Make config consistent across projects

Co-authored-by: Martin Lablans <6804500+lablans@users.noreply.github.com>

.gitignore

@@ -1,6 +1,9 @@
 ##Ignore site configuration
 .gitmodules
 site-config/*
-.idea
+
 ## Ignore site configuration
 */docker-compose.override.yml
+
+## MAC OS
+.DS_Store

README.md

@@ -6,24 +6,30 @@ This repository is the starting point for any information and tools you will nee
 
 1. [Requirements](#requirements)
     - [Hardware](#hardware)
-    - [System](#system)
-      - [Git](#git)
-      - [Docker](#docker)
+    - [Software](#software)
+    - [Network](#network)
 2. [Deployment](#deployment)
-    - [Installation](#installation)
+    - [Site name](#site-name)
+    - [Projects](#projects)
+    - [GitLab repository](#gitlab-repository)
+    - [Base Installation](#base-installation)
     - [Register with Samply.Beam](#register-with-samplybeam)
     - [Starting and stopping your Bridgehead](#starting-and-stopping-your-bridgehead)
-    - [Auto-starting your Bridgehead when the server starts](#auto-starting-your-bridgehead-when-the-server-starts)
-3. [Additional Services](#additional-Services)
-    - [Monitoring](#monitoring)
-    - [Register with a Directory](#register-with-a-Directory)
-4. [Site-specific configuration](#site-specific-configuration)
+    - [Testing your new Bridgehead](#testing-your-new-bridgehead)
+    - [De-installing a Bridgehead](#de-installing-a-bridgehead)
+3. [Site-specific configuration](#site-specific-configuration)
     - [HTTPS Access](#https-access)
-    - [Locally Managed Secrets](#locally-managed-secrets)
-    - [Git Proxy Configuration](#git-proxy-configuration)
-    - [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
+    - [TLS terminating proxies](#tls-terminating-proxies)
+    - [File structure](#file-structure)
+    - [BBMRI-ERIC Directory entry needed](#bbmri-eric-directory-entry-needed)
+4. [Things you should know](#things-you-should-know)
+    - [Auto-Updates](#auto-updates)
+    - [Auto-Backups](#auto-backups)
     - [Non-Linux OS](#non-linux-os)
-5. [License](#license)
+5. [Troubleshooting](#troubleshooting)
+    - [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
+    - [Monitoring](#monitoring)
+6. [License](#license)
 
 ## Requirements
 
@@ -50,18 +56,78 @@ We recommend to install Docker(-compose) from its official sources as described
 
 Note for Ubuntu: Please note that snap versions of Docker are not supported.
 
+Note for git and Docker: if you have a local proxy, you will need to adjust your setup appropriately, see [git proxy](https://gist.github.com/evantoli/f8c23a37eb3558ab8765) and [docker proxy](https://docs.docker.com/network/proxy/).
+
 ### Network
 
-Since it needs to carry sensitive patient data, Bridgeheads are intended to be deployed within your institution's secure network and behave well even in networks in strict security settings, e.g. firewall rules. The only connectivity required is an outgoing HTTPS proxy. TLS termination is supported, too (see [below](#tls-terminating-proxies))
+A running Bridgehead requires an outgoing HTTPS proxy to communicate with the central components.
+
+Additionally, your site might use its own proxy. You should discuss this with your local systems administration. If a proxy is being used, you will need to note down the URL of the proxy. If it is a secure proxy, then you will also need to make a note of its username and password. This information will be used later on during the installation process.
+
+Note that git and Docker may also need to be configured to use this proxy. This is a job for your systems administrators.
+
+If there is a site firewall, this needs to be configured so that outgoing calls to the following URLs are allowed: *.dkfz.de, github.com, docker.io, *.docker.io, *.samply.de.
 
 Note for Ubuntu: Please note that the uncomplicated firewall (ufw) is known to conflict with Docker [here](https://github.com/chaifeng/ufw-docker).
 
 ## Deployment
 
+### Site name
+
+You will need to choose a short name for your site. This is not a URL, just a simple identifying string. For the examples below, we will use "your-site-name", but you should obviously choose something that is meaningful to you and which is unique.
+
+Site names should adhere to the following conventions:
+
+- They should be lower-case.
+- They should generally be named after the city where your site is based, e.g. ```karlsruhe```.
+- If you have a multi-part name, please use a hypen ("-") as separator, e.g. ```le-havre```.
+- If your site is for testing purposes, rather than production, please append "-test", e.g. ```zaragoza-test```.
+- If you are a developer and you are making changes to the Bridgehead, please use your name and prepend "dev-", e.g. ```dev-joe-doe```.
+
+### GitLab repository
+
+In order to be able to install, you will need to have your own repository in GitLab for your site's configuration settings. This allows automated updates of the Bridgehead software.
+
+To request a new repository, please contact your research network administration or send an email to one of the project specific addresses:
+
+- For the bbmri project: bridgehead@helpdesk.bbmri-eric.eu.
+- For the ccp project: support-ccp@dkfz-heidelberg.de
+
+Mention:
+- which project you belong to, i.e. "bbmri" or "ccp"
+- site name (According to conventions listed above)
+- operator name and email
+
+We will set the repository up for you. We will then send you:
+
+- A Repository Short Name (RSN). Beware: this is distinct from your site name.
+- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/bbmri-bridgehead-configs/dummy.git
+
+During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
+
+
 ### Base Installation
 
-First, clone the repository to the directory `/srv/docker/bridgehead`:
+First, download your site specific configuration repository:
+```shell
+sudo mkdir -p /etc/bridgehead/
+sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
+```
 
+Review the site configuration:
+```shell
+sudo cat /etc/bridgehead/bbmri.conf
+```
+
+Pay special attention to:
+
+- SITE_NAME
+- SITE_ID
+- OPERATOR_FIRST_NAME
+- OPERATOR_LAST_NAME
+- OPERATOR_EMAIL
+
+Clone the bridgehead repository:
 ```shell
 sudo mkdir -p /srv/docker/
 sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
@@ -74,8 +140,6 @@ cd /srv/docker/bridgehead
 sudo ./bridgehead install <PROJECT>
 ```
 
-... and follow the instructions on the screen. You should then be prompted to do the next step:
-
 ### Register with Samply.Beam
 
 Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
@@ -85,7 +149,7 @@ cd /srv/docker/bridgehead
 sudo ./bridgehead enroll <PROJECT>
 ```
 
-... and follow the instructions on the screen. You should then be prompted to do the next step:
+... and follow the instructions on the screen. Please send your default Collection ID and the display name of your site together with the certificate request when you enroll. You should then be prompted to do the next step:
 
 ### Starting and stopping your Bridgehead
 
@@ -109,6 +173,60 @@ To enable/disable autostart, run
 sudo systemctl [enable|disable] bridgehead@<PROJECT>.service
 ```
 
+### Testing your new Bridgehead
+
+After starting the Bridgehead, you can watch the initialization process with the following command:
+
+```shell
+journalctl -u bridgehead@bbmri -f
+```
+
+if this exits with something similar to the following:
+
+```
+bridgehead@bbmri.service: Main process exited, code=exited, status=1/FAILURE
+```
+
+Then you know that there was a problem with starting the Bridgehead. Scroll up the printout to find the cause of the error.
+
+Once the Bridgehead is running, you can also view the individual Docker processes with:
+
+```shell
+docker ps
+```
+
+There should be 6 - 10 Docker proceses. If there are fewer, then you know that something has gone wrong. To see what is going on, run:
+
+```shell
+journalctl -u bridgehead@bbmri -f
+```
+
+Once the Bridgehead has passed these checks, take a look at the landing page:
+
+```
+https://localhost
+```
+
+You can either do this in a browser or with curl. If you visit the URL in the browser, you will neet to click through several warnings, because you will initially be using a self-signed certificate. With curl, you can bypass these checks:
+
+```shell
+curl -k https://localhost
+```
+
+If you get errors when you do this, you need to use ```docker logs``` to examine your landing page container in order to determine what is going wrong.
+
+If you have chosen to take part in our monitoring program (by setting the ```MONITOR_APIKEY``` variable in the configuration), you will be informed by email when problems are detected in your Bridgehead.
+
+### De-installing a Bridgehead
+
+You may decide that you want to remove a Bridgehead installation from your machine, e.g. if you want to migrate it to a new location or if you want to start a fresh installation because the initial attempts did not work.
+
+To do this, run:
+
+```shell
+sh bridgehead uninstall
+```
+
 ## Site-specific configuration
 
 ### HTTPS Access
@@ -119,6 +237,21 @@ Even within your internal network, the Bridgehead enforces HTTPS for all service
 
 All of the Bridgehead's outgoing connections are secured by transport encryption (TLS) and a Bridgehead will refuse to connect if certificate verification fails. If your local forward proxy server performs TLS termination, please place its CA certificate in `/etc/bridgehead/trusted-ca-certs` as a `.pem` file, e.g. `/etc/bridgehead/trusted-ca-certs/mylocalca.pem`. Then, all Bridgehead components will pick up this certificate and trust it for outgoing connections.
 
+To find the certificate file, first run the following:
+
+```
+curl -v https://broker.bbmri.samply.de/v1/health
+```
+
+In the output, look out for the line:
+
+
+```
+successfully set certificate verify locations:
+```
+
+Here a file will be mentioned, perhaps in the directory /etc/ssl/certs. The exact location  will depend on your operating system. This is the file that you need to copy.
+
 ### File structure
 
 - `/srv/docker/bridgehead` contains this git repository with the shell scripts and *project-specific configuration*. In here, all files are identical for all sites. You should not make any changes here.
@@ -131,15 +264,46 @@ All of the Bridgehead's outgoing connections are secured by transport encryption
 
 Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
 
+### BBMRI-ERIC Directory entry needed
+
+If you run a biobank, you should be listed together with your collections with in the [Directory](https://directory.bbmri-eric.eu), a BBMRI-ERIC project that catalogs biobanks.
+
+To do this, contact the BBMRI-ERIC national node for the country where your biobank is based, see [the list of nodes](http://www.bbmri-eric.eu/national-nodes/).
+
+Once you have added your biobank to the Directory you got persistent identifier (PID) for your biobank and unique identifiers (IDs) for your collections. The collection IDs are necessary for the biospecimens assigning to the collections and later in the data flows between BBMRI-ERIC tools. In case you cannot distribute all your biospecimens within collections via assigning the collection IDs, **you should choose one of your sample collections as a default collection for your biobank**. This collection will be automatically used to label any samples that have not been assigned a collection ID in your ETL process. Make a note of this default collection ID, you will need it later on in the installation process.
+
+### Directory sync tool
+
+The Bridgehead's **Directory Sync** is an optional feature that keeps the Directory up to date with your local data, e.g. number of samples. Conversely, it also updates the local FHIR store with the latest contact details etc. from the Directory. You must explicitly set your country specific directory URL, username and password to enable this feature.
+
+Full details can be found in [directory_sync_service](https://github.com/samply/directory_sync_service).
+
+To enable it, you will need to set these variables to the ```bbmri.conf``` file of your GitLab repository. Here is an example config:
+
+```
+DS_DIRECTORY_URL=https://directory.bbmri-eric.eu
+DS_DIRECTORY_USER_NAME=your_directory_username
+DS_DIRECTORY_USER_PASS=qwdnqwswdvqHBVGFR9887
+DS_TIMER_CRON="0 22 * * *"
+```
+You must contact the Directory team for your national node to find the URL, and to register as a user.
+
+Additionally, you should choose when you want Directory sync to run. In the example above, this is set to happen at 10 pm every evening. You can modify this to suit your requirements. The timer specification should follow the [cron](https://crontab.guru) convention.
+
+Once you edited the gitlab config, the bridgehead will autoupdate the config with the values and will sync the data.
+
+There will be a delay before the effects of Directory sync become visible. First, you will need to wait until the time you have specified in ```TIMER_CRON```. Second, the information will then be synchronized from your national node with the central European Directory. This can take up to 24 hours.
+
 ## Things you should know
 
 ### Auto-Updates
 
 Your Bridgehead will automatically and regularly check for updates. Whenever something has been updates (e.g., one of the git repositories or one of the docker images), your Bridgehead is automatically restarted. This should happen automatically and does not need any configuration.
 
-If you would like to understand what happens exactly and when, please check the systemd units deployed during the [installation](#base-installation) via `systemctl cat bridgehead-update@<PROJECT>.service` and `systemctl cat bridgehead-update@<PROJECT.timer`.
+If you would like to understand what happens exactly and when, please check the systemd units deployed during the [installation](#base-installation) via `systemctl cat bridgehead-update@<PROJECT>.service` and `systemctl cat bridgehead-update@<PROJECT>.timer`.
 
 ### Auto-Backups
+
 Some of the components in the bridgehead will store persistent data. For those components, we integrated an automated backup solution in the bridgehead updates. It will automatically save the backup in multiple files
 
 1) Last-XX, were XX represents a weekday to allow re-import of at least one version of the database for each of the past seven days.
@@ -148,20 +312,9 @@ Some of the components in the bridgehead will store persistent data. For those c
 
 To enable the Auto-Backup feature, please set the Variable `BACKUP_DIRECTORY` in your sites configuration.
 
-### Monitoring
+### Development Installation
 
-To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring 
-
-- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
-- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
-
-In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
-
-## Troubleshooting
-
-### Docker Daemon Proxy Configuration
-
-Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
+By using `./bridgehead dev-install <projectname>` instead of `install`, you can install a developer bridgehead. The difference is, that you can provide an arbitrary configuration repository during the installation, meaning that it does not have to adhere to the usual naming scheme. This allows for better decoupling between development and production configurations.
 
 ### Non-Linux OS
 
@@ -180,6 +333,22 @@ We have tested the installation procedure with an Ubuntu 22.04 guest system runn
 
 Installation under WSL ought to work, but we have not tested this.
 
+## Troubleshooting
+
+### Docker Daemon Proxy Configuration
+
+Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
+
+
+### Monitoring
+
+To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring 
+
+- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
+- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
+
+In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
+
 ## License
 
 Copyright 2019 - 2022 The Samply Community

bbmri/docker-compose.yml

@@ -1,60 +1,10 @@
 version: "3.7"
 
+# This includes only the shared persistence for BBMRI-ERIC and GBN. Federation components are included as modules, see vars.
+
 services:
-  traefik:
-    container_name: bridgehead-traefik
-    image: traefik:latest
-    command:
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --providers.file.directory=/configuration/
-      - --api.dashboard=true
-      - --accesslog=true
-      - --entrypoints.web.http.redirections.entrypoint.to=websecure
-      - --entrypoints.web.http.redirections.entrypoint.scheme=https
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
-      - "traefik.http.routers.dashboard.entrypoints=websecure"
-      - "traefik.http.routers.dashboard.service=api@internal"
-      - "traefik.http.routers.dashboard.tls=true"
-      - "traefik.http.routers.dashboard.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.users=${LDM_LOGIN}"
-    ports:
-      - 80:80
-      - 443:443
-    volumes:
-      - /etc/bridgehead/traefik-tls:/certs:ro
-      - ../lib/traefik-configuration/:/configuration:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-
-  forward_proxy:
-    container_name: bridgehead-forward-proxy
-    image: samply/bridgehead-forward-proxy:latest
-    environment:
-      HTTPS_PROXY: ${HTTPS_PROXY_URL}
-      USERNAME: ${HTTPS_PROXY_USERNAME}
-      PASSWORD: ${HTTPS_PROXY_PASSWORD}
-    volumes:
-      - /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro
-
-  landing:
-    container_name: bridgehead-landingpage
-    image: samply/bridgehead-landingpage:master
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.landing.rule=PathPrefix(`/`)"
-      - "traefik.http.services.landing.loadbalancer.server.port=80"
-      - "traefik.http.routers.landing.tls=true"
-    environment:
-      HOST: ${HOST}
-      PROJECT: ${PROJECT}
-      SITE_NAME: ${SITE_NAME}
-
   blaze:
-    image: "samply/blaze:0.19"
+    image: docker.verbis.dkfz.de/cache/samply/blaze:latest
     container_name: bridgehead-bbmri-blaze
     environment:
       BASE_URL: "http://bridgehead-bbmri-blaze:8080"
@@ -71,42 +21,10 @@ services:
       - "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
       - "traefik.http.routers.blaze_ccp.tls=true"
 
-  spot:
-    image: samply/spot:latest
-    container_name: bridgehead-spot
-    environment:
-      SECRET: ${SPOT_BEAM_SECRET_LONG}
-      APPID: spot
-      PROXY_ID: ${PROXY_ID}
-      LDM_URL: http://bridgehead-bbmri-blaze:8080/fhir
-      BEAM_PROXY: http://beam-proxy:8081
-    depends_on:
-      - "beam-proxy"
-      - "blaze"
-
-  beam-proxy:
-    image: samply/beam-proxy:main
-    container_name: bridgehead-beam-proxy
-    environment:
-      BROKER_URL: ${BROKER_URL}
-      PROXY_ID: ${PROXY_ID}
-      APP_0_ID: spot
-      APP_0_KEY: ${SPOT_BEAM_SECRET_SHORT}
-      PRIVKEY_FILE: /run/secrets/proxy.pem
-      ALL_PROXY: http://forward_proxy:3128
-      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
-      ROOTCERT_FILE: /conf/root.crt.pem
-    secrets:
-      - proxy.pem
-    depends_on:
-      - "forward_proxy"
-    volumes:
-      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - ./root.crt.pem:/conf/root.crt.pem:ro
-
 volumes:
   blaze-data:
 
+# used in modules *-locator.yml
 secrets:
   proxy.pem:
     file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

bbmri/modules/directory-sync-compose.yml

@@ -0,0 +1,8 @@
+services:
+  directory_sync_service:
+    image: "docker.verbis.dkfz.de/cache/samply/directory_sync_service"
+    environment:
+      DS_DIRECTORY_URL: ${DS_DIRECTORY_URL}
+      DS_DIRECTORY_USER_NAME: ${DS_DIRECTORY_USER_NAME}
+      DS_DIRECTORY_PASS_CODE: ${DS_DIRECTORY_PASS_CODE}
+      DS_TIMER_CRON: ${DS_TIMER_CRON}

bbmri/modules/directory-sync.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [ -n "${DS_DIRECTORY_USER_NAME}" ]; then
+	log INFO "Directory sync setup detected -- will start directory sync service."
+	OVERRIDE+=" -f ./$PROJECT/modules/directory-sync-compose.yml"
+fi

bbmri/modules/dnpm-compose.yml

@@ -0,0 +1,51 @@
+version: "3.7"
+
+services:
+  dnpm-beam-proxy:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    container_name: bridgehead-dnpm-beam-proxy
+    environment:
+      BROKER_URL: ${DNPM_BROKER_URL}
+      PROXY_ID: ${DNPM_PROXY_ID}
+      APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
+      ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
+
+  dnpm-beam-connect:
+    depends_on: [ dnpm-beam-proxy ]
+    image: docker.verbis.dkfz.de/cache/samply/beam-connect:develop
+    container_name: bridgehead-dnpm-beam-connect
+    environment:
+      PROXY_URL: http://dnpm-beam-proxy:8081
+      PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
+      APP_ID: dnpm-connect.${DNPM_PROXY_ID}
+      DISCOVERY_URL: "./conf/central_targets.json"
+      LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
+      HTTP_PROXY: http://forward_proxy:3128
+      HTTPS_PROXY: http://forward_proxy:3128
+      NO_PROXY: dnpm-beam-proxy,dnpm-backend
+      RUST_LOG: ${RUST_LOG:-info}
+      NO_AUTH: "true"
+    volumes:
+      - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
+      - /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
+      - "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
+      - "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
+      - "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
+      - "traefik.http.routers.dnpm-connect.tls=true"
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

bbmri/modules/dnpm-setup.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [ -n "${ENABLE_DNPM}" ]; then
+	log INFO "DNPM setup detected (Beam.Connect) -- will start Beam and Beam.Connect for DNPM."
+	OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
+
+	# Set variables required for Beam-Connect
+	DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+	DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+	DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
+	DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
+	DNPM_PROXY_ID="${SITE_ID}.${DNPM_BROKER_ID}"
+fi

bbmri/modules/eric-compose.yml

@@ -0,0 +1,46 @@
+version: "3.7"
+
+services:
+  focus-eric:
+    image: docker.verbis.dkfz.de/cache/samply/focus:main
+    container_name: bridgehead-focus-eric
+    environment:
+      API_KEY: ${ERIC_FOCUS_BEAM_SECRET_SHORT}
+      BEAM_APP_ID_LONG: focus.${ERIC_PROXY_ID}
+      PROXY_ID: ${ERIC_PROXY_ID}
+      BLAZE_URL: "http://blaze:8080/fhir/"
+      BEAM_PROXY_URL: http://beam-proxy-eric:8081
+      RETRY_COUNT: ${FOCUS_RETRY_COUNT}
+    depends_on:
+      - "beam-proxy-eric"
+      - "blaze"
+
+  beam-proxy-eric:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    container_name: bridgehead-beam-proxy-eric
+    environment:
+      BROKER_URL: ${ERIC_BROKER_URL}
+      PROXY_ID: ${ERIC_PROXY_ID}
+      APP_focus_KEY: ${ERIC_FOCUS_BEAM_SECRET_SHORT}
+      APP_monitoring_KEY: ${ERIC_MONITORING_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
+      ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/bbmri/modules/eric.root.crt.pem:/conf/root.crt.pem:ro
+
+  bridgehead-monitoring:
+    image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
+    container_name: bridgehead-monitoring-eric
+    environment:
+      - BEAM_ID=monitoring.${ERIC_PROXY_ID}
+      - BEAM_API_KEY=${ERIC_MONITORING_BEAM_SECRET_SHORT}
+      - BEAM_PROXY_URL=http://beam-proxy-eric:8081
+    depends_on:
+      - beam-proxy-eric

bbmri/modules/eric-setup.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+if [ "${ENABLE_ERIC}" == "true" ]; then
+	log INFO "BBMRI-ERIC setup detected -- will start services for BBMRI-ERIC."
+	OVERRIDE+=" -f ./$PROJECT/modules/eric-compose.yml"
+
+	# Set required variables
+	ERIC_BROKER_ID=broker.bbmri.samply.de
+	ERIC_BROKER_URL=https://${ERIC_BROKER_ID}
+	ERIC_PROXY_ID=${SITE_ID}.${ERIC_BROKER_ID}
+	ERIC_FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+	ERIC_SUPPORT_EMAIL=bridgehead@helpdesk.bbmri-eric.eu
+
+	#Monitoring
+	ERIC_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+fi

bbmri/modules/gbn-compose.yml

@@ -0,0 +1,47 @@
+version: "3.7"
+
+services:
+  focus-gbn:
+    image: docker.verbis.dkfz.de/cache/samply/focus:main
+    container_name: bridgehead-focus-gbn
+    environment:
+      API_KEY: ${GBN_FOCUS_BEAM_SECRET_SHORT}
+      BEAM_APP_ID_LONG: focus.${GBN_PROXY_ID}
+      PROXY_ID: ${GBN_PROXY_ID}
+      BLAZE_URL: "http://blaze:8080/fhir/"
+      BEAM_PROXY_URL: http://beam-proxy-gbn:8081
+      RETRY_COUNT: ${FOCUS_RETRY_COUNT}
+    depends_on:
+      - "beam-proxy-gbn"
+      - "blaze"
+
+  beam-proxy-gbn:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    container_name: bridgehead-beam-proxy-gbn
+    environment:
+      BROKER_URL: ${GBN_BROKER_URL}
+      PROXY_ID: ${GBN_PROXY_ID}
+      APP_focus_KEY: ${GBN_FOCUS_BEAM_SECRET_SHORT}
+      APP_monitoring_KEY: ${GBN_MONITORING_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
+      ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/bbmri/modules/gbn.root.crt.pem:/conf/root.crt.pem:ro
+
+  bridgehead-monitoring:
+    image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
+    container_name: bridgehead-monitoring-gbn
+    environment:
+      - BEAM_ID=monitoring.${GBN_PROXY_ID}
+      - BEAM_API_KEY=${GBN_MONITORING_BEAM_SECRET_SHORT}
+      - BEAM_PROXY_URL=http://beam-proxy-gbn:8081
+    depends_on:
+      - beam-proxy-gbn
+

bbmri/modules/gbn-setup.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+if [ "${ENABLE_GBN}" == "true" ]; then
+	log INFO "GBN setup detected -- will start services for German Biobank Node."
+	OVERRIDE+=" -f ./$PROJECT/modules/gbn-compose.yml"
+
+	# Set required variables
+	GBN_BROKER_ID=broker.bbmri.de
+	GBN_BROKER_URL=https://${GBN_BROKER_ID}
+	GBN_PROXY_ID=${SITE_ID}.${GBN_BROKER_ID}
+	GBN_FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+	GBN_SUPPORT_EMAIL=feedback@germanbiobanknode.de
+
+	#Monitoring
+	GBN_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+fi

bbmri/modules/gbn.root.crt.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAh2gAwIBAgIUckVOQQWZBTC0pWhn1X3lPxAWricwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwOTA0MDkwMTQ0WhcNMzMw
+OTAxMDkwMjEzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAOOD+CVvteBmu1hKV1QlfbHmiLCnuf6F+9k+1u/b
+6as6k7BURn8KZAxVLWSIwC6x2C7n9CHN9Jieb4DWpS0XmXQVUEpT1/yiLGBdxp2x
+nrbzm7caOunsWsPlGOcXPJKJpzAhcg58RDzXZ+2+shulSmsgPNlWBaLhNL5wj0sQ
+MzbwGVlGIJg18Ye/9WgQkO2ZcnTGb5cRsChKs4H43ZC34ZSSk7wqWg6P3e2xFam1
+YKXBOZzhwHoI4AxUQ+gd6upz5dqcwbaNZm10VP8fMac2dMLw9cOCS0ueDCS4viLd
+A69yds19AndBPMZhoEY1UHafjJ1uITRJQpaaB4vNliX+1rECAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFC74YIorSwWD
+/s5ozz3xvqUMDJ3qMB8GA1UdIwQYMBaAFC74YIorSwWD/s5ozz3xvqUMDJ3qMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCzcIccBzYr
+sHCGTGsSyLGBYsuI5yl+hvFOitYTha/mC+XBxq2R6By2WzbfSZtyZkUtC/+FqdCY
+VtMSjbDVXtBgsabfqODBobHmPyOEmNUX4IGcyn06rdM+rHQRah98lF+PhiPPO42F
+9Wj8dkq4/Gf+Yarq31ZbY0sed2sEPZ/bV26Og8Ft9qip5gKwklyakAiCnDIq+QBd
+ltvng3g08AQM0o5KIphP2/WU0UoSk1YPVMjRxuLiFg8xvr2EdCQQ9oA7xbhrmAXe
+242HVW/7KokjmowyWTQlIUGnuGdCOtTl8h74eHTID0YWO68hHkA0J5Ox2j4dZxvw
+HRFTxAR1gGKX
+-----END CERTIFICATE-----

bbmri/vars

@@ -1,7 +1,37 @@
-BROKER_ID=broker.bbmri.samply.de
-BROKER_URL=https://${BROKER_ID}
-PROXY_ID=${SITE_ID}.${BROKER_ID}
-SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}"
-SUPPORT_EMAIL=bridgehead@helpdesk.bbmri-eric.eu
+# Makes sense for all European Biobanks
+: ${ENABLE_ERIC:=true}
+
+# Makes only sense for German Biobanks
+: ${ENABLE_GBN:=false}
+
+FOCUS_RETRY_COUNT=32
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
+
+for module in $PROJECT/modules/*.sh
+do
+    log DEBUG "sourcing $module"
+    source $module
+done
+
+SUPPORT_EMAIL=$ERIC_SUPPORT_EMAIL
+BROKER_URL_FOR_PREREQ=$ERIC_BROKER_URL
+
+if [ -n "$GBN_SUPPORT_EMAIL" ]; then
+    SUPPORT_EMAIL=$GBN_SUPPORT_EMAIL
+fi
+
+function do_enroll {
+    COUNT=0
+    if [ "$ENABLE_ERIC" == "true" ]; then
+        do_enroll_inner $ERIC_PROXY_ID $ERIC_SUPPORT_EMAIL
+        COUNT=$((COUNT+1))
+    fi
+    if [ "$ENABLE_GBN" == "true" ]; then
+        do_enroll_inner $GBN_PROXY_ID $GBN_SUPPORT_EMAIL
+        COUNT=$((COUNT+1))
+    fi
+    if [ $COUNT -ge 2 ]; then
+        echo
+        echo "You just received $COUNT certificate signing requests (CSR). Please send $COUNT e-mails, with 1 CSR each, to the respective e-mail address."
+    fi
+}

bridgehead

@@ -32,6 +32,9 @@ case "$PROJECT" in
 	bbmri)
 		#nothing extra to do
 		;;
+	minimal)
+		#nothing extra to do
+		;;
 	*)
 		printUsage
 		exit 1
@@ -51,6 +54,11 @@ loadVars() {
 	set +a
 
 	OVERRIDE=${OVERRIDE:=""}
+	# minimal contains shared components, so potential overrides must be applied in every project
+	if [ -f "minimal/docker-compose.override.yml" ]; then
+		log INFO "Applying Bridgehead common components override (minimal/docker-compose.override.yml)"
+		OVERRIDE+=" -f ./minimal/docker-compose.override.yml"
+	fi
 	if [ -f "$PROJECT/docker-compose.override.yml" ]; then
 		log INFO "Applying $PROJECT/docker-compose.override.yml"
 		OVERRIDE+=" -f ./$PROJECT/docker-compose.override.yml"
@@ -65,33 +73,46 @@ case "$ACTION" in
 		hc_send log "Bridgehead $PROJECT startup: Checking requirements ..."
 		checkRequirements
 		hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..."
-		export LDM_LOGIN=$(getLdmPassword)
-		exec $COMPOSE -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
+		exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
 		;;
 	stop)
 		loadVars
-		exec $COMPOSE -f ./$PROJECT/docker-compose.yml $OVERRIDE down
+		# HACK: This is temporarily to properly shut down false bridgehead instances (bridgehead-ccp instead ccp)
+		$COMPOSE -p bridgehead-$PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE down
+		exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE down
+		;;
+	is-running)
+		bk_is_running
+		exit $?
 		;;
 	update)
 		loadVars
 		exec ./lib/update-bridgehead.sh $PROJECT
 		;;
 	install)
-		source ./lib/prepare-system.sh
+		source ./lib/prepare-system.sh NODEV
+		loadVars
+		exec ./lib/install-bridgehead.sh $PROJECT
+		;;
+	dev-install)
+		exec ./lib/prepare-system.sh DEV
 		loadVars
 		exec ./lib/install-bridgehead.sh $PROJECT
 		;;
 	uninstall)
 		exec ./lib/uninstall-bridgehead.sh $PROJECT
 		;;
+	adduser)
+		loadVars
+		log "INFO" "Adding encrypted credentials in /etc/bridgehead/$PROJECT.local.conf"
+    		read -p "Please choose the component (LDM_AUTH|NNGM_AUTH) you want to add a user to : " COMPONENT
+    		read -p "Please enter a username: " USER
+    		read -s -p "Please enter a password (will not be echoed): "$'\n' PASSWORD
+    		add_basic_auth_user $USER $PASSWORD $COMPONENT $PROJECT
+		;;
 	enroll)
 		loadVars
-		if [ -e $PRIVATEKEYFILENAME ]; then
-			log ERROR "Private key already exists at $PRIVATEKEYFILENAME. Please delete first to proceed."
-			exit 1
-		fi
-		docker run --rm -ti -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $PROXY_ID --admin-email $SUPPORT_EMAIL
-		chmod 600 $PRIVATEKEYFILENAME
+		do_enroll $PROXY_ID
 		;;
 	preRun | preUpdate)
 		fixPermissions

ccp/docker-compose.yml

@@ -1,65 +1,12 @@
 version: "3.7"
 
 services:
-  traefik:
-    container_name: bridgehead-traefik
-    image: traefik:latest
-    command:
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --providers.file.directory=/configuration/
-      - --api.dashboard=true
-      - --accesslog=true
-      - --entrypoints.web.http.redirections.entrypoint.to=websecure
-      - --entrypoints.web.http.redirections.entrypoint.scheme=https
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
-      - "traefik.http.routers.dashboard.entrypoints=websecure"
-      - "traefik.http.routers.dashboard.service=api@internal"
-      - "traefik.http.routers.dashboard.tls=true"
-      - "traefik.http.routers.dashboard.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.users=${LDM_LOGIN}"
-    ports:
-      - 80:80
-      - 443:443
-    volumes:
-      - /etc/bridgehead/traefik-tls:/certs:ro
-      - ../lib/traefik-configuration/:/configuration:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-
-  forward_proxy:
-    container_name: bridgehead-forward-proxy
-    image: samply/bridgehead-forward-proxy:latest
-    environment:
-      HTTPS_PROXY: ${HTTPS_PROXY_URL}
-      USERNAME: ${HTTPS_PROXY_USERNAME}
-      PASSWORD: ${HTTPS_PROXY_PASSWORD}
-    volumes:
-      - /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro
-
-  landing:
-    container_name: bridgehead-landingpage
-    image: samply/bridgehead-landingpage:master
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.landing.rule=PathPrefix(`/`)"
-      - "traefik.http.services.landing.loadbalancer.server.port=80"
-      - "traefik.http.routers.landing.tls=true"
-    environment:
-      HOST: ${HOST}
-      PROJECT: ${PROJECT}
-      SITE_NAME: ${SITE_NAME}
-
   blaze:
-    image: "samply/blaze:0.19"
+    image: docker.verbis.dkfz.de/cache/samply/blaze:latest
     container_name: bridgehead-ccp-blaze
     environment:
       BASE_URL: "http://bridgehead-ccp-blaze:8080"
       JAVA_TOOL_OPTIONS: "-Xmx4g"
-      LOG_LEVEL: "debug"
       ENFORCE_REFERENTIAL_INTEGRITY: "false"
     volumes:
       - "blaze-data:/app/data"
@@ -71,29 +18,29 @@ services:
       - "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
       - "traefik.http.routers.blaze_ccp.tls=true"
 
