From 1c3fa4fa3fb6c21f886f2c9fdb4fe19b73a6545c Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Tue, 17 Jan 2023 08:56:02 +0100
Subject: [PATCH 1/8] refactor: Changed Paths for persistent Data

---
 README.md                             |  4 ++--
 ccp/modules/id-management-compose.yml |  4 ++--
 ccp/modules/id-management.md          |  6 +++---
 ccp/mtba-compose.yml                  |  2 +-
 lib/install-bridgehead.sh             | 15 ++++++++++-----
 lib/update-bridgehead.sh              | 10 +---------
 6 files changed, 19 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 24ebdf2..134e1ae 100644
--- a/README.md
+++ b/README.md
@@ -128,8 +128,8 @@ All of the Bridgehead's outgoing connections are secured by transport encryption
   - `/etc/bridgehead/traefik-tls` contains your Bridgehead's reverse proxies TLS certificates for [HTTPS access](#https-access).
   - `/etc/bridgehead/pki` contains your Bridgehead's private key (e.g., but not limited to Samply.Beam), generated as part of the [Samply.Beam enrollment](#register-with-samplybeam).
   - `/etc/bridgehead/trusted-ca-certs` contains third-party certificates to be trusted by the Bridgehead. For example, you want to place the certificates of your [TLS-terminating proxy](#network) here.
-- `/var/data/bridgehead` contains persistent data of the bridgehead
-  - `/var/data/bridgehead/backups` contains automatically created backups of the databases.
+  - `/var/lib/bridgehead/data` contains persistent data of the bridgehead
+  - `/var/cache/bridgehead/backup` contains automatically created backups of the databases.
 
 Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
 
diff --git a/ccp/modules/id-management-compose.yml b/ccp/modules/id-management-compose.yml
index 4baaba7..896663b 100644
--- a/ccp/modules/id-management-compose.yml
+++ b/ccp/modules/id-management-compose.yml
@@ -71,6 +71,6 @@ services:
       POSTGRES_DB: "mainzelliste"
       POSTGRES_PASSWORD: ${PATIENTLIST_POSTGRES_PASSWORD}
     volumes:
-      - "/var/data/bridgehead/patientlist:/var/lib/postgresql/data"
-      # NOTE: Add backups here. This is only imported if /var/data/bridgehead/patientlist/ is empty!!!
+      - "/var/lib/bridgehead/data/patientlist:/var/lib/postgresql/data"
+      # NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
       - "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
diff --git a/ccp/modules/id-management.md b/ccp/modules/id-management.md
index 60cb5b1..c45b95a 100644
--- a/ccp/modules/id-management.md
+++ b/ccp/modules/id-management.md
@@ -26,7 +26,7 @@ Upon configuration, the Bridgehead will spawn the following services:
 
 - The `bridgehead-id-manager` at https://bridgehead.local/id-manager, provides a common interface for creating pseudonyms in the bridgehead.
 - The `bridgehead-patientlist` at https://bridgehead.local/patientlist is a local instance of the open-source software [Mainzelliste](https://mainzelliste.de). This service's primary task is to map patients IDAT to pseudonyms identifying them along the different CCP projects.
-- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted in `/var/data/bridgehead/patientlist` and backups are automatically created in `/var/data/bridgehead/backups/bridgehead-patientlist-db`.
+- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted in `/var/lib/bridgehead/data/patientlist` and backups are automatically created in `/var/cache/bridgehead/backup/bridgehead-patientlist-db`.
 
 ### How to import an existing database (e.g from Legacy Windows or from Backups)
 First you must shutdown your local bridgehead instance:
@@ -36,10 +36,10 @@ systemctl stop bridgehead@ccp
 
 Next you need to remove the current patientlist database:
 ```
-rm -rf /var/data/bridgehead/patientlist
+rm -rf /var/lib/bridgehead/data/patientlist
 ```
 
-Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then /var/data/bridgehead/patientlist is empty. 
+Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then /var/lib/bridgehead/data/patientlist is empty. 
 > NOTE: Please create the postgres dump with the options "--no-owner" and "--no-privileges". Additionally ensure the dump is created in the plain format (SQL).
 
 After this, you can restart your bridgehead and the dump will be imported:
diff --git a/ccp/mtba-compose.yml b/ccp/mtba-compose.yml
index d492ae0..1c62989 100644
--- a/ccp/mtba-compose.yml
+++ b/ccp/mtba-compose.yml
@@ -24,7 +24,7 @@ services:
       - "traefik.http.routers.mtba.tls=true"
     volumes:
       # This directory persists the FHIR Resources that are needed to import data into blaze.
-      - /var/data/bridgehead/mtba:/app/mtba-files/persist
+      - /var/lib/bridgehead/data/mtba:/app/mtba-files/persist
       # Place new import files in this directory
       - /tmp/bridgehead/mtba/:/app/mtba-files/input
 
diff --git a/lib/install-bridgehead.sh b/lib/install-bridgehead.sh
index 7cbd8ef..04503e3 100755
--- a/lib/install-bridgehead.sh
+++ b/lib/install-bridgehead.sh
@@ -22,8 +22,8 @@ Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
     /bin/systemctl stop bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@*.service, \\
-    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/data/bridgehead, \\
-    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/data/bridgehead
+    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/lib/bridgehead /var/cache/bridgehead, \\
+    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/lib/bridgehead /var/cache/bridgehead
 
 bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
 EOF
@@ -37,9 +37,14 @@ if [ -z "$LDM_PASSWORD" ]; then
   echo -e "## Local Data Management Basic Authentication\n# User: $PROJECT\nLDM_PASSWORD=$generated_passwd" >> /etc/bridgehead/${PROJECT}.local.conf;
 fi
 
-log "INFO" "Creating directory /var/data/bridgehead for storage of persistent data."
-mkdir -p /var/data/bridgehead
-chown -R bridgehead /var/data/bridgehead
+log "INFO" "Creating directory /var/lib/bridgehead for storage of persistent data."
+mkdir -p /var/lib/bridgehead
+chown -R bridgehead /var/lib/bridgehead
+
+
+log "INFO" "Creating directory /var/cache/bridgehead for storage of backups."
+mkdir -p /var/cache/bridgehead
+chown -R bridgehead /var/cache/bridgehead
 
 log "INFO" "Registering system units for bridgehead and bridgehead-update"
 cp -v \
diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh
index cc1d55f..65560ea 100755
--- a/lib/update-bridgehead.sh
+++ b/lib/update-bridgehead.sh
@@ -4,15 +4,7 @@ source lib/functions.sh
 AUTO_BACKUP=${AUTO_BACKUP:-true}
 
 if [ "$AUTO_BACKUP" == "true" ]; then
-  BACKUP_DIRECTORY="/var/data/bridgehead/backups"
-  if [ ! -d /var/data ]; then
-    log DEBUG "Created /var/data"
-    mkdir /var/data
-  fi
-  if [ ! -d /var/data/bridgehead ]; then
-    log DEBUG "Created /var/data/bridgehead"
-    mkdir /var/data/bridgehead
-  fi
+  BACKUP_DIRECTORY="/var/cache/bridgehead/backup"
   if [ ! -d $BACKUP_DIRECTORY ]; then
     message="Performing automatic maintenance: Creating Backup directory $BACKUP_DIRECTORY."
     hc_send log "$message"

From 0d998ab8716a2e2c5c92fa84e65ccc608524ccef Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 10:55:44 +0100
Subject: [PATCH 2/8] refactor: Move persistent data to named volumes

---
 README.md                             | 1 -
 ccp/modules/id-management-compose.yml | 5 ++++-
 ccp/modules/id-management.md          | 6 +++---
 ccp/mtba-compose.yml                  | 5 ++++-
 lib/install-bridgehead.sh             | 9 ++-------
 5 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 134e1ae..e1d3286 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,6 @@ All of the Bridgehead's outgoing connections are secured by transport encryption
   - `/etc/bridgehead/traefik-tls` contains your Bridgehead's reverse proxies TLS certificates for [HTTPS access](#https-access).
   - `/etc/bridgehead/pki` contains your Bridgehead's private key (e.g., but not limited to Samply.Beam), generated as part of the [Samply.Beam enrollment](#register-with-samplybeam).
   - `/etc/bridgehead/trusted-ca-certs` contains third-party certificates to be trusted by the Bridgehead. For example, you want to place the certificates of your [TLS-terminating proxy](#network) here.
-  - `/var/lib/bridgehead/data` contains persistent data of the bridgehead
   - `/var/cache/bridgehead/backup` contains automatically created backups of the databases.
 
 Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
diff --git a/ccp/modules/id-management-compose.yml b/ccp/modules/id-management-compose.yml
index 896663b..72aebcc 100644
--- a/ccp/modules/id-management-compose.yml
+++ b/ccp/modules/id-management-compose.yml
@@ -71,6 +71,9 @@ services:
       POSTGRES_DB: "mainzelliste"
       POSTGRES_PASSWORD: ${PATIENTLIST_POSTGRES_PASSWORD}
     volumes:
-      - "/var/lib/bridgehead/data/patientlist:/var/lib/postgresql/data"
+      - "patientlist-db-data:/var/lib/postgresql/data"
       # NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
       - "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
+
+volumes:
+  patientlist-db-data:
diff --git a/ccp/modules/id-management.md b/ccp/modules/id-management.md
index c45b95a..e18d3f8 100644
--- a/ccp/modules/id-management.md
+++ b/ccp/modules/id-management.md
@@ -26,7 +26,7 @@ Upon configuration, the Bridgehead will spawn the following services:
 
 - The `bridgehead-id-manager` at https://bridgehead.local/id-manager, provides a common interface for creating pseudonyms in the bridgehead.
 - The `bridgehead-patientlist` at https://bridgehead.local/patientlist is a local instance of the open-source software [Mainzelliste](https://mainzelliste.de). This service's primary task is to map patients IDAT to pseudonyms identifying them along the different CCP projects.
-- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted in `/var/lib/bridgehead/data/patientlist` and backups are automatically created in `/var/cache/bridgehead/backup/bridgehead-patientlist-db`.
+- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted as a named volume `patientlist-db-data` and backups are automatically created in `/var/cache/bridgehead/backup/bridgehead-patientlist-db`.
 
 ### How to import an existing database (e.g from Legacy Windows or from Backups)
 First you must shutdown your local bridgehead instance:
@@ -36,10 +36,10 @@ systemctl stop bridgehead@ccp
 
 Next you need to remove the current patientlist database:
 ```
-rm -rf /var/lib/bridgehead/data/patientlist
+docker volume rm patientlist-db-data;
 ```
 
-Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then /var/lib/bridgehead/data/patientlist is empty. 
+Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then the volume `patientlist-db-data` was removed previously. 
 > NOTE: Please create the postgres dump with the options "--no-owner" and "--no-privileges". Additionally ensure the dump is created in the plain format (SQL).
 
 After this, you can restart your bridgehead and the dump will be imported:
diff --git a/ccp/mtba-compose.yml b/ccp/mtba-compose.yml
index 1c62989..857ff34 100644
--- a/ccp/mtba-compose.yml
+++ b/ccp/mtba-compose.yml
@@ -24,10 +24,13 @@ services:
       - "traefik.http.routers.mtba.tls=true"
     volumes:
       # This directory persists the FHIR Resources that are needed to import data into blaze.
-      - /var/lib/bridgehead/data/mtba:/app/mtba-files/persist
+      - mtba-data:/app/mtba-files/persist
       # Place new import files in this directory
       - /tmp/bridgehead/mtba/:/app/mtba-files/input
 
   # TODO: Include CBioPortal in Deployment ...
   # NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted!
   # TODO: Find a trigger to let mtba signal a restart for CBioPortal
+
+volumes:
+  mtba-data:
diff --git a/lib/install-bridgehead.sh b/lib/install-bridgehead.sh
index 04503e3..f1aff73 100755
--- a/lib/install-bridgehead.sh
+++ b/lib/install-bridgehead.sh
@@ -22,8 +22,8 @@ Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
     /bin/systemctl stop bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@*.service, \\
-    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/lib/bridgehead /var/cache/bridgehead, \\
-    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/lib/bridgehead /var/cache/bridgehead
+    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/cache/bridgehead, \\
+    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/cache/bridgehead
 
 bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
 EOF
@@ -37,11 +37,6 @@ if [ -z "$LDM_PASSWORD" ]; then
   echo -e "## Local Data Management Basic Authentication\n# User: $PROJECT\nLDM_PASSWORD=$generated_passwd" >> /etc/bridgehead/${PROJECT}.local.conf;
 fi
 
-log "INFO" "Creating directory /var/lib/bridgehead for storage of persistent data."
-mkdir -p /var/lib/bridgehead
-chown -R bridgehead /var/lib/bridgehead
-
-
 log "INFO" "Creating directory /var/cache/bridgehead for storage of backups."
 mkdir -p /var/cache/bridgehead
 chown -R bridgehead /var/cache/bridgehead

From 1befa65f35033f9383aae88b7fdcf5fd0244e156 Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 10:59:29 +0100
Subject: [PATCH 3/8] refactor: Changed Salt for patientlist db password

---
 ccp/modules/id-management-setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ccp/modules/id-management-setup.sh b/ccp/modules/id-management-setup.sh
index d2449c7..98c4217 100644
--- a/ccp/modules/id-management-setup.sh
+++ b/ccp/modules/id-management-setup.sh
@@ -6,7 +6,7 @@ function idManagementSetup() {
 		OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
 
 		# Auto Generate local Passwords
-		PATIENTLIST_POSTGRES_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+		PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
 		IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
 
 		# Source the ID Generators Configuration

From 713dc5f4e9564596fb2a47afaceeb2a28cd2ea1d Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 11:15:09 +0100
Subject: [PATCH 4/8] refactor: Move Backups after the Update

---
 lib/update-bridgehead.sh | 62 ++++++++++++++++++++--------------------
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh
index 65560ea..7fb3688 100755
--- a/lib/update-bridgehead.sh
+++ b/lib/update-bridgehead.sh
@@ -1,37 +1,6 @@
 #!/bin/bash
 source lib/functions.sh
 
-AUTO_BACKUP=${AUTO_BACKUP:-true}
-
-if [ "$AUTO_BACKUP" == "true" ]; then
-  BACKUP_DIRECTORY="/var/cache/bridgehead/backup"
-  if [ ! -d $BACKUP_DIRECTORY ]; then
-    message="Performing automatic maintenance: Creating Backup directory $BACKUP_DIRECTORY."
-    hc_send log "$message"
-    log INFO "$message"
-    mkdir -p $BACKUP_DIRECTORY
-  fi
-  BACKUP_SERVICES="$(docker ps --filter ancestor=postgres:14-alpine --format "{{.Names}}" | tr "\n" "\ ")"
-  log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
-  for service in $BACKUP_SERVICES; do
-    if [ ! -d $BACKUP_DIRECTORY/$service ]; then
-      message="Performing automatic maintenance: Creating Backup directory for $service in $BACKUP_DIRECTORY."
-      hc_send log "$message"
-      log INFO "$message"
-      mkdir -p $BACKUP_DIRECTORY/$service
-    fi
-    if createEncryptedPostgresBackup "$BACKUP_DIRECTORY" "$service"; then
-      message="Performing automatic maintenance: Stored encrypted Backup for $service in $BACKUP_DIRECTORY."
-      hc_send log "$message"
-      log INFO "$message"
-    else
-      fail_and_report 5 "Failed to create encrypted update for $service"
-    fi
-  done
-else
-  log WARN "Automated backups are disabled (variable AUTO_BACKUPS != \"true\")"
-fi
-
 AUTO_HOUSEKEEPING=${AUTO_HOUSEKEEPING:-true}
 
 if [ "$AUTO_HOUSEKEEPING" == "true" ]; then
@@ -134,6 +103,37 @@ else
   hc_send log "$RES"
 fi
 
+AUTO_BACKUP=${AUTO_BACKUP:-true}
+
+if [ "$AUTO_BACKUP" == "true" ]; then
+  BACKUP_DIRECTORY="/var/cache/bridgehead/backup"
+  if [ ! -d $BACKUP_DIRECTORY ]; then
+    message="Performing automatic maintenance: Creating Backup directory $BACKUP_DIRECTORY."
+    hc_send log "$message"
+    log INFO "$message"
+    mkdir -p $BACKUP_DIRECTORY
+  fi
+  BACKUP_SERVICES="$(docker ps --filter ancestor=postgres:14-alpine --format "{{.Names}}" | tr "\n" "\ ")"
+  log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
+  for service in $BACKUP_SERVICES; do
+    if [ ! -d $BACKUP_DIRECTORY/$service ]; then
+      message="Performing automatic maintenance: Creating Backup directory for $service in $BACKUP_DIRECTORY."
+      hc_send log "$message"
+      log INFO "$message"
+      mkdir -p $BACKUP_DIRECTORY/$service
+    fi
+    if createEncryptedPostgresBackup "$BACKUP_DIRECTORY" "$service"; then
+      message="Performing automatic maintenance: Stored encrypted Backup for $service in $BACKUP_DIRECTORY."
+      hc_send log "$message"
+      log INFO "$message"
+    else
+      fail_and_report 5 "Failed to create encrypted update for $service"
+    fi
+  done
+else
+  log WARN "Automated backups are disabled (variable AUTO_BACKUPS != \"true\")"
+fi
+
 exit 0
 
