Merge pull request #397 from samply/develop

develop -> main

README.md

@@ -130,25 +130,29 @@ Mention:
 - site name (According to conventions listed above)
 - operator name and email
 
-We will set the repository up for you. We will then send you:
+We will set the repository up for you. We will then send you either:
 
-- A Repository Short Name (RSN). Beware: this is distinct from your site name.
+- Way A: a one-time enrollment code, or
-- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/<project>-bridgehead-configs/dummy.git
+- Way B: a repository URL including access credentials.
 
 During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
 
 
 ### Base Installation
 
-First, download your site specific configuration repository:
+Clone the bridgehead repository and run the installation script:
 ```shell
-sudo mkdir -p /etc/bridgehead/
+sudo mkdir -p /srv/docker/
-sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
+sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
+cd /srv/docker/bridgehead
+sudo ./bridgehead install <PROJECT>
 ```
 
+When asked, choose Way A or Way B. For Way A, enter your one-time enrollment code and your site name; for Way B, enter your repository URL. The installation downloads your site configuration to `/etc/bridgehead`. If your server needs an HTTP proxy to reach the internet, pass it to the script, e.g. `sudo https_proxy=http://proxy.example.org:3128 ./bridgehead install <PROJECT>`.
+
 Review the site configuration:
 ```shell
-sudo cat /etc/bridgehead/bbmri.conf
+sudo cat /etc/bridgehead/<PROJECT>.conf
 ```
 
 Pay special attention to:
@@ -159,21 +163,10 @@ Pay special attention to:
 - OPERATOR_LAST_NAME
 - OPERATOR_EMAIL
 
-Clone the bridgehead repository:
-```shell
-sudo mkdir -p /srv/docker/
-sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
-```
-
-Then, run the installation script:
-
-```shell
-cd /srv/docker/bridgehead
-sudo ./bridgehead install <PROJECT>
-```
-
 ### Register with Samply.Beam
 
+If you installed with Way A, this has already been done for you; skip to the next step.
+
 Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
 
 ``` shell
@@ -359,14 +352,20 @@ https://<Name of your server>/bbmri-localdatamanagement/fhir
 ```
 The name of your server will generally be the full name of the VM that the Bridgehead runs on. You can alternatively supply an IP address.
 
-The FHIR API uses basic auth. You can find the credentials in `/etc/bridgehead/<project>.local.conf`.
+For more information on how to use the FHIR API, please refer to the [Hapi FHIR tutorial](https://github.com/hapifhir/fhir-tutorial/blob/master/CRUD%20operations/lesson.md).
+
+The Bridgehead's FHIR API uses basic auth. You can find the credentials in `/etc/bridgehead/<project>.local.conf`.
 
 Note that if you don't have a DNS certificate for the Bridgehead, you will need to allow an insecure connection. E.g. with curl, use the `-k` flag.
 
-The storage space on your hard drive will depend on the number of FHIR resources that you intend to generate. This will be the sum of the number of patients/subjects, the number of samples, the number of conditions/diseases and the number of observations. As a general rule of thumb, you can assume that each resource will consume about 2 kilobytes of disk space.
+As an alternative to curl, you can also use the tool [blazectl](https://github.com/samply/blazectl) for uploading data to the FHIR store.
+
+The storage space needed on your hard drive will depend on the number of FHIR resources that you intend to generate. This will be the sum of the number of patients/subjects, the number of samples, the number of conditions/diseases and the number of observations. As a general rule of thumb, you can assume that each resource will consume about 2 kilobytes of disk space.
 
 For more information on Blaze performance, please refer to [import performance](https://github.com/samply/blaze/blob/master/docs/performance/import.md).
 
+If you can make your data available in tabular form (e.g. as an Excel file), then you can use the ["a small fire"](https://github.com/bbdataeng/a-small-fire) tool to convert your data into the FHIR format needed for upload to the FHIR store.
+
 ### Clearing data
 
 The Bridgehead's FHIR store, Blaze, saves its data in a Docker volume. This means that the data will persist even if you stop the Bridgehead. You can clear existing data from the FHIR store by deleting the relevant Docker volume.
@@ -451,6 +450,20 @@ If these variables are not set, the Data Quality Agent will still run and genera
 Reports are accessible at `https://<your-host>/bbmri-data-quality-agent` (default credentials are admin:admin, please change it after first login!!).
 
 [Official documentation](https://fdqf.bbmri-eric.eu/user/deployment.html)
+
+### OVis (CCP only)
+
+OVis visualizes your tumor documentation data at `https://<your-host>/ccp-ovis`. Set in your `ccp.conf`:
+
+```bash
+ENABLE_OVIS=true
+OVIS_SUPERADMIN_EMAILS=admin@your-site.de
+```
+
+Users authenticate centrally with their CCP account (membership in your site's CCP group required), while their permissions are defined inside OVis -- so no duplicate user accounts are needed. The addresses in `OVIS_SUPERADMIN_EMAILS` become super admins and can grant roles to everyone else.
+
+Data is imported on first start into `/var/cache/bridgehead/ccp/ovis-mongodb`. Deleting that directory also resets all OVis permissions.
+
 ## Things you should know
 
 ### Auto-Updates

bbmri/modules/data-quality-agent-compose.yml

@@ -4,6 +4,7 @@ services:
   data-quality-agent:
     image: ghcr.io/bbmri-cz/data-quality-agent:${DATA_QUALITY_AGENT_TAG}
     container_name: bridgehead-bbmri-data-quality-agent
+    user: "${BRIDGEHEAD_UID}:${BRIDGEHEAD_GID}"
     environment:
       APP_SETTING_FHIR_URL: http://bridgehead-bbmri-blaze:8080/fhir
       REPORTING_SERVER_URL: ${DATA_QUALITY_SERVER_URL}

bbmri/modules/data-quality-agent-setup.sh

@@ -2,6 +2,8 @@
 
 if [ "$ENABLE_DATA_QUALITY_AGENT" == "true" ]; then
     log INFO "Data Quality Agent setup detected -- will start data-quality-agent service."
+    export BRIDGEHEAD_UID="$(id -u bridgehead)"
+    export BRIDGEHEAD_GID="$(id -g bridgehead)"
     OVERRIDE+=" -f ./$PROJECT/modules/data-quality-agent-compose.yml"
 fi
 

bbmri/modules/eric-compose.yml

@@ -12,6 +12,7 @@ services:
       BEAM_PROXY_URL: http://beam-proxy-eric:8081
       RETRY_COUNT: ${FOCUS_RETRY_COUNT}
       OBFUSCATE_BBMRI_ERIC_WAY: "true"
+      CQL_FLAVOUR: "${FOCUS_CQL_FLAVOUR}"
     depends_on:
       - "beam-proxy-eric"
       - "blaze"

bridgehead

@@ -153,7 +153,13 @@ case "$ACTION" in
 		exec ./lib/update-bridgehead.sh $PROJECT
 		;;
 	check)
+		# Ignore the caller's environment, e.g. proxy variables, like bridgehead@.service does
+		if [ "$(id -u)" -eq 0 ]; then
+			exec systemd-run --wait --pipe --quiet --collect -p User=bridgehead -p WorkingDirectory="$BASE" "$BASE/bridgehead" check $PROJECT
+		fi
+		trap 'log "ERROR" "Unable to load the configuration of $PROJECT"; exit 3' EXIT
 		loadVars &> /dev/null
+		trap - EXIT
 		exec ./lib/check-bridgehead.sh $PROJECT
 		;;
 	install)

cce/docker-compose.yml

@@ -57,7 +57,7 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro
+      - ${ROOT_CRT_FILE}:/conf/root.crt.pem:ro
 
 
 volumes:

cce/root.crt.pem

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
+MIIDNTCCAh2gAwIBAgIUD8gordqfXZkBt/18/i3GL+ZHIfgwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjYwOTA3MDgzMDA0WhcNMzYw
-MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+OTA0MDgzMDM0WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
+AQEBBQADggEPADCCAQoCggEBAMRoq11ZV5FyDNEADhVdPxYEisVbPMMKsXlUxQEW
-TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
+ibv/CgQdrgf+AVTpR9Z9qrMmHCd52bTAkck7C6WES0mGhZ/u/Kgciga+HORVf8H0
-OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
+5YthLcJRO5d5t2e2rquYTRRZzmaeUtYGP/LJe1IdBjZmbzHxzH9IALdQqmtqSMr5
-XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
+kRHd4zzLA8NtzGsJSqOcU5KfDRaA++3kEIWjGVRfzZBSQTj5A8v/98ETDt9HVqq7
-pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
+D9lPEZl9OUF3P3/wJWC/adTYyV1AXf3gET5XNZXftbmvhxO9yhNAxAXS3ogXI6EH
-K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
+fXfvWbv+OKv5jDIwHyLQpBpzfCIPrulaOLpXFXaEH+CPceUCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFBddxl5dqafn
-poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
+Lv7QBWkTjsFSGGB6MB8GA1UdIwQYMBaAFBddxl5dqafnLv7QBWkTjsFSGGB6MBYG
-A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCWfW75sCaL
-AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
+Cx6JaZAWfe3Fhd7QPZmGmeOlkcdJZJ7T6jLIBMcMpAxirCXA0I1omlY0esHnljd5
-fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
+00BX03AVG0McJcclH9yCf5n+eLp0b2c8F1bvgn68I8kQg4SZIdnGL+iot74apRRx
-3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
+3BvQF5IwZbnOD+MENXDzwlrCX7MZwt0/EC3t9tPnVLCZwk/mOXLlr64a+y7D0lKZ
-n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
+2+LJ76Ty7RTGPN5cUgHoRodRcJ37r9Uol2dXezQTBjffLP7Kf/PPIhhjGxximadc
-7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
+/kfmKu4u0e+whQV+8N260+6ScvTr8RArjIwb4vV0NolDwsoUAFaoAvZ5pNRhEnA+
-Rtup0MTxSJtN
+2Z8f6iL3sKOW
 -----END CERTIFICATE-----

cce/test.root.crt.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
+MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
+TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
+OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
+XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
+pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
+K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
+poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
+AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
+fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
+3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
+n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
+7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
+Rtup0MTxSJtN
+-----END CERTIFICATE-----

cce/vars

@@ -1,4 +1,9 @@
-BROKER_ID=test-no-real-data.broker.samply.de
+BROKER_ID=broker.cce.dkfz.de
+ROOT_CRT_FILE=/srv/docker/bridgehead/cce/root.crt.pem
+if [ "$ENVIRONMENT" == "test" ]; then
+	BROKER_ID=test-no-real-data.broker.samply.de
+	ROOT_CRT_FILE=/srv/docker/bridgehead/cce/test.root.crt.pem
+fi
 BROKER_URL=https://${BROKER_ID}
 PROXY_ID=${SITE_ID}.${BROKER_ID}
 FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"

ccp/modules/ovis-compose.yml

@@ -0,0 +1,107 @@
+services:
+  ovis-traefik-forward-auth:
+    container_name: bridgehead-ccp-ovis-forward-auth
+    image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
+    environment:
+      - http_proxy=http://forward_proxy:3128
+      - https_proxy=http://forward_proxy:3128
+      - OAUTH2_PROXY_PROVIDER=oidc
+      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
+      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
+      - OAUTH2_PROXY_CLIENT_ID=${OIDC_PRIVATE_CLIENT_ID}
+      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
+      - OAUTH2_PROXY_COOKIE_SECRET=${OVIS_AUTH_COOKIE_SECRET}
+      - OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_ovis
+      - OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
+      - OAUTH2_PROXY_COOKIE_REFRESH=4m
+      - OAUTH2_PROXY_COOKIE_EXPIRE=24h
+      - OAUTH2_PROXY_HTTP_ADDRESS=:4180
+      - OAUTH2_PROXY_REVERSE_PROXY=true
+      - OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST}
+      - OAUTH2_PROXY_UPSTREAMS=static://202
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_SCOPE=openid profile email
+      - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
+      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
+      - OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_USER_GROUP}
+      - OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
+      - OAUTH2_PROXY_PROXY_PREFIX=/oauth2-ovis
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180"
+      - "traefik.http.routers.ovis-traefik-forward-auth.rule=Host(`${HOST}`) && PathPrefix(`/oauth2-ovis`)"
+      - "traefik.http.routers.ovis-traefik-forward-auth.tls=true"
+      - "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.address=http://ovis-traefik-forward-auth:4180"
+      - "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.authResponseHeaders=Authorization,X-Auth-Request-Email,X-Auth-Request-User,X-Auth-Request-Preferred-Username"
+    depends_on:
+      forward_proxy:
+        condition: service_healthy
+
+  ovis-backend-database-mongodb:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-mongodb:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-mongo
+    volumes:
+      - /var/cache/bridgehead/ccp/ovis-mongodb:/data/db
+
+  ovis-backend-mongodb-data-preprocessing:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-preprocessor:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-preprocessing
+    environment:
+      ADDRESS: mongodb://ovis-backend-database-mongodb:27017
+    depends_on:
+      - ovis-backend-database-mongodb
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:9000/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 5s
+
+  ovis-backend-data-import:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-data-import:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-import
+    depends_on:
+      ovis-backend-mongodb-data-preprocessing:
+        condition: service_healthy
+    environment:
+      FHIR_SERVER_URL: http://bridgehead-ccp-blaze:8080/fhir
+
+  ovis-backend-cox:
+    image: samply/ovis-backend-cox:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-cox
+
+  ovis-backend-apollo:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-apollo:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-backend
+    environment:
+      ADDRESS: mongodb://ovis-backend-database-mongodb:27017
+      OVIS_SUPERADMIN_EMAILS: ${OVIS_SUPERADMIN_EMAILS:-}
+    depends_on:
+      - ovis-backend-database-mongodb
+      - ovis-backend-mongodb-data-preprocessing
+      - ovis-backend-data-import
+      - ovis-backend-cox
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "-X", "POST", "-H", "content-type: application/json", "-d", "{\"query\":\"{__typename}\"}", "http://localhost:4001/graphql"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    # Internal only - no direct Traefik exposure. GraphQL is accessed via frontend internal proxy.
+
+  ovis-frontend:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-frontend:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-frontend
+    environment:
+      ORIGIN: https://${HOST}
+    depends_on:
+      ovis-backend-apollo:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.regex=^https?://([^/]+)/ccp-ovis$$"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.replacement=https://$${1}/ccp-ovis/"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.permanent=true"
+      - "traefik.http.routers.ovis-frontend-ccp.tls=true"
+      - "traefik.http.routers.ovis-frontend-ccp.rule=PathPrefix(`/ccp-ovis`)"
+      - "traefik.http.routers.ovis-frontend-ccp.middlewares=traefik-forward-auth-ovis,ovis-frontend-ccp-slash-redirect"
+      - "traefik.http.services.ovis-frontend-ccp.loadbalancer.server.port=5173"

ccp/modules/ovis-setup.sh

@@ -0,0 +1,12 @@
+#!/bin/bash -e
+
+if [ "$ENABLE_OVIS" == true ]; then
+  log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware."
+  OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml"
+  add_private_oidc_redirect_url "/oauth2-ovis/callback"
+  add_private_oidc_redirect_url "/ccp-ovis*"
+  OVIS_AUTH_COOKIE_SECRET="$(generate_simple_password 'ovisCookieSecret' | head -c 16)"
+  if [ -z "$OVIS_SUPERADMIN_EMAILS" ]; then
+    log WARN "OVIS is enabled but OVIS_SUPERADMIN_EMAILS is not set -- nobody will be able to administrate OVIS."
+  fi
+fi

itcc/modules/itcc-omics-ingest.yaml

@@ -1,22 +1,37 @@
 services:
   omics-endpoint:
-    image: samply/itcc-omics-ingest:main
+    image: samply/itcc-omics-ingest:develop
     environment:
       API_KEY: ${GENERATE_API_KEY}
+      API_PORT: "6080"
       BEAM_APP_ID_LONG: omics-endpoint.${PROXY_ID}
       BEAM_SECRET: ${FOCUS_BEAM_SECRET_SHORT}
+      BEAM_URL: http://beam-proxy:8081
+      BLAZE_URL: http://bridgehead-itcc-blaze:8080/fhir/
+      BOX_ROOT: /var/lib/itcc-maf-box
       DWH_SOCKET_ID: ${DWH_SOCKET_ID}
       DWH_TASK_ID: ${DWH_TASK_ID}
-      PARTNER_ID: ${SITE_ID}
+      SITE_ID: ${SITE_ID}
       ML_API_KEY: ${GENERATE_API_KEY}
+      ML_URL: http://bridgehead-patientlist:8080
+      UI_PORT: "3000"
+    volumes:
+      - "omics-maf-box:/var/lib/itcc-maf-box"
     labels:
       - "traefik.http.routers.omics.rule=Host(`${HOST}`) &&
         PathPrefix(`/api/upload`)"
       - "traefik.enable=true"
       - "traefik.http.services.omics.loadbalancer.server.port=6080"
+      - "traefik.http.routers.omics.service=omics"
       - "traefik.http.routers.omics.tls=true"
       - "traefik.http.middlewares.omics-stripprefix.stripprefix.prefixes=/api"
       - "traefik.http.routers.omics.middlewares=omics-stripprefix"
+      - "traefik.http.routers.itcc-uploader.rule=Host(`${HOST}`) && PathPrefix(`/itcc-uploader`)"
+      - "traefik.http.routers.itcc-uploader.service=itcc-uploader"
+      - "traefik.http.routers.itcc-uploader.tls=true"
+      - "traefik.http.services.itcc-uploader.loadbalancer.server.port=3000"
+      - "traefik.http.middlewares.itcc-uploader-stripprefix.stripprefix.prefixes=/itcc-uploader"
+      - "traefik.http.routers.itcc-uploader.middlewares=auth,itcc-uploader-stripprefix"
 
   patientlist-db:
     image: postgres:${POSTGRES_TAG}
@@ -60,6 +75,7 @@ services:
         target: /etc/resources/keys/symmetric_key.json
 
 volumes:
+  omics-maf-box:
   patientlist-db-data:
 secrets:
   mainzelliste.docker.conf:

lib/check-bridgehead.sh

@@ -1,74 +1,95 @@
 #!/bin/bash
 source lib/functions.sh
 
-log INFO "Running Bridgehead checks..."
+if [ -t 1 ]; then
-
+  GREEN=$(printf '\033[32m')
-# Directory ownership
+  YELLOW=$(printf '\033[33m')
-log INFO "Checking directory ownership..."
+  RED=$(printf '\033[31m')
-OWNERSHIP_OK=true
+  RESET=$(printf '\033[0m')
-if ! checkOwner /srv/docker/bridgehead bridgehead &> /dev/null; then
-  log ERROR "Wrong ownership for /srv/docker/bridgehead."
-  log INFO "Hint: Run 'sudo chown -R bridgehead /srv/docker/bridgehead'."
-  OWNERSHIP_OK=false
-fi
-if ! checkOwner /etc/bridgehead bridgehead &> /dev/null; then
-  log ERROR "Wrong ownership for /etc/bridgehead."
-  log INFO "Hint: Run 'sudo chown -R bridgehead /etc/bridgehead'."
-  OWNERSHIP_OK=false
-fi
-
-if [ "$OWNERSHIP_OK" = true ]; then
-  log INFO "Directory ownership is correct."
-fi
-
-# Git repository status
-log INFO "Checking Git repository status..."
-GIT_OK=true
-if [ -d "/etc/bridgehead/.git" ]; then
-  if [ -n "$(git -C "/etc/bridgehead" status --porcelain)" ]; then
-    log ERROR "The config repo at /etc/bridgehead is modified.\n$(git -C /etc/bridgehead status -s)"
-    log INFO "Hint: Review your changes with git diff if they are already upstreamed use git stash and git pull to update the repo"
-    GIT_OK=false
-  fi
-fi
-if [ -n "$(git -C "$(pwd)" status --porcelain)" ]; then
-  log ERROR "$(pwd) is modified. \n$(git -C "$(pwd)" status -s)"
-  log INFO "Hint: If these are site specific changes to docker compose files consider moving them to $PROJECT/docker-compose.override.yml which is ignored by git."
-  log INFO "      If they are already upstreamed use git stash and git pull to update the repo"
-  GIT_OK=false
-fi
-
-if [ "$GIT_OK" = true ]; then
-  log INFO "Git repositories are clean."
-fi
-
-# Git remote connection
-log INFO "Checking Git remote connection..."
-GIT_REMOTE_OK=true
-if [ -d "/etc/bridgehead/.git" ]; then
-  if ! git -C "/etc/bridgehead" fetch --dry-run >/dev/null 2>&1; then
-    log ERROR "Cannot connect to the Git remote for /etc/bridgehead."
-    log INFO "Hint: Check your network connection and Git remote configuration for /etc/bridgehead."
-    GIT_REMOTE_OK=false
-  fi
-fi
-if [ -d "$(pwd)/.git" ]; then
-  if ! git -C "$(pwd)" fetch --dry-run >/dev/null 2>&1; then
-    log ERROR "Cannot connect to the Git remote for $(pwd)."
-    log INFO "Hint: Check your network connection and Git remote configuration for $(pwd)."
-    GIT_REMOTE_OK=false
-  fi
-fi
-
-if [ "$GIT_REMOTE_OK" = true ]; then
-  log INFO "Git remote connection successful."
-fi
-
-if [ "$OWNERSHIP_OK" = true ] && [ "$GIT_OK" = true ] && [ "$GIT_REMOTE_OK" = true ]; then
-  log INFO "All checks passed."
-  exit 0
 else
-  log ERROR "Some checks failed. Please review the hints and fix the issues."
+  GREEN=""
-  log ERROR "Without fixing these issues bridgehead updates may not work correctly."
+  YELLOW=""
-  exit 1
+  RED=""
+  RESET=""
 fi
+
+WORST=0
+
+report() {
+  local status=$1 message=$2 color level label
+  shift 2
+  case "$status" in
+    OK) color=$GREEN; level=0; label=" OK " ;;
+    WARN) color=$YELLOW; level=1; label="WARN" ;;
+    *) color=$RED; level=2; label="CRIT" ;;
+  esac
+  printf '[%s%s%s] %s\n' "$color" "$label" "$RESET" "$message"
+  local hint
+  for hint in "$@"; do
+    printf '%s\n' "$hint" | sed 's/^/       /'
+  done
+  if [ $level -gt $WORST ]; then
+    WORST=$level
+  fi
+}
+
+GIT_PROXY_ARGS=()
+if [ -n "$HTTPS_PROXY_FULL_URL" ]; then
+  GIT_PROXY_ARGS=(-c http.proxy=$HTTPS_PROXY_FULL_URL -c https.proxy=$HTTPS_PROXY_FULL_URL)
+fi
+
+echo "Running Bridgehead checks for project $PROJECT ..."
+
+if [ -n "$BROKER_URL_FOR_PREREQ" ]; then
+  if https_proxy=$HTTPS_PROXY_FULL_URL curl -m 10 -sS -o /dev/null "$BROKER_URL_FOR_PREREQ" 2>/dev/null; then
+    report OK "Network connection to $BROKER_URL_FOR_PREREQ"
+  else
+    report CRIT "Cannot connect to $BROKER_URL_FOR_PREREQ with the configured proxy \"$HTTPS_PROXY_URL\"" \
+      "Hint: If your server needs a proxy, HTTPS_PROXY_URL (and, if required, HTTPS_PROXY_USERNAME and HTTPS_PROXY_PASSWORD) must be set in /etc/bridgehead/$PROJECT.conf. Please ask ${SUPPORT_EMAIL:-the support team of your project} to add it to your site configuration."
+  fi
+fi
+
+for DIR in /srv/docker/bridgehead /etc/bridgehead; do
+  if checkOwner $DIR bridgehead &> /dev/null; then
+    report OK "Ownership of $DIR"
+  else
+    report CRIT "Wrong ownership for $DIR" "Hint: Run 'sudo chown -R bridgehead $DIR'."
+  fi
+done
+
+if [ -d "/etc/bridgehead/.git" ]; then
+  if [ -z "$(git -C "/etc/bridgehead" status --porcelain)" ]; then
+    report OK "The config repo at /etc/bridgehead is clean"
+  else
+    report WARN "The config repo at /etc/bridgehead is modified:" \
+      "$(git -C /etc/bridgehead status -s)" \
+      "Hint: Review your changes with git diff if they are already upstreamed use git stash and git pull to update the repo"
+  fi
+fi
+if [ -z "$(git -C "$(pwd)" status --porcelain)" ]; then
+  report OK "$(pwd) is clean"
+else
+  report WARN "$(pwd) is modified:" \
+    "$(git -C "$(pwd)" status -s)" \
+    "Hint: If these are site specific changes to docker compose files consider moving them to $PROJECT/docker-compose.override.yml which is ignored by git." \
+    "      If they are already upstreamed use git stash and git pull to update the repo"
+fi
+
+secret_sync_gitlab_token &> /dev/null
+
+for DIR in /etc/bridgehead "$(pwd)"; do
+  if [ -d "$DIR/.git" ]; then
+    if git "${GIT_PROXY_ARGS[@]}" -C "$DIR" fetch --dry-run >/dev/null 2>&1; then
+      report OK "Git remote connection for $DIR"
+    else
+      report CRIT "Cannot connect to the Git remote for $DIR" "Hint: Check your network connection and Git remote configuration for $DIR."
+    fi
+  fi
+done
+
+case $WORST in
+  0) echo "All checks passed." ;;
+  1) echo "Some checks reported warnings. Please review the hints." ;;
+  *) echo "Some checks failed. Please review the hints and fix the issues. Without fixing these issues bridgehead updates may not work correctly." ;;
+esac
+exit $WORST

lib/functions.sh

@@ -336,21 +336,57 @@ function sync_secrets() {
     set +a # Export variables in the regular way
 }
 
+# Map a GitLab URL to the prefix recognized by Secret Sync
+function secret_sync_gitlab_instance() {
+    case "$1" in
+        *git.verbis.dkfz.de*) echo verbis;;
+        *gitlab.bbmri-eric.eu*) echo bbmri;;
+        *) return 1;;
+    esac
+}
+
+# Use Secret Sync to validate the GitLab token in /var/cache/bridgehead/secrets/gitlab-token.
+# If it is missing or expired, Secret Sync will create a new token and write it to the file.
+# The git credential helper reads the token from the file during git pull.
+function secret_sync_fetch_gitlab_token() {
+    local gitlab=$1 proxy_id=$2 broker_url=$3 broker_id=$4 privkey_file=$5 root_crt_file=$6
+    if [ ! -f "$privkey_file" ] || [ ! -f "$root_crt_file" ]; then
+        log "WARN" "Not running Secret Sync because $privkey_file or $root_crt_file is missing"
+        return 1
+    fi
+    local trusted_ca_args=()
+    if [ -d /etc/bridgehead/trusted-ca-certs ]; then
+        trusted_ca_args=(-v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro -e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs)
+    fi
+    mkdir -p /var/cache/bridgehead/secrets
+    chmod 700 /var/cache/bridgehead/secrets
+    log "INFO" "Running Secret Sync for the GitLab token (gitlab=$gitlab)"
+    docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
+    docker run --rm \
+        -v $privkey_file:/run/secrets/privkey.pem:ro \
+        -v $root_crt_file:/run/secrets/root.crt.pem:ro \
+        "${trusted_ca_args[@]}" \
+        -v /var/cache/bridgehead/secrets:/secret-sync/ \
+        -e CACHE_PATH=/secret-sync/gitlab-token \
+        -e NO_PROXY=localhost,127.0.0.1 \
+        -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
+        -e PROXY_ID=$proxy_id \
+        -e BROKER_URL=$broker_url \
+        -e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
+        -e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN:$gitlab \
+        docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
+}
+
 function secret_sync_gitlab_token() {
-    if [[ "$PROJECT" != "ccp" && "$PROJECT" != "bbmri" ]]; then
+    if [[ "$PROJECT" != "ccp" && "$PROJECT" != "bbmri" && "$PROJECT" != "cce" ]] && [ -z "$(git -C /etc/bridgehead config credential.helper)" ]; then
-        log "INFO" "Not running Secret Sync for project minimal"
+        log "INFO" "Not running Secret Sync for project $PROJECT"
         return
     fi
-    # Map the origin of the git repository /etc/bridgehead to the prefix recognized by Secret Sync
     local gitlab
-    case "$(git -C /etc/bridgehead remote get-url origin)" in
+    if ! gitlab=$(secret_sync_gitlab_instance "$(git -C /etc/bridgehead remote get-url origin)"); then
-        *git.verbis.dkfz.de*) gitlab=verbis;;
-        *gitlab.bbmri-eric.eu*) gitlab=bbmri;;
-        *)
         log "WARN" "Not running Secret Sync because the git repository /etc/bridgehead has unknown origin"
         return
-            ;;
+    fi
-    esac
 
     if [ "$PROJECT" == "bbmri" ]; then
         # If the project is BBMRI, use the BBMRI-ERIC broker and not the GBN broker
@@ -365,30 +401,7 @@ function secret_sync_gitlab_token() {
         root_crt_file="/srv/docker/bridgehead/$PROJECT/root.crt.pem"
     fi
 
-    # Create a temporary directory for Secret Sync that is valid per boot
+    if secret_sync_fetch_gitlab_token "$gitlab" "$proxy_id" "$broker_url" "$broker_id" "$PRIVATEKEYFILENAME" "$root_crt_file"; then
-    secret_sync_tempdir="/tmp/bridgehead/secret-sync.boot-$(cat /proc/sys/kernel/random/boot_id)"
-    mkdir -p $secret_sync_tempdir
-
-    # Use Secret Sync to validate the GitLab token in $secret_sync_tempdir/cache.
-    # If it is missing or expired, Secret Sync will create a new token and write it to the file.
-    # The git credential helper reads the token from the file during git pull.
-    log "INFO" "Running Secret Sync for the GitLab token (gitlab=$gitlab)"
-    docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
-    docker run --rm \
-        -v $PRIVATEKEYFILENAME:/run/secrets/privkey.pem:ro \
-        -v $root_crt_file:/run/secrets/root.crt.pem:ro \
-        -v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro \
-        -v $secret_sync_tempdir:/secret-sync/ \
-        -e CACHE_PATH=/secret-sync/gitlab-token \
-        -e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs \
-        -e NO_PROXY=localhost,127.0.0.1 \
-        -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
-        -e PROXY_ID=$proxy_id \
-        -e BROKER_URL=$broker_url \
-        -e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
-        -e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN:$gitlab \
-        docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
-    if [ $? -eq 0 ]; then
         log "INFO" "Secret Sync was successful"
         # In the past we used to hardcode tokens into the repository URL. We have to remove those now for the git credential helper to become effective.
         CLEAN_REPO="$(git -C /etc/bridgehead remote get-url origin | sed -E 's|https://[^@]+@|https://|')"
@@ -397,8 +410,6 @@ function secret_sync_gitlab_token() {
         git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
     else
         log "WARN" "Secret Sync failed"
-        # Remove the git credential helper
-        git -C /etc/bridgehead config --unset credential.helper
     fi
 
     # In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
@@ -407,6 +418,84 @@ function secret_sync_gitlab_token() {
     git -C /srv/docker/bridgehead config --unset credential.helper
 }
 
+function bootstrap_site_configuration() {
+    local site=$1 enrollment_code=$2 repository_url=$3
+    local SITE_ID=$site BROKER_ID="" BROKER_URL="" PROXY_ID="" PRIVATEKEYFILENAME=""
+    local HTTPS_PROXY_FULL_URL=${HTTPS_PROXY_FULL_URL:-${https_proxy:-${HTTPS_PROXY:-}}}
+    eval "$(grep -E '^(BROKER_ID|BROKER_URL|PROXY_ID|PRIVATEKEYFILENAME)=' "$PROJECT/vars")"
+    if [ -z "$BROKER_ID" ]; then
+        log "ERROR" "Project $PROJECT has no Samply.Beam broker to enroll with."
+        return 1
+    fi
+    local gitlab
+    if ! gitlab=$(secret_sync_gitlab_instance "$repository_url"); then
+        log "ERROR" "Secret Sync does not support the GitLab server of $repository_url."
+        return 1
+    fi
+
+    local enroll_dir
+    enroll_dir=$(mktemp -d /run/bridgehead-enrollment.XXXXXX)
+    local key_file="$enroll_dir/$SITE_ID.priv.pem"
+    log "INFO" "Enrolling Beam Proxy Id $PROXY_ID"
+    if ! docker run --rm -v "$enroll_dir:/pki" docker.verbis.dkfz.de/cache/samply/beam-enroll:latest --output-file "/pki/$SITE_ID.priv.pem" --proxy-id "$PROXY_ID" > "$enroll_dir/enroll.out"; then
+        log "ERROR" "Unable to generate the private key for $PROXY_ID."
+        rm -rf "$enroll_dir"
+        return 1
+    fi
+    local csr
+    csr=$(sed -n '/BEGIN CERTIFICATE REQUEST/,/END CERTIFICATE REQUEST/p' "$enroll_dir/enroll.out")
+    printf '%s' "$enrollment_code" > "$enroll_dir/enrollment-code"
+    local response
+    response=$(curl -sS --data-urlencode "csr=$csr" --data-urlencode "token@$enroll_dir/enrollment-code" "$BROKER_URL/csr" 2>&1)
+    if [[ "$response" != *"Successfully registered CSR"* ]]; then
+        log "ERROR" "$BROKER_URL did not accept the certificate request with your one-time enrollment code: $(echo "$response" | sed -e 's/<[^>]*>//g' | tr -s '[:space:]' ' ' | head -c 300)"
+        rm -rf "$enroll_dir"
+        return 1
+    fi
+
+    local answer
+    until retry 3 secret_sync_fetch_gitlab_token "$gitlab" "$PROXY_ID" "$BROKER_URL" "$BROKER_ID" "$key_file" "/srv/docker/bridgehead/$PROJECT/root.crt.pem" \
+        && git -c credential.helper=/srv/docker/bridgehead/lib/gitlab-token-helper.sh clone "$repository_url" /etc/bridgehead; do
+        log "ERROR" "Unable to download $repository_url."
+        read -r -p "Fix the cause and retry? If you don't, you will need a new one-time enrollment code. [Y/n] " answer || answer=n
+        if [[ "$answer" == [Nn]* ]]; then
+            rm -rf "$enroll_dir"
+            return 1
+        fi
+    done
+    local configured_site_id
+    configured_site_id=$(grep -m1 -E '^SITE_ID=' "/etc/bridgehead/$PROJECT.conf" | cut -d= -f2- | tr -d "\"'")
+    if [ "$configured_site_id" != "$SITE_ID" ]; then
+        log "ERROR" "Your configuration repository is for site '$configured_site_id', but you entered '$SITE_ID'. Ask for a one-time enrollment code for '$configured_site_id' and run the installation again."
+        rm -rf /etc/bridgehead "$enroll_dir"
+        return 1
+    fi
+    git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
+    mkdir -p "$(dirname "$PRIVATEKEYFILENAME")"
+    mv "$key_file" "$PRIVATEKEYFILENAME"
+    chmod 600 "$PRIVATEKEYFILENAME"
+    rm -rf "$enroll_dir"
+}
+
+function read_masked() {
+    local prompt=$1 char value=""
+    local -n read_masked_result=$2
+    printf '%s' "$prompt"
+    while IFS= read -r -s -n1 char && [ -n "$char" ]; do
+        if [[ "$char" == $'\x7f' || "$char" == $'\b' ]]; then
+            if [ -n "$value" ]; then
+                value=${value%?}
+                printf '\b \b'
+            fi
+        else
+            value+=$char
+            printf '*'
+        fi
+    done
+    echo
+    read_masked_result=$value
+}
+
 capitalize_first_letter() {
     input="$1"
     capitalized="$(tr '[:lower:]' '[:upper:]' <<< ${input:0:1})${input:1}"

lib/gitlab-token-helper.sh

@@ -2,7 +2,7 @@
 
 [ "$1" = "get" ] || exit
 
-source "/tmp/bridgehead/secret-sync.boot-$(cat /proc/sys/kernel/random/boot_id)/gitlab-token"
+source /var/cache/bridgehead/secrets/gitlab-token
 
 # Any non-empty username works, only the token matters
 cat << EOF

lib/install-bridgehead.sh

@@ -21,7 +21,6 @@ Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
     /bin/systemctl start bridgehead@${PROJECT}.service, \\
     /bin/systemctl stop bridgehead@${PROJECT}.service, \\
     /bin/systemctl restart bridgehead@${PROJECT}.service, \\
-    /bin/systemctl restart bridgehead@*.service, \\
     /bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead, \\
     /usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
 
@@ -64,6 +63,16 @@ cp -v \
 
 systemctl daemon-reload
 
+fixPermissions
+
+log "INFO" "Checking your bridgehead ..."
+CHECK_RESULT=0
+/srv/docker/bridgehead/bridgehead check "${PROJECT}" || CHECK_RESULT=$?
+if [ $CHECK_RESULT -ge 2 ]; then
+  log "ERROR" "Some checks failed. Fix them and run the installation again."
+  exit 1
+fi
+
 log INFO "Trying to update your bridgehead ..."
 
 systemctl start bridgehead-update@"${PROJECT}".service

lib/prepare-system.sh

@@ -67,9 +67,6 @@ case "$PROJECT" in
 	kr)
 		site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
 		;;
-	dhki)
-		site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
-		;;
 	nngm)
 		site_configuration_repository_middle="git.verbis.dkfz.de/nngm/"
 		;;
@@ -92,24 +89,50 @@ if [ -d /etc/bridgehead ]; then
     fi
 elif [[ "$DEV_MODE" == "NODEV" ]]; then
     log "INFO" "Now cloning your site configuration repository for you."
+    if [ -z "$access_token" ] && [ -z "$enrollment_code" ]; then
+        echo "Way A: You received a one-time enrollment code."
+        echo "Way B: You received a repository URL including access credentials."
+        read -p "Please choose your way of installation [A/B]: " way
+        case "$way" in
+            [Aa])
+                read -p "Please enter your one-time enrollment code: " enrollment_code
+                ;;
+            [Bb])
+                read_masked "Please enter your repository URL: " site_configuration_repository_url
+                ;;
+            *)
+                log "ERROR" "Please choose A or B."
+                exit 1
+                ;;
+        esac
+    fi
+    if [ -z "$site_configuration_repository_url" ]; then
         if [ -z "$site" ]; then
             read -p "Please enter your site: " site
         fi
-    if [ -z "$access_token" ]; then
+        site=$(echo $site | tr '[:upper:]' '[:lower:]')
-        read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
+    fi
+    if [ -z "$access_token" ] && [ -n "$enrollment_code" ]; then
+        if ! bootstrap_site_configuration "$site" "$enrollment_code" "https://${site_configuration_repository_middle}${site}.git"; then
+            log "ERROR" "Unable to set up your configuration repository with your one-time enrollment code (Way A)."
+            exit 1
+        fi
+    else
+        if [ -n "$access_token" ]; then
+            site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}${site}.git"
         fi
-    site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}$(echo $site | tr '[:upper:]' '[:lower:]').git"
         git clone $site_configuration_repository_url /etc/bridgehead
         if [ $? -gt 0 ]; then
             log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
         fi
+    fi
 elif [[ "$DEV_MODE" == "DEV" ]]; then
     log "INFO" "Now cloning your developer configuration repository for you."
     read -p "Please enter your config repository URL: " url
     git clone "$url" /etc/bridgehead
 fi
 
-chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
+fixPermissions
 mkdir -p /tmp/bridgehead /var/cache/bridgehead
 chown -R bridgehead:docker /tmp/bridgehead /var/cache/bridgehead
 chmod -R g+wr /var/cache/bridgehead /tmp/bridgehead

lib/prerequisites.sh

@@ -72,6 +72,7 @@ source ${PROJECT}/vars
 if [ "${PROJECT}" != "minimal" ]; then
   set +e
   SERVERTIME="$(https_proxy=$HTTPS_PROXY_FULL_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
+  [ -n "$SERVERTIME" ]
   RET=$?
   set -e
   if [ $RET -ne 0 ]; then

lib/update-bridgehead.sh

@@ -98,7 +98,7 @@ if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then
   RES="Updates detected, now restarting bridgehead:\n$CHANGES"
   log "INFO" "$RES"
   hc_send log "$RES"
-  sudo /bin/systemctl restart bridgehead@*.service
+  sudo /bin/systemctl restart bridgehead@${PROJECT}.service
 else
   RES="Nothing updated, nothing to restart."
   log "INFO" "$RES"

versions/acceptance

@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
 MTBA_TAG=develop
 DATA_QUALITY_AGENT_TAG=latest
+OVIS_TAG=main

versions/prod

@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=main
 MTBA_TAG=main
 DATA_QUALITY_AGENT_TAG=0.1
+OVIS_TAG=main

versions/test

@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
 MTBA_TAG=develop
 DATA_QUALITY_AGENT_TAG=latest
+OVIS_TAG=main