-  spot:
-    image: samply/spot:latest
-    container_name: bridgehead-spot
+  focus:
+    image: docker.verbis.dkfz.de/cache/samply/focus:main
+    container_name: bridgehead-focus
     environment:
-      SECRET: ${SPOT_BEAM_SECRET_LONG}
-      APPID: spot
+      API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      BEAM_APP_ID_LONG: focus.${PROXY_ID}
       PROXY_ID: ${PROXY_ID}
-      LDM_URL: http://bridgehead-ccp-blaze:8080/fhir
-      BEAM_PROXY: http://beam-proxy:8081
+      BLAZE_URL: "http://bridgehead-ccp-blaze:8080/fhir/"
+      BEAM_PROXY_URL: http://beam-proxy:8081
+      RETRY_COUNT: ${FOCUS_RETRY_COUNT}
+      OBFUSCATE: "no"
     depends_on:
       - "beam-proxy"
       - "blaze"
 
   beam-proxy:
-    image: samply/beam-proxy:main
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
     container_name: bridgehead-beam-proxy
     environment:
       BROKER_URL: ${BROKER_URL}
       PROXY_ID: ${PROXY_ID}
-      APP_0_ID: spot
-      APP_0_KEY: ${SPOT_BEAM_SECRET_SHORT}
-      APP_1_ID: report-hub
-      APP_1_KEY: ${REPORTHUB_BEAM_SECRET_SHORT}
+      APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      APP_monitoring_KEY: ${CCP_MONITORING_BEAM_SECRET_SHORT}
       PRIVKEY_FILE: /run/secrets/proxy.pem
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
@@ -104,7 +51,17 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - ./root.crt.pem:/conf/root.crt.pem:ro
+      - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
+  
+  bridgehead-monitoring:
+    image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
+    container_name: bridgehead-monitoring-ccp
+    environment:
+      - BEAM_ID=monitoring.${PROXY_ID}
+      - BEAM_API_KEY=${CCP_MONITORING_BEAM_SECRET_SHORT}
+      - BEAM_PROXY_URL=http://beam-proxy:8081
+    depends_on:
+      - beam-proxy
 
 
 volumes:

ccp/modules/ccp-setup.sh

@@ -0,0 +1,2 @@
+#Monitoring
+CCP_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"

ccp/modules/dnpm-compose.yml

@@ -0,0 +1,31 @@
+version: "3.7"
+
+services:
+  beam-proxy:
+    environment:
+      APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
+  dnpm-beam-connect:
+    depends_on: [ beam-proxy ]
+    image: docker.verbis.dkfz.de/cache/samply/beam-connect:develop
+    container_name: bridgehead-dnpm-beam-connect
+    environment:
+      PROXY_URL: http://beam-proxy:8081
+      PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
+      APP_ID: dnpm-connect.${PROXY_ID}
+      DISCOVERY_URL: "./conf/central_targets.json"
+      LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
+      HTTP_PROXY: "http://forward_proxy:3128"
+      HTTPS_PROXY: "http://forward_proxy:3128"
+      NO_PROXY: beam-proxy,dnpm-backend
+      RUST_LOG: ${RUST_LOG:-info}
+      NO_AUTH: "true"
+    volumes:
+      - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
+      - /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
+      - "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
+      - "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
+      - "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
+      - "traefik.http.routers.dnpm-connect.tls=true"

ccp/modules/dnpm-setup.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ -n "${ENABLE_DNPM}" ]; then
+	log INFO "DNPM setup detected (Beam.Connect) -- will start Beam.Connect for DNPM."
+	OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
+
+	# Set variables required for Beam-Connect
+	DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+	DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+fi

ccp/modules/exliquid-compose.yml

@@ -1,34 +0,0 @@
-version: "3.7"
-
-services:
-  exliquid-task-store:
-    image: "samply/blaze:0.19"
-    container_name: bridgehead-exliquid-task-store
-    environment:
-      BASE_URL: "http://bridgehead-exliquid-task-store:8080"
-      JAVA_TOOL_OPTIONS: "-Xmx1g"
-    volumes:
-    - "exliquid-task-store-data:/app/data"
-    labels:
-      - "traefik.enable=false"
-
-  exliquid-report-hub:
-    image: "samply/report-hub:latest"
-    container_name: bridgehead-exliquid-report-hub
-    environment:
-      SPRING_WEBFLUX_BASE_PATH: "/exliquid"
-      JAVA_TOOL_OPTIONS: "-Xmx1g"
-      APP_BEAM_APPID: "report-hub.${PROXY_ID}"
-      APP_BEAM_SECRET: ${REPORTHUB_BEAM_SECRET_SHORT}
-      APP_BEAM_PROXY_BASEURL: http://beam-proxy:8081
-      APP_TASKSTORE_BASEURL: "http://bridgehead-exliquid-task-store:8080/fhir"
-      APP_DATASTORE_BASEURL:  http://bridgehead-ccp-blaze:8080/fhir
-    restart: always
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.report-ccp.rule=PathPrefix(`/exliquid`)"
-      - "traefik.http.services.report-ccp.loadbalancer.server.port=8080"
-      - "traefik.http.routers.report-ccp.tls=true"
-
-volumes:
-  exliquid-task-store-data:

ccp/modules/exliquid-setup.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-
-case ${SITE_ID} in
-  berlin|dresden|essen|frankfurt|freiburg|luebeck|mainz|muenchen-lmu|muenchen-tu|mannheim|tuebingen)
-    EXLIQUID=1
-    ;;
-  dktk-test)
-    EXLIQUID=1
-    ;;
-  *)
-    EXLIQUID=0
-    ;;
-esac
-if [[ $EXLIQUID -eq 1 ]]; then
-  log INFO "EXLIQUID setup detected -- will start Report-Hub."
-  OVERRIDE+=" -f ./$PROJECT/modules/exliquid-compose.yml"
-fi

ccp/modules/exporter-compose.yml

@@ -1,42 +0,0 @@
-version: "3.7"
-
-services:
-  exporter:
-    image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
-    container_name: bridgehead-ccp-exporter
-    environment:
-      LOG_LEVEL: "INFO"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
-      CROSS_ORIGINS: "https://${HOST}/ccp-teiler-root-config"
-      EXPORTER_DB_USER: "exporter"
-      EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
-      CLEAN_TEMP_FILES_CRON_EXPRESSION: "0 0 1 * * *"
-      TEMP_FILES_LIFETIME_IN_DAYS: "1"
-      CLEAN_WRITE_FILES_CRON_EXPRESSION: "0 0 2 * * *"
-      WRITE_FILES_LIFETIME_IN_DAYS: "30"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.exporter_ccp.rule=PathPrefix(`/ccp-exporter`)"
-      - "traefik.http.services.exporter_ccp.loadbalancer.server.port=8092"
-      - "traefik.http.routers.exporter_ccp.tls=true"
-      - "traefik.http.routers.exporter_ccp.middlewares=auth"
-    volumes:
-      - "exporter:/app/exporter-files"
-
-  exporter-db:
-    image: postgres:15.1-alpine
-    container_name: bridgehead-ccp-exporter-db
-    environment:
-      POSTGRES_USER: "exporter"
-      POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      POSTGRES_DB: "exporter"
-    volumes:
-      - "exporter-db:/var/lib/postgresql/data"
-
-
-volumes:
-  exporter-db:
-    name: "exporter-db"
-  exporter:
-    name: "exporter"

ccp/modules/exporter-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-
-if [ -n "$ENABLE_EXPORTER" ];then
-  log INFO "Exporter setup detected -- will start Exporter service."
-  OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
-fi
-# TODO: Generate password in another way so that not all passwords are the same?
-EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"

ccp/modules/id-management-compose.yml

@@ -5,6 +5,7 @@ services:
     container_name: bridgehead-id-manager
     environment:
       TOMCAT_REVERSEPROXY_FQDN: ${HOST}
+      TOMCAT_REVERSEPROXY_SSL: "true"
       MAGICPL_SITE: ${IDMANAGEMENT_FRIENDLY_ID}
       MAGICPL_ALLOWED_ORIGINS: https://${HOST}
       MAGICPL_LOCAL_PATIENTLIST_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
@@ -42,7 +43,7 @@ services:
       - patientlist-db
 
   patientlist-db:
-    image: postgres:15.1-alpine
+    image: docker.verbis.dkfz.de/cache/postgres:15.1-alpine
     container_name: bridgehead-patientlist-db
     environment:
       POSTGRES_USER: "mainzelliste"

ccp/modules/id-management-setup.sh

@@ -1,5 +1,21 @@
 #!/bin/bash
 
+function idManagementSetup() {
+	if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
+		log INFO "id-management setup detected -- will start id-management (mainzelliste & magicpl)."
+		OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
+
+		# Auto Generate local Passwords
+		PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+		IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+
+		# Transform Seeds Configuration to pass it to the Mainzelliste Container
+		PATIENTLIST_SEEDS_TRANSFORMED="$(declare -p PATIENTLIST_SEEDS | tr -d '\"' | sed 's/\[/\[\"/g' | sed 's/\]/\"\]/g')"
+
+		# Ensure old ids are working !!!
+		export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
+	fi
+}
 
 # Transform into single string array, e.g. 'dktk-test' to 'dktk test'
 # Usage: transformToSingleStringArray 'dktk-test' -> 'dktk test'
@@ -34,18 +50,3 @@ function legacyIdMapping() {
 	normalized_string=$(applySpecialCases "$uppercase_string");
 	echo "$normalized_string" | tr -d ' '
 }
-
-if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
-  log INFO "id-management setup detected -- will start id-management (mainzelliste & magicpl)."
-  OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
-
-  # Auto Generate local Passwords
-  PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
-  IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-
-  # Transform Seeds Configuration to pass it to the Mainzelliste Container
-  PATIENTLIST_SEEDS_TRANSFORMED="$(declare -p PATIENTLIST_SEEDS | tr -d '\"' | sed 's/\[/\[\"/g' | sed 's/\]/\"\]/g')"
-
-  # Ensure old ids are working !!!
-  export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
-fi

ccp/modules/mtba-compose.yml

@@ -2,7 +2,7 @@ version: "3.7"
 
 services:
   mtba:
-    image: samply/mtba:develop
+    image: docker.verbis.dkfz.de/cache/samply/mtba:develop
     container_name: bridgehead-mtba
     environment:
       BLAZE_STORE_URL: http://blaze:8080

ccp/modules/mtba-setup.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+function mtbaSetup() {
+       # TODO: Check if ID-Management Module is activated!
        if [ -n "$ENABLE_MTBA" ];then
                log INFO "MTBA setup detected -- will start MTBA Service and CBioPortal."
               if [ ! -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
@@ -8,3 +10,4 @@ if [ -n "$ENABLE_MTBA" ];then
               fi
                OVERRIDE+=" -f ./$PROJECT/modules/mtba-compose.yml"
        fi
+}

ccp/modules/nngm-compose.yml

@@ -1,32 +1,29 @@
 version: "3.7"
+volumes:
+  nngm-rest:
 
 services:
   connector:
-    container_name: bridgehead-nngm-connector
-    image: docker.verbis.dkfz.de/ccp/connector:bk2
+    container_name: bridgehead-connector
+    image: docker.verbis.dkfz.de/ccp/nngm-rest:main
     environment:
-      POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASSWORD}
-      NNGM_MAGICPL_APIKEY: ${NNGM_MAGICPL_APIKEY}
-      NNGM_MAINZELLISTE_APIKEY: ${NNGM_MAINZELLISTE_APIKEY}
-      NNGM_CTS_APIKEY: ${NNGM_CTS_APIKEY}
-      NNGM_CRYPTKEY: ${NNGM_CRYPTKEY}
+      CTS_MAGICPL_API_KEY: ${NNGM_MAGICPL_APIKEY}
+      CTS_API_KEY: ${NNGM_CTS_APIKEY}
+      CRYPT_KEY: ${NNGM_CRYPTKEY}
+      #CTS_MAGICPL_SITE: ${SITE_ID}TODO
     restart: always
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.connector.rule=PathPrefix(`/ccp-connector`)"
+      - "traefik.http.routers.connector.rule=PathPrefix(`/nngm-connector`)"
+      - "traefik.http.middlewares.connector_strip.stripprefix.prefixes=/nngm-connector"
       - "traefik.http.services.connector.loadbalancer.server.port=8080"
       - "traefik.http.routers.connector.tls=true"
-
-  connector_db:
-    image: postgres:9.5-alpine
-    container_name: bridgehead-nngm-connector-db
+      - "traefik.http.routers.connector.middlewares=connector_strip,auth-nngm"
     volumes:
-      - "connector_db_data:/var/lib/postgresql/data"
-    environment:
-      POSTGRES_DB: "samplyconnector"
-      POSTGRES_USER: "samplyconnector"
-      POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASSWORD}
-    restart: always
+      - nngm-rest:/var/log
+
+  traefik:
+    labels:
+      - "traefik.http.middlewares.auth-nngm.basicauth.users=${NNGM_AUTH}"
+
 
