samply/bridgehead
1
0
Fork 0
mirror of https://github.com/samply/bridgehead.git synced 2026-03-31 20:20:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Enhance OVIS setup script to handle missing CA directory and refine logging

Browse Source 
Updated the ovis-setup.sh script to improve handling of the trusted CA directory, ensuring that the oauth2-proxy uses the system trust store if the directory is missing. Adjusted logging messages for clarity regarding the detection of custom OIDC CA files, specifically focusing on .crt files. Additionally, added a new environment variable for TLS_CA_CERTIFICATES_DIR in the ovis-compose.yml file to support trusted CA certificates.
This commit is contained in:
tm16-medma
2026-03-26 16:16:21 +01:00
parent fd2cf2dead
commit 3cb1d70416
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ccp/modules/ovis-compose.yml
View File

@@ -6,6 +6,7 @@ services:
environment: environment:
- http_proxy=http://forward_proxy:3128 - http_proxy=http://forward_proxy:3128
- https_proxy=http://forward_proxy:3128 - https_proxy=http://forward_proxy:3128
- TLS_CA_CERTIFICATES_DIR=/etc/bridgehead/trusted-ca-certs
- OAUTH2_PROXY_USE_SYSTEM_TRUST_STORE=true - OAUTH2_PROXY_USE_SYSTEM_TRUST_STORE=true
- OAUTH2_PROXY_PROVIDER_CA_FILES=${OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES} - OAUTH2_PROXY_PROVIDER_CA_FILES=${OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES}
- OAUTH2_PROXY_PROVIDER=oidc - OAUTH2_PROXY_PROVIDER=oidc

13
ccp/modules/ovis-setup.sh
View File

@@ -3,18 +3,21 @@
if [ -n "$ENABLE_OVIS" ]; then if [ -n "$ENABLE_OVIS" ]; then
log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware." log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware."
TRUSTED_CA_DIR="/etc/bridgehead/trusted-ca-certs" TRUSTED_CA_DIR="/etc/bridgehead/trusted-ca-certs"
OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES=""
if [ -d "$TRUSTED_CA_DIR" ]; then if [ -d "$TRUSTED_CA_DIR" ]; then
shopt -s nullglob shopt -s nullglob
ca_candidates=("$TRUSTED_CA_DIR"/*.crt "$TRUSTED_CA_DIR"/*.pem) ca_cert_candidates=("$TRUSTED_CA_DIR"/*.crt)
shopt -u nullglob shopt -u nullglob
if [ ${#ca_candidates[@]} -gt 0 ]; then if [ ${#ca_cert_candidates[@]} -gt 0 ]; then
OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES="$(IFS=,; printf '%s' "${ca_candidates[*]}")" OVIS_OAUTH2_PROXY_PROVIDER_CA_FILES="$(IFS=,; printf '%s' "${ca_cert_candidates[*]}")"
log INFO "OVIS oauth2-proxy will trust custom OIDC CA files from $TRUSTED_CA_DIR." log INFO "OVIS oauth2-proxy will trust OIDC provider CA files from $TRUSTED_CA_DIR (*.crt)."
else else
log INFO "No custom OIDC CA files (*.crt/*.pem) found in $TRUSTED_CA_DIR; using container system trust store only." log INFO "No *.crt files found in $TRUSTED_CA_DIR; oauth2-proxy will use system trust store only."
fi fi
else
log INFO "Trusted CA directory $TRUSTED_CA_DIR is missing; oauth2-proxy will use system trust store only."
fi fi
OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml" OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml"