ENVIRONMENT=test keeps CCE sites on test-no-real-data.broker.samply.de
with its root CA in cce/test.root.crt.pem; every other environment uses
broker.cce.dkfz.de and cce/root.crt.pem.
cce/vars now enrolls against our own broker, whose Vault minted its own
root CA on 2026-09-07 (SHA-256 73:74:A5:2B...:C1:F6). The pinned copy
still held the test broker's, so the master bridgehead could not have
verified a single proxy certificate. itcc/ and kr/ keep the old file --
they still enroll against test-no-real-data.broker.samply.de.
The CCE broker is live at broker.cce.dkfz.de, so the test broker at
test-no-real-data.broker.samply.de is no longer the CCE broker.
BROKER_ID roots the Beam PKI namespace, so this moves the proxy id to
cce-master.broker.cce.dkfz.de and the app ids derived from it --
cce/root.crt.pem still pins the old broker's CA and must be replaced
with the new one, and the proxy has to be re-enrolled before the
bridgehead connects again.
* cce: Fetch the config repository token via Secret Sync
* Keep the Secret Sync GitLab token across reboots and outages
* Install site configuration with a one-time enrollment code
* Align the itcc and dhki cases in prepare-system.sh
* Report an unreachable broker instead of a clock skew during install
* Show bridgehead check results as OK, WARN or CRIT and run them during install
* Refresh the config repo token before bridgehead check fetches
* Skip Secret Sync until the private key and root certificate exist
* Indent the case block in prepare-system.sh with tabs only
* Hide the config repo URL, token and enrollment code from other local users
* remove the unreachable second dhki case
---------
Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>
* sites moved to etc itcc.comf
* mainzelliste test
* volume
* fix image
* db name chaged
* ingest component test
* clean up
* maizelliste env db
* test server ip
* beam sockets
* teswt socket and task
* secure db and ml
* refactor and patient endpoints
* partner id
* new refactor and encription key generation
* db deleted
* keyset to var/
* feat: add Data Quality Agent configuration and setup
* fix: correct environment variable name in Data Quality Agent configuration
* feat: update Data Quality Agent configuration and setup instructions
* feat: update Data Quality Agent setup and documentation
* feat: add volume configuration for agent data in Data Quality Agent compose file
* feat: update volume configuration for Data Quality Agent in compose file
* Update README.md
Co-authored-by: Tobias Kussel <TKussel@users.noreply.github.com>
---------
Co-authored-by: Tobias Kussel <TKussel@users.noreply.github.com>
Right now, Directory sync will only be activated if a username has been
specified. It also needs to run if a login token has been specified,
hence the change in this commit.
The Directory team have requested that we allow token login to the
Directory, where a user uses LSAAI credentials to obtain a token from
the Directory, and then uses this to authenticate Directory sync. This
has been implemented via an environment variable, in an analogous way to
the already existing username/password method.
The default start time for the Directory sync has been shifted to 22:30,
to prevent conflicts with the Bridgehead auto-update.
Relevant changes have been made to the documentation.
Co-authored-by: Torben Brenner <76154651+torbrenner@users.noreply.github.com>
Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>
Co-authored-by: Martin Lablans <6804500+lablans@users.noreply.github.com>
Directory sync needs to be able to launch at specific times of day, and in order to do this in a predictable way, the timezone used inside the Docker container should be the same as the host. To do this, two files need to be mounted from the host. One file contains information about the time zone, the other file contains the file zone name.
Pierre Delpy
Manoj Waikar
Pierre DelpyandMartin Lablans
tm16-medma
Jan
DavidCroftDKFZ
Tim Schumacher
Enola Knezevic
Tobias Kussel
afigueroaDkfz
Martin Jurk
Radovan Tomášik
Patrick Skowronek
Manoj Waikar
Niklas Reimer
djuarezgf
Tim Schumacher