-volumes:
-  connector_db_data:

ccp/modules/nngm-setup.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 
+function nngmSetup() {
 	if [ -n "$NNGM_CTS_APIKEY" ]; then
 		log INFO "nNGM setup detected -- will start nNGM Connector."
 		OVERRIDE+=" -f ./$PROJECT/modules/nngm-compose.yml"
 	fi
-CONNECTOR_POSTGRES_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+	}

ccp/modules/opal-compose.yml

@@ -1,79 +0,0 @@
-version: "3.7"
-
-services:
-
-  ############################################ DataSHIELD Client (Rocker R-Studio)
-  rstudio:
-    image: docker.verbis.dkfz.de/dktk/bridgehead-rstudio:latest
-    container_name: bridgehead-rstudio
-    #TODO: Connect with Keycloak: https://rocker-project.org/images/versioned/rstudio.html
-    environment:
-      USER: "ruser"
-      PASSWORD: "${RSTUDIO_PASSWORD}"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.login.rule=PathPrefix(`/rstudio`)"
-      - "traefik.http.services.login.loadbalancer.server.port=8787"
-      - "traefik.http.routers.login.tls=true"
-    volumes:
-      - "rstudio-config:/home/rstudio/.config/rstudio"
-      - "rstudio-workspace:/home/rstudio/workspace"
-      - "rstudio-user-files:/home/user-files"
-
-  ############################################ DataSHIELD Server (Opal)
-  opal:
-    image: obiba/opal:4.5
-    container_name: bridgehead-opal
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.login.rule=PathPrefix(`/opal`)"
-      - "traefik.http.services.login.loadbalancer.server.port=8080" #TODO: HTTPS -> 8443
-      - "traefik.http.routers.login.tls=true"
-    links:
-      - opal-rserver
-      - opal-mongo
-      - opal-db
-    environment:
-      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
-      # OPAL_ADMINISTRATOR_USER: "administrator"
-      OPAL_ADMINISTRATOR_PASSWORD: "${OPAL_ADMINISTRATOR_PASSWORD}"
-      MONGO_HOST: "opal-mongo"
-      MONGO_PORT: "27017"
-      POSTGRESDATA_HOST: "opal-db"
-      POSTGRESDATA_DATABASE: "opal"
-      POSTGRESDATA_USER: "opal"
-      POSTGRESDATA_PASSWORD: "${OPAL_DB_PASSWORD}"
-
-      ROCK_HOSTS: "opal-rserver:8085"
-    volumes:
-      - "opal:/srv"
-
-  opal-mongo: # IDs
-    image: mongo:4.2 # TODO: Update mongo:6.0.4
-    container_name: bridgehead-opal-mongo
-
-  opal-db: # Data
-    image: postgres:15.1
-    container_name: bridgehead-opal-db
-    environment:
-      POSTGRES_PASSWORD: "${OPAL_DB_PASSWORD}"
-      POSTGRES_USER: "opal"
-      POSTGRES_DB: "opal"
-    volumes:
-      - "opal-db:/var/lib/postgresql/data"
-
-  opal-rserver:
-    image: datashield/rock-base:6.2-R4.2  # https://datashield.discourse.group/t/ds-aggregate-method-error/416/4
-    container_name: bridgehead-opal-rserver
-
-volumes:
-  rstudio-config:
-    name: "rstudio-config"
-  rstudio-workspace:
-    name: "rstudio-workspace"
-  rstudio-user-files:
-    name: "rstudio-user-files"
-  opal-db:
-    name: "opal-db"
-  opal:
-    name: "opal"

ccp/modules/opal-setup.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-if [ "$ENABLE_OPAL" == true ];then
-  log INFO "Opal setup detected -- will start Opal services."
-  OVERRIDE+=" -f ./$PROJECT/modules/opal-compose.yml"
-fi
-OPAL_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"

ccp/modules/teiler-ui-compose.yml

@@ -1,267 +0,0 @@
-version: "3.7"
-
-services:
-  ############################################ Keycloak
-  login-db:
-    image: "postgres:15.1"
-    container_name: bridgehead-login-db
-    environment:
-      POSTGRES_USER: "keycloak"
-      POSTGRES_PASSWORD: "${KEYCLOAK_DB_PASSWORD}" # Set in teiler-setup.sh
-      POSTGRES_DB: "keycloak"
-    volumes:
-      - "login-db:/var/lib/postgresql/data"
-
-  login:
-    #image: "jboss/keycloak:16.1.1"
-    image: docker.verbis.dkfz.de/ccp/dktk-keycloak:latest
-    container_name: bridgehead-login
-    environment:
-      KEYCLOAK_ADMIN: "admin"
-      KEYCLOAK_ADMIN_PASSWORD: "${KEYCLOAK_ADMIN_PASSWORD}"
-      KC_DB_PASSWORD: "${KEYCLOAK_DB_PASSWORD}" # Set in teiler-setup.sh
-      KC_HOSTNAME_URL: "https://${HOST}/login"
-      KC_HOSTNAME_STRICT: "false"
-      KC_PROXY_ADDRESS_FORWARDING: "true"
-      TEILER_ROOT_CONFIG_EXTERN_URL: "https://${HOST}/ccp-teiler"
-    command:
-      - start-dev --import-realm --proxy edge --http-relative-path=/login
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.login.rule=PathPrefix(`/login`)"
-      - "traefik.http.services.login.loadbalancer.server.port=8080"
-      - "traefik.http.routers.login.tls=true"
-    depends_on:
-      - login-db
-
-  ############################################ Teiler-UI
-  teiler-root-config:
-    image: samply/teiler-root-config:developer
-    container_name: bridgehead-teiler-root-config
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_root_config_ccp.rule=PathPrefix(`/ccp-teiler`)"
-      - "traefik.http.services.teiler_root_config_ccp.loadbalancer.server.port=9000"
-      - "traefik.http.routers.teiler_root_config_ccp.tls=true"
-    environment:
-      TEILER_CORE_URL: "https://${HOST}/ccp-teiler-core"
-      TEILER_UI_URL: "https://${HOST}/ccp-teiler-ui"
-      DEFAULT_LANGUAGE: "de"
-
-  teiler-ui:
-    image: samply/teiler-ui:developer
-    container_name: bridgehead-teiler-ui
-    #  ports:
-    #    - 4200:80
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_ui_ccp.rule=PathPrefix(`/ccp-teiler-ui`)"
-      - "traefik.http.services.teiler_ui_ccp.loadbalancer.server.port=80"
-      - "traefik.http.routers.teiler_ui_ccp.tls=true"
-    environment:
-      DEFAULT_LANGUAGE: "DE"
-      TEILER_CORE_URL: "https://${HOST}/ccp-teiler-core"
-      KEYCLOAK_URL: "https://${HOST}/login"
-      KEYCLOAK_REALM: "teiler-ui"
-      KEYCLOAK_CLIENT_ID: "teiler-ui"
-      TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
-      TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
-      TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
-      TEILER_PROJECT: "${PROJECT}"
-
-  teiler-core:
-    image: samply/teiler-core:developer
-    container_name: bridgehead-teiler-core
-    volumes:
-      - "/etc/bridgehead/ccp.conf:/app/ccp.conf"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_core_ccp.rule=PathPrefix(`/ccp-teiler-core`)"
-      - "traefik.http.services.teiler_core_ccp.loadbalancer.server.port=8085"
-      - "traefik.http.routers.teiler_core_ccp.tls=true"
-    environment:
-      LOG_LEVEL: "INFO"
-      APPLICATION_PORT: "8085"
-      DEFAULT_LANGUAGE: "DE"
-      CONFIG_ENV_VAR_PATH: "/app/ccp.conf"
-      TEILER_CONFIG_UPDATER_CRON: "0 1 * * * *"
-      TEILER_ROOT_CONFIG_URL: "https://${HOST}/ccp-teiler"
-      TEILER_UI_DE_URL: "https://${HOST}/ccp-teiler-ui/de"
-      TEILER_UI_EN_URL: "https://${HOST}/ccp-teiler-ui/en"
-      TEILER_APP1_NAME: "config"
-      #    TEILER_APP2_NAME: "quality-report"
-      TEILER_APP3_NAME: "keycloak"
-      TEILER_APP3_TITLE: "Keycloak"
-      TEILER_APP4_DESCRIPTION_EN: "Authentication site"
-      TEILER_APP4_DESCRIPTION_DE: "Authentifizierungsseite"
-      TEILER_APP4_SOURCEURL: "https://${HOST}/login/auth/"
-      TEILER_APP4_ROLES: "TEILER_ADMIN"
-      TEILER_APP4_ISACTIVATED: "true"
-      TEILER_APP4_ICONSOURCEURL: "https://upload.wikimedia.org/wikipedia/commons/2/29/Keycloak_Logo.png"
-      TEILER_APP4_ORDER: "5"
-      TEILER_APP4_ISEXTERNALLINK: "true"
-      TEILER_APP4_ISLOCAL: "true"
-      #    TEILER_APP5_NAME: "pgadmin"
-      #    TEILER_APP5_TITLE: "PgAdmin"
-      #    TEILER_APP5_DESCRIPTION: "Database Management"
-      #    TEILER_APP5_SOURCEURL: "http://localhost:5000"
-      #    TEILER_APP5_ROLES: "TEILER_ADMIN"
-      #    TEILER_APP5_ISACTIVATED: "true"
-      #    TEILER_APP5_ICONSOURCEURL: "https://user-images.githubusercontent.com/24623425/36042969-f87531d4-0d8a-11e8-9dee-e87ab8c6a9e3.png"
-      #    TEILER_APP5_ORDER: "6"
-      #    TEILER_APP5_ISEXTERNALLINK: "true"
-      #    TEILER_APP5_ISLOCAL: "true"
-      TEILER_APP6_NAME: "ldm"
-      TEILER_APP6_TITLE_EN: "Local data management"
-      TEILER_APP6_TITLE_DE: "Lokales Datenmanagement"
-      TEILER_APP6_DESCRIPTION_EN: "Local Data Management"
-      TEILER_APP6_DESCRIPTION_DE: "Lokales Datenmanagement"
-      TEILER_APP6_SOURCEURL: "${CENTRAXX_URL}"
-      TEILER_APP6_ROLES: "TEILER_PUBLIC"
-      TEILER_APP6_ISACTIVATED: "${IS_DKTK_SITE}"
-      TEILER_APP6_ICONCLASS: "bi bi-server"
-      TEILER_APP6_ORDER: "7"
-      TEILER_APP6_ISEXTERNALLINK: "true"
-      TEILER_APP6_ISLOCAL: "true"
-      TEILER_APP7_NAME: "id-manager"
-      TEILER_APP7_TITLE: "ID-Manager"
-      TEILER_APP7_DESCRIPTION: "ID Manager"
-      TEILER_APP7_SOURCEURL: "https://${HOST}/id-manager/index.html"
-      TEILER_APP7_ROLES: "TEILER_PUBLIC"
-      TEILER_APP7_ISACTIVATED: "true"
-      TEILER_APP7_ICONCLASS: "bi bi-person-bounding-box"
-      TEILER_APP7_ORDER: "8"
-      TEILER_APP7_ISEXTERNALLINK: "true"
-      TEILER_APP7_ISLOCAL: "true"
-      TEILER_APP8_NAME: "patient-list"
-      TEILER_APP8_TITLE_EN: "Patient List"
-      TEILER_APP8_TITLE_DE: "Patientenliste"
-      TEILER_APP8_DESCRIPTION_EN: "Patient List"
-      TEILER_APP8_DESCRIPTION_DE: "Patientenliste"
-      TEILER_APP8_SOURCEURL: "https://${HOST}/patientlist"
-      TEILER_APP8_ROLES: "TEILER_PUBLIC"
-      TEILER_APP8_ISACTIVATED: "true"
-      TEILER_APP8_ICONCLASS: "bi bi-person-rolodex"
-      TEILER_APP8_ORDER: "9"
-      TEILER_APP8_ISEXTERNALLINK: "true"
-      TEILER_APP8_ISLOCAL: "true"
-      TEILER_APP9_NAME: "project-pseudonymisation"
-      TEILER_APP9_TITLE_EN: "Project Pseudonymisation"
-      TEILER_APP9_TITLE_DE: "Projectpseudonymisierung"
-      TEILER_APP9_DESCRIPTION_EN: "Project Pseudonymisation"
-      TEILER_APP9_DESCRIPTION_DE: "Projectpseudonymisierung"
-      TEILER_APP9_SOURCEURL: "https://${HOST}/id-manager/html/projectSelection.html"
-      TEILER_APP9_ROLES: "TEILER_PUBLIC"
-      TEILER_APP9_ISACTIVATED: "true"
-      TEILER_APP9_ICONCLASS: "bi bi-person-lines-fill"
-      TEILER_APP9_ORDER: "10"
-      TEILER_APP9_ISEXTERNALLINK: "true"
-      TEILER_APP9_ISLOCAL: "true"
-      TEILER_APP10_NAME: "federated-search"
-      TEILER_APP10_TITLE: "Lens"
-      TEILER_APP10_DESCRIPTION_EN: "Federated Search"
-      TEILER_APP10_DESCRIPTION_DE: "Föderierte Suche"
-      TEILER_APP10_SOURCEURL: "https://demo.lens.samply.de/"
-      TEILER_APP10_ROLES: "TEILER_PUBLIC"
-      TEILER_APP10_ISACTIVATED: "true"
-      TEILER_APP10_ICONCLASS: "bi bi-search"
-      TEILER_APP10_ORDER: "13"
-      TEILER_APP10_ISEXTERNALLINK: "true"
-      TEILER_APP10_ISLOCAL: "false"
-      TEILER_APP11_NAME: "central-patient-list"
-      TEILER_APP11_TITLE_EN: "Central Patient List"
-      TEILER_APP11_TITLE_DE: "Zentrale Patientenliste"
-      TEILER_APP11_DESCRIPTION_EN: "Central Patient List"
-      TEILER_APP11_DESCRIPTION_DE: "Zentrale Patientenliste"
-      TEILER_APP11_SOURCEURL: "https://patientlist.ccp-it.dktk.dkfz.de/"
-      TEILER_APP11_ROLES: "TEILER_PUBLIC"
-      TEILER_APP11_ISACTIVATED: "true"
-      TEILER_APP11_ICONCLASS: "bi bi-person-rolodex"
-      TEILER_APP11_ORDER: "14"
-      TEILER_APP11_ISEXTERNALLINK: "true"
-      TEILER_APP11_ISLOCAL: "false"
-      TEILER_APP12_NAME: "central id-manager"
-      TEILER_APP12_TITLE_EN: "Central ID-Manager"
-      TEILER_APP12_TITLE_DE: "Zentraler ID-Manager"
-      TEILER_APP12_DESCRIPTION_EN: "Central ID Manager"
-      TEILER_APP12_DESCRIPTION_DE: "Zentraler ID-Manager"
-      TEILER_APP12_SOURCEURL: "https://dktk-kne.kgu.de/"
-      TEILER_APP12_ROLES: "TEILER_PUBLIC"
-      TEILER_APP12_ISACTIVATED: "true"
-      TEILER_APP12_ICONCLASS: "bi bi-person-bounding-box"
-      TEILER_APP12_ORDER: "15"
-      TEILER_APP12_ISEXTERNALLINK: "true"
-      TEILER_APP12_ISLOCAL: "false"
-      # TODO: Icinga to be replaced by Zabbix
-      TEILER_APP13_NAME: "monitoring"
-      TEILER_APP13_TITLE: "Icinga"
-      TEILER_APP13_DESCRIPTION: "Icinga Monitoring"
-      TEILER_APP13_SOURCEURL: "https://monitor.vmitro.de/icingaweb2/dashboard"
-      TEILER_APP13_ROLES: "TEILER_ADMIN"
-      TEILER_APP13_ISACTIVATED: "true"
-      TEILER_APP13_ICONSOURCEURL: "https://images.ctfassets.net/o7xu9whrs0u9/QmL67mCGdRQ8PBcuKHGnF/858c0aee95762f59d67b25073f9483c2/icinga-logo.png"
-      TEILER_APP13_ORDER: "16"
-      TEILER_APP13_ISEXTERNALLINK: "true"
-      TEILER_APP13_ISLOCAL: "false"
-      #    TEILER_APP14_NAME: "function-tests"
-      #    TEILER_APP15_NAME: "event-log"
-      TEILER_APP16_NAME: "active-inquiries"
-      TEILER_APP16_BACKENDURL: "https://${HOST}/ccp-exporter"
-      TEILER_APP17_NAME: "archived-inquiries"
-      TEILER_APP17_BACKENDURL: "https://${HOST}/ccp-exporter"
-      TEILER_APP18_NAME: "failed-inquiries"
-      TEILER_APP18_BACKENDURL: "https://${HOST}/ccp-exporter"
-      TEILER_APP19_NAME: "inquiry"
-      TEILER_APP19_INMENU: "false"
-      #    TEILER_APP20_NAME: "cbioportal"
-      #    TEILER_APP20_TITLE: "cBioportal"
-      #    TEILER_APP20_DESCRIPTION: "Interactive exploration of multidimensional cancer genomics data sets"
-      #    TEILER_APP20_SOURCEURL: "http://localhost:8082"
-      #    TEILER_APP20_ROLES: "TEILER_USER"
-      #    TEILER_APP20_ISACTIVATED: "true"
-      #    TEILER_APP20_ICONSOURCEURL: "https://docs.cbioportal.org/images/cbio-logo.png"
-      #    TEILER_APP20_ORDER: "17"
-      #    TEILER_APP20_ISEXTERNALLINK: "true"
-      #    TEILER_APP20_ISLOCAL: "true"
-      #    TEILER_APP21_NAME: "mtba-bp"
-      #    TEILER_APP21_TITLE: "MTBA-BP"
-      #    TEILER_APP21_DESCRIPTION: "MTBA Camunda Business Process"
-      #    TEILER_APP21_SOURCEURL: "http://localhost:8480"
-      #    TEILER_APP21_ROLES: "TEILER_ADMIN"
-      #    TEILER_APP21_ISACTIVATED: "true"
-      #    TEILER_APP21_ICONSOURCEURL: "https://camunda.com/wp-content/uploads/2020/05/logo-camunda-black.svg"
-      #    TEILER_APP21_ORDER: "18"
-      #    TEILER_APP21_ISEXTERNALLINK: "true"
-      #    TEILER_APP21_ISLOCAL: "true"
-      TEILER_APP22_NAME: "dialog-quali"
-      TEILER_APP22_INMENU: "false"
-      TEILER_APP23_NAME: "dialog-uploads"
-      TEILER_APP23_INMENU: "false"
-      TEILER_APP24_NAME: "inquiry-dialog"
-      TEILER_APP24_INMENU: "false"
-      TEILER_APP25_NAME: "dialog-tests"
-      TEILER_APP25_INMENU: "false"
-      TEILER_APP26_NAME: "opal"
-      TEILER_APP26_TITLE: "Opal"
-      TEILER_APP26_DESCRIPTION: "Opal is OBiBa’s core database application for biobanks."
-      TEILER_APP26_SOURCEURL: "https://${HOST}/opal"
-      TEILER_APP26_ROLES: "TEILER_USER"
-      TEILER_APP26_ISACTIVATED: "true"
-      TEILER_APP26_ICONSOURCEURL: "https://www.obiba.org/assets/themes/bootstrap/img/obiba-logo-small.png"
-      TEILER_APP26_ORDER: "19"
-      TEILER_APP26_ISEXTERNALLINK: "true"
-      TEILER_APP26_ISLOCAL: "true"
-      TEILER_APP27_NAME: "rstudio"
-      TEILER_APP27_TITLE: "R Studio"
-      TEILER_APP27_DESCRIPTION: "RStudio is an integrated development environment (IDE) for R and Python."
-      TEILER_APP27_SOURCEURL: "https://${HOST}/rstudio"
-      TEILER_APP27_ROLES: "TEILER_USER"
-      TEILER_APP27_ISACTIVATED: "true"
-      TEILER_APP27_ICONSOURCEURL: "https://rstudio.com/wp-content/uploads/2018/10/RStudio-Logo-Flat.png"
-      TEILER_APP27_ORDER: "20"
-      TEILER_APP27_ISEXTERNALLINK: "true"
-      TEILER_APP27_ISLOCAL: "true"
-
-volumes:
-  login-db:
-    name: "login-db"

ccp/modules/teiler-ui-setup.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-if [ "$ENABLE_TEILER" == true ];then
-  log INFO "Teiler-UI setup detected -- will start Teiler-UI services."
-  OVERRIDE+=" -f ./$PROJECT/modules/teiler-ui-compose.yml"
-fi
-KEYCLOAK_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password. It is not required to be secret.\" | openssl rsautl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"

ccp/root-new.crt.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAh2gAwIBAgIUN7yzueIZzwpe8PaPEIMY8zoH+eMwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwNTIzMTAxNzIzWhcNMzMw
+NTIwMTAxNzUzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAN5JAj+HydSGaxvA0AOcrXVTZ9FfsH0cMVBlQb72
+bGZgrRvkqtB011TNXZfsHl7rPxCY61DcsDJfFq3+8VHT+S9HE0qV1bEwP+oA3xc4
+Opq77av77cNNOqDC7h+jyPhHcUaE33iddmrH9Zn2ofWTSkKHHu3PAe5udCrc2QnD
+4PLRF6gqiEY1mcGknJrXj1ff/X0nRY/m6cnHNXz0Cvh8oPOtbdfGgfZjID2/fJNP
+fNoNKqN+5oJAZ+ZZ9id9rBvKj1ivW3F2EoGjZF268SgZzc5QrM/D1OpSBQf5SF/V
+qUPcQTgt9ry3YR+SZYazLkfKMEOWEa0WsqJVgXdQ6FyergcCAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEa70kcseqU5
+bHx2zSt4bG21HokhMB8GA1UdIwQYMBaAFEa70kcseqU5bHx2zSt4bG21HokhMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCGmE7NXW4T
+6J4mV3b132cGEMD7grx5JeiXK5EHMlswUS+Odz0NcBNzhUHdG4WVMbrilHbI5Ua+
+6jdKx5WwnqzjQvElP0MCw6sH/35gbokWgk1provOP99WOFRsQs+9Sm8M2XtMf9HZ
+m3wABwU/O+dhZZ1OT1PjSZD0OKWKqH/KvlsoF5R6P888KpeYFiIWiUNS5z21Jm8A
+ZcllJjiRJ60EmDwSUOQVJJSMOvtr6xTZDZLtAKSN8zN08lsNGzyrFwqjDwU0WTqp
+scMXEGBsWQjlvxqDnXyljepR0oqRIjOvgrWaIgbxcnu98tK/OdBGwlAPKNUW7Crr
+vO+eHxl9iqd4
+-----END CERTIFICATE-----

ccp/root.crt.pem

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUMeGRSrNPhRdQ1tU7uK5+lUa4f38wDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjIwOTI5MTQxMjU1WhcNMzIw
-OTI2MTQxMzI1WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMYyroOUeb27mYzClOrjCmgIceLalsFA0aVCh5mZ
-KtP8+1U3oq/7exP30gXiJojxW7xoerfyQY9s0Sz5YYbxYbuskFOYEtyAILB/pxgd
-+k+J3tlZKolpfmo7WT5tZiHxH/zjrtAYGnuB2xPHRMCWh/tHYrELgXQuilNol24y
-GBa1plTlARy0aKEDUHp87WLhD2qH7B8sFlLgo0+gunE1UtR2HMSPF45w3VXszyG6
-fJNrAj0yPnKy3Dm1BMO3jDO2e0A9lCQ71a4j4TeKePfCk1xCArSu6PpiwiacKplF
-c6CRR6KrWVm2g+8Y2hFcOBG/Py2xusm3PWbpylGq6vtFRkkCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEFxD6BQwQO5
-xsJ+3cvZypsnh6dDMB8GA1UdIwQYMBaAFEFxD6BQwQO5xsJ+3cvZypsnh6dDMBYG
-A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQB5zTeIhV/3
-3Am6O144EFtnIeaZ2w0D6aEHqHAZp50vJv3+uQfOliCOzgw7VDxI4Zz2JALjlR/i
-uOYHsu3YIRMIOmPOjqrdDJa6auB0ufL4oUPfCRln7Fh0f3JVlz3BUoHsSDt949p4
-g0nnsciL2JHuzlqjn7Jyt3L7dAHrlFKulCcuidG5D3cqXrRCbF83f+k3TC/HRiNd
-25oMi7I4MP/SOCdfQGUGIsHIf/0hSm3pNjDOrC/XuI/8gh2f5io+Y8V+hMwMBcm4
-JbH8bdyBB+EIhsNbTwf2MWntD5bmg47sf7hh23aNvKXI67Li1pTI2t1CqiGnFR0U
-fCEpeaEAHs0k
+MIIDNTCCAh2gAwIBAgIUN7yzueIZzwpe8PaPEIMY8zoH+eMwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwNTIzMTAxNzIzWhcNMzMw
+NTIwMTAxNzUzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAN5JAj+HydSGaxvA0AOcrXVTZ9FfsH0cMVBlQb72
+bGZgrRvkqtB011TNXZfsHl7rPxCY61DcsDJfFq3+8VHT+S9HE0qV1bEwP+oA3xc4
+Opq77av77cNNOqDC7h+jyPhHcUaE33iddmrH9Zn2ofWTSkKHHu3PAe5udCrc2QnD
+4PLRF6gqiEY1mcGknJrXj1ff/X0nRY/m6cnHNXz0Cvh8oPOtbdfGgfZjID2/fJNP
+fNoNKqN+5oJAZ+ZZ9id9rBvKj1ivW3F2EoGjZF268SgZzc5QrM/D1OpSBQf5SF/V
+qUPcQTgt9ry3YR+SZYazLkfKMEOWEa0WsqJVgXdQ6FyergcCAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEa70kcseqU5
+bHx2zSt4bG21HokhMB8GA1UdIwQYMBaAFEa70kcseqU5bHx2zSt4bG21HokhMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCGmE7NXW4T
+6J4mV3b132cGEMD7grx5JeiXK5EHMlswUS+Odz0NcBNzhUHdG4WVMbrilHbI5Ua+
+6jdKx5WwnqzjQvElP0MCw6sH/35gbokWgk1provOP99WOFRsQs+9Sm8M2XtMf9HZ
+m3wABwU/O+dhZZ1OT1PjSZD0OKWKqH/KvlsoF5R6P888KpeYFiIWiUNS5z21Jm8A
+ZcllJjiRJ60EmDwSUOQVJJSMOvtr6xTZDZLtAKSN8zN08lsNGzyrFwqjDwU0WTqp
+scMXEGBsWQjlvxqDnXyljepR0oqRIjOvgrWaIgbxcnu98tK/OdBGwlAPKNUW7Crr
+vO+eHxl9iqd4
 -----END CERTIFICATE-----

ccp/vars

@@ -1,15 +1,20 @@
-BROKER_ID=broker.dev.ccp-it.dktk.dkfz.de
+BROKER_ID=broker.ccp-it.dktk.dkfz.de
 BROKER_URL=https://${BROKER_ID}
 PROXY_ID=${SITE_ID}.${BROKER_ID}
-SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}"
-REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}"
+FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+FOCUS_RETRY_COUNT=32
 SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
 
+BROKER_URL_FOR_PREREQ=$BROKER_URL
+
+
 for module in $PROJECT/modules/*.sh
 do
-    log INFO "sourcing $module"
+    log DEBUG "sourcing $module"
     source $module
 done
+
+idManagementSetup
+nngmSetup
+mtbaSetup

lib/functions.sh

@@ -9,14 +9,6 @@ detectCompose() {
 	fi
 }
 
-getLdmPassword() {
-	if [ -n "$LDM_PASSWORD" ]; then
-		docker run --rm httpd:alpine htpasswd -nb $PROJECT $LDM_PASSWORD | tr -d '\n' | tr -d '\r'
-	else
-		echo -n ""
-	fi
-}
-
 exitIfNotRoot() {
   if [ "$EUID" -ne 0 ]; then
     log "ERROR" "Please run as root"
@@ -34,7 +26,7 @@ checkOwner(){
 }
 
 printUsage() {
-	echo "Usage: bridgehead start|stop|update|install|uninstall|enroll PROJECTNAME"
+	echo "Usage: bridgehead start|stop|is-running|update|install|uninstall|adduser|enroll PROJECTNAME"
 	echo "PROJECTNAME should be one of ccp|bbmri"
 }
 
@@ -169,6 +161,54 @@ function retry {
   return 0
 }
 
-##Setting Network properties
-# currently not needed
-#export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
+function bk_is_running {
+	detectCompose
+	RUNNING="$($COMPOSE -p $PROJECT -f minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE ps -q)"
+	NUMBEROFRUNNING=$(echo "$RUNNING" | wc -l)
+	if [ $NUMBEROFRUNNING -ge 2 ]; then
+		return 0
+	else
+		return 1
+	fi
+}
+
+function do_enroll_inner {
+	PARAMS=""
+	
+	MANUAL_PROXY_ID="${1:-$PROXY_ID}"
+	if [ -z "$MANUAL_PROXY_ID" ]; then
+		log ERROR "No Proxy ID set"
+		exit 1
+	else
+		log INFO "Enrolling Beam Proxy Id $MANUAL_PROXY_ID"
+	fi
+
+	SUPPORT_EMAIL="${2:-$SUPPORT_EMAIL}"
+	if [ -n "$SUPPORT_EMAIL" ]; then
+		PARAMS+="--admin-email $SUPPORT_EMAIL"
+	fi
+
+	docker run --rm -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $MANUAL_PROXY_ID $PARAMS
+	chmod 600 $PRIVATEKEYFILENAME
+}
+
+function do_enroll {
+	do_enroll_inner $@
+}
+
+add_basic_auth_user() {
+   USER="${1}"
+   PASSWORD="${2}"
+   NAME="${3}"
+   PROJECT="${4}"
+   FILE="/etc/bridgehead/${PROJECT}.local.conf"
+   ENCRY_CREDENTIALS="$(docker run --rm docker.verbis.dkfz.de/cache/httpd:alpine htpasswd -nb $USER $PASSWORD  | tr -d '\n' | tr -d '\r')"
+   if [ -f $FILE ] && grep -R -q "$NAME=" $FILE # if a specific basic auth user already exists:
+   then
+     sed -i "/$NAME/ s|='|='$ENCRY_CREDENTIALS,|" $FILE
+   else
+     echo -e "\n## Basic Authentication Credentials for:\n$NAME='$ENCRY_CREDENTIALS'" >> $FILE;
+   fi
+ 	log DEBUG "Saving clear text credentials in $FILE. If wanted, delete them manually."
+   sed -i "/^$NAME/ s|$|\n# User: $USER\n# Password: $PASSWORD|" $FILE
+}

lib/install-bridgehead.sh

@@ -29,12 +29,16 @@ bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
 EOF
 
 # TODO: Determine whether this should be located in setup-bridgehead (triggered through bridgehead install) or in update bridgehead (triggered every hour)
-if [ -z "$LDM_PASSWORD" ]; then
-  log "INFO" "Now generating a password for the local data management. Please save the password for your ETL process!"
+if [ -z "$LDM_AUTH" ]; then
+  log "INFO" "Now generating basic auth for the local data management (see adduser in bridgehead for more information). "
   generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
+  add_basic_auth_user $PROJECT $generated_passwd "LDM_AUTH" $PROJECT
+fi
 
-  log "INFO" "Your generated credentials are:\n            user: $PROJECT\n            password: $generated_passwd"
-  echo -e "## Local Data Management Basic Authentication\n# User: $PROJECT\nLDM_PASSWORD=$generated_passwd" >> /etc/bridgehead/${PROJECT}.local.conf;
+if [ ! -z "$NNGM_CTS_APIKEY" ] && [ -z "$NNGM_AUTH" ]; then
+  log "INFO" "Now generating basic auth for nNGM upload API (see adduser in bridgehead for more information). "
+  generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
+  add_basic_auth_user "nngm" $generated_passwd "NNGM_AUTH" $PROJECT
 fi
 
 log "INFO" "Registering system units for bridgehead and bridgehead-update"

lib/monitoring.sh

@@ -47,8 +47,8 @@ function hc_send(){
 
     if [ -n "$2" ]; then
         MSG="$2\n\nDocker stats:\n$UPTIME"
-        echo -e "$MSG" | https_proxy=$HTTPS_PROXY_URL curl -A "$USER_AGENT" -s -o /dev/null -X POST --data-binary @- "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
+        echo -e "$MSG" | https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null -X POST --data-binary @- "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
     else
-        https_proxy=$HTTPS_PROXY_URL curl -A "$USER_AGENT" -s -o /dev/null "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
+        https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
     fi
 }

lib/prepare-system.sh

@@ -1,10 +1,21 @@
 #!/bin/bash -e
 
+DEV_MODE="${1:-NODEV}"
+
 source lib/log.sh
 source lib/functions.sh
 
 log "INFO" "Preparing your system for bridgehead installation ..."
 
+# Check, if running in WSL
+if [[ $(grep -i Microsoft /proc/version) ]]; then
+    # Check, if systemd is available
+    if [ "$(systemctl is-system-running)" = "offline" ]; then
+        log "ERROR" "It seems you have no active systemd environment in your WSL environment. Please follow the guide in https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/"
+        exit 1
+    fi
+fi
+
 # Create the bridgehead user
 if id bridgehead &>/dev/null; then
     log "INFO" "Existing user with id $(id -u bridgehead) will be used by the bridgehead system units."
@@ -14,7 +25,12 @@ else
 fi
 
 # Clone the OpenSource repository of bridgehead
+set +e
+bridgehead_repository_url=$(git remote get-url origin)
+if [ $? -ne 0 ]; then
     bridgehead_repository_url="https://github.com/samply/bridgehead.git"
+fi
+set -e
 if [ -d "/srv/docker/bridgehead" ]; then
     current_owner=$(stat -c '%U' /srv/docker/bridgehead)
     if [ "$(su -c 'git -C /srv/docker/bridgehead remote get-url origin' $current_owner)" == "$bridgehead_repository_url" ]; then
@@ -26,7 +42,7 @@ if [ -d "/srv/docker/bridgehead" ]; then
 else
     log "INFO" "Cloning $bridgehead_repository_url to /srv/docker/bridgehead"
     mkdir -p /srv/docker/
-    git clone bridgehead_repository_url /srv/docker/bridgehead
+    git clone $bridgehead_repository_url /srv/docker/bridgehead
 fi
 
 case "$PROJECT" in
@@ -36,6 +52,9 @@ case "$PROJECT" in
 	bbmri)
 		site_configuration_repository_middle="git.verbis.dkfz.de/bbmri-bridgehead-configs/"
 		;;
+	minimal)
+		site_configuration_repository_middle="git.verbis.dkfz.de/minimal-bridgehead-configs/"
+		;;
 	*)
 		log ERROR "Internal error, this should not happen."
         exit 1
@@ -50,18 +69,26 @@ if [ -d /etc/bridgehead ]; then
     else
         log "WARN" "Your site configuration repository in /etc/bridgehead seems to have another origin than git.verbis.dkfz.de. Please check if the repository is correctly cloned!"
     fi
-else
+elif [[ "$DEV_MODE" == "NODEV" ]]; then
     log "INFO" "Now cloning your site configuration repository for you."
+    if [ -z "$site" ]; then
         read -p "Please enter your site: " site
+    fi
+    if [ -z "$access_token" ]; then
         read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
+    fi
     site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}$(echo $site | tr '[:upper:]' '[:lower:]').git"
     git clone $site_configuration_repository_url /etc/bridgehead
     if [ $? -gt 0 ]; then
         log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
     fi
+elif [[ "$DEV_MODE" == "DEV" ]]; then
+    log "INFO" "Now cloning your developer configuration repository for you."
+    read -p "Please enter your config repository URL: " url
+    git clone "$url" /etc/bridgehead
 fi
 
 chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
 
-log INFO "System preparation is completed and private key is present."
+log INFO "System preparation is completed and configuration is present."
 

lib/prerequisites.sh

@@ -62,6 +62,34 @@ if [ -e /etc/bridgehead/vault.conf ]; then
   fi
 fi
 
+log INFO "Checking network access ($BROKER_URL_FOR_PREREQ) ..."
+
+source /etc/bridgehead/${PROJECT}.conf
+source ${PROJECT}/vars
+
+set +e
+SERVERTIME="$(https_proxy=$HTTPS_PROXY_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
+RET=$?
+set -e
+if [ $RET -ne 0 ]; then
+	log WARN "Unable to connect to Samply.Beam broker at $BROKER_URL_FOR_PREREQ. Please check your proxy settings.\nThe currently configured proxy was \"$HTTPS_PROXY_URL\". This error is normal when using proxy authentication."
+	log WARN "Unable to check clock skew due to previous error."
+else
+	log INFO "Checking clock skew ..."
+
+	SERVERTIME_AS_TIMESTAMP=$(date --date="$SERVERTIME" +%s)
+	MYTIME=$(date +%s)
+	SKEW=$(($SERVERTIME_AS_TIMESTAMP - $MYTIME))
+	SKEW=$(echo $SKEW | awk -F- '{print $NF}')
+	SYNCTEXT="For example, consider entering a correct NTP server (e.g. your institution's Active Directory Domain Controller in /etc/systemd/timesyncd.conf (option NTP=) and restart systemd-timesyncd."
+	if [ $SKEW -ge 300 ]; then
+		report_error 5 "Your clock is not synchronized (${SKEW}s off). This will cause Samply.Beam's certificate will fail. Please setup time synchronization. $SYNCTEXT"
+		exit 1
+	elif [ $SKEW -ge 60 ]; then
+		log WARN "Your clock is more than a minute off (${SKEW}s). Consider syncing to a time server. $SYNCTEXT"
+	fi
+fi
+
 checkPrivKey() {
   if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then
     log INFO "Success - private key found."
@@ -69,8 +97,6 @@ checkPrivKey() {
     log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run\n  bridgehead enroll ${PROJECT}\nand follow the instructions."
     return 1
   fi
-  log INFO "Success - all prerequisites are met!"
-  hc_send log "Success - all prerequisites are met!"
   return 0
 }
 
@@ -80,4 +106,7 @@ else
   checkPrivKey || exit 1
 fi
 
+log INFO "Success - all prerequisites are met!"
+hc_send log "Success - all prerequisites are met!"
+
 exit 0

lib/update-bridgehead.sh

@@ -4,10 +4,15 @@ source lib/functions.sh
 AUTO_HOUSEKEEPING=${AUTO_HOUSEKEEPING:-true}
 
 if [ "$AUTO_HOUSEKEEPING" == "true" ]; then
-	A="Performing automatic maintenance: Cleaning docker images."
+	A="Performing automatic maintenance: "
+	if bk_is_running; then
+		A="$A Cleaning docker images."
+		docker system prune -a -f
+	else
+		A="$A Not cleaning docker images since BK is not running."
+	fi
 	hc_send log "$A"
 	log INFO "$A"
-	docker system prune -a -f
 else
 	log WARN "Automatic housekeeping disabled (variable AUTO_HOUSEKEEPING != \"true\")"
 fi
@@ -81,7 +86,7 @@ done
 # Check docker updates
 log "INFO" "Checking for updates to running docker images ..."
 docker_updated="false"
-for IMAGE in $(cat $PROJECT/docker-compose.yml ${OVERRIDE//-f/} | grep -v "^#" | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do
+for IMAGE in $(cat $PROJECT/docker-compose.yml ${OVERRIDE//-f/} minimal/docker-compose.yml | grep -v "^#" | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do
   log "INFO" "Checking for Updates of Image: $IMAGE"
   if docker pull $IMAGE | grep "Downloaded newer image"; then
     CHANGE="Image $IMAGE updated."
@@ -134,6 +139,15 @@ else
   log WARN "Automated backups are disabled (variable AUTO_BACKUPS != \"true\")"
 fi
 
+#TODO: the following block can be deleted after successful update at all sites
+if [ ! -z "$LDM_PASSWORD" ]; then
+  FILE="/etc/bridgehead/$PROJECT.local.conf"
+  log "INFO" "Migrating LDM_PASSWORD to encrypted credentials in $FILE"
+  add_basic_auth_user $PROJECT $LDM_PASSWORD "LDM_AUTH" $PROJECT
+  add_basic_auth_user $PROJECT $LDM_PASSWORD "NNGM_AUTH" $PROJECT
+  sed -i "/LDM_PASSWORD/{d;}" $FILE
+fi
+
 exit 0
 
 # TODO: Print last commit explicit

minimal/docker-compose.yml

@@ -0,0 +1,59 @@
+version: "3.7"
+
+services:
+  traefik:
+    container_name: bridgehead-traefik
+    image: docker.verbis.dkfz.de/cache/traefik:latest
+    command:
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.file.directory=/configuration/
+      - --api.dashboard=true
+      - --accesslog=true
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.tls=true"
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      - "traefik.http.middlewares.auth.basicauth.users=${LDM_AUTH}"
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - /etc/bridgehead/traefik-tls:/certs:ro
+      - ../lib/traefik-configuration/:/configuration:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
+  forward_proxy:
+    container_name: bridgehead-forward-proxy
+    image: docker.verbis.dkfz.de/cache/samply/bridgehead-forward-proxy:latest
+    environment:
+      HTTPS_PROXY: ${HTTPS_PROXY_URL}
+      USERNAME: ${HTTPS_PROXY_USERNAME}
+      PASSWORD: ${HTTPS_PROXY_PASSWORD}
+    tmpfs:
+      - /var/log/squid
+      - /var/spool/squid
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro
+
+  landing:
+    container_name: bridgehead-landingpage
+    image: docker.verbis.dkfz.de/cache/samply/bridgehead-landingpage:master
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.landing.rule=PathPrefix(`/`)"
+      - "traefik.http.services.landing.loadbalancer.server.port=80"
+      - "traefik.http.routers.landing.tls=true"
+    environment:
+      HOST: ${HOST}
+      PROJECT: ${PROJECT}
+      SITE_NAME: ${SITE_NAME}
+
+

minimal/modules/dnpm-compose.yml

@@ -0,0 +1,51 @@
+version: "3.7"
+
+services:
+  dnpm-beam-proxy:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    container_name: bridgehead-dnpm-beam-proxy
+    environment:
+      BROKER_URL: ${DNPM_BROKER_URL}
+      PROXY_ID: ${DNPM_PROXY_ID}
+      APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: ./conf/trusted-ca-certs
+      ROOTCERT_FILE: ./conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
+
+  dnpm-beam-connect:
+    depends_on: [ dnpm-beam-proxy ]
+    image: docker.verbis.dkfz.de/cache/samply/beam-connect:develop
+    container_name: bridgehead-dnpm-beam-connect
+    environment:
+      PROXY_URL: http://dnpm-beam-proxy:8081
+      PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
+      APP_ID: dnpm-connect.${DNPM_PROXY_ID}
+      DISCOVERY_URL: "./conf/central_targets.json"
+      LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
+      HTTP_PROXY: http://forward_proxy:3128
+      HTTPS_PROXY: http://forward_proxy:3128
+      NO_PROXY: dnpm-beam-proxy,dnpm-backend
+      RUST_LOG: ${RUST_LOG:-info}
+      NO_AUTH: "true"
+    volumes:
+      - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
+      - /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
+      - "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
+      - "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
+      - "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
+      - "traefik.http.routers.dnpm-connect.tls=true"
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

minimal/modules/dnpm-setup.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [ -n "${ENABLE_DNPM}" ]; then
+	log DEBUG "DNPM setup detected (Beam.Connect) -- will start Beam and Beam.Connect for DNPM."
+	OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
+
+	# Set variables required for Beam-Connect
+	DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+	DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+	DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
+	DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
+	DNPM_PROXY_ID="${SITE_ID}.${DNPM_BROKER_ID}"
+fi

minimal/vars

@@ -0,0 +1,6 @@
+for module in $PROJECT/modules/*.sh
+do
+    log DEBUG "sourcing $module"
+    source $module
+done
+PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem