mirror of
https://github.com/samply/bridgehead.git
synced 2025-06-16 21:50:14 +02:00
Compare commits
1 Commits
feature/nn
...
feature/ac
| Author | SHA1 | Date | |
|---|---|---|---|
| 8138df1de3 |
199
README.md
199
README.md
@ -6,29 +6,24 @@ This repository is the starting point for any information and tools you will nee
|
||||
|
||||
1. [Requirements](#requirements)
|
||||
- [Hardware](#hardware)
|
||||
- [Software](#software)
|
||||
- [Network](#network)
|
||||
- [System](#system)
|
||||
- [Git](#git)
|
||||
- [Docker](#docker)
|
||||
2. [Deployment](#deployment)
|
||||
- [Site name](#site-name)
|
||||
- [Projects](#projects)
|
||||
- [GitLab repository](#gitlab-repository)
|
||||
- [Base Installation](#base-installation)
|
||||
- [Installation](#installation)
|
||||
- [Register with Samply.Beam](#register-with-samplybeam)
|
||||
- [Starting and stopping your Bridgehead](#starting-and-stopping-your-bridgehead)
|
||||
- [Testing your new Bridgehead](#testing-your-new-bridgehead)
|
||||
- [De-installing a Bridgehead](#de-installing-a-bridgehead)
|
||||
3. [Site-specific configuration](#site-specific-configuration)
|
||||
- [HTTPS Access](#https-access)
|
||||
- [TLS terminating proxies](#tls-terminating-proxies)
|
||||
- [File structure](#file-structure)
|
||||
4. [Things you should know](#things-you-should-know)
|
||||
- [Auto-Updates](#auto-updates)
|
||||
- [Auto-Backups](#auto-backups)
|
||||
- [Non-Linux OS](#non-linux-os)
|
||||
5. [Troubleshooting](#troubleshooting)
|
||||
- [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
|
||||
- [Auto-starting your Bridgehead when the server starts](#auto-starting-your-bridgehead-when-the-server-starts)
|
||||
3. [Additional Services](#additional-Services)
|
||||
- [Monitoring](#monitoring)
|
||||
6. [License](#license)
|
||||
- [Register with a Directory](#register-with-a-Directory)
|
||||
4. [Site-specific configuration](#site-specific-configuration)
|
||||
- [HTTPS Access](#https-access)
|
||||
- [Locally Managed Secrets](#locally-managed-secrets)
|
||||
- [Git Proxy Configuration](#git-proxy-configuration)
|
||||
- [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
|
||||
- [Non-Linux OS](#non-linux-os)
|
||||
5. [License](#license)
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -63,62 +58,10 @@ Note for Ubuntu: Please note that the uncomplicated firewall (ufw) is known to c
|
||||
|
||||
## Deployment
|
||||
|
||||
### Site name
|
||||
|
||||
You will need to choose a short name for your site. This is not a URL, just a simple identifying string. For the examples below, we will use "your-site-name", but you should obviously choose something that is meaningful to you and which is unique.
|
||||
|
||||
Site names should adhere to the following conventions:
|
||||
|
||||
- They should be lower-case.
|
||||
- They should generally be named after the city where your site is based, e.g. ```karlsruhe```.
|
||||
- If you have a multi-part name, please use a hypen ("-") as separator, e.g. ```le-havre```.
|
||||
- If your site is for testing purposes, rather than production, please append "-test", e.g. ```zaragoza-test```.
|
||||
- If you are a developer and you are making changes to the Bridgehead, please use your name and prepend "dev-", e.g. ```dev-joe-doe```.
|
||||
|
||||
### GitLab repository
|
||||
|
||||
In order to be able to install, you will need to have your own repository in GitLab for your site's configuration settings. This allows automated updates of the Bridgehead software.
|
||||
|
||||
To request a new repository, please contact your research network administration or send an email to one of the project specific addresses:
|
||||
|
||||
- For the bbmri project: bridgehead@helpdesk.bbmri-eric.eu.
|
||||
- For the ccp project: support-ccp@dkfz-heidelberg.de
|
||||
|
||||
Mention:
|
||||
- which project you belong to, i.e. "bbmri" or "ccp"
|
||||
- site name (According to conventions listed above)
|
||||
- operator name and email
|
||||
|
||||
We will set the repository up for you. We will then send you:
|
||||
|
||||
- A Repository Short Name (RSN). Beware: this is distinct from your site name.
|
||||
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/bbmri-bridgehead-configs/dummy.git
|
||||
|
||||
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
|
||||
|
||||
|
||||
### Base Installation
|
||||
|
||||
First, download your site specific configuration repository:
|
||||
```shell
|
||||
sudo mkdir -p /etc/bridgehead/
|
||||
sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
|
||||
```
|
||||
First, clone the repository to the directory `/srv/docker/bridgehead`:
|
||||
|
||||
Review the site configuration:
|
||||
```shell
|
||||
sudo cat /etc/bridgehead/bbmri.conf
|
||||
```
|
||||
|
||||
Pay special attention to:
|
||||
|
||||
- SITE_NAME
|
||||
- SITE_ID
|
||||
- OPERATOR_FIRST_NAME
|
||||
- OPERATOR_LAST_NAME
|
||||
- OPERATOR_EMAIL
|
||||
|
||||
Clone the bridgehead repository:
|
||||
```shell
|
||||
sudo mkdir -p /srv/docker/
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
@ -131,6 +74,8 @@ cd /srv/docker/bridgehead
|
||||
sudo ./bridgehead install <PROJECT>
|
||||
```
|
||||
|
||||
... and follow the instructions on the screen. You should then be prompted to do the next step:
|
||||
|
||||
### Register with Samply.Beam
|
||||
|
||||
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
|
||||
@ -164,60 +109,6 @@ To enable/disable autostart, run
|
||||
sudo systemctl [enable|disable] bridgehead@<PROJECT>.service
|
||||
```
|
||||
|
||||
### Testing your new Bridgehead
|
||||
|
||||
After starting the Bridgehead, you can watch the initialization process with the following command:
|
||||
|
||||
```shell
|
||||
journalctl -u bridgehead@bbmri -f
|
||||
```
|
||||
|
||||
if this exits with something similar to the following:
|
||||
|
||||
```
|
||||
bridgehead@bbmri.service: Main process exited, code=exited, status=1/FAILURE
|
||||
```
|
||||
|
||||
Then you know that there was a problem with starting the Bridgehead. Scroll up the printout to find the cause of the error.
|
||||
|
||||
Once the Bridgehead is running, you can also view the individual Docker processes with:
|
||||
|
||||
```shell
|
||||
docker ps
|
||||
```
|
||||
|
||||
There should be 6 - 10 Docker proceses. If there are fewer, then you know that something has gone wrong. To see what is going on, run:
|
||||
|
||||
```shell
|
||||
journalctl -u bridgehead@bbmri -f
|
||||
```
|
||||
|
||||
Once the Bridgehead has passed these checks, take a look at the landing page:
|
||||
|
||||
```
|
||||
https://localhost
|
||||
```
|
||||
|
||||
You can either do this in a browser or with curl. If you visit the URL in the browser, you will neet to click through several warnings, because you will initially be using a self-signed certificate. With curl, you can bypass these checks:
|
||||
|
||||
```shell
|
||||
curl -k https://localhost
|
||||
```
|
||||
|
||||
If you get errors when you do this, you need to use ```docker logs``` to examine your landing page container in order to determine what is going wrong.
|
||||
|
||||
If you have chosen to take part in our monitoring program (by setting the ```MONITOR_APIKEY``` variable in the configuration), you will be informed by email when problems are detected in your Bridgehead.
|
||||
|
||||
### De-installing a Bridgehead
|
||||
|
||||
You may decide that you want to remove a Bridgehead installation from your machine, e.g. if you want to migrate it to a new location or if you want to start a fresh installation because the initial attempts did not work.
|
||||
|
||||
To do this, run:
|
||||
|
||||
```shell
|
||||
sh bridgehead uninstall
|
||||
```
|
||||
|
||||
## Site-specific configuration
|
||||
|
||||
### HTTPS Access
|
||||
@ -240,29 +131,6 @@ All of the Bridgehead's outgoing connections are secured by transport encryption
|
||||
|
||||
Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
|
||||
|
||||
### Directory sync
|
||||
|
||||
This is an optional feature for bbmri projects. It keeps the [BBMRI Directory](https://directory.bbmri-eric.eu/) up to date with your local data eg. number of samples. It also updates the local FHIR store with the latest contact details etc. from the Directory. You must explicitly set your country specific directory url, username and password to enable this feature.
|
||||
|
||||
Full details can be found in [directory_sync_service](https://github.com/samply/directory_sync_service).
|
||||
|
||||
To enable it, you will need to set these variables to the ```bbmri.conf``` file of your GitLab repository. Here is an example config:
|
||||
|
||||
```
|
||||
### Directory sync service
|
||||
DS_DIRECTORY_URL=https://directory.bbmri-eric.eu
|
||||
DS_DIRECTORY_USER_NAME=your_directory_username
|
||||
DS_DIRECTORY_USER_PASS=qwdnqwswdvqHBVGFR9887
|
||||
DS_TIMER_CRON="0 22 * * *"
|
||||
```
|
||||
You must contact the Directory for your national node to find the URL, and to register as a user.
|
||||
|
||||
Additionally, you should choose when you want Directory sync to run. In the example above, this is set to happen at 10 pm every evening. You can modify this to suit your requirements. The timer specification should follow the [cron](https://crontab.guru) convention.
|
||||
|
||||
Once you edited the gitlab config. The bridgehead will autoupdate the config with the values and will sync the data.
|
||||
|
||||
There will be a delay before the effects of Directory sync become visible. First, you will need to wait until the time you have specified in ```TIMER_CRON```. Second, the information will then be synchronized from your national node with the central European Directory. This can take up to 24 hours.
|
||||
|
||||
## Things you should know
|
||||
|
||||
### Auto-Updates
|
||||
@ -271,19 +139,20 @@ Your Bridgehead will automatically and regularly check for updates. Whenever som
|
||||
|
||||
If you would like to understand what happens exactly and when, please check the systemd units deployed during the [installation](#base-installation) via `systemctl cat bridgehead-update@<PROJECT>.service` and `systemctl cat bridgehead-update@<PROJECT.timer`.
|
||||
|
||||
### Auto-Backups
|
||||
### Monitoring
|
||||
|
||||
Some of the components in the bridgehead will store persistent data. For those components, we integrated an automated backup solution in the bridgehead updates. It will automatically save the backup in multiple files
|
||||
To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring
|
||||
|
||||
1) Last-XX, were XX represents a weekday to allow re-import of at least one version of the database for each of the past seven days.
|
||||
2) Year-KW-XX, were XX represents the calendar week to allow re-import of at least one version per calendar week
|
||||
3) Year-Month, to allow re-import of at least one version per month
|
||||
- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
|
||||
- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
|
||||
|
||||
To enable the Auto-Backup feature, please set the Variable `BACKUP_DIRECTORY` in your sites configuration.
|
||||
In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
|
||||
|
||||
### Development Installation
|
||||
## Troubleshooting
|
||||
|
||||
By using `./bridgehead dev-install <projectname>` instead of `install`, you can install a developer bridgehead. The difference is, that you can provide an arbitrary configuration repository during the installation, meaning that it does not have to adhere to the usual naming scheme. This allows for better decoupling between development and production configurations.
|
||||
### Docker Daemon Proxy Configuration
|
||||
|
||||
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
|
||||
|
||||
### Non-Linux OS
|
||||
|
||||
@ -302,22 +171,6 @@ We have tested the installation procedure with an Ubuntu 22.04 guest system runn
|
||||
|
||||
Installation under WSL ought to work, but we have not tested this.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Docker Daemon Proxy Configuration
|
||||
|
||||
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
|
||||
|
||||
|
||||
### Monitoring
|
||||
|
||||
To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring
|
||||
|
||||
- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
|
||||
- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
|
||||
|
||||
In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
|
||||
|
||||
## License
|
||||
|
||||
Copyright 2019 - 2022 The Samply Community
|
||||
|
||||
@ -1,8 +0,0 @@
|
||||
services:
|
||||
directory_sync_service:
|
||||
image: "docker.verbis.dkfz.de/cache/samply/directory_sync_service"
|
||||
environment:
|
||||
DS_DIRECTORY_URL: ${DS_DIRECTORY_URL}
|
||||
DS_DIRECTORY_USER_NAME: ${DS_DIRECTORY_USER_NAME}
|
||||
DS_DIRECTORY_PASS_CODE: ${DS_DIRECTORY_PASS_CODE}
|
||||
DS_TIMER_CRON: ${DS_TIMER_CRON}
|
||||
@ -1,8 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
function dirSetup() {
|
||||
if [ -n "$DS_DIRECTORY_USER_NAME" ]; then
|
||||
log INFO "Directory sync setup detected -- will start directory sync service."
|
||||
OVERRIDE+=" -f ./$PROJECT/directory-sync-compose.yml"
|
||||
fi
|
||||
}
|
||||
@ -3,7 +3,7 @@ version: "3.7"
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: docker.verbis.dkfz.de/cache/traefik:latest
|
||||
image: traefik:latest
|
||||
command:
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
@ -32,7 +32,7 @@ services:
|
||||
|
||||
forward_proxy:
|
||||
container_name: bridgehead-forward-proxy
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-forward-proxy:latest
|
||||
image: samply/bridgehead-forward-proxy:latest
|
||||
environment:
|
||||
HTTPS_PROXY: ${HTTPS_PROXY_URL}
|
||||
USERNAME: ${HTTPS_PROXY_USERNAME}
|
||||
@ -42,7 +42,7 @@ services:
|
||||
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-landingpage:master
|
||||
image: samply/bridgehead-landingpage:master
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
@ -54,7 +54,7 @@ services:
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.19
|
||||
image: "samply/blaze:0.18"
|
||||
container_name: bridgehead-bbmri-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-bbmri-blaze:8080"
|
||||
@ -71,28 +71,27 @@ services:
|
||||
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_ccp.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:develop
|
||||
container_name: bridgehead-focus
|
||||
spot:
|
||||
image: samply/spot:latest
|
||||
container_name: bridgehead-spot
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
SECRET: ${SPOT_BEAM_SECRET_LONG}
|
||||
APPID: spot
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-bbmri-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
LDM_URL: http://bridgehead-bbmri-blaze:8080/fhir
|
||||
BEAM_PROXY: http://beam-proxy:8081
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
image: "samply/beam-proxy:develop"
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_0_ID: focus
|
||||
APP_0_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
APP_0_ID: spot
|
||||
APP_0_KEY: ${SPOT_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
|
||||
@ -1,11 +1,7 @@
|
||||
BROKER_ID=broker.bbmri.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=32
|
||||
SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}"
|
||||
SUPPORT_EMAIL=bridgehead@helpdesk.bbmri-eric.eu
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
# This will load directory-sync setup.
|
||||
source $PROJECT/directory-sync.sh
|
||||
dirSetup
|
||||
|
||||
13
bridgehead
13
bridgehead
@ -70,25 +70,14 @@ case "$ACTION" in
|
||||
;;
|
||||
stop)
|
||||
loadVars
|
||||
# HACK: This is tempoarily to properly shut down false bridgehead instances (bridgehead-ccp instead ccp)
|
||||
$COMPOSE -p bridgehead-$PROJECT -f ./$PROJECT/docker-compose.yml $OVERRIDE down
|
||||
exec $COMPOSE -f ./$PROJECT/docker-compose.yml $OVERRIDE down
|
||||
;;
|
||||
is-running)
|
||||
bk_is_running
|
||||
exit $?
|
||||
;;
|
||||
update)
|
||||
loadVars
|
||||
exec ./lib/update-bridgehead.sh $PROJECT
|
||||
;;
|
||||
install)
|
||||
source ./lib/prepare-system.sh NODEV
|
||||
loadVars
|
||||
exec ./lib/install-bridgehead.sh $PROJECT
|
||||
;;
|
||||
dev-install)
|
||||
exec ./lib/prepare-system.sh DEV
|
||||
source ./lib/prepare-system.sh
|
||||
loadVars
|
||||
exec ./lib/install-bridgehead.sh $PROJECT
|
||||
;;
|
||||
|
||||
@ -3,7 +3,7 @@ version: "3.7"
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: docker.verbis.dkfz.de/cache/traefik:latest
|
||||
image: traefik:latest
|
||||
command:
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
@ -32,7 +32,7 @@ services:
|
||||
|
||||
forward_proxy:
|
||||
container_name: bridgehead-forward-proxy
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-forward-proxy:latest
|
||||
image: samply/bridgehead-forward-proxy:latest
|
||||
environment:
|
||||
HTTPS_PROXY: ${HTTPS_PROXY_URL}
|
||||
USERNAME: ${HTTPS_PROXY_USERNAME}
|
||||
@ -42,7 +42,7 @@ services:
|
||||
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-landingpage:master
|
||||
image: samply/bridgehead-landingpage:master
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
@ -54,7 +54,7 @@ services:
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.19
|
||||
image: "samply/blaze:0.18"
|
||||
container_name: bridgehead-ccp-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-ccp-blaze:8080"
|
||||
@ -72,7 +72,7 @@ services:
|
||||
- "traefik.http.routers.blaze_ccp.tls=true"
|
||||
|
||||
spot:
|
||||
image: docker.verbis.dkfz.de/cache/samply/spot:latest
|
||||
image: samply/spot:latest
|
||||
container_name: bridgehead-spot
|
||||
environment:
|
||||
SECRET: ${SPOT_BEAM_SECRET_LONG}
|
||||
@ -85,7 +85,7 @@ services:
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
image: "samply/beam-proxy:develop"
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
|
||||
@ -1,34 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
exliquid-task-store:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.19
|
||||
container_name: bridgehead-exliquid-task-store
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-exliquid-task-store:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx1g"
|
||||
volumes:
|
||||
- "exliquid-task-store-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
exliquid-report-hub:
|
||||
image: docker.verbis.dkfz.de/cache/samply/report-hub:latest
|
||||
container_name: bridgehead-exliquid-report-hub
|
||||
environment:
|
||||
SPRING_WEBFLUX_BASE_PATH: "/exliquid"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx1g"
|
||||
APP_BEAM_APPID: "report-hub.${PROXY_ID}"
|
||||
APP_BEAM_SECRET: ${REPORTHUB_BEAM_SECRET_SHORT}
|
||||
APP_BEAM_PROXY_BASEURL: http://beam-proxy:8081
|
||||
APP_TASKSTORE_BASEURL: "http://bridgehead-exliquid-task-store:8080/fhir"
|
||||
APP_DATASTORE_BASEURL: http://bridgehead-ccp-blaze:8080/fhir
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.report-ccp.rule=PathPrefix(`/exliquid`)"
|
||||
- "traefik.http.services.report-ccp.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.report-ccp.tls=true"
|
||||
|
||||
volumes:
|
||||
exliquid-task-store-data:
|
||||
@ -1,19 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
function exliquidSetup() {
|
||||
case ${SITE_ID} in
|
||||
berlin|dresden|essen|frankfurt|freiburg|luebeck|mainz|muenchen-lmu|muenchen-tum|mannheim|tuebingen)
|
||||
EXLIQUID=1
|
||||
;;
|
||||
dktk-test)
|
||||
EXLIQUID=1
|
||||
;;
|
||||
*)
|
||||
EXLIQUID=0
|
||||
;;
|
||||
esac
|
||||
if [[ $EXLIQUID -eq 1 ]]; then
|
||||
log INFO "EXLIQUID setup detected -- will start Report-Hub."
|
||||
OVERRIDE+=" -f ./$PROJECT/exliquid-compose.yml"
|
||||
fi
|
||||
}
|
||||
@ -1,57 +0,0 @@
|
||||
version: "3.7"
|
||||
services:
|
||||
id-manager:
|
||||
image: docker.verbis.dkfz.de/bridgehead/magicpl
|
||||
container_name: bridgehead-id-manager
|
||||
environment:
|
||||
TOMCAT_REVERSEPROXY_FQDN: ${HOST}
|
||||
MAGICPL_SITE: ${IDMANAGEMENT_FRIENDLY_ID}
|
||||
MAGICPL_ALLOWED_ORIGINS: https://${HOST}
|
||||
MAGICPL_LOCAL_PATIENTLIST_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
MAGICPL_CENTRAXX_APIKEY: ${IDMANAGER_UPLOAD_APIKEY}
|
||||
MAGICPL_CONNECTOR_APIKEY: ${IDMANAGER_READ_APIKEY}
|
||||
MAGICPL_CENTRAL_PATIENTLIST_APIKEY: ${IDMANAGER_CENTRAL_PATIENTLIST_APIKEY}
|
||||
MAGICPL_CONTROLNUMBERGENERATOR_APIKEY: ${IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY}
|
||||
MAGICPL_OIDC_CLIENT_ID: ${IDMANAGER_AUTH_CLIENT_ID}
|
||||
MAGICPL_OIDC_CLIENT_SECRET: ${IDMANAGER_AUTH_CLIENT_SECRET}
|
||||
depends_on:
|
||||
- patientlist
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.id-manager.rule=PathPrefix(`/id-manager`)"
|
||||
- "traefik.http.services.id-manager.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.id-manager.tls=true"
|
||||
|
||||
patientlist:
|
||||
image: docker.verbis.dkfz.de/bridgehead/mainzelliste
|
||||
container_name: bridgehead-patientlist
|
||||
environment:
|
||||
- TOMCAT_REVERSEPROXY_FQDN=${HOST}
|
||||
- ML_SITE=${IDMANAGEMENT_FRIENDLY_ID}
|
||||
- ML_DB_PASS=${PATIENTLIST_POSTGRES_PASSWORD}
|
||||
- ML_API_KEY=${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
- ML_UPLOAD_API_KEY=${IDMANAGER_UPLOAD_APIKEY}
|
||||
# Add Variables from /etc/patientlist-id-generators.env
|
||||
- PATIENTLIST_SEEDS_TRANSFORMED
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.patientlist.rule=PathPrefix(`/patientlist`)"
|
||||
- "traefik.http.services.patientlist.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.patientlist.tls=true"
|
||||
depends_on:
|
||||
- patientlist-db
|
||||
|
||||
patientlist-db:
|
||||
image: docker.verbis.dkfz.de/cache/postgres:15.1-alpine
|
||||
container_name: bridgehead-patientlist-db
|
||||
environment:
|
||||
POSTGRES_USER: "mainzelliste"
|
||||
POSTGRES_DB: "mainzelliste"
|
||||
POSTGRES_PASSWORD: ${PATIENTLIST_POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- "patientlist-db-data:/var/lib/postgresql/data"
|
||||
# NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
|
||||
- "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
|
||||
|
||||
volumes:
|
||||
patientlist-db-data:
|
||||
@ -1,52 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
function idManagementSetup() {
|
||||
if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log INFO "id-management setup detected -- will start id-management (mainzelliste & magicpl)."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
|
||||
|
||||
# Auto Generate local Passwords
|
||||
PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
|
||||
# Transform Seeds Configuration to pass it to the Mainzelliste Container
|
||||
PATIENTLIST_SEEDS_TRANSFORMED="$(declare -p PATIENTLIST_SEEDS | tr -d '\"' | sed 's/\[/\[\"/g' | sed 's/\]/\"\]/g')"
|
||||
|
||||
# Ensure old ids are working !!!
|
||||
export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
|
||||
fi
|
||||
}
|
||||
|
||||
# Transform into single string array, e.g. 'dktk-test' to 'dktk test'
|
||||
# Usage: transformToSingleStringArray 'dktk-test' -> 'dktk test'
|
||||
function transformToSingleStringArray() {
|
||||
echo "${1//-/ }";
|
||||
}
|
||||
|
||||
# Ensure all Words are Uppercase
|
||||
# Usage: transformToUppercase 'dktk test' -> 'Dktk Test'
|
||||
function transformToUppercase() {
|
||||
result="";
|
||||
for word in $1; do
|
||||
result+=" ${word^}";
|
||||
done
|
||||
echo "$result";
|
||||
}
|
||||
|
||||
# Handle all execeptions from the norm (e.g LMU, TUM)
|
||||
# Usage: applySpecialCases 'Muenchen Lmu Test' -> 'Muenchen LMU Test'
|
||||
function applySpecialCases() {
|
||||
result="$1";
|
||||
result="${result/Lmu/LMU}";
|
||||
result="${result/Tum/TUM}";
|
||||
echo "$result";
|
||||
}
|
||||
|
||||
# Transform current siteids to legacy version
|
||||
# Usage: legacyIdMapping "dktk-test" -> "DktkTest"
|
||||
function legacyIdMapping() {
|
||||
single_string_array=$(transformToSingleStringArray "$1");
|
||||
uppercase_string=$(transformToUppercase "$single_string_array");
|
||||
normalized_string=$(applySpecialCases "$uppercase_string");
|
||||
echo "$normalized_string" | tr -d ' '
|
||||
}
|
||||
@ -1,66 +0,0 @@
|
||||
# Module: Id-Management
|
||||
This module provides integration with the CCP-Pseudonymiziation Service. To learn more on the backgrounds of this service, you can refer to the [CCP Data Protection Concept](https://dktk.dkfz.de/klinische-plattformen/documents-download).
|
||||
|
||||
## Getting Started
|
||||
The following configuration variables are added to your sites-configuration repository:
|
||||
|
||||
```
|
||||
IDMANAGER_UPLOAD_APIKEY="<random-string>"
|
||||
IDMANAGER_READ_APIKEY="<random-string>"
|
||||
IDMANAGER_CENTRAL_PATIENTLIST_APIKEY="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_AUTH_CLIENT_ID="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_AUTH_CLIENT_SECRET="<given-to-you-by-ccp-it>"
|
||||
|
||||
IDMANAGER_SEEDS_BK="<three-numbers>"
|
||||
IDMANAGER_SEEDS_MDS="<three-numbers>"
|
||||
IDMANAGER_SEEDS_DKTK000001985="<three-numbers>"
|
||||
```
|
||||
> NOTE: Additionally, the CCP-IT adds lines declaring the `PATIENTLIST_SEEDS` array in your site configuration. This will contain the seeds for the different id-generators used in all projects.
|
||||
|
||||
Once your Bridgehead is updated and restarted, you're all set!
|
||||
|
||||
## Additional information you may want to know
|
||||
|
||||
### Services
|
||||
|
||||
Upon configuration, the Bridgehead will spawn the following services:
|
||||
|
||||
- The `bridgehead-id-manager` at https://bridgehead.local/id-manager, provides a common interface for creating pseudonyms in the bridgehead.
|
||||
- The `bridgehead-patientlist` at https://bridgehead.local/patientlist is a local instance of the open-source software [Mainzelliste](https://mainzelliste.de). This service's primary task is to map patients IDAT to pseudonyms identifying them along the different CCP projects.
|
||||
- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted as a named volume `patientlist-db-data`.
|
||||
|
||||
### How to import an existing database (e.g from Legacy Windows or from Backups)
|
||||
First you must shutdown your local bridgehead instance:
|
||||
```
|
||||
systemctl stop bridgehead@ccp
|
||||
```
|
||||
|
||||
Next you need to remove the current patientlist database:
|
||||
```
|
||||
docker volume rm patientlist-db-data;
|
||||
```
|
||||
|
||||
Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then the volume `patientlist-db-data` was removed previously.
|
||||
> NOTE: Please create the postgres dump with the options "--no-owner" and "--no-privileges". Additionally ensure the dump is created in the plain format (SQL).
|
||||
|
||||
After this, you can restart your bridgehead and the dump will be imported:
|
||||
```
|
||||
systemctl start bridgehead@ccp
|
||||
```
|
||||
|
||||
### How to connect your local data-management
|
||||
Typically, the sites connect their local data-management for the pseudonym creation with the id-management in the bridgehead. In the following two sections, you can read where you can change the configuration:
|
||||
#### Sites using CentraXX
|
||||
On your CentraXX Server, you need to change following settings in the "centraxx-dev.properties" file.
|
||||
```
|
||||
dktk.idmanagement.url=https://<your-linux-bk-host>/id-manager/translator/getId
|
||||
dktk.idmanagement.apiKey=<your-setting-for-IDMANAGER_UPLOAD_APIKEY>
|
||||
```
|
||||
They typically already exist, but need to be changed to the new values!
|
||||
#### Sites using ADT2FHIR
|
||||
@Pierre
|
||||
|
||||
|
||||
### How to connect the legacy windows bridgehead
|
||||
You need to change the configuration file "..." of your Windows Bridgehead. TODO...
|
||||
@ -1,36 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
mtba:
|
||||
image: docker.verbis.dkfz.de/cache/samply/mtba:develop
|
||||
container_name: bridgehead-mtba
|
||||
environment:
|
||||
BLAZE_STORE_URL: http://blaze:8080
|
||||
# NOTE: Aktuell Berechtigungen wie MagicPL!!!
|
||||
# TODO: Add separate ApiKey to MagicPL only for MTBA!
|
||||
ID_MANAGER_API_KEY: ${IDMANAGER_UPLOAD_APIKEY}
|
||||
ID_MANAGER_PSEUDONYM_ID_TYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID
|
||||
ID_MANAGER_URL: http://id-manager:8080/id-manager
|
||||
PATIENT_CSV_FIRST_NAME_HEADER: ${MTBA_PATIENT_CSV_FIRST_NAME_HEADER}
|
||||
PATIENT_CSV_LAST_NAME_HEADER: ${MTBA_PATIENT_CSV_LAST_NAME_HEADER}
|
||||
PATIENT_CSV_GENDER_HEADER: ${MTBA_PATIENT_CSV_GENDER_HEADER}
|
||||
PATIENT_CSV_BIRTHDAY_HEADER: ${MTBA_PATIENT_CSV_BIRTHDAY_HEADER}
|
||||
CBIOPORTAL_URL: http://cbioportal:8080
|
||||
FILE_CHARSET: ${MTBA_FILE_CHARSET}
|
||||
FILE_END_OF_LINE: ${MTBA_FILE_END_OF_LINE}
|
||||
CSV_DELIMITER: ${MTBA_CSV_DELIMITER}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.mtba.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.mtba.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.mtba.tls=true"
|
||||
volumes:
|
||||
- /tmp/bridgehead/mtba/input:/app/input
|
||||
- /tmp/bridgehead/mtba/persist:/app/persist
|
||||
|
||||
# TODO: Include CBioPortal in Deployment ...
|
||||
# NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted!
|
||||
# TODO: Find a trigger to let mtba signal a restart for CBioPortal
|
||||
|
||||
volumes:
|
||||
mtba-data:
|
||||
@ -1,24 +1,32 @@
|
||||
version: "3.7"
|
||||
volumes:
|
||||
nngm-rest:
|
||||
|
||||
services:
|
||||
connector:
|
||||
container_name: bridgehead-connector
|
||||
image: docker.verbis.dkfz.de/ccp/nngm-rest:main
|
||||
image: docker.verbis.dkfz.de/ccp/connector:bk2
|
||||
environment:
|
||||
CTS_MAGICPL_API_KEY: ${NNGM_MAGICPL_APIKEY}
|
||||
CTS_API_KEY: ${NNGM_CTS_APIKEY}
|
||||
CRYPT_KEY: ${NNGM_CRYPTKEY}
|
||||
#CTS_MAGICPL_SITE: ${SITE_ID}TODO
|
||||
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASSWORD}
|
||||
NNGM_MAGICPL_APIKEY: ${NNGM_MAGICPL_APIKEY}
|
||||
NNGM_MAINZELLISTE_APIKEY: ${NNGM_MAINZELLISTE_APIKEY}
|
||||
NNGM_CTS_APIKEY: ${NNGM_CTS_APIKEY}
|
||||
NNGM_CRYPTKEY: ${NNGM_CRYPTKEY}
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.connector.rule=PathPrefix(`/nngm-connector`)"
|
||||
- "traefik.http.middlewares.connector_strip.stripprefix.prefixes=/nngm-connector"
|
||||
- "traefik.http.routers.connector.rule=PathPrefix(`/ccp-connector`)"
|
||||
- "traefik.http.services.connector.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.connector.tls=true"
|
||||
- "traefik.http.routers.connector.middlewares=connector_strip,auth"
|
||||
volumes:
|
||||
- nngm-rest:/var/log
|
||||
|
||||
connector_db:
|
||||
image: postgres:9.5-alpine
|
||||
container_name: bridgehead-ccp-connector-db
|
||||
volumes:
|
||||
- "connector_db_data:/var/lib/postgresql/data"
|
||||
environment:
|
||||
POSTGRES_DB: "samplyconnector"
|
||||
POSTGRES_USER: "samplyconnector"
|
||||
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASSWORD}
|
||||
restart: always
|
||||
|
||||
volumes:
|
||||
connector_db_data:
|
||||
|
||||
@ -1,24 +1,9 @@
|
||||
#!/bin/bash
|
||||
##nNGM vars:
|
||||
#NNGM_MAGICPL_APIKEY
|
||||
#NNGM_CTS_APIKEY
|
||||
#NNGM_CRYPTKEY
|
||||
|
||||
function nngmSetup() {
|
||||
if [ -n "$NNGM_CTS_APIKEY" ]; then
|
||||
log INFO "nNGM setup detected -- will start nNGM Connector."
|
||||
OVERRIDE+=" -f ./$PROJECT/nngm-compose.yml"
|
||||
fi
|
||||
}
|
||||
|
||||
function mtbaSetup() {
|
||||
# TODO: Check if ID-Management Module is activated!
|
||||
if [ -n "$ENABLE_MTBA" ];then
|
||||
log INFO "MTBA setup detected -- will start MTBA Service and CBioPortal."
|
||||
if [ ! -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log ERROR "Detected MTBA Module configuration but ID-Management Module seems not to be configured!"
|
||||
exit 1;
|
||||
fi
|
||||
OVERRIDE+=" -f ./$PROJECT/mtba-compose.yml"
|
||||
fi
|
||||
CONNECTOR_POSTGRES_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
}
|
||||
|
||||
6
ccp/vars
6
ccp/vars
@ -8,12 +8,6 @@ REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRE
|
||||
SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
# This will load id-management setup. Effective only if id-management configuration is defined.
|
||||
source $PROJECT/modules/id-management-setup.sh
|
||||
idManagementSetup
|
||||
# This will load nngm setup. Effective only if nngm configuration is defined.
|
||||
source $PROJECT/nngm-setup.sh
|
||||
nngmSetup
|
||||
source $PROJECT/exliquid-setup.sh
|
||||
exliquidSetup
|
||||
mtbaSetup
|
||||
@ -11,7 +11,7 @@ detectCompose() {
|
||||
|
||||
getLdmPassword() {
|
||||
if [ -n "$LDM_PASSWORD" ]; then
|
||||
docker run --rm docker.verbis.dkfz.de/cache/httpd:alpine htpasswd -nb $PROJECT $LDM_PASSWORD | tr -d '\n' | tr -d '\r'
|
||||
docker run --rm httpd:alpine htpasswd -nb $PROJECT $LDM_PASSWORD | tr -d '\n' | tr -d '\r'
|
||||
else
|
||||
echo -n ""
|
||||
fi
|
||||
@ -34,7 +34,7 @@ checkOwner(){
|
||||
}
|
||||
|
||||
printUsage() {
|
||||
echo "Usage: bridgehead start|stop|is-running|update|install|uninstall|enroll PROJECTNAME"
|
||||
echo "Usage: bridgehead start|stop|update|install|uninstall|enroll PROJECTNAME"
|
||||
echo "PROJECTNAME should be one of ccp|bbmri"
|
||||
}
|
||||
|
||||
@ -117,6 +117,11 @@ fixPermissions() {
|
||||
|
||||
source lib/monitoring.sh
|
||||
|
||||
log_and_report() {
|
||||
log INFO "$@"
|
||||
hc_send 0 "$@"
|
||||
}
|
||||
|
||||
report_error() {
|
||||
CODE=$1
|
||||
shift
|
||||
@ -131,22 +136,11 @@ fail_and_report() {
|
||||
|
||||
setHostname() {
|
||||
if [ -z "$HOST" ]; then
|
||||
export HOST=$(hostname -f | tr "[:upper:]" "[:lower:]")
|
||||
export HOST=$(hostname -f)
|
||||
log DEBUG "Using auto-detected hostname $HOST."
|
||||
fi
|
||||
}
|
||||
|
||||
# Takes 1) The Backup Directory Path 2) The name of the Service to be backuped
|
||||
# Creates 3 Backups: 1) For the past seven days 2) For the current month and 3) for each calendar week
|
||||
createEncryptedPostgresBackup(){
|
||||
docker exec "$2" bash -c 'pg_dump -U $POSTGRES_USER $POSTGRES_DB --format=p --no-owner --no-privileges' | \
|
||||
# TODO: Encrypt using /etc/bridgehead/pki/${SITE_ID}.priv.pem | \
|
||||
tee "$1/$2/$(date +Last-%A).sql" | \
|
||||
tee "$1/$2/$(date +%Y-%m).sql" > \
|
||||
"$1/$2/$(date +%Y-KW%V).sql"
|
||||
}
|
||||
|
||||
|
||||
# from: https://gist.github.com/sj26/88e1c6584397bb7c13bd11108a579746
|
||||
# ex. use: retry 5 /bin/false
|
||||
function retry {
|
||||
@ -169,17 +163,6 @@ function retry {
|
||||
return 0
|
||||
}
|
||||
|
||||
function bk_is_running {
|
||||
detectCompose
|
||||
RUNNING="$($COMPOSE -p $PROJECT -f ./$PROJECT/docker-compose.yml $OVERRIDE ps -q)"
|
||||
NUMBEROFRUNNING=$(echo "$RUNNING" | wc -l)
|
||||
if [ $NUMBEROFRUNNING -ge 2 ]; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
##Setting Network properties
|
||||
# currently not needed
|
||||
#export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
|
||||
|
||||
@ -1,21 +1,10 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
DEV_MODE="${1:-NODEV}"
|
||||
|
||||
source lib/log.sh
|
||||
source lib/functions.sh
|
||||
|
||||
log "INFO" "Preparing your system for bridgehead installation ..."
|
||||
|
||||
# Check, if running in WSL
|
||||
if [[ $(grep -i Microsoft /proc/version) ]]; then
|
||||
# Check, if systemd is available
|
||||
if [ "$(systemctl is-system-running)" = "offline" ]; then
|
||||
log "ERROR" "It seems you have no active systemd environment in your WSL environment. Please follow the guide in https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Create the bridgehead user
|
||||
if id bridgehead &>/dev/null; then
|
||||
log "INFO" "Existing user with id $(id -u bridgehead) will be used by the bridgehead system units."
|
||||
@ -25,12 +14,7 @@ else
|
||||
fi
|
||||
|
||||
# Clone the OpenSource repository of bridgehead
|
||||
set +e
|
||||
bridgehead_repository_url=$(git remote get-url origin)
|
||||
if [ $? -ne 0 ]; then
|
||||
bridgehead_repository_url="https://github.com/samply/bridgehead.git"
|
||||
fi
|
||||
set -e
|
||||
bridgehead_repository_url="https://github.com/samply/bridgehead.git"
|
||||
if [ -d "/srv/docker/bridgehead" ]; then
|
||||
current_owner=$(stat -c '%U' /srv/docker/bridgehead)
|
||||
if [ "$(su -c 'git -C /srv/docker/bridgehead remote get-url origin' $current_owner)" == "$bridgehead_repository_url" ]; then
|
||||
@ -42,7 +26,7 @@ if [ -d "/srv/docker/bridgehead" ]; then
|
||||
else
|
||||
log "INFO" "Cloning $bridgehead_repository_url to /srv/docker/bridgehead"
|
||||
mkdir -p /srv/docker/
|
||||
git clone $bridgehead_repository_url /srv/docker/bridgehead
|
||||
git clone bridgehead_repository_url /srv/docker/bridgehead
|
||||
fi
|
||||
|
||||
case "$PROJECT" in
|
||||
@ -66,7 +50,7 @@ if [ -d /etc/bridgehead ]; then
|
||||
else
|
||||
log "WARN" "Your site configuration repository in /etc/bridgehead seems to have another origin than git.verbis.dkfz.de. Please check if the repository is correctly cloned!"
|
||||
fi
|
||||
elif [[ "$DEV_MODE" == "NODEV" ]]; then
|
||||
else
|
||||
log "INFO" "Now cloning your site configuration repository for you."
|
||||
read -p "Please enter your site: " site
|
||||
read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
|
||||
@ -75,13 +59,9 @@ elif [[ "$DEV_MODE" == "NODEV" ]]; then
|
||||
if [ $? -gt 0 ]; then
|
||||
log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
|
||||
fi
|
||||
elif [[ "$DEV_MODE" == "DEV" ]]; then
|
||||
log "INFO" "Now cloning your developer configuration repository for you."
|
||||
read -p "Please enter your config repository URL: " url
|
||||
git clone "$url" /etc/bridgehead
|
||||
fi
|
||||
|
||||
chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
|
||||
|
||||
log INFO "System preparation is completed and configuration is present."
|
||||
log INFO "System preparation is completed and private key is present."
|
||||
|
||||
|
||||
@ -4,15 +4,10 @@ source lib/functions.sh
|
||||
AUTO_HOUSEKEEPING=${AUTO_HOUSEKEEPING:-true}
|
||||
|
||||
if [ "$AUTO_HOUSEKEEPING" == "true" ]; then
|
||||
A="Performing automatic maintenance: "
|
||||
if bk_is_running; then
|
||||
A="$A Cleaning docker images."
|
||||
docker system prune -a -f
|
||||
else
|
||||
A="$A Not cleaning docker images since BK is not running."
|
||||
fi
|
||||
A="Performing automatic maintenance: Cleaning docker images."
|
||||
hc_send log "$A"
|
||||
log INFO "$A"
|
||||
docker system prune -a -f
|
||||
else
|
||||
log WARN "Automatic housekeeping disabled (variable AUTO_HOUSEKEEPING != \"true\")"
|
||||
fi
|
||||
@ -35,6 +30,19 @@ checkOwner /etc/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong
|
||||
|
||||
CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh"
|
||||
|
||||
# Check if access-token is up-to-date
|
||||
log INFO "Checking authentication information for git server"
|
||||
current_configuration_remote="$(git -C /etc/bridgehead remote get-url origin)"
|
||||
|
||||
if [[ ${current_configuration_remote} != "https://$GIT_REMOTE_TOKEN@"* ]];then
|
||||
new_configuration_remote="https://$GIT_REMOTE_TOKEN@${current_configuration_remote#*@}"
|
||||
git -C /etc/bridgehead remote set-url origin "${new_configuration_remote}"
|
||||
log_and_report "Updated the authentication credentials for /etc/bridgehead."
|
||||
log INFO "Your new authentication url is ${new_configuration_remote}"
|
||||
else
|
||||
log_and_report "Authentication credentials in /etc/bridgehead are up-to-date"
|
||||
fi
|
||||
|
||||
CHANGES=""
|
||||
|
||||
# Check git updates
|
||||
@ -43,6 +51,7 @@ for DIR in /etc/bridgehead $(pwd); do
|
||||
log "INFO" "Checking for updates to git repo $DIR ..."
|
||||
OUT="$(git -C $DIR status --porcelain)"
|
||||
if [ -n "$OUT" ]; then
|
||||
log WARN "The working directory $DIR is modified. Changed files: $OUT"
|
||||
report_error log "The working directory $DIR is modified. Changed files: $OUT"
|
||||
fi
|
||||
if [ "$(git -C $DIR config --get credential.helper)" != "$CREDHELPER" ]; then
|
||||
@ -80,17 +89,13 @@ for DIR in /etc/bridgehead $(pwd); do
|
||||
log "INFO" "You can review all changes on the repository with $git_repository_url/compare?from=$old_git_hash&to=$new_git_hash"
|
||||
fi
|
||||
git_updated="true"
|
||||
git -C "$DIR" checkout main
|
||||
REPORT_BRANCH_NAME=$(git -C "$DIR" branch --show-current)
|
||||
REPORT_STATUS_CHECK=$(git -C "$DIR" status --porcelain)
|
||||
report_error 7 "MAINTENANCE: Switched Branch to main, you are now on branch $REPORT_BRANCH_NAME \n see status \n $REPORT_STATUS_CHECK"
|
||||
fi
|
||||
done
|
||||
|
||||
# Check docker updates
|
||||
log "INFO" "Checking for updates to running docker images ..."
|
||||
docker_updated="false"
|
||||
for IMAGE in $(cat $PROJECT/docker-compose.yml ${OVERRIDE//-f/} | grep -v "^#" | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do
|
||||
for IMAGE in $(cat $PROJECT/docker-compose.yml | grep -v "^#" | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do
|
||||
log "INFO" "Checking for Updates of Image: $IMAGE"
|
||||
if docker pull $IMAGE | grep "Downloaded newer image"; then
|
||||
CHANGE="Image $IMAGE updated."
|
||||
@ -112,37 +117,6 @@ else
|
||||
hc_send log "$RES"
|
||||
fi
|
||||
|
||||
if [ -n "${BACKUP_DIRECTORY}" ]; then
|
||||
if [ ! -d "$BACKUP_DIRECTORY" ]; then
|
||||
message="Performing automatic maintenance: Attempting to create backup directory $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
mkdir -p "$BACKUP_DIRECTORY"
|
||||
chown -R "$BACKUP_DIRECTORY" bridgehead;
|
||||
fi
|
||||
checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $(pwd)"
|
||||
# Collect all container names that contain '-db'
|
||||
BACKUP_SERVICES="$(docker ps --filter name=-db --format "{{.Names}}" | tr "\n" "\ ")"
|
||||
log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
|
||||
for service in $BACKUP_SERVICES; do
|
||||
if [ ! -d "$BACKUP_DIRECTORY/$service" ]; then
|
||||
message="Performing automatic maintenance: Attempting to create backup directory for $service in $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
mkdir -p "$BACKUP_DIRECTORY/$service"
|
||||
fi
|
||||
if createEncryptedPostgresBackup "$BACKUP_DIRECTORY" "$service"; then
|
||||
message="Performing automatic maintenance: Stored encrypted backup for $service in $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
else
|
||||
fail_and_report 5 "Failed to create encrypted update for $service"
|
||||
fi
|
||||
done
|
||||
else
|
||||
log WARN "Automated backups are disabled (variable AUTO_BACKUPS != \"true\")"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
# TODO: Print last commit explicit
|
||||
|
||||
Reference in New Issue
Block a user