From b5ca5ea4a78fa329a586f762ec2afcc66c38a278 Mon Sep 17 00:00:00 2001
From: lablans <m.lablans@dkfz-heidelberg.de>
Date: Fri, 15 Sep 2023 08:12:16 +0000
Subject: [PATCH] Autogenerate maps for Opal's beam-connect. To be completed by
 @Threated with a map-generator in the script.

---
 ccp/modules/datashield-compose.yml |  6 +++---
 ccp/modules/datashield-setup.sh    | 11 ++++++-----
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/ccp/modules/datashield-compose.yml b/ccp/modules/datashield-compose.yml
index 7ddc55c..68576cc 100644
--- a/ccp/modules/datashield-compose.yml
+++ b/ccp/modules/datashield-compose.yml
@@ -84,7 +84,7 @@ services:
     depends_on:
       - beam-proxy
     volumes:
-      - /etc/bridgehead/datashield-connect/:/map:ro
+      - /tmp/bridgehead/opal-map/:/map/:ro
 
   beam-proxy:
     environment:
@@ -102,6 +102,6 @@ services:
 
 secrets:
   opal-cert.pem:
-    file: /etc/bridgehead/trusted-ca-certs/opal-cert.pem
+    file: /tmp/bridgehead/opal-cert.pem
   opal-key.pem:
-    file: /etc/bridgehead/trusted-ca-certs/opal-key.pem
+    file: /tmp/bridgehead/opal-key.pem
diff --git a/ccp/modules/datashield-setup.sh b/ccp/modules/datashield-setup.sh
index 4948021..8652431 100644
--- a/ccp/modules/datashield-setup.sh
+++ b/ccp/modules/datashield-setup.sh
@@ -5,10 +5,11 @@ if [ "$ENABLE_DATASHIELD" == true ]; then
   OVERRIDE+=" -f ./$PROJECT/modules/datashield-compose.yml"
   OPAL_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for Opal. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
   DATASHIELD_CONNECT_SECRET="$(echo \"This is a salt string to generate one consistent password as the DataShield Connect secret. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
-  if [ ! -e "/etc/bridgehead/trusted-ca-certs/opal-cert.pem" ]; then
-    openssl req -x509 -newkey rsa:4096 -nodes -keyout /etc/bridgehead/trusted-ca-certs/opal-key.pem -out /etc/bridgehead/trusted-ca-certs/opal-cert.pem -days 3650 -subj "/CN=${HOST:-opal}/C=DE"
-    chmod g+r /etc/bridgehead/trusted-ca-certs/opal-key.pem
-    chown bridgehead:docker /etc/bridgehead/trusted-ca-certs/opal-key.pem
-    chown bridgehead:docker /etc/bridgehead/trusted-ca-certs/opal-cert.pem
+  if [ ! -e /tmp/bridgehead/opal-cert.pem ]; then
+    mkdir -p /tmp/bridgehead/
+    chown -R bridgehead:docker /tmp/bridgehead/
+    openssl req -x509 -newkey rsa:4096 -nodes -keyout /tmp/bridgehead/opal-key.pem -out /tmp/bridgehead/opal-cert.pem -days 3650 -subj "/CN=${HOST:-opal}/C=DE"
+    chown -R bridgehead:docker /tmp/bridgehead/
+    chmod g+r /tmp/bridgehead/opal-key.pem
   fi
 fi