 # TODO: Print last commit explicit

From 17d48a3636c812d7d2ac1a07b6adab20c930d75c Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 11:26:31 +0100
Subject: [PATCH 5/8] refactor: Expect User to select a Backup Directory

---
 README.md                    |  3 ++-
 ccp/modules/id-management.md |  2 +-
 lib/install-bridgehead.sh    |  8 ++------
 lib/update-bridgehead.sh     | 19 ++++++++-----------
 4 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index e1d3286..8fba0c9 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,6 @@ All of the Bridgehead's outgoing connections are secured by transport encryption
   - `/etc/bridgehead/traefik-tls` contains your Bridgehead's reverse proxies TLS certificates for [HTTPS access](#https-access).
   - `/etc/bridgehead/pki` contains your Bridgehead's private key (e.g., but not limited to Samply.Beam), generated as part of the [Samply.Beam enrollment](#register-with-samplybeam).
   - `/etc/bridgehead/trusted-ca-certs` contains third-party certificates to be trusted by the Bridgehead. For example, you want to place the certificates of your [TLS-terminating proxy](#network) here.
-  - `/var/cache/bridgehead/backup` contains automatically created backups of the databases.
 
 Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
 
@@ -147,6 +146,8 @@ Some of the components in the bridgehead will store persistent data. For those c
 2) Year-KW-XX, were XX represents the calendar week to allow re-import of at least one version per calendar week
 3) Year-Month, to allow re-import of at least one version per month
 
+To enable the Auto-Backup feature, please set the Variable `BACKUP_DIRECTORY` in your sites configuration.
+
 ### Monitoring
 
 To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring 
diff --git a/ccp/modules/id-management.md b/ccp/modules/id-management.md
index e18d3f8..98da3d1 100644
--- a/ccp/modules/id-management.md
+++ b/ccp/modules/id-management.md
@@ -26,7 +26,7 @@ Upon configuration, the Bridgehead will spawn the following services:
 
 - The `bridgehead-id-manager` at https://bridgehead.local/id-manager, provides a common interface for creating pseudonyms in the bridgehead.
 - The `bridgehead-patientlist` at https://bridgehead.local/patientlist is a local instance of the open-source software [Mainzelliste](https://mainzelliste.de). This service's primary task is to map patients IDAT to pseudonyms identifying them along the different CCP projects.
-- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted as a named volume `patientlist-db-data` and backups are automatically created in `/var/cache/bridgehead/backup/bridgehead-patientlist-db`.
+- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted as a named volume `patientlist-db-data`.
 
 ### How to import an existing database (e.g from Legacy Windows or from Backups)
 First you must shutdown your local bridgehead instance:
diff --git a/lib/install-bridgehead.sh b/lib/install-bridgehead.sh
index f1aff73..c42119f 100755
--- a/lib/install-bridgehead.sh
+++ b/lib/install-bridgehead.sh
@@ -22,8 +22,8 @@ Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
     /bin/systemctl stop bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@*.service, \\
-    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/cache/bridgehead, \\
-    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead /var/cache/bridgehead
+    /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead, \\
+    /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
 
 bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
 EOF
@@ -37,10 +37,6 @@ if [ -z "$LDM_PASSWORD" ]; then
   echo -e "## Local Data Management Basic Authentication\n# User: $PROJECT\nLDM_PASSWORD=$generated_passwd" >> /etc/bridgehead/${PROJECT}.local.conf;
 fi
 
-log "INFO" "Creating directory /var/cache/bridgehead for storage of backups."
-mkdir -p /var/cache/bridgehead
-chown -R bridgehead /var/cache/bridgehead
-
 log "INFO" "Registering system units for bridgehead and bridgehead-update"
 cp -v \
     lib/systemd/bridgehead\@.service \
diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh
index 7fb3688..276f60c 100755
--- a/lib/update-bridgehead.sh
+++ b/lib/update-bridgehead.sh
@@ -103,27 +103,24 @@ else
   hc_send log "$RES"
 fi
 
