diff --git a/.gitignore b/.gitignore index 1b91eec..d6c86b5 100644 --- a/.gitignore +++ b/.gitignore @@ -9,4 +9,4 @@ landing/* docker-compose.override.yml site.conf auth/* -certs/* \ No newline at end of file +certs/* diff --git a/LICENSE b/LICENSE index 261eeb9..29f81d8 100644 --- a/LICENSE +++ b/LICENSE @@ -1,201 +1,201 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md index 7745b47..0bb72e1 100644 --- a/README.md +++ b/README.md @@ -8,13 +8,17 @@ TOC 1. [About](#about) - [Projects](#projects) - [GBA/BBMRI-ERIC](#gbabbmri-eric) - - [DKTK/C4](#dktkc4) + - [CCP(DKTK/C4)](#ccpdktkc4) - [NNGM](#nngm) - [Bridgehead Components](#bridgehead-components) - - [Blaze Server](#blaze-serverhttpsgithubcomsamplyblaze) + - [Blaze Server](#blaze-serverhttpsgithubcomsamplyblaze) + - [Connector](#connector) 1. [Requirements](#requirements) - [Hardware](#hardware) - [System](#system-requirements) + - [git](#git) + - [docker](#dockerhttpsdocsdockercomget-docker) + - [systemd](#systemd) 2. [Getting Started](#getting-started) - [DKTK](#dktkc4) - [C4](#c4) @@ -32,9 +36,9 @@ TOC TODO: Insert comprehensive feature list of the bridgehead? Why would anyone install it? -### Projects +## Projects -#### GBA/BBMRI-ERIC +### GBA/BBMRI-ERIC The **Sample Locator** is a tool that allows researchers to make searches for samples over a large number of geographically distributed biobanks. Each biobank runs a so-called **Bridgehead** at its site, which makes it visible to the Sample Locator. The Bridgehead is designed to give a high degree of protection to patient data. Additionally, a tool called the [Negotiator][negotiator] puts you in complete control over which samples and which data are delivered to which researcher. @@ -44,11 +48,11 @@ The Bridgehead has two primary components: * The **Blaze Store**. This is a highly responsive FHIR data store, which you will need to fill with your data via an ETL chain. * The **Connector**. This is the communication portal to the Sample Locator, with specially designed features that make it possible to run it behind a corporate firewall without making any compromises on security. -#### DKTK/C4 +### CCP(DKTK/C4) TODO: -#### NNGM +### nNGM TODO: @@ -62,8 +66,6 @@ This holds the actual data being searched. This store must be filled by you, gen TODO: - - ## Requirements ### Hardware @@ -72,149 +74,169 @@ For running your bridgehead we recommend the follwing Hardware: - 4 CPU cores - At least 8 GB Ram -- 10GB Hard Drive + how many data GB you need to store in the bridgehead +- 100GB Hard Drive, SSD recommended ### System Requirements Before starting the installation process, please ensure that following software is available on your system: -#### [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) +#### Git + +Check if you have at leat git 2.0 installed on the system with: -To check that you have a working git installation, please run ``` shell -cd ~/; -git clone https://github.com/octocat/Hello-World.git; -cat ~/Hello-World/README; -rm -rf Hello-World; +git --version ``` -If you see the output "Hello World!" your installation should be working. #### [Docker](https://docs.docker.com/get-docker/) -To check your docker installation, you can try to execute dockers "Hello World" Image. The command is: -``` shell -docker run --rm --name hello-world hello-world; -``` -Docker will now download the "hello-world" docker image and try to execute it. After the download you should see a message starting with "Hello from Docker!". - -> NOTE: If the download of the image fails (e.g with "connection timed out" message), ensure that you have correctly set the proxy for the docker daemon. Refer to ["Docker Daemon Proxy Configuration" in the "Pitfalls" section](#docker-daemon-proxy-configuration) - -You should also check, that the version of docker installed by you is newer than "1.20". To check this, just run +To check your docker installation, you should execute the docker with --version: ``` shell docker --version ``` -#### [Docker Compose](https://docs.docker.com/compose/cli-command/#installing-compose-v2) - -To check your docker-compose installation, please run the following command. It uses the "hello-world" image from the previous section: -``` shell -docker-compose -f - up < NOTE: If the download of the image fails (e.g with "connection timed out" message), ensure that you have correctly set the proxy for the docker daemon. Refer to ["Docker Daemon Proxy Configuration" in the "Pitfalls" section](#docker-daemon-proxy-configuration) + #### [systemd](https://systemd.io/) -You shouldn't need to install it yourself. If systemd is not available on your system you should get another system. +You shouldn't need to install it yourself, If systemd is not available on your system you should get another system. To check if systemd is available on your system, please execute ``` shell systemctl --version ``` +If systemd is not installed, you can start the bridgehead. However, for productive use we recomend using systemd. + --- ## Getting Started +### Installation + If your system passed all checks from ["Requirements" section], you are now ready to download the bridgehead. First, clone the repository to the directory "/srv/docker/bridgehead": -u - ``` shell sudo mkdir -p /srv/docker/; sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead; ``` -Next, you need to configure a set of variables, specific for your site with not so high security concerns. You can visit the configuration template at [GitHub](https://github.com/samply/bridgehead-config). You can download the repositories contents and add them to the "bridgehead-config" directory. +It is recomended to create a user for the bridgehead service. This should be done after clone the repository. Since not all linux distros support ```adduser```, we provide an action for the systemcall ```useradd```. You should try the first one, when the systm can't create the user you should try the second one. ``` shell -sudo git submodule add -f https://github.com/samply/bridgehead-config.git ./site-config; +adduser --no-create-home --disabled-login --ingroup docker --gecos "" bridgehead ``` + +``` shell +useradd -M -g docker -N -s /sbin/nologin bridgehead +``` + +After adding the User you need to change the ownership of the directory to the bridgehead user. + +``` shell +chown bridgehead /srv/docker/bridgehead/ -R +``` + +### Configuration + > NOTE: If you are part of the CCP-IT we will provide you another link for the configuration. -You should now be able to run a bridgehead instance. To check if everything works, execute the following: +Next, you need to configure a set of variables, specific for your site with not so high security concerns. You can clone the configuration template at [GitHub](https://github.com/samply/bridgehead-config). The confiugration of the bridgehead should be located in /etc/bridghead. + ``` shell -sudo ./lib/init-test-environment.sh; -sudo ./start-bridgehead.sh ; +sudo git clone https://github.com/samply/bridgehead-config.git /etc/bridgehead; ``` -You should now be able to access the landing page on your system, e.g "http:///" +After cloning or forking the repository you need to add value to the template. If you are a part of the CCP-IT you will get an already filled out config repo. -To remove the test-environment, run (make sure you don't have other docker services installed on this system, docker volume prune is destructive!) +### Testing your bridgehead + +We recomend to run first with the start and stop script. If you have trouble starting the bridghead have a look at the troubleshooting section. + +Now you ready to run a bridgehead instance. The bridgehead scripts checks if your configuration is correct. To check if everything works, execute the following: ``` shell -sudo ./stop-bridgehead.sh ; -sudo docker volume prune; +/srv/docker/bridgehead/bridgehead start ``` -For a server, we highly recommend that you install the system units for managing the bridgehead, provided by us. . You can do this by executing the [setup-bridgehead-units.sh](./lib/setup-bridgehead-units.sh) script: +You should now be able to access the landing page on your system, e.g "https:///". + +To shutdown the bridgehead just run. ``` shell -sudo ./lib/setup-bridgehead-units.sh +/srv/docker/bridgehead/bridgehead stop ``` -Finally, you need to configure your sites secrets. These are places as configuration for each bridgeheads system unit. Refer to the section for your specific project: +### Systemd service configuration + +For a server, we highly recommend that you install the system units for managing the bridgehead, provided by us. You can do this by executing the [bridgehead](./bridgehead) script: +``` shell +sudo /srv/docker/bridgehead/bridgehead install +``` + +This will install the systemd units to run and update the bridghead. + +Finally, you need to configure your sites secrets. These are places as configuration for each bridgehead system unit. Refer to the section for your specific project: + +For Every project you need to set the proxy this way, if you have one. This is done with the ```systemctl edit``` comand. + +``` shell +sudo systemctl edit bridgehead@.service; +sudo systemctl edit bridgehead-update@.service; +``` + +``` conf +[Service] +Environment=http_proxy= +Environment=https_proxy= +``` + +There a further configurations for each project. + +#### CCP(DKTK/C4) + +For the federate search please follow the basic auth configuration step. ### DKTK/C4 You can create the site specific configuration with: -``` shell -sudo systemctl edit bridgehead@dktk.service; -``` This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor and define your machines secrets. You share some of the ID-Management secrets with the central patientlist (Mainz) and controlnumbergenerator (Frankfurt). Refer to the ["Configuration" section](#configuration) for this. ``` conf [Service] -Environment=HOSTIP= -Environment=HOST= -Environment=HTTP_PROXY_USER= -Environment=HTTP_PROXY_PASSWORD= -Environment=HTTPS_PROXY_USER= -Environment=HTTPS_PROXY_PASSWORD= -Environment=CONNECTOR_POSTGRES_PASS= -Environment=ML_DB_PASS= -Environment=MAGICPL_API_KEY= -Environment=MAGICPL_MAINZELLISTE_API_KEY= -Environment=MAGICPL_API_KEY_CONNECTOR= -Environment=MAGICPL_MAINZELLISTE_CENTRAL_API_KEY= -Environment=MAGICPL_CENTRAL_API_KEY= -Environment=MAGICPL_OIDC_CLIENT_ID= -Environment=MAGICPL_OIDC_CLIENT_SECRET= +Environment=http_proxy= +Environment=https_proxy= ``` To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service: ``` shell sudo systemctl daemon-reload; -sudo systemctl bridgehead@dktk.service; +sudo systemctl bridgehead@ccp.service; ``` -### C4 - You can create the site specific configuration with: ``` shell @@ -225,6 +247,8 @@ This will open your default editor allowing you to edit the docker system units ``` conf [Service] +Environment=http_proxy= +Environment=https_proxy= Environment=HOSTIP= Environment=HOST= Environment=HTTP_PROXY_USER= @@ -232,7 +256,6 @@ Environment=HTTP_PROXY_PASSWORD= Environment=HTTPS_PROXY_USER= Environment=HTTPS_PROXY_PASSWORD= Environment=CONNECTOR_POSTGRES_PASS= -Environment=STORE_POSTGRES_PASS= Environment=ML_DB_PASS= Environment=MAGICPL_API_KEY= Environment=MAGICPL_MAINZELLISTE_API_KEY= @@ -277,28 +300,38 @@ sudo systemctl daemon-reload; sudo systemctl bridgehead@gbn.service; ``` -### Developers - -Because some developers machines doesn't support system units (e.g Windows Subsystem for Linux), we provide a dev environment [configuration script](./lib/init-test-environment.sh). -It is not recommended to use this script in production! - ## Configuration ### Basic Auth -Some services we use authfication to protect the data. For example for local data managemnt like the blaze. +For Data protection we use basic authenfication for some services. To access those services you need an username and password combination. If you start the bridgehead without basic auth, then those services are not accesbile. We provide a script which set the needed config for you, just run the script and follow the instructions. + +``` shell +add_user.sh +``` + +The result needs to be set in either in the systemd service or in your console. + + +#### Console + +When just running the bridgehead you need to export the auth variable. Be aware that this export is only for the current session in the environment and after exit it will not be accessible anymore. + +``` shell +export bc_auth_user= +``` + +Cation: you need to escape occrring dollar signs. + +#### systemd + -The /auth direcotry contians for each project a file with user and password combination. If it is not present please create a file with just the project name. To add a combination use [htpasswdgenerator](https://htpasswdgenerator.de/) or use htpasswd on your maschine. ### HTTPS Access We advise to use https for all service of your bridgehead. HTTPS is enabled on default. For starting the bridghead you need a ssl certificate. You can either create it yourself or get a signed one. You need to drop the certificates in /certs. -If you want to create it yourself, you can generate the necessary certs with: - -``` shell -openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 365 -``` +The bridgehead create one autotmatic on the first start. However, it will be unsigned and we recomend to get a signed one. ### Locally Managed Secrets @@ -357,34 +390,34 @@ sudo systemctl start bridgehead-update@ #### Remove the Bridgehead System Units -If, for some reason you want to remove the installed bridgehead units, we added a [script](./lib/remove-bridgehead-units.sh) you can execute: +If, for some reason you want to remove the installed bridgehead units, we added a command to [bridgehead](./bridgehead): ``` shell -sudo ./lib/remove-bridgehead-units.sh +sudo /srv/docker/bridgehead/bridgehead uninstall ``` ### On Developers Machine For developers, we provide additional scripts for starting and stopping the specif bridgehead: -#### Start +#### Start or stop -This shell script start a specified bridgehead. Choose between "dktk", "c4" and "gbn". +This command starts a specified bridgehead. Choose between "dktk", "c4" and "gbn". ``` shell -./start-bridgehead +/srv/docker/bridgehead/bridgehead start ``` #### Stop -This shell script stops a specified bridgehead. Choose between "dktk", "c4" and "gbn". +This command stops a specified bridgehead. Choose between "dktk", "c4" and "gbn". ``` shell -./stop-bridgehead +/srv/docker/bridgehead/bridgehead stop ``` #### Update This shell script updates the configuration for all bridgeheads installed on your system. ``` shell -./update-bridgehead +/srv/docker/bridgehead/bridgehead update ``` > NOTE: If you want to regularly update your developing instance, you can create a CRON job that executes this script. diff --git a/bridgehead b/bridgehead new file mode 100755 index 0000000..20616e6 --- /dev/null +++ b/bridgehead @@ -0,0 +1,68 @@ +#!/bin/bash -e + +baseDir() { + # see https://stackoverflow.com/questions/59895 + SOURCE=${BASH_SOURCE[0]} + while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink + DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd ) + SOURCE=$(readlink "$SOURCE") + [[ $SOURCE != /* ]] && SOURCE=$DIR/$SOURCE # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located + done + DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd ) + echo $DIR +} + +BASE=$(baseDir) +cd $BASE + +source ./lib/functions.sh + +ACTION=$1 +export PROJECT=$2 + +if [[ -z $1 || -z $2 ]]; then + printUsage + exit 1 +fi + +case "$PROJECT" in + ccp) + #nothing extra to do + ;; + nngm) + #nothing extra to do + ;; + gbn) + #nothing extra to do + ;; + *) + printUsage + exit 1 + ;; +esac + +case "$ACTION" in + start) + checkRequirements + fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1 + exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf up + ;; + stop) + exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf down + ;; + update) + exec ./lib/update-bridgehead.sh $PROJECT + ;; + install) + exec ./lib/setup-bridgehead-units.sh $PROJECT + ;; + uninstall) + exec ./lib/remove-bridgehead-units.sh $PROJECT + ;; + *) + printUsage + exit 1 + ;; +esac + +exit 0 diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml new file mode 100644 index 0000000..e3ef2e4 --- /dev/null +++ b/ccp/docker-compose.yml @@ -0,0 +1,102 @@ +version: "3.7" + +services: + traefik: + container_name: bridgehead-traefik + image: traefik:latest + command: + - --entrypoints.web.address=:80 + - --entrypoints.websecure.address=:443 + - --providers.docker=true + - --api.dashboard=true + - --accesslog=true # print access-logs + - --entrypoints.web.http.redirections.entrypoint.to=websecure + - --entrypoints.web.http.redirections.entrypoint.scheme=https + labels: + - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)" + - "traefik.http.routers.dashboard.entrypoints=websecure" + - "traefik.http.routers.dashboard.service=api@internal" + - "traefik.http.routers.dashboard.tls=true" + - "traefik.http.routers.dashboard.middlewares=auth" + - "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}" + ports: + - 80:80 + - 443:443 + volumes: + - ../certs:/tools/certs + - /var/run/docker.sock:/var/run/docker.sock:ro + + forward_proxy: + container_name: bridgehead-forward-proxy + image: samply/bridgehead-forward-proxy:develop + environment: + http_proxy: ${http_proxy} + https_proxy: ${https_proxy} + volumes: + - "bridgehead-proxy:/var/log/squid" + + landing: + container_name: bridgehead-landingpage + image: samply/bridgehead-landingpage:master + labels: + - "traefik.enable=true" + - "traefik.http.routers.landing.rule=PathPrefix(`/`)" + - "traefik.http.services.landing.loadbalancer.server.port=80" + - "traefik.http.routers.landing.tls=true" + environment: + HOST: ${HOST} + PROJECT: ${PROJECT} + SITE_NAME: ${SITE_NAME} + + blaze: + image: "samply/blaze:0.17" + container_name: bridgehead-ccp-blaze + environment: + BASE_URL: "http://blaze:8080" + JAVA_TOOL_OPTIONS: "-Xmx4g" + LOG_LEVEL: "debug" + ENFORCE_REFERENTIAL_INTEGRITY: "false" + volumes: + - "blaze-data:/app/data" + labels: + - "traefik.enable=true" + - "traefik.http.middlewares.ccp-auth.basicauth.users=${bc_auth_users}" + - "traefik.http.routers.blaze_ccp.rule=PathPrefix(`/ccp-localdatamanagement`)" + - "traefik.http.middlewares.ccp_b_strip.stripprefix.prefixes=/ccp-localdatamanagement" + - "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080" + - "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,ccp-auth" + - "traefik.http.routers.blaze_ccp.tls=true" + + ccp-search-share: + image: "samply/dktk-fed-search-share:main" + container_name: bridgehead-ccp-share + environment: + APP_BASE_URL: "http://dktk-fed-search-share:8080" + APP_BROKER_BASEURL: "https://dktk-fed-search.verbis.dkfz.de/broker/rest/searchbroker" + APP_BROKER_MAIL: ${CCP_SEARCHBROKER_USERNAME} + APP_BROKER_AUTHTOKEN: ${CCP_SEARCHBROKER_PASSWORD} + APP_STORE_BASEURL: "http://bridgehead-ccp-blaze:8080/fhir" + SPRING_DATASOURCE_URL: "jdbc:postgresql://bridgehead-ccp-share-db:5432/postgres" + JAVA_TOOL_OPTIONS: -Xmx1g -Dhttp.proxyHost=bridgehead-forward-proxy -Dhttp.proxyPort=3128 -Dhttps.proxyHost=bridgehead-forward-proxy -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts="bridgehead-*" + depends_on: + - ccp-search-share-db + - blaze + labels: + - "traefik.enable=true" + - "traefik.http.routers.dktk-fed-search.rule=PathPrefix(`/ccp-connector`)" + - "traefik.http.services.dktk-fed-search.loadbalancer.server.port=8080" + + ccp-search-share-db: + image: "postgres:14" + container_name: bridgehead-ccp-share-db + environment: + POSTGRES_USER: "postgres" + POSTGRES_PASSWORD: "postgres" + POSTGRES_DB: "dktk-fed-search-share" + volumes: + - "ccp-search-share-db-data:/var/lib/postgresql/data" + +volumes: + blaze-data: + bridgehead-proxy: + ccp-search-share-db-data: diff --git a/gbn/docker-compose.yml b/gbn/docker-compose.yml new file mode 100644 index 0000000..476d355 --- /dev/null +++ b/gbn/docker-compose.yml @@ -0,0 +1,100 @@ +version: '3.7' + +volumes: + gbn-connector-logs: + gbn-connector-db-data: + gbn-store-db-data: + +services: + traefik: + container_name: bridgehead-traefik + image: traefik:2 + command: + - --entrypoints.web.address=:80 + - --entrypoints.websecure.address=:443 + - --providers.docker=true + - --api.dashboard=true + - --accesslog=true # print access-logs + - --entrypoints.web.http.redirections.entrypoint.to=websecure + - --entrypoints.web.http.redirections.entrypoint.scheme=https + labels: + - "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)" + - "traefik.http.routers.dashboard.entrypoints=websecure" + - "traefik.http.routers.dashboard.service=api@internal" + - "traefik.http.routers.dashboard.tls=true" + - "traefik.http.routers.dashboard.middlewares=auth" + - "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}" + ports: + - 80:80 + - 443:443 + volumes: + - ../certs:/tools/certs + - /var/run/docker.sock:/var/run/docker.sock:ro + extra_hosts: + - "host.docker.internal:host-gateway" + + forward_proxy: + container_name: bridgehead-forward-proxy + image: ubuntu/squid + environment: + http_proxy: ${http_proxy} + https_proxy: ${https_proxy} + volumes: + - "bridgehead-proxy:/var/log/squid" + + landing: + container_name: bridgehead-landingpage + image: samply/bridgehead-landingpage + labels: + - "traefik.enable=true" + - "traefik.http.routers.landing.rule=PathPrefix(`/`)" + - "traefik.http.services.landing.loadbalancer.server.port=80" + - "traefik.http.routers.landing.tls=true" + environment: + HOST: ${HOST} + PROJECT: ${PROJECT} + SITE_NAME: ${SITE_NAME} + + blaze: + image: "samply/blaze:0.17" + container_name: bridgehead-gbn-blaze + environment: + BASE_URL: "http://blaze:8080" + JAVA_TOOL_OPTIONS: "-Xmx4g" + LOG_LEVEL: "debug" + ENFORCE_REFERENTIAL_INTEGRITY: "false" + volumes: + - "blaze-data:/app/data" + labels: + - "traefik.enable=true" + - "traefik.http.middlewares.gbn-auth.basicauth.users=${bc_auth_users}" + - "traefik.http.routers.blaze_gbn.rule=PathPrefix(`/gbn-localdatamanagement`)" + - "traefik.http.middlewares.gbn_b_strip.stripprefix.prefixes=/gbn-localdatamanagement" + - "traefik.http.services.blaze_gbn.loadbalancer.server.port=8080" + - "traefik.http.routers.blaze_gbn.middlewares=gbn_b_strip,gbn-auth" + - "traefik.http.routers.blaze_gbn.tls=true" + + gbn-connector: + container_name: bridgehead-gbn-connector + image: "samply/share-client:gbn-feature-environmentPreconfiguration" + environment: + POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS} + volumes: + - "gbn-connector-logs:/usr/local/tomcat/logs" + labels: + - "traefik.enable=true" + - "traefik.http.routers.gbn_connector.rule=PathPrefix(`/gbn-connector`)" + - "traefik.http.services.gbn_connector.loadbalancer.server.port=8080" + depends_on: + - "gbn-connector-db" + restart: "always" + + gbn-connector-db: + image: "postgres:10.17" + environment: + POSTGRES_DB: "samply.connector" + POSTGRES_USER: "samply" + POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS} + volumes: + - "gbn-connector-db-data:/var/lib/postgresql/data" + restart: "always" diff --git a/lib/add_bc_user.sh b/lib/add_bc_user.sh new file mode 100755 index 0000000..8185658 --- /dev/null +++ b/lib/add_bc_user.sh @@ -0,0 +1,10 @@ +#!/bin/bash -e +source lib/functions.sh + +log "INFO" "This script add's a user with password to the bridghead" + +read -p 'Username: ' bc_user +read -sp 'Password: ' bc_password + +log "INFO" "\nPlease export the line in the your environment. Please replace the dollar signs with with \\\$" +docker run --rm -it httpd:latest htpasswd -nb $bc_user $bc_password diff --git a/lib/functions.sh b/lib/functions.sh index 4dc30f5..d16094c 100755 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -2,11 +2,115 @@ exitIfNotRoot() { if [ "$EUID" -ne 0 ]; then +<<<<<<< HEAD echo "Please run as root" +======= + log "ERROR" "Please run as root" +>>>>>>> version-1 exit 1 fi } +<<<<<<< HEAD log() { echo "$(date +'%Y-%m-%d %T')" "$1:" "$2" } +======= +checkOwner(){ + COUNT=$(find $1 ! -user $2 |wc -l) + if [ $COUNT -gt 0 ]; then + log ERROR "$COUNT files in $1 are not owned by user $2. Run find $1 ! -user $2 to see them, chown -R $2 $1 to correct this issue." + return 1 + fi + return 0 +} + +log() { + echo -e "$(date +'%Y-%m-%d %T')" "$1:" "$2" +} + +printUsage() { + echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME" + echo "PROJECTNAME should be one of ccp|nngm|gbn" +} + +checkRequirements() { + if ! lib/prerequisites.sh; then + log "ERROR" "Validating Prerequisites failed, please fix the error(s) above this line." + exit 1 + else + return 0 + fi +} + +fetchVarsFromVault() { + [ -e /etc/bridgehead/vault.conf ] && source /etc/bridgehead/vault.conf + + if [ -z "$BW_MASTERPASS" ] || [ -z "$BW_CLIENTID" ] || [ -z "$BW_CLIENTSECRET" ]; then + log "ERROR" "Please supply correct credentials in /etc/bridgehead/vault.conf." + return 1 + fi + + set +e + + PASS=$(BW_MASTERPASS="$BW_MASTERPASS" BW_CLIENTID="$BW_CLIENTID" BW_CLIENTSECRET="$BW_CLIENTSECRET" docker run --rm -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET -e http_proxy samply/bridgehead-vaultfetcher $@) + RET=$? + + if [ $RET -ne 0 ]; then + echo "Code: $RET" + echo $PASS + return $RET + fi + + eval $(echo -e "$PASS" | sed 's/\r//g') + + set -e + + return 0 +} + +fetchVarsFromVaultByFile() { + VARS_TO_FETCH="" + + for line in $(cat $@); do + if [[ $line =~ .*=[\"]*\[\"]*.* ]]; then + VARS_TO_FETCH+="$(echo -n $line | sed 's/=.*//') " + fi + done + + if [ -z "$VARS_TO_FETCH" ]; then + return 0 + fi + + log INFO "Fetching $(echo $VARS_TO_FETCH | wc -w) secrets from Vault ..." + + fetchVarsFromVault $VARS_TO_FETCH + + return 0 +} + +assertVarsNotEmpty() { + MISSING_VARS="" + + for VAR in $@; do + if [ -z "${!VAR}" ]; then + MISSING_VARS+="$VAR " + fi + done + + if [ -n "$MISSING_VARS" ]; then + log "ERROR" "Mandatory variables not defined: $MISSING_VARS" + return 1 + fi + + return 0 +} + +##Setting Network properties +export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}'); +export HOST=$(hostname) +export PRODUCTION="false"; +if [ "$(git branch --show-current)" == "main" ]; then + export PRODUCTION="true"; +fi +>>>>>>> version-1 diff --git a/lib/gitpassword.sh b/lib/gitpassword.sh new file mode 100755 index 0000000..25eb9ce --- /dev/null +++ b/lib/gitpassword.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +if [ "$1" != "get" ]; then + echo "Usage: $0 get" + exit 1 +fi + +baseDir() { + # see https://stackoverflow.com/questions/59895 + SOURCE=${BASH_SOURCE[0]} + while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink + DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd ) + SOURCE=$(readlink "$SOURCE") + [[ $SOURCE != /* ]] && SOURCE=$DIR/$SOURCE # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located + done + DIR=$( cd -P "$( dirname "$SOURCE" )/.." >/dev/null 2>&1 && pwd ) + echo $DIR +} + +BASE=$(baseDir) +cd $BASE + +source lib/functions.sh + +assertVarsNotEmpty SITE_ID || exit 1 + +PARAMS="$(cat)" +GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g') + +fetchVarsFromVault GIT_PASSWORD + +if [ -z "${GIT_PASSWORD}" ]; then + log ERROR "Git password not found." + exit 1 +fi + +cat </dev/null; then + log ERROR "User bridgehead does not exist. Please consult readme for installation." + exit 1 +fi + +checkOwner . bridgehead || exit 1 +checkOwner /etc/bridgehead bridgehead || exit 1 + +## Check if user is a su +log INFO "Checking if all prerequisites are met ..." +>>>>>>> version-1 prerequisites="git docker docker-compose" for prerequisite in $prerequisites; do $prerequisite --version 2>&1 @@ -15,6 +30,7 @@ for prerequisite in $prerequisites; do # TODO: Check for specific version done +<<<<<<< HEAD echo "Checking site.conf" #check if site.conf is created @@ -52,3 +68,44 @@ if [ -d "site-config/${project}.env" ]; then fi echo "All prerequisites are met!" +======= +log INFO "Checking configuration ..." + +## Download submodule +if [ ! -d "/etc/bridgehead/" ]; then + log ERROR "Please set up the config folder at /etc/bridgehead. Instruction are in the readme." + exit 1 +fi + +# TODO: Check all required variables here in a generic loop + +#check if project env is present +if [ -d "/etc/bridgehead/${PROJECT}.conf" ]; then + log ERROR "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf." + exit 1 +fi + +# TODO: Make sure you're in the right directory, or, even better, be independent from the working directory. + +log INFO "Checking ssl cert" + +if [ ! -d "certs" ]; then + log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)" + mkdir -p certs +fi + +if [ ! -e "certs/traefik.crt" ]; then + openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 3650 -subj "/CN=$HOST" +fi + +if [ -e /etc/bridgehead/vault.conf ]; then + if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then + log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf." + exit 1 + fi +fi + +log INFO "Success - all prerequisites are met!" + +exit 0 +>>>>>>> version-1 diff --git a/lib/remove-bridgehead-units.sh b/lib/remove-bridgehead-units.sh new file mode 100755 index 0000000..b81b042 --- /dev/null +++ b/lib/remove-bridgehead-units.sh @@ -0,0 +1,25 @@ +#!/bin/bash -e + +source lib/functions.sh + +if [ $# -eq 0 ]; then + log "ERROR" "Please provide a Project as argument" + exit 1 +fi + +if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then + log "ERROR" "Please provide a supported project like ccp, gbn or nngm" + exit 1 +fi + +export PROJECT=$1 + +#checkRequirements // not needed when uninstalling + +log "INFO" "Stopping system units and removing bridgehead for ${PROJECT} ..." + +systemctl disable --now bridgehead@${PROJECT}.service bridgehead-update@${PROJECT}.timer bridgehead-update@${PROJECT}.service + +rm -v /etc/systemd/system/{bridgehead\@.service,bridgehead-update\@.timer,bridgehead-update\@.service} + +log "INFO" "Successfully removed bridgehead for ${PROJECT} from your system" diff --git a/lib/setup-bridgehead-units.sh b/lib/setup-bridgehead-units.sh new file mode 100755 index 0000000..dc3f9fb --- /dev/null +++ b/lib/setup-bridgehead-units.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +source lib/functions.sh + +exitIfNotRoot + +if [ $# -eq 0 ]; then + log "ERROR" "Please provide a Project as argument" + exit 1 +fi + +if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then + log "ERROR" "Please provide a supported project like ccp, gbn or nngm" + exit 1 +fi + +export PROJECT=$1 + +checkRequirements + +log "INFO" "Register system units for bridgehead and bridgehead-update" +cp -v \ + lib/systemd/bridgehead\@.service \ + lib/systemd/bridgehead-update\@.service \ + lib/systemd/bridgehead-update\@.timer \ + /etc/systemd/system/ + +systemctl daemon-reload + +if ! systemctl is-active --quiet bridgehead@"${PROJECT}"; then + log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service" + systemctl enable bridgehead@"${PROJECT}" + log "INFO" "Enabling nightly updates for bridgehead@${PROJECT}.service ..." + systemctl enable --now bridgehead-update@"${PROJECT}".timer +fi + +log "INFO" "\nDone - now start your bridgehead by running\n\tsystemctl start bridgehead@${PROJECT}.service\nor by rebooting your machine." diff --git a/lib/systemd/bridgehead-update@.service b/lib/systemd/bridgehead-update@.service index c70495a..6c41bd4 100644 --- a/lib/systemd/bridgehead-update@.service +++ b/lib/systemd/bridgehead-update@.service @@ -1,3 +1,4 @@ +<<<<<<< HEAD [Unit] Description=Bridgehead (%i) Update Service @@ -8,3 +9,15 @@ ExecStart=/bin/bash -c "/srv/docker/bridgehead/update-bridgehead.sh %i" [Install] WantedBy=multi-user.target +======= +[Unit] +Description=Bridgehead (%i) Update Service + +[Service] +Type=oneshot +User=bridgehead +ExecStart=/srv/docker/bridgehead/bridgehead update %i + +[Install] +WantedBy=multi-user.target +>>>>>>> version-1 diff --git a/lib/systemd/bridgehead-update@.timer b/lib/systemd/bridgehead-update@.timer index ce44814..546fc90 100644 --- a/lib/systemd/bridgehead-update@.timer +++ b/lib/systemd/bridgehead-update@.timer @@ -1,3 +1,4 @@ +<<<<<<< HEAD [Unit] Description=Nightly Updates of Bridgehead (%i) @@ -6,3 +7,13 @@ OnCalendar=*-*-* 03:00:00 [Install] WantedBy=basic.target +======= +[Unit] +Description=Nightly Updates of Bridgehead (%i) + +[Timer] +OnCalendar=*-*-* 03:00:00 + +[Install] +WantedBy=basic.target +>>>>>>> version-1 diff --git a/lib/systemd/bridgehead@.service b/lib/systemd/bridgehead@.service index 73718b9..25e3364 100644 --- a/lib/systemd/bridgehead@.service +++ b/lib/systemd/bridgehead@.service @@ -1,3 +1,4 @@ +<<<<<<< HEAD [Unit] Description=Bridgehead (%i) Service @@ -13,3 +14,17 @@ ExecStop=/bin/bash -c '`which docker-compose` -f %i/docker-compose.yml --env-fil [Install] WantedBy=multi-user.target +======= +[Unit] +Description=Bridgehead (%i) Service + +[Service] +User=bridgehead +Restart=always +RestartSec=30 +ExecStart=/srv/docker/bridgehead/bridgehead start %i +ExecStop=/srv/docker/bridgehead/bridgehead stop %i + +[Install] +WantedBy=multi-user.target +>>>>>>> version-1 diff --git a/lib/update-bridgehead.sh b/lib/update-bridgehead.sh new file mode 100755 index 0000000..b6cd317 --- /dev/null +++ b/lib/update-bridgehead.sh @@ -0,0 +1,73 @@ +#!/bin/bash +source lib/functions.sh + +CONFFILE=/etc/bridgehead/$1.conf + +if [ ! -e $CONFFILE ]; then + log ERROR "Configuration file $CONFFILE not found." + exit 1 +fi + +source $CONFFILE + +assertVarsNotEmpty SITE_ID || exit 1 +export SITE_ID + +checkOwner . bridgehead || exit 1 +checkOwner /etc/bridgehead bridgehead || exit 1 + +CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh" + +# Check git updates +for DIR in /etc/bridgehead $(pwd); do + log "INFO" "Checking for updates to git repo $DIR ..." + if [ "$(git -C $DIR config --get credential.helper)" != "$CREDHELPER" ]; then + log "INFO" "Configuring repo to use bridgehead git credential helper." + git -C $DIR config credential.helper "$CREDHELPER" + fi + old_git_hash="$(git -C $DIR rev-parse --verify HEAD)" + git -C $DIR fetch 2>&1 + git -C $DIR pull 2>&1 + new_git_hash="$(git -C $DIR rev-parse --verify HEAD)" + git_updated="false" + if [ "$old_git_hash" != "$new_git_hash" ]; then + log "INFO" "Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash" + # NOTE: Link generation doesn't work on repositories placed at an self-hosted instance of bitbucket. + # See: https://community.atlassian.com/t5/Bitbucket-questions/BitBucket-4-14-diff-between-any-two-commits/qaq-p/632974 + git_repository_url="$(git -C $DIR remote get-url origin)" + git_repository_url=${git_repository_url/.git/} + if [ "$( echo $git_repository_url | grep "github.com")" ]; then + # Ensure web link even if ssh is used + git_repository_url="${git_repository_url/git@github.com/https:\/\/github.com\/}" + log "INFO" "You can review all changes on the repository with $git_repository_url/compare/$old_git_hash...$new_git_hash" + elif [ "$( echo $git_repository_url | grep "git.verbis.dkfz.de")" ]; then + git_repository_url="${git_repository_url/ssh:\/\/git@git.verbis.dkfz.de/https:\/\/git.verbis.dkfz.de\/}" + git_repository_url="https://$(echo $git_repository_url | awk -F '@' '{print $2}')" + log "INFO" "You can review all changes on the repository with $git_repository_url/compare?from=$old_git_hash&to=$new_git_hash" + fi + git_updated="true" + fi +done + +# Check docker updates +log "INFO" "Checking for updates to running docker images ..." +docker_updated="false" +for IMAGE in $(docker ps --filter "name=bridgehead" --format {{.Image}}); do + log "INFO" "Checking for Updates of Image: $IMAGE" + if docker pull $IMAGE | grep "Downloaded newer image"; then + log "INFO" "$IMAGE updated." + docker_updated="true" + fi +done + +# If anything is updated, restart service +if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then + log "INFO" "Update detected, now restarting bridgehead" + systemctl restart 'bridgehead@*' +else + log "INFO" "Nothing updated, nothing to restart." +fi + +exit 0 + +# TODO: Print last commit explicit diff --git a/nngm/docker-compose.yml b/nngm/docker-compose.yml new file mode 100644 index 0000000..3b28580 --- /dev/null +++ b/nngm/docker-compose.yml @@ -0,0 +1,86 @@ +version: "3.7" + +services: + traefik: + container_name: bridgehead-traefik + image: traefik:2.4 + command: + - --api.insecure=true + - --entrypoints.web.address=:80 + - --entrypoints.websecure.address=:443 + - --providers.docker=true + - --entrypoints.web.http.redirections.entrypoint.to=websecure + - --entrypoints.web.http.redirections.entrypoint.scheme=https + ports: + - 80:80 + - 443:443 + - 8080:8080 + volumes: + - ../certs:/tools/certs + - /var/run/docker.sock:/var/run/docker.sock:ro + extra_hosts: + - "host.docker.internal:host-gateway" + + ### Does need to know the outside proxy to connect central components + forward_proxy: + container_name: bridgehead-squid + image: ubuntu/squid + environment: + http_proxy: ${http_proxy} + https_proxy: ${https_proxy} + volumes: + - "bridgehead-proxy:/var/log/squid" + +## Needs internal proxy config + landing: + container_name: bridgehead-landingpage + image: samply/bridgehead-landingpage + labels: + - "traefik.enable=true" + - "traefik.http.routers.landing.rule=PathPrefix(`/`)" + - "traefik.http.services.landing.loadbalancer.server.port=80" + - "traefik.http.routers.landing.tls=true" + environment: + HOST: ${HOST} + PROJECT: ${PROJECT} + SITE_NAME: ${SITE_NAME} + + nngm-connector: + container_name: bridgehead-nngm-connector + image: "samply/share-client:nngm-feature-environmentPreconfiguration" + environment: + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} + NNGM_MAGICPL_APIKEY: ${NNGM_MAGICPL_APIKEY} + NNGM_MAINZELLISTE_APIKEY: ${NNGM_MAINZELLISTE_APIKEY} + NNGM_CTS_APIKEY: ${NNGM_CTS_APIKEY} + NNGM_CRYPTKEY: ${NNGM_CRYPTKEY} + volumes: + - "nngm-connector-logs:/usr/local/tomcat/logs" + labels: + - "traefik.enable=true" + - "traefik.http.routers.nngm_connector.rule=PathPrefix(`/nngm-connector`)" + - "traefik.http.services.nngm_connector.loadbalancer.server.port=8080" + - "traefik.http.routers.nngm_connector.tls=true" + + depends_on: + - "nngm-connector-db" + - "forward_proxy" + ports: + - 5005:5005 + restart: "always" + + nngm-connector-db: + container_name: bridgehead-nngm-connector-db + image: "postgres:10.17" + environment: + POSTGRES_DB: "share_v2" + POSTGRES_USER: "samplyweb" + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} + volumes: + - "nngm-connector-db-data:/var/lib/postgresql/data" + restart: "always" + +volumes: + nngm-connector-db-data: + nngm-connector-logs: + bridgehead-proxy: