - - --api.dashboard=true + - --providers.docker=true - --api.dashboard=true - --accesslog=true # print access-logs - --entrypoints.web.http.redirections.entrypoint.to=websecure - --entrypoints.web.http.redirections.entrypoint.scheme=https @@ -67,36 +66,52 @@ services: - "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,ccp-auth" - "traefik.http.routers.blaze_ccp.tls=true" - ccp-search-share: - image: "samply/dktk-fed-search-share:main" - container_name: bridgehead-ccp-share + task-store: + image: "samply/blaze:develop" environment: - APP_BASE_URL: "http://dktk-fed-search-share:8080" - APP_BROKER_BASEURL: "https://dktk-fed-search.verbis.dkfz.de/broker/rest/searchbroker" - APP_BROKER_MAIL: ${CCP_SEARCHBROKER_USERNAME} - APP_BROKER_AUTHTOKEN: ${CCP_SEARCHBROKER_PASSWORD} - APP_STORE_BASEURL: "http://bridgehead-ccp-blaze:8080/fhir" - SPRING_DATASOURCE_URL: "jdbc:postgresql://bridgehead-ccp-share-db:5432/postgres" - JAVA_TOOL_OPTIONS: -Xmx1g -Dhttp.proxyHost=bridgehead-forward-proxy -Dhttp.proxyPort=3128 -Dhttps.proxyHost=bridgehead-forward-proxy -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts="bridgehead-*" - depends_on: - - ccp-search-share-db - - blaze - labels: - - "traefik.enable=true" - - "traefik.http.routers.dktk-fed-search.rule=PathPrefix(`/ccp-connector`)" - - "traefik.http.services.dktk-fed-search.loadbalancer.server.port=8080" - - ccp-search-share-db: - image: "postgres:14" - container_name: bridgehead-ccp-share-db - environment: - POSTGRES_USER: "postgres" - POSTGRES_PASSWORD: "postgres" - POSTGRES_DB: "dktk-fed-search-share" + BASE_URL: "http://localhost:8083" + JAVA_TOOL_OPTIONS: "-Xmx1g" + LOG_LEVEL: "debug" + ports: + - "8083:8080" volumes: - - "ccp-search-share-db-data:/var/lib/postgresql/data" + - "task-store-data:/app/data" + + data-store: + image: "samply/blaze:develop" + environment: + BASE_URL: "http://localhost:8084" + JAVA_TOOL_OPTIONS: "-Xmx1g" + LOG_LEVEL: "debug" + ports: + - "8084:8080" + volumes: + - "data-store-data:/app/data" + + # spot: + # image: "samply/spot" + + beam-proxy: + image: "samply/beam-proxy:develop" + environment: + BROKER_URL: ${BROKER_URL} + PROXY_ID: ${PROXY_ID} + APP_0_ID: ${APP_0_ID_SHORT} + APP_0_KEY: ${APP_0_KEY} + APP_1_ID: ${APP_1_ID_SHORT} + APP_1_KEY: ${APP_1_KEY} + PRIVKEY_FILE: /run/secrets/proxy.pem + secrets: + - proxy.pem + volumes: blaze-data: bridgehead-proxy: ccp-search-share-db-data: + task-store-data: + data-store-data: + +secrets: + proxy.pem: + file: ./pki/${PROXY_ID_SHORT}.priv.pem diff --git a/start-bridgehead.sh b/start-bridgehead.sh index bf1478d..b658c93 100755 --- a/start-bridgehead.sh +++ b/start-bridgehead.sh @@ -13,6 +13,6 @@ source site.conf log "Starting bridgehead" -docker-compose -f ${project}/docker-compose.yml --env-file site-config/${project}.env up -d +docker-compose -f <(docker run --rm --volume ${pwd}/${project}/:/tmp/workdir/ samply/templer /tmp/workdir/docker-compose.yml TEST="TEST_0 TEST_1") config log "The bridgehead should be in online in a few seconds" From 5c2c76e75979d4b94840bd2cdf673226c0473e62 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Wed, 7 Sep 2022 11:09:53 +0200 Subject: [PATCH 02/92] Added WIP spot and beam proxy --- ccp/docker-compose.yml | 52 +++++++++++++++++++----------------------- lib/prerequisites.sh | 5 ++++ 2 files changed, 28 insertions(+), 29 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 75a06c3..860b689 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -7,7 +7,8 @@ services: command: - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 - - --providers.docker=true - --api.dashboard=true + - --providers.docker=true + - --api.dashboard=true - --accesslog=true # print access-logs - --entrypoints.web.http.redirections.entrypoint.to=websecure - --entrypoints.web.http.redirections.entrypoint.scheme=https @@ -51,7 +52,7 @@ services: image: "samply/blaze:0.17" container_name: bridgehead-ccp-blaze environment: - BASE_URL: "http://blaze:8080" + BASE_URL: "http://bridgehead-ccp-blaze:8080" JAVA_TOOL_OPTIONS: "-Xmx4g" LOG_LEVEL: "debug" ENFORCE_REFERENTIAL_INTEGRITY: "false" @@ -65,34 +66,24 @@ services: - "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080" - "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,ccp-auth" - "traefik.http.routers.blaze_ccp.tls=true" - - task-store: - image: "samply/blaze:develop" - environment: - BASE_URL: "http://localhost:8083" - JAVA_TOOL_OPTIONS: "-Xmx1g" - LOG_LEVEL: "debug" - ports: - - "8083:8080" - volumes: - - "task-store-data:/app/data" - data-store: - image: "samply/blaze:develop" + spot: + image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:9a80eeef29f08ecec947fc2df55a65424255e6d60105fee8ee0ef77db27af01c" environment: - BASE_URL: "http://localhost:8084" - JAVA_TOOL_OPTIONS: "-Xmx1g" - LOG_LEVEL: "debug" - ports: - - "8084:8080" - volumes: - - "data-store-data:/app/data" - - # spot: - # image: "samply/spot" + SECRET: ${SECRET} + APPID: ${APP_0_ID_SHORT} + PROXY_ID: ${PROXY_ID} + LDM_URL: ${LDM_URL} + BEAM_PROXY: http://beam-proxy:8081 + depends_on: + - "beam-proxy" + - "blaze" + labels: + - "traefik.enable=false" beam-proxy: image: "samply/beam-proxy:develop" + container_name: bridgehead-beam-proxy environment: BROKER_URL: ${BROKER_URL} PROXY_ID: ${PROXY_ID} @@ -101,17 +92,20 @@ services: APP_1_ID: ${APP_1_ID_SHORT} APP_1_KEY: ${APP_1_KEY} PRIVKEY_FILE: /run/secrets/proxy.pem + http_proxy: http://bridgehead-forward-proxy:3128 + https_proxy: http://bridgehead-forward-proxy:3128 secrets: - proxy.pem + labels: + - "traefik.enable=false" + depends_on: + - "forward_proxy" volumes: blaze-data: bridgehead-proxy: - ccp-search-share-db-data: - task-store-data: - data-store-data: secrets: proxy.pem: - file: ./pki/${PROXY_ID_SHORT}.priv.pem + file: /etc/bridgehead/pki/${PROXY_ID_SHORT}.priv.pem diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh index e04161b..0000406 100755 --- a/lib/prerequisites.sh +++ b/lib/prerequisites.sh @@ -52,6 +52,11 @@ if [ ! -e "certs/traefik.crt" ]; then openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 3650 -subj "/CN=$HOST" fi +if [ ! -e "etc/bridgehead/pki/*.priv.pem" ]; then + log ERROR "Privaste certificsate for beam is missing" + exit 1 +fi + if [ -e /etc/bridgehead/vault.conf ]; then if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf." From 4ef896c3f26604b536ca09bfe6f9bef01cbf1748 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Wed, 7 Sep 2022 15:26:01 +0200 Subject: [PATCH 03/92] Replaced forward proxy with site proxy --- ccp/docker-compose.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 860b689..bf4ba2c 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -92,8 +92,9 @@ services: APP_1_ID: ${APP_1_ID_SHORT} APP_1_KEY: ${APP_1_KEY} PRIVKEY_FILE: /run/secrets/proxy.pem - http_proxy: http://bridgehead-forward-proxy:3128 - https_proxy: http://bridgehead-forward-proxy:3128 + RUST_LOG: info + http_proxy: ${http_proxy} + https_proxy: ${https_proxy} secrets: - proxy.pem labels: From 1050d413cd5aa4a189c9b3dfd20b143388496ce1 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Thu, 8 Sep 2022 09:33:03 +0200 Subject: [PATCH 04/92] Added more Debug loging --- ccp/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index bf4ba2c..6a8c26f 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -68,7 +68,7 @@ services: - "traefik.http.routers.blaze_ccp.tls=true" spot: - image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:9a80eeef29f08ecec947fc2df55a65424255e6d60105fee8ee0ef77db27af01c" + image: "samply/spot" environment: SECRET: ${SECRET} APPID: ${APP_0_ID_SHORT} @@ -92,7 +92,7 @@ services: APP_1_ID: ${APP_1_ID_SHORT} APP_1_KEY: ${APP_1_KEY} PRIVKEY_FILE: /run/secrets/proxy.pem - RUST_LOG: info + RUST_LOG: debug http_proxy: ${http_proxy} https_proxy: ${https_proxy} secrets: From 066ab45e9c41a2bfce5ea04757dfb8da8c889bdf Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Thu, 8 Sep 2022 10:21:14 +0200 Subject: [PATCH 05/92] WIP: Beam Pem Check --- lib/prerequisites.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh index 0000406..e04161b 100755 --- a/lib/prerequisites.sh +++ b/lib/prerequisites.sh @@ -52,11 +52,6 @@ if [ ! -e "certs/traefik.crt" ]; then openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 3650 -subj "/CN=$HOST" fi -if [ ! -e "etc/bridgehead/pki/*.priv.pem" ]; then - log ERROR "Privaste certificsate for beam is missing" - exit 1 -fi - if [ -e /etc/bridgehead/vault.conf ]; then if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf." From cd7257b2958acf90565c595e7ebc07561a2a95e4 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Thu, 8 Sep 2022 10:23:07 +0200 Subject: [PATCH 06/92] Added real image --- ccp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 6a8c26f..365c1f4 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -82,7 +82,7 @@ services: - "traefik.enable=false" beam-proxy: - image: "samply/beam-proxy:develop" + image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" container_name: bridgehead-beam-proxy environment: BROKER_URL: ${BROKER_URL} From c8fc96132164180cb5cd47a8bcd5b49f1e31f8c0 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Thu, 8 Sep 2022 10:24:25 +0200 Subject: [PATCH 07/92] At the right point now --- ccp/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 365c1f4..ab0a830 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -68,7 +68,7 @@ services: - "traefik.http.routers.blaze_ccp.tls=true" spot: - image: "samply/spot" + image: "docker pull docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" environment: SECRET: ${SECRET} APPID: ${APP_0_ID_SHORT} @@ -82,7 +82,7 @@ services: - "traefik.enable=false" beam-proxy: - image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" + image: "samply/beam-proxy:develop" container_name: bridgehead-beam-proxy environment: BROKER_URL: ${BROKER_URL} From 93f0551ac6e2ea3a8bb468da5bc0798dbaddf5b6 Mon Sep 17 00:00:00 2001 From: Patrick Skowronek Date: Thu, 8 Sep 2022 10:25:18 +0200 Subject: [PATCH 08/92] Fix ref --- ccp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index ab0a830..48bb616 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -68,7 +68,7 @@ services: - "traefik.http.routers.blaze_ccp.tls=true" spot: - image: "docker pull docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" + image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" environment: SECRET: ${SECRET} APPID: ${APP_0_ID_SHORT} From f4f33b95fccd2f94a95e8189476c1ac91c0221df Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Mon, 26 Sep 2022 10:51:35 +0200 Subject: [PATCH 09/92] fix: Added Traefik Certificate Specification --- ccp/docker-compose.yml | 5 ++++- lib/traefik-configuration/certificates.yaml | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 lib/traefik-configuration/certificates.yaml diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 48bb616..8ac42c8 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -7,7 +7,9 @@ services: command: - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 - - --providers.docker=true + - --providers.docker=true + - --providers.file.watch=true + - --providers.file.directory=/configuration/ - --api.dashboard=true - --accesslog=true # print access-logs - --entrypoints.web.http.redirections.entrypoint.to=websecure @@ -24,6 +26,7 @@ services: - 443:443 volumes: - ../certs:/tools/certs + - ../lib/traefik-configuration/:/configuration - /var/run/docker.sock:/var/run/docker.sock:ro forward_proxy: diff --git a/lib/traefik-configuration/certificates.yaml b/lib/traefik-configuration/certificates.yaml new file mode 100644 index 0000000..7a78ce3 --- /dev/null +++ b/lib/traefik-configuration/certificates.yaml @@ -0,0 +1,4 @@ +tls: + certificates: + - certFile: /certs/certificate.pem + keyFile: /certs/private-key.pem From 996e8dbd1bb7e6b5c5497916e259592c66bb121b Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Mon, 26 Sep 2022 10:54:46 +0200 Subject: [PATCH 10/92] refactor: Remove unused Bridgehead Scripts --- install-bridgehead.sh | 32 -------------------------------- start-bridgehead.sh | 18 ------------------ stop-bridgehead.sh | 8 -------- uninstall-bridgehead.sh | 10 ---------- update-bridgehead.sh | 38 -------------------------------------- 5 files changed, 106 deletions(-) delete mode 100755 install-bridgehead.sh delete mode 100755 start-bridgehead.sh delete mode 100755 stop-bridgehead.sh delete mode 100755 uninstall-bridgehead.sh delete mode 100755 update-bridgehead.sh diff --git a/install-bridgehead.sh b/install-bridgehead.sh deleted file mode 100755 index 389354a..0000000 --- a/install-bridgehead.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -### Note: Currently not complete, needs some features before useable for production - -source lib/functions.sh - -exitIfNotRoot - -if ! ./lib/prerequisites.sh; then - log "Prerequisites failed, exiting" - exit 1 -fi -source site.conf - -./lib/generate.sh - -echo -e "\nInstalling systemd units ..." -cp -v \ - lib/systemd/bridgehead\@.service \ - lib/systemd/bridgehead-update\@.service \ - lib/systemd/bridgehead-update\@.timer \ - /etc/systemd/system/ - -systemctl daemon-reload - -if ! systemctl is-active --quiet bridgehead@"${project}"; then - echo "Enabling autostart of bridgehead@${project}.service" - systemctl enable bridgehead@"${project}" - echo "Enabling nightly updates for bridgehead@${project}.service ..." - systemctl enable --now bridgehead-update@"${project}".timer -fi - -echo -e "\nDone - now start your bridgehead by running\n\tsystemctl start bridgehead@${project}.service\nor by rebooting your machine." \ No newline at end of file diff --git a/start-bridgehead.sh b/start-bridgehead.sh deleted file mode 100755 index b658c93..0000000 --- a/start-bridgehead.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash -### Note: Currently not complete, needs some features before useable for production - -source lib/functions.sh - -if ! lib/prerequisites.sh; then - log "Prerequisites failed, exiting" - exit -fi -source site.conf - -./lib/generate.sh - -log "Starting bridgehead" - -docker-compose -f <(docker run --rm --volume ${pwd}/${project}/:/tmp/workdir/ samply/templer /tmp/workdir/docker-compose.yml TEST="TEST_0 TEST_1") config - -log "The bridgehead should be in online in a few seconds" diff --git a/stop-bridgehead.sh b/stop-bridgehead.sh deleted file mode 100755 index 6da0228..0000000 --- a/stop-bridgehead.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -e - -source lib/functions.sh -source site.conf - -log "Stopping bridgehead" - -docker-compose -f ${project}/docker-compose.yml --env-file site-config/${project}.env down diff --git a/uninstall-bridgehead.sh b/uninstall-bridgehead.sh deleted file mode 100755 index 877ca01..0000000 --- a/uninstall-bridgehead.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -e - -source site.conf -source lib/functions.sh - -echo "Stopping systemd services and removing bridgehead ..." - -systemctl disable --now bridgehead@${project}.service bridgehead-update@${project}.timer bridgehead-update@${project}.service - -rm -v /etc/systemd/system/{bridgehead\@.service,bridgehead-update\@.timer,bridgehead-update\@.service} diff --git a/update-bridgehead.sh b/update-bridgehead.sh deleted file mode 100755 index 330d303..0000000 --- a/update-bridgehead.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash -service="bridgehead" - -source lib/functions.sh - -if ! lib/prerequisites.sh; then - log "Prerequisites failed, exiting" - exit -fi - -log "INFO" "Checking for updates of $service" -# check prerequisites - -# check if updates are available -old_git_hash="$(git rev-parse --verify HEAD)" -git fetch 2>&1 -git pull 2>&1 -new_git_hash="$(git rev-parse --verify HEAD)" -git_updated="false" -if [ "$old_git_hash" != "$new_git_hash" ]; then - log "INFO" "Pulled new changes from origin" - git_updated="true" -fi -docker_updated="false" -for image in $(docker ps --filter "name=$service" --format {{.Image}}); do - log "INFO" "Checking for Updates of Image: $image" - if docker pull $image | grep "Downloaded newer image"; then - log "INFO" "$image updated." - docker_updated="true" - fi -done -if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then - log "INFO" "Due to previous updates now restarting $service@$1" - systemctl restart "$service@$1.service" - ./lib/generate.sh -fi -log "INFO" "checking updates finished" -exit 0 From b95357570c3679818010b2e72cd1761f356bf752 Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Thu, 29 Sep 2022 16:31:35 +0200 Subject: [PATCH 11/92] fix: Added All Proxy in Beam --- ccp/docker-compose.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 8ac42c8..5bc9e61 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -96,8 +96,7 @@ services: APP_1_KEY: ${APP_1_KEY} PRIVKEY_FILE: /run/secrets/proxy.pem RUST_LOG: debug - http_proxy: ${http_proxy} - https_proxy: ${https_proxy} + ALL_PROXY: http://forward_proxy:3128 secrets: - proxy.pem labels: From ab7565b1502643a65163abf3de8c6bfd8b38e811 Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Thu, 29 Sep 2022 16:33:50 +0200 Subject: [PATCH 12/92] fix: Switched Spot to Docker Hub Image --- ccp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 5bc9e61..a2a6cc7 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -71,7 +71,7 @@ services: - "traefik.http.routers.blaze_ccp.tls=true" spot: - image: "docker.verbis.dkfz.de/ccp-private/local-spot@sha256:dd57474f9dd0a37ddc45d29fda160eac0070446da974a76cedc78c184b47adda" + image: samply/spot:latest environment: SECRET: ${SECRET} APPID: ${APP_0_ID_SHORT} From caef43ec59f9d1ab9e4496402a4be9b6e0b79280 Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Fri, 30 Sep 2022 11:49:18 +0200 Subject: [PATCH 13/92] fix: Ensured use of HTTP_PROXY_URL in update job --- lib/update-bridgehead.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index b6cd317..6b4e0fe 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -26,9 +26,15 @@ for DIR in /etc/bridgehead $(pwd); do git -C $DIR config credential.helper "$CREDHELPER" fi old_git_hash="$(git -C $DIR rev-parse --verify HEAD)" - git -C $DIR fetch 2>&1 - git -C $DIR pull 2>&1 - new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" + if [ -z "$HTTP_PROXY_URL" ]; then + log "INFO" "Git is using no proxy!" + git -C $DIR fetch 2>&1 + git -C $DIR pull 2>&1 + else + log "INFO" "Git is using proxy ${HTTP_PROXY_URL} from ${CONFFILE}" + git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR fetch 2>&1 + git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR pull 2>&1 + fi new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" git_updated="false" if [ "$old_git_hash" != "$new_git_hash" ]; then log "INFO" "Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash" From da6cf146003d4b8e8dc26c86aff00c9cef9363b1 Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Fri, 30 Sep 2022 13:42:41 +0200 Subject: [PATCH 14/92] Add missing newline in update-bridgehead.sh --- lib/update-bridgehead.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index 6b4e0fe..9788ff1 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -34,7 +34,8 @@ for DIR in /etc/bridgehead $(pwd); do log "INFO" "Git is using proxy ${HTTP_PROXY_URL} from ${CONFFILE}" git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR fetch 2>&1 git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR pull 2>&1 - fi new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" + fi + new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" git_updated="false" if [ "$old_git_hash" != "$new_git_hash" ]; then log "INFO" "Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash" From 55f4f66328948f73f7210855d4f49f5559fd4f1e Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Fri, 30 Sep 2022 13:54:43 +0200 Subject: [PATCH 15/92] fix: Now using correct Certificates for Traefik --- lib/traefik-configuration/certificates.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/traefik-configuration/certificates.yaml b/lib/traefik-configuration/certificates.yaml index 7a78ce3..eb9809a 100644 --- a/lib/traefik-configuration/certificates.yaml +++ b/lib/traefik-configuration/certificates.yaml @@ -1,4 +1,4 @@ tls: certificates: - - certFile: /certs/certificate.pem - keyFile: /certs/private-key.pem + - certFile: /certs/traefik.crt + keyFile: /certs/traefik.key From 4c84d65548bd2d31202afd133e06e3c2845169d3 Mon Sep 17 00:00:00 2001 From: Torben Brenner Date: Fri, 30 Sep 2022 14:20:37 +0200 Subject: [PATCH 16/92] refactor: Use Proxy from Site Config --- ccp/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index a2a6cc7..2b05083 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -33,8 +33,8 @@ services: container_name: bridgehead-forward-proxy image: samply/bridgehead-forward-proxy:develop environment: - http_proxy: ${http_proxy} - https_proxy: ${https_proxy} + http_proxy: ${HTTP_PROXY_URL} + https_proxy: ${HTTPS_PROXY_URL} volumes: - "bridgehead-proxy:/var/log/squid" From 7692c4e889434b366def22cddb2b61c8e488acbd Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Fri, 30 Sep 2022 15:25:09 +0200 Subject: [PATCH 17/92] Update install scripts and prereqs (sudo) --- lib/prerequisites.sh | 6 ++++++ lib/remove-bridgehead-units.sh | 4 ++++ lib/setup-bridgehead-units.sh | 31 +++++++++++++++++++++------- lib/systemd/bridgehead-update@.timer | 4 ++-- lib/systemd/bridgehead@.service | 3 ++- 5 files changed, 37 insertions(+), 11 deletions(-) diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh index e04161b..4e03530 100755 --- a/lib/prerequisites.sh +++ b/lib/prerequisites.sh @@ -23,6 +23,12 @@ for prerequisite in $prerequisites; do # TODO: Check for specific version done +log INFO "Checking if sudo is installed ..." +if [ ! -d /etc/sudoers.d ]; then + log ERROR "/etc/sudoers.d does not exist. Please install sudo package." + exit 1 +fi + log INFO "Checking configuration ..." ## Download submodule diff --git a/lib/remove-bridgehead-units.sh b/lib/remove-bridgehead-units.sh index b81b042..36d1dad 100755 --- a/lib/remove-bridgehead-units.sh +++ b/lib/remove-bridgehead-units.sh @@ -16,6 +16,10 @@ export PROJECT=$1 #checkRequirements // not needed when uninstalling +log INFO "Removing bridgehead sudoers permissions." + +rm -vf /etc/sudoers.d/bridgehead-${PROJECT} + log "INFO" "Stopping system units and removing bridgehead for ${PROJECT} ..." systemctl disable --now bridgehead@${PROJECT}.service bridgehead-update@${PROJECT}.timer bridgehead-update@${PROJECT}.service diff --git a/lib/setup-bridgehead-units.sh b/lib/setup-bridgehead-units.sh index dc3f9fb..f2c213c 100755 --- a/lib/setup-bridgehead-units.sh +++ b/lib/setup-bridgehead-units.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -e source lib/functions.sh @@ -18,6 +18,18 @@ export PROJECT=$1 checkRequirements +log "INFO" "Allowing the bridgehead user to start/stop the bridgehead." + +cat < /etc/sudoers.d/bridgehead-"${PROJECT}" +# This has been added by the Bridgehead installer. Remove with bridgehead uninstall. +Cmnd_Alias BRIDGEHEAD${PROJECT} = \\ + /bin/systemctl start bridgehead@${PROJECT}.service, \\ + /bin/systemctl stop bridgehead@${PROJECT}.service, \\ + /bin/systemctl restart bridgehead@${PROJECT}.service + +bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT} +EOF + log "INFO" "Register system units for bridgehead and bridgehead-update" cp -v \ lib/systemd/bridgehead\@.service \ @@ -27,11 +39,14 @@ cp -v \ systemctl daemon-reload -if ! systemctl is-active --quiet bridgehead@"${PROJECT}"; then - log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service" - systemctl enable bridgehead@"${PROJECT}" - log "INFO" "Enabling nightly updates for bridgehead@${PROJECT}.service ..." - systemctl enable --now bridgehead-update@"${PROJECT}".timer -fi +log INFO "Trying to update your bridgehead ..." -log "INFO" "\nDone - now start your bridgehead by running\n\tsystemctl start bridgehead@${PROJECT}.service\nor by rebooting your machine." +systemctl start bridgehead-update@"${PROJECT}".service + +log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service" +systemctl enable bridgehead@"${PROJECT}".service + +log "INFO" "Enabling auto-updates for bridgehead@${PROJECT}.service ..." +systemctl enable --now bridgehead-update@"${PROJECT}".timer + +log "INFO" "\nSuccess - now start your bridgehead by running\n systemctl start bridgehead@${PROJECT}.service\n or by rebooting your machine." diff --git a/lib/systemd/bridgehead-update@.timer b/lib/systemd/bridgehead-update@.timer index ce44814..4c8fada 100644 --- a/lib/systemd/bridgehead-update@.timer +++ b/lib/systemd/bridgehead-update@.timer @@ -1,8 +1,8 @@ [Unit] -Description=Nightly Updates of Bridgehead (%i) +Description=Hourly Updates of Bridgehead (%i) [Timer] -OnCalendar=*-*-* 03:00:00 +OnCalendar=*-*-* *:00:00 [Install] WantedBy=basic.target diff --git a/lib/systemd/bridgehead@.service b/lib/systemd/bridgehead@.service index 4458d9a..c387c71 100644 --- a/lib/systemd/bridgehead@.service +++ b/lib/systemd/bridgehead@.service @@ -1,5 +1,6 @@ [Unit] -Description=Bridgehead (%i) Service +Description=Bridgehead (%i) +Requires=docker.service [Service] User=bridgehead From d89c08702ce6e26c743c69842c5f9341a7fdf3f5 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Fri, 30 Sep 2022 15:35:37 +0200 Subject: [PATCH 18/92] Update deployment --- lib/setup-bridgehead-units.sh | 11 ++++++----- lib/update-bridgehead.sh | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/lib/setup-bridgehead-units.sh b/lib/setup-bridgehead-units.sh index f2c213c..a1393c2 100755 --- a/lib/setup-bridgehead-units.sh +++ b/lib/setup-bridgehead-units.sh @@ -22,12 +22,13 @@ log "INFO" "Allowing the bridgehead user to start/stop the bridgehead." cat < /etc/sudoers.d/bridgehead-"${PROJECT}" # This has been added by the Bridgehead installer. Remove with bridgehead uninstall. -Cmnd_Alias BRIDGEHEAD${PROJECT} = \\ - /bin/systemctl start bridgehead@${PROJECT}.service, \\ - /bin/systemctl stop bridgehead@${PROJECT}.service, \\ - /bin/systemctl restart bridgehead@${PROJECT}.service +Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\ + /bin/systemctl start bridgehead@${PROJECT}.service, \\ + /bin/systemctl stop bridgehead@${PROJECT}.service, \\ + /bin/systemctl restart bridgehead@${PROJECT}.service, \\ + /bin/systemctl restart bridgehead@*.service -bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT} +bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^} EOF log "INFO" "Register system units for bridgehead and bridgehead-update" diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index 9788ff1..9bb73bd 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -70,7 +70,7 @@ done # If anything is updated, restart service if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then log "INFO" "Update detected, now restarting bridgehead" - systemctl restart 'bridgehead@*' + sudo /bin/systemctl restart bridgehead@*.service else log "INFO" "Nothing updated, nothing to restart." fi From 69b33941c4db72217407508be484e12396d2e373 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Fri, 30 Sep 2022 16:05:36 +0200 Subject: [PATCH 19/92] Derive spot variables --- bridgehead | 12 +++++++++--- ccp/docker-compose.yml | 16 ++++++++-------- ccp/vars | 7 +++++++ 3 files changed, 24 insertions(+), 11 deletions(-) create mode 100644 ccp/vars diff --git a/bridgehead b/bridgehead index 20616e6..35442c9 100755 --- a/bridgehead +++ b/bridgehead @@ -41,14 +41,20 @@ case "$PROJECT" in ;; esac +# Load variables from /etc/bridgehead and /srv/docker/bridgehead +set -a +source /etc/bridgehead/$PROJECT.conf +fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1 +[ -e ./$PROJECT/vars ] && source ./$PROJECT/vars +set +a + case "$ACTION" in start) checkRequirements - fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1 - exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf up + exec docker-compose -f ./$PROJECT/docker-compose.yml up ;; stop) - exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf down + exec docker-compose -f ./$PROJECT/docker-compose.yml down ;; update) exec ./lib/update-bridgehead.sh $PROJECT diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 2b05083..161e495 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -73,10 +73,10 @@ services: spot: image: samply/spot:latest environment: - SECRET: ${SECRET} - APPID: ${APP_0_ID_SHORT} + SECRET: ${SPOT_BEAM_SECRET_LONG} + APPID: spot PROXY_ID: ${PROXY_ID} - LDM_URL: ${LDM_URL} + LDM_URL: http://bridgehead-ccp-blaze:8080/fhir BEAM_PROXY: http://beam-proxy:8081 depends_on: - "beam-proxy" @@ -90,10 +90,10 @@ services: environment: BROKER_URL: ${BROKER_URL} PROXY_ID: ${PROXY_ID} - APP_0_ID: ${APP_0_ID_SHORT} - APP_0_KEY: ${APP_0_KEY} - APP_1_ID: ${APP_1_ID_SHORT} - APP_1_KEY: ${APP_1_KEY} + APP_0_ID: spot + APP_0_KEY: ${SPOT_BEAM_SECRET_SHORT} + APP_1_ID: report-hub + APP_1_KEY: ${REPORTHUB_BEAM_SECRET_SHORT} PRIVKEY_FILE: /run/secrets/proxy.pem RUST_LOG: debug ALL_PROXY: http://forward_proxy:3128 @@ -111,4 +111,4 @@ volumes: secrets: proxy.pem: - file: /etc/bridgehead/pki/${PROXY_ID_SHORT}.priv.pem + file: /etc/bridgehead/pki/${SITE_ID}.priv.pem diff --git a/ccp/vars b/ccp/vars new file mode 100644 index 0000000..4152fa4 --- /dev/null +++ b/ccp/vars @@ -0,0 +1,7 @@ +BROKER_ID=broker.dev.ccp-it.dktk.dkfz.de +BROKER_URL=https://${BROKER_ID} +PROXY_ID=${SITE_ID}.${BROKER_ID} +SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)" +SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}" +REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)" +REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}" From 99126a89598961401469dae5b9b177bb8b47cf48 Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Tue, 4 Oct 2022 10:04:32 +0200 Subject: [PATCH 20/92] Shutdown all docker containers if one fails ... will then be restarted by systemd --- bridgehead | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bridgehead b/bridgehead index 35442c9..85d9348 100755 --- a/bridgehead +++ b/bridgehead @@ -51,7 +51,7 @@ set +a case "$ACTION" in start) checkRequirements - exec docker-compose -f ./$PROJECT/docker-compose.yml up + exec docker-compose -f ./$PROJECT/docker-compose.yml up --abort-on-container-exit ;; stop) exec docker-compose -f ./$PROJECT/docker-compose.yml down From bba1041bed0dcda5ea021630bdb193ff811a9c20 Mon Sep 17 00:00:00 2001 From: Torben Brenner <76154651+torbrenner@users.noreply.github.com> Date: Wed, 5 Oct 2022 12:52:39 +0200 Subject: [PATCH 21/92] Updated Blaze from v0.17 -> v0.18 --- ccp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 161e495..65343d6 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -52,7 +52,7 @@ services: SITE_NAME: ${SITE_NAME} blaze: - image: "samply/blaze:0.17" + image: "samply/blaze:0.18" container_name: bridgehead-ccp-blaze environment: BASE_URL: "http://bridgehead-ccp-blaze:8080" From b41e5b23158d0a8e05b1620d3599b19a56a716cd Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Wed, 5 Oct 2022 19:58:07 +0200 Subject: [PATCH 22/92] Fix permissions on startup. Requires re-install of systemd units. --- bridgehead | 3 +++ lib/systemd/bridgehead-update@.service | 1 + lib/systemd/bridgehead@.service | 1 + 3 files changed, 5 insertions(+) diff --git a/bridgehead b/bridgehead index 85d9348..eba542d 100755 --- a/bridgehead +++ b/bridgehead @@ -65,6 +65,9 @@ case "$ACTION" in uninstall) exec ./lib/remove-bridgehead-units.sh $PROJECT ;; + fixPermissions) + chown -R bridgehead /etc/bridgehead . + ;; *) printUsage exit 1 diff --git a/lib/systemd/bridgehead-update@.service b/lib/systemd/bridgehead-update@.service index c1d8b4c..e8b42ea 100644 --- a/lib/systemd/bridgehead-update@.service +++ b/lib/systemd/bridgehead-update@.service @@ -4,6 +4,7 @@ Description=Bridgehead (%i) Update Service [Service] Type=oneshot User=bridgehead +ExecStartPre=-/srv/docker/bridgehead/bridgehead fixPermissions %i ExecStart=/srv/docker/bridgehead/bridgehead update %i [Install] diff --git a/lib/systemd/bridgehead@.service b/lib/systemd/bridgehead@.service index c387c71..f109e5a 100644 --- a/lib/systemd/bridgehead@.service +++ b/lib/systemd/bridgehead@.service @@ -6,6 +6,7 @@ Requires=docker.service User=bridgehead Restart=always RestartSec=30 +ExecStartPre=-/srv/docker/bridgehead/bridgehead fixPermissions %i ExecStart=/srv/docker/bridgehead/bridgehead start %i ExecStop=/srv/docker/bridgehead/bridgehead stop %i From 8a6274389459c0c15a8dfcac852c2238c1081b07 Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Thu, 6 Oct 2022 10:45:50 +0200 Subject: [PATCH 23/92] Monitoring for bridgehead startup and update (#22) --- bridgehead | 12 +++++--- lib/functions.sh | 23 +++++++++++---- lib/gitpassword.sh | 5 ++-- lib/log.sh | 5 ++++ lib/monitoring.sh | 41 ++++++++++++++++++++++++++ lib/prerequisites.sh | 16 ++++------ lib/setup-bridgehead-units.sh | 4 ++- lib/systemd/bridgehead-update@.service | 3 +- lib/systemd/bridgehead@.service | 3 +- lib/update-bridgehead.sh | 19 +++++++----- 10 files changed, 98 insertions(+), 33 deletions(-) create mode 100644 lib/log.sh create mode 100755 lib/monitoring.sh diff --git a/bridgehead b/bridgehead index eba542d..87d6a1f 100755 --- a/bridgehead +++ b/bridgehead @@ -43,14 +43,16 @@ esac # Load variables from /etc/bridgehead and /srv/docker/bridgehead set -a -source /etc/bridgehead/$PROJECT.conf -fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1 +source /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "/etc/bridgehead/$PROJECT.conf not found" +fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "Unable to fetchVarsFromVaultByFile" [ -e ./$PROJECT/vars ] && source ./$PROJECT/vars set +a case "$ACTION" in start) + hc_send log "Bridgehead $PROJECT startup: Checking requirements ..." checkRequirements + hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..." exec docker-compose -f ./$PROJECT/docker-compose.yml up --abort-on-container-exit ;; stop) @@ -65,8 +67,10 @@ case "$ACTION" in uninstall) exec ./lib/remove-bridgehead-units.sh $PROJECT ;; - fixPermissions) - chown -R bridgehead /etc/bridgehead . + preRun | preUpdate) + fixPermissions + ;; + postRun | postUpdate) ;; *) printUsage diff --git a/lib/functions.sh b/lib/functions.sh index 3d5a88f..ded0cd9 100755 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -1,9 +1,11 @@ #!/bin/bash -e +source lib/log.sh + exitIfNotRoot() { if [ "$EUID" -ne 0 ]; then log "ERROR" "Please run as root" - exit 1 + fail_and_report 1 "Please run as root" fi } @@ -16,10 +18,6 @@ checkOwner(){ return 0 } -log() { - echo -e "$(date +'%Y-%m-%d %T')" "$1:" "$2" -} - printUsage() { echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME" echo "PROJECTNAME should be one of ccp|nngm|gbn" @@ -28,7 +26,7 @@ printUsage() { checkRequirements() { if ! lib/prerequisites.sh; then log "ERROR" "Validating Prerequisites failed, please fix the error(s) above this line." - exit 1 + fail_and_report 1 "Validating prerequisites failed." else return 0 fi @@ -97,6 +95,19 @@ assertVarsNotEmpty() { return 0 } +fixPermissions() { + CHOWN=$(which chown) + sudo $CHOWN -R bridgehead /etc/bridgehead /srv/docker/bridgehead +} + +source lib/monitoring.sh + +fail_and_report() { + log ERROR "$2" + hc_send $1 "$2" + exit $1 +} + ##Setting Network properties export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}'); export HOST=$(hostname) diff --git a/lib/gitpassword.sh b/lib/gitpassword.sh index 25eb9ce..17756d6 100755 --- a/lib/gitpassword.sh +++ b/lib/gitpassword.sh @@ -22,7 +22,7 @@ cd $BASE source lib/functions.sh -assertVarsNotEmpty SITE_ID || exit 1 +assertVarsNotEmpty SITE_ID || fail_and_report 1 "gitpassword.sh failed: SITE_ID is empty." PARAMS="$(cat)" GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g') @@ -30,8 +30,7 @@ GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g') fetchVarsFromVault GIT_PASSWORD if [ -z "${GIT_PASSWORD}" ]; then - log ERROR "Git password not found." - exit 1 + fail_and_report 1 "gitpassword.sh failed: Git password not found." fi cat <&1 is_available=$? if [ $is_available -gt 0 ]; then - log "ERROR" "Prerequisite not fulfilled - $prerequisite is not available!" - exit 79 + fail_and_report 79 "Prerequisite not fulfilled - $prerequisite is not available!" fi # TODO: Check for specific version done log INFO "Checking if sudo is installed ..." if [ ! -d /etc/sudoers.d ]; then - log ERROR "/etc/sudoers.d does not exist. Please install sudo package." - exit 1 + fail_and_report 1 "/etc/sudoers.d does not exist. Please install sudo package." fi log INFO "Checking configuration ..." ## Download submodule if [ ! -d "/etc/bridgehead/" ]; then - log ERROR "Please set up the config folder at /etc/bridgehead. Instruction are in the readme." - exit 1 + fail_and_report 1 "Please set up the config folder at /etc/bridgehead. Instruction are in the readme." fi # TODO: Check all required variables here in a generic loop #check if project env is present if [ -d "/etc/bridgehead/${PROJECT}.conf" ]; then - log ERROR "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf." - exit 1 + fail_and_report 1 "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf." fi # TODO: Make sure you're in the right directory, or, even better, be independent from the working directory. @@ -60,11 +56,11 @@ fi if [ -e /etc/bridgehead/vault.conf ]; then if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then - log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf." - exit 1 + fail_and_report 1 "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf." fi fi log INFO "Success - all prerequisites are met!" +hc_send log "Success - all prerequisites are met!" exit 0 diff --git a/lib/setup-bridgehead-units.sh b/lib/setup-bridgehead-units.sh index a1393c2..a96e583 100755 --- a/lib/setup-bridgehead-units.sh +++ b/lib/setup-bridgehead-units.sh @@ -26,7 +26,9 @@ Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\ /bin/systemctl start bridgehead@${PROJECT}.service, \\ /bin/systemctl stop bridgehead@${PROJECT}.service, \\ /bin/systemctl restart bridgehead@${PROJECT}.service, \\ - /bin/systemctl restart bridgehead@*.service + /bin/systemctl restart bridgehead@*.service, \\ + /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead, \\ + /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^} EOF diff --git a/lib/systemd/bridgehead-update@.service b/lib/systemd/bridgehead-update@.service index e8b42ea..3a7f347 100644 --- a/lib/systemd/bridgehead-update@.service +++ b/lib/systemd/bridgehead-update@.service @@ -4,8 +4,9 @@ Description=Bridgehead (%i) Update Service [Service] Type=oneshot User=bridgehead -ExecStartPre=-/srv/docker/bridgehead/bridgehead fixPermissions %i +ExecStartPre=-/srv/docker/bridgehead/bridgehead preUpdate %i ExecStart=/srv/docker/bridgehead/bridgehead update %i +ExecStopPost=-/srv/docker/bridgehead/bridgehead postUpdate %i [Install] WantedBy=multi-user.target diff --git a/lib/systemd/bridgehead@.service b/lib/systemd/bridgehead@.service index f109e5a..7645793 100644 --- a/lib/systemd/bridgehead@.service +++ b/lib/systemd/bridgehead@.service @@ -6,9 +6,10 @@ Requires=docker.service User=bridgehead Restart=always RestartSec=30 -ExecStartPre=-/srv/docker/bridgehead/bridgehead fixPermissions %i +ExecStartPre=-/srv/docker/bridgehead/bridgehead preRun %i ExecStart=/srv/docker/bridgehead/bridgehead start %i ExecStop=/srv/docker/bridgehead/bridgehead stop %i +ExecStopPost=-/srv/docker/bridgehead/bridgehead postRun %i [Install] WantedBy=multi-user.target diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index 9bb73bd..162d592 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -1,20 +1,21 @@ #!/bin/bash source lib/functions.sh +hc_send log "Updating bridgehead ..." + CONFFILE=/etc/bridgehead/$1.conf if [ ! -e $CONFFILE ]; then - log ERROR "Configuration file $CONFFILE not found." - exit 1 + fail_and_report 1 "Configuration file $CONFFILE not found." fi source $CONFFILE -assertVarsNotEmpty SITE_ID || exit 1 +assertVarsNotEmpty SITE_ID || fail_and_report 1 "Update failed: SITE_ID empty" export SITE_ID -checkOwner . bridgehead || exit 1 -checkOwner /etc/bridgehead bridgehead || exit 1 +checkOwner . bridgehead || fail_and_report 1 "Update failed: Wrong permissions in $(pwd)" +checkOwner /etc/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /etc/bridgehead" CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh" @@ -69,10 +70,14 @@ done # If anything is updated, restart service if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then - log "INFO" "Update detected, now restarting bridgehead" + RES="Update detected, now restarting bridgehead" + log "INFO" "$RES" + hc_send log "$RES" sudo /bin/systemctl restart bridgehead@*.service else - log "INFO" "Nothing updated, nothing to restart." + RES="Nothing updated, nothing to restart." + log "INFO" "$RES" + hc_send log "$RES" fi exit 0 From 2fb57980eef3a4f51fbe90025d508396045ff25a Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Thu, 6 Oct 2022 12:04:24 +0200 Subject: [PATCH 24/92] Format docker status table --- lib/monitoring.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/monitoring.sh b/lib/monitoring.sh index d9bbf60..b6384b0 100755 --- a/lib/monitoring.sh +++ b/lib/monitoring.sh @@ -29,7 +29,7 @@ function hc_send(){ fi if [ -z "$UPTIME" ]; then - UPTIME=$(docker ps --format '{{.Names}} {{.RunningFor}}' --filter name=bridgehead || echo "Unable to get docker statistics") + UPTIME=$(docker ps --format 'table {{.Names}} \t{{.RunningFor}} \t {{.Status}} \t {{.Image}}' --filter name=bridgehead || echo "Unable to get docker statistics") fi if [ -n "$2" ]; then From 0f449344195b8724a8905981d6c0afcd2288977d Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Thu, 6 Oct 2022 12:05:36 +0200 Subject: [PATCH 25/92] Clarified log message --- lib/update-bridgehead.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index 162d592..a79fece 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -1,7 +1,7 @@ #!/bin/bash source lib/functions.sh -hc_send log "Updating bridgehead ..." +hc_send log "Checking for bridgehead updates ..." CONFFILE=/etc/bridgehead/$1.conf From f7c4bf6ac5cb0def425904b6d9dc9a5a872ca479 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Thu, 6 Oct 2022 12:49:31 +0200 Subject: [PATCH 26/92] Consider stopped docker containers for reports, updates --- lib/monitoring.sh | 2 +- lib/update-bridgehead.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/monitoring.sh b/lib/monitoring.sh index b6384b0..bdd9a35 100755 --- a/lib/monitoring.sh +++ b/lib/monitoring.sh @@ -29,7 +29,7 @@ function hc_send(){ fi if [ -z "$UPTIME" ]; then - UPTIME=$(docker ps --format 'table {{.Names}} \t{{.RunningFor}} \t {{.Status}} \t {{.Image}}' --filter name=bridgehead || echo "Unable to get docker statistics") + UPTIME=$(docker ps -a --format 'table {{.Names}} \t{{.RunningFor}} \t {{.Status}} \t {{.Image}}' --filter name=bridgehead || echo "Unable to get docker statistics") fi if [ -n "$2" ]; then diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index a79fece..19dd8e7 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -60,7 +60,7 @@ done # Check docker updates log "INFO" "Checking for updates to running docker images ..." docker_updated="false" -for IMAGE in $(docker ps --filter "name=bridgehead" --format {{.Image}}); do +for IMAGE in $(cat $PROJECT/docker-compose.yml | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do log "INFO" "Checking for Updates of Image: $IMAGE" if docker pull $IMAGE | grep "Downloaded newer image"; then log "INFO" "$IMAGE updated." From 7b15e02becda271641ebc002955c30dab025d708 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Thu, 6 Oct 2022 12:49:48 +0200 Subject: [PATCH 27/92] Use HTTPS proxy (not http proxy) for git pull --- lib/update-bridgehead.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh index 19dd8e7..ef07590 100755 --- a/lib/update-bridgehead.sh +++ b/lib/update-bridgehead.sh @@ -33,8 +33,8 @@ for DIR in /etc/bridgehead $(pwd); do git -C $DIR pull 2>&1 else log "INFO" "Git is using proxy ${HTTP_PROXY_URL} from ${CONFFILE}" - git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR fetch 2>&1 - git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR pull 2>&1 + git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR fetch 2>&1 + git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR pull 2>&1 fi new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" git_updated="false" From 67ec348f747b8419f3ab454d9884d50c2bd13179 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Thu, 6 Oct 2022 16:27:52 +0200 Subject: [PATCH 28/92] Support docker-compose.override.yml --- bridgehead | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/bridgehead b/bridgehead index 87d6a1f..6ea59e4 100755 --- a/bridgehead +++ b/bridgehead @@ -48,15 +48,21 @@ fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "Una [ -e ./$PROJECT/vars ] && source ./$PROJECT/vars set +a +OVERRIDE="" +if [ -f "$PROJECT/docker-compose.override.yml" ]; then + log INFO "Apply docker-compose.override.yml" + OVERRIDE+="-f ./$PROJECT/docker-compose.override.yml" +fi + case "$ACTION" in start) hc_send log "Bridgehead $PROJECT startup: Checking requirements ..." checkRequirements hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..." - exec docker-compose -f ./$PROJECT/docker-compose.yml up --abort-on-container-exit + exec docker-compose -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit ;; stop) - exec docker-compose -f ./$PROJECT/docker-compose.yml down + exec docker-compose -f ./$PROJECT/docker-compose.yml $OVERRIDE down ;; update) exec ./lib/update-bridgehead.sh $PROJECT From ca45a3dbe9a408e618e33adbff65b6b06c226d21 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Tue, 11 Oct 2022 11:06:52 +0200 Subject: [PATCH 29/92] Support /etc/bridgehead/PROJECT.local.conf --- bridgehead | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bridgehead b/bridgehead index 6ea59e4..5c7d121 100755 --- a/bridgehead +++ b/bridgehead @@ -44,13 +44,17 @@ esac # Load variables from /etc/bridgehead and /srv/docker/bridgehead set -a source /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "/etc/bridgehead/$PROJECT.conf not found" +if [ -e /etc/bridgehead/$PROJECT.local.conf ]; then + log INFO "Applying /etc/bridgehead/$PROJECT.local.conf" + source /etc/bridgehead/$PROJECT.local.conf || fail_and_report 1 "Found /etc/bridgehead/$PROJECT.local.conf but failed to import" +fi fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "Unable to fetchVarsFromVaultByFile" [ -e ./$PROJECT/vars ] && source ./$PROJECT/vars set +a OVERRIDE="" if [ -f "$PROJECT/docker-compose.override.yml" ]; then - log INFO "Apply docker-compose.override.yml" + log INFO "Applying $PROJECT/docker-compose.override.yml" OVERRIDE+="-f ./$PROJECT/docker-compose.override.yml" fi From f7742f2a2bfb0e2d9292ff75c96d7a5dbaa095f7 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Tue, 11 Oct 2022 13:28:51 +0200 Subject: [PATCH 30/92] Make traefik volumes read-only --- ccp/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 65343d6..d78a842 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -25,8 +25,8 @@ services: - 80:80 - 443:443 volumes: - - ../certs:/tools/certs - - ../lib/traefik-configuration/:/configuration + - ../certs:/tools/certs:ro + - ../lib/traefik-configuration/:/configuration:ro - /var/run/docker.sock:/var/run/docker.sock:ro forward_proxy: From e439510920f36c272fe8ce99efc630849ce0ac9b Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Tue, 11 Oct 2022 13:29:09 +0200 Subject: [PATCH 31/92] Rename spot container so it shows up in monitoring --- ccp/docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index d78a842..3ef7f24 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -72,6 +72,7 @@ services: spot: image: samply/spot:latest + container_name: bridgehead-spot environment: SECRET: ${SPOT_BEAM_SECRET_LONG} APPID: spot From 7ecb39d6cede55a820e36900ccca92554782b1f7 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Tue, 11 Oct 2022 18:29:08 +0200 Subject: [PATCH 32/92] Use new forward proxy --- ccp/docker-compose.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 3ef7f24..c446f64 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -31,13 +31,14 @@ services: forward_proxy: container_name: bridgehead-forward-proxy - image: samply/bridgehead-forward-proxy:develop + image: samply/bridgehead-forward-proxy:main environment: - http_proxy: ${HTTP_PROXY_URL} - https_proxy: ${HTTPS_PROXY_URL} + HTTPS_PROXY: ${HTTPS_PROXY_URL} + USERNAME: ${HTTPS_PROXY_USERNAME} + PASSWORD: ${HTTPS_PROXY_PASSWORD} volumes: - - "bridgehead-proxy:/var/log/squid" - + - /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro + landing: container_name: bridgehead-landingpage image: samply/bridgehead-landingpage:master @@ -60,7 +61,7 @@ services: LOG_LEVEL: "debug" ENFORCE_REFERENTIAL_INTEGRITY: "false" volumes: - - "blaze-data:/app/data" + - "blaze-data:/app/data" labels: - "traefik.enable=true" - "traefik.http.middlewares.ccp-auth.basicauth.users=${bc_auth_users}" @@ -98,17 +99,19 @@ services: PRIVKEY_FILE: /run/secrets/proxy.pem RUST_LOG: debug ALL_PROXY: http://forward_proxy:3128 + TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs secrets: - proxy.pem labels: - "traefik.enable=false" depends_on: - "forward_proxy" + volumes: + - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro volumes: blaze-data: - bridgehead-proxy: secrets: proxy.pem: From 0f1cb966badaa95997b4636840ff1197d8b755c6 Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Tue, 11 Oct 2022 18:36:42 +0200 Subject: [PATCH 33/92] Use tag latest for forward proxy --- ccp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index c446f64..bc8fdf2 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -31,7 +31,7 @@ services: forward_proxy: container_name: bridgehead-forward-proxy - image: samply/bridgehead-forward-proxy:main + image: samply/bridgehead-forward-proxy:latest environment: HTTPS_PROXY: ${HTTPS_PROXY_URL} USERNAME: ${HTTPS_PROXY_USERNAME} From e273e97d9cfa1fb351743ae4db4227e2ee6a368d Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Mon, 17 Oct 2022 14:38:34 +0200 Subject: [PATCH 34/92] Certificate enrollment (#24) --- bridgehead | 8 ++++++++ ccp/vars | 2 ++ lib/functions.sh | 2 +- lib/prerequisites.sh | 11 ++++++++++- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/bridgehead b/bridgehead index 5c7d121..5548a7d 100755 --- a/bridgehead +++ b/bridgehead @@ -77,6 +77,14 @@ case "$ACTION" in uninstall) exec ./lib/remove-bridgehead-units.sh $PROJECT ;; + enroll) + if [ -e $PRIVATEKEYFILENAME ]; then + echo "Private key already exists at $PRIVATEKEYFILENAME. Please delete first to proceed." + exit 1 + fi + docker run --rm -ti -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $PROXY_ID --admin-email $SUPPORT_EMAIL + chmod 600 $PRIVATEKEYFILENAME + ;; preRun | preUpdate) fixPermissions ;; diff --git a/ccp/vars b/ccp/vars index 4152fa4..ce12d1a 100644 --- a/ccp/vars +++ b/ccp/vars @@ -5,3 +5,5 @@ SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | he SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}" REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)" REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}" +SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de +PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem diff --git a/lib/functions.sh b/lib/functions.sh index ded0cd9..5059829 100755 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -19,7 +19,7 @@ checkOwner(){ } printUsage() { - echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME" + echo "Usage: bridgehead start|stop|update|install|uninstall|enroll PROJECTNAME" echo "PROJECTNAME should be one of ccp|nngm|gbn" } diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh index f4fd3be..2709a6f 100755 --- a/lib/prerequisites.sh +++ b/lib/prerequisites.sh @@ -43,7 +43,7 @@ fi # TODO: Make sure you're in the right directory, or, even better, be independent from the working directory. -log INFO "Checking ssl cert" +log INFO "Checking ssl cert for accessing bridgehead via https" if [ ! -d "certs" ]; then log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)" @@ -60,6 +60,15 @@ if [ -e /etc/bridgehead/vault.conf ]; then fi fi +log INFO "Checking your beam proxy private key" + +if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then + log INFO "Success - private key found." +else + log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run bridgehead enroll ${PROJECT} and follow the instructions". + exit 1 +fi + log INFO "Success - all prerequisites are met!" hc_send log "Success - all prerequisites are met!" From f8b9aed7f52b1c0774b94afbbac20d23aad612eb Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Mon, 17 Oct 2022 15:09:18 +0200 Subject: [PATCH 35/92] Cleaning --- .gitignore | 8 +-- ccp/docker-compose.yml | 4 +- lib/generate.sh | 116 ----------------------------------------- lib/log.sh | 0 lib/prerequisites.sh | 20 +++---- site.dev.conf | 11 ---- 6 files changed, 13 insertions(+), 146 deletions(-) delete mode 100755 lib/generate.sh mode change 100644 => 100755 lib/log.sh delete mode 100644 site.dev.conf diff --git a/.gitignore b/.gitignore index d6c86b5..2c4c7ec 100644 --- a/.gitignore +++ b/.gitignore @@ -3,10 +3,4 @@ site-config/* ## Ignore site configuration -config/**/* -!config/**/*.default -landing/* -docker-compose.override.yml -site.conf -auth/* -certs/* +*/docker-compose.override.yml diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 65343d6..2539d8e 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -25,8 +25,8 @@ services: - 80:80 - 443:443 volumes: - - ../certs:/tools/certs - - ../lib/traefik-configuration/:/configuration + - /etc/bridgehead/traefik-tls:/tools/certs:ro + - ../lib/traefik-configuration/:/configuration:ro - /var/run/docker.sock:/var/run/docker.sock:ro forward_proxy: diff --git a/lib/generate.sh b/lib/generate.sh deleted file mode 100755 index 9673055..0000000 --- a/lib/generate.sh +++ /dev/null @@ -1,116 +0,0 @@ -#!/bin/bash - -if [ ! -d ./landing ] -then - mkdir landing -fi - -if [ ! -f ./landing/index.html ] -then - touch index.html -fi - -CENTRAL_SERVICES=" - CCP-IT - Monitoring Service - " - -LOCAL_SERVICES=" - Bridgehead - Reverse Proxy Traefik - " - -if [ "$project" = "dktk" ] || [ "$project" = "c4" ] || [ "$project" = "dktk-fed" ] -then - CENTRAL_SERVICES+=" - CCP-IT - Zentrale Patientenliste - - - CCP-IT - Dezentrale Suche - - - CCP-IT - Zentrale Suche - - - CCP-IT - Deployment-Server - - - CCP-IT - Zentraler Kontrollnummernerzeuger - - " -fi - -if [ "$project" = "dktk-fed" ] -then - LOCAL_SERVICES+=" - DKTK - Blaze - - " -fi - -cat > ./landing/index.html < - - - - - - Bridgehead Overview - - - - - - - - - -