-AUTO_BACKUP=${AUTO_BACKUP:-true}
-
-if [ "$AUTO_BACKUP" == "true" ]; then
-  BACKUP_DIRECTORY="/var/cache/bridgehead/backup"
-  if [ ! -d $BACKUP_DIRECTORY ]; then
-    message="Performing automatic maintenance: Creating Backup directory $BACKUP_DIRECTORY."
+if [ -z "${BACKUP_DIRECTORY}" ]; then
+  if [ ! -d "$BACKUP_DIRECTORY" ]; then
+    message="Performing automatic maintenance: Attempting to create backup directory $BACKUP_DIRECTORY."
     hc_send log "$message"
     log INFO "$message"
-    mkdir -p $BACKUP_DIRECTORY
+    mkdir -p "$BACKUP_DIRECTORY"
   fi
   BACKUP_SERVICES="$(docker ps --filter ancestor=postgres:14-alpine --format "{{.Names}}" | tr "\n" "\ ")"
   log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
   for service in $BACKUP_SERVICES; do
-    if [ ! -d $BACKUP_DIRECTORY/$service ]; then
-      message="Performing automatic maintenance: Creating Backup directory for $service in $BACKUP_DIRECTORY."
+    if [ ! -d "$BACKUP_DIRECTORY/$service" ]; then
+      message="Performing automatic maintenance: Attempting to create backup directory for $service in $BACKUP_DIRECTORY."
       hc_send log "$message"
       log INFO "$message"
-      mkdir -p $BACKUP_DIRECTORY/$service
+      mkdir -p "$BACKUP_DIRECTORY/$service"
     fi
     if createEncryptedPostgresBackup "$BACKUP_DIRECTORY" "$service"; then
-      message="Performing automatic maintenance: Stored encrypted Backup for $service in $BACKUP_DIRECTORY."
+      message="Performing automatic maintenance: Stored encrypted backup for $service in $BACKUP_DIRECTORY."
       hc_send log "$message"
       log INFO "$message"
     else

From a37bf79c030908e80284c981975161bb31b989cc Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 11:31:36 +0100
Subject: [PATCH 6/8] refactor: Added Monitoring for backup permissions

---
 lib/update-bridgehead.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh
index 276f60c..0f1c413 100755
--- a/lib/update-bridgehead.sh
+++ b/lib/update-bridgehead.sh
@@ -109,7 +109,9 @@ if [ -z "${BACKUP_DIRECTORY}" ]; then
     hc_send log "$message"
     log INFO "$message"
     mkdir -p "$BACKUP_DIRECTORY"
+    chown -R "$BACKUP_DIRECTORY" bridgehead;
   fi
+  checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $(pwd)"
   BACKUP_SERVICES="$(docker ps --filter ancestor=postgres:14-alpine --format "{{.Names}}" | tr "\n" "\ ")"
   log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
   for service in $BACKUP_SERVICES; do

From 98afeac701f0065d0052f07a8c9b27ce9e2ff779 Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 11:49:18 +0100
Subject: [PATCH 7/8] refactor: Use -db as Indicator for Backups

---
 lib/update-bridgehead.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh
index 0f1c413..ab39cca 100755
--- a/lib/update-bridgehead.sh
+++ b/lib/update-bridgehead.sh
@@ -112,7 +112,8 @@ if [ -z "${BACKUP_DIRECTORY}" ]; then
     chown -R "$BACKUP_DIRECTORY" bridgehead;
   fi
   checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $(pwd)"
-  BACKUP_SERVICES="$(docker ps --filter ancestor=postgres:14-alpine --format "{{.Names}}" | tr "\n" "\ ")"
+  # Collect all container names that contain '-db'
+  BACKUP_SERVICES="$(docker ps --filter name=-db --format "{{.Names}}" | tr "\n" "\ ")"
   log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
   for service in $BACKUP_SERVICES; do
     if [ ! -d "$BACKUP_DIRECTORY/$service" ]; then

From 2445a5978506bd7d3b84d85fafe7e8a16d6f239d Mon Sep 17 00:00:00 2001
From: Torben Brenner <t.brenner@dkfz-heidelberg.de>
Date: Fri, 27 Jan 2023 11:52:09 +0100
Subject: [PATCH 8/8] refacotr: Restructured passing Patientlist Seeds

---
 ccp/modules/id-management-compose.yml | 25 +------------------------
 ccp/modules/id-management-setup.sh    |  4 ++--
 ccp/modules/id-management.md          |  2 ++
 3 files changed, 5 insertions(+), 26 deletions(-)

diff --git a/ccp/modules/id-management-compose.yml b/ccp/modules/id-management-compose.yml
index 72aebcc..3f13519 100644
--- a/ccp/modules/id-management-compose.yml
+++ b/ccp/modules/id-management-compose.yml
@@ -31,30 +31,7 @@ services:
       - ML_DB_PASS=${PATIENTLIST_POSTGRES_PASSWORD}
       - ML_API_KEY=${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
       # Add Variables from /etc/patientlist-id-generators.env
-      - ML_BK_IDGENERATOR_RANDOM_1
-      - ML_BK_IDGENERATOR_RANDOM_2
-      - ML_BK_IDGENERATOR_RANDOM_3
-      - ML_MDS_IDGENERATOR_RANDOM_1
-      - ML_MDS_IDGENERATOR_RANDOM_2
-      - ML_MDS_IDGENERATOR_RANDOM_3
-      - ML_DKTK000001985_IDGENERATOR_RANDOM_1
-      - ML_DKTK000001985_IDGENERATOR_RANDOM_2
-      - ML_DKTK000001985_IDGENERATOR_RANDOM_3
-      - ML_DKTK000001986_IDGENERATOR_RANDOM_1
-      - ML_DKTK000001986_IDGENERATOR_RANDOM_2
-      - ML_DKTK000001986_IDGENERATOR_RANDOM_3
-      - ML_DKTK000001950_IDGENERATOR_RANDOM_1
-      - ML_DKTK000001950_IDGENERATOR_RANDOM_2
-      - ML_DKTK000001950_IDGENERATOR_RANDOM_3
-      - ML_DKTK000001951_IDGENERATOR_RANDOM_1
-      - ML_DKTK000001951_IDGENERATOR_RANDOM_2
-      - ML_DKTK000001951_IDGENERATOR_RANDOM_3
-      - ML_DKTK999999999_IDGENERATOR_RANDOM_1
-      - ML_DKTK999999999_IDGENERATOR_RANDOM_2
-      - ML_DKTK999999999_IDGENERATOR_RANDOM_3
-      - ML_DKTK000002089_IDGENERATOR_RANDOM_1
-      - ML_DKTK000002089_IDGENERATOR_RANDOM_2
-      - ML_DKTK000002089_IDGENERATOR_RANDOM_3
+      - PATIENTLIST_SEEDS_TRANSFORMED
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.patientlist.rule=PathPrefix(`/patientlist`)"
diff --git a/ccp/modules/id-management-setup.sh b/ccp/modules/id-management-setup.sh
index 98c4217..0f361dc 100644
--- a/ccp/modules/id-management-setup.sh
+++ b/ccp/modules/id-management-setup.sh
@@ -9,8 +9,8 @@ function idManagementSetup() {
 		PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
 		IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
 
-		# Source the ID Generators Configuration
-		source /etc/bridgehead/patientlist-id-generators.env
+		# Transform Seeds Configuration to pass it to the Mainzelliste Container
+		PATIENTLIST_SEEDS_TRANSFORMED="$(declare -p PATIENTLIST_SEEDS | tr -d '\"' | sed 's/\[/\[\"/g' | sed 's/\]/\"\]/g')"
 
 		# Ensure old ids are working !!!
 		legacyIdMapping
diff --git a/ccp/modules/id-management.md b/ccp/modules/id-management.md
index 98da3d1..66f9f71 100644
--- a/ccp/modules/id-management.md
+++ b/ccp/modules/id-management.md
@@ -16,10 +16,12 @@ IDMANAGER_SEEDS_BK="<three-numbers>"
 IDMANAGER_SEEDS_MDS="<three-numbers>"
 IDMANAGER_SEEDS_DKTK000001985="<three-numbers>"
 ```
+> NOTE: Additionally, the CCP-IT adds lines declaring the `PATIENTLIST_SEEDS` array in your site configuration. This will contain the seeds for the different id-generators used in all projects.
 
 Once your Bridgehead is updated and restarted, you're all set!
 
 ## Additional information you may want to know
+
 ### Services
 
 Upon configuration, the Bridgehead will spawn the following services: