verbis-admin
/
bridgehead
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'version-1' into develop

This commit is contained in:
Patrick Skowronek 2022-07-12 11:06:19 +02:00
parent 28fcb2159c 65c30708b8
commit 411edbf0e7
17 changed files with 1074 additions and 298 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

223
README.md
View File

@ -8,13 +8,17 @@ TOC
1. [About](#about)
- [Projects](#projects)
- [GBA/BBMRI-ERIC](#gbabbmri-eric)
- [DKTK/C4](#dktkc4)
- [CCP(DKTK/C4)](#ccpdktkc4)
- [NNGM](#nngm)
- [Bridgehead Components](#bridgehead-components)
- [Blaze Server](#blaze-serverhttpsgithubcomsamplyblaze)
- [Connector](#connector)
1. [Requirements](#requirements)
- [Hardware](#hardware)
- [System](#system-requirements)
- [git](#git)
- [docker](#dockerhttpsdocsdockercomget-docker)
- [systemd](#systemd)
2. [Getting Started](#getting-started)
- [DKTK](#dktkc4)
- [C4](#c4)
@ -32,9 +36,9 @@ TOC
TODO: Insert comprehensive feature list of the bridgehead? Why would anyone install it?
### Projects
## Projects
#### GBA/BBMRI-ERIC
### GBA/BBMRI-ERIC
The **Sample Locator** is a tool that allows researchers to make searches for samples over a large number of geographically distributed biobanks. Each biobank runs a so-called **Bridgehead** at its site, which makes it visible to the Sample Locator. The Bridgehead is designed to give a high degree of protection to patient data. Additionally, a tool called the [Negotiator][negotiator] puts you in complete control over which samples and which data are delivered to which researcher.
@ -44,11 +48,11 @@ The Bridgehead has two primary components:
* The **Blaze Store**. This is a highly responsive FHIR data store, which you will need to fill with your data via an ETL chain.
* The **Connector**. This is the communication portal to the Sample Locator, with specially designed features that make it possible to run it behind a corporate firewall without making any compromises on security.
#### DKTK/C4
### CCP(DKTK/C4)
TODO:
#### NNGM
### nNGM
TODO:
@ -62,8 +66,6 @@ This holds the actual data being searched. This store must be filled by you, gen
TODO:
## Requirements
### Hardware
@ -72,149 +74,169 @@ For running your bridgehead we recommend the follwing Hardware:
- 4 CPU cores
- At least 8 GB Ram
- 10GB Hard Drive + how many data GB you need to store in the bridgehead
- 100GB Hard Drive, SSD recommended
### System Requirements
Before starting the installation process, please ensure that following software is available on your system:
#### [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
#### Git
Check if you have at leat git 2.0 installed on the system with:
To check that you have a working git installation, please run
``` shell
cd ~/;
git clone https://github.com/octocat/Hello-World.git;
cat ~/Hello-World/README;
rm -rf Hello-World;
git --version
```
If you see the output "Hello World!" your installation should be working.
#### [Docker](https://docs.docker.com/get-docker/)
To check your docker installation, you can try to execute dockers "Hello World" Image. The command is:
``` shell
docker run --rm --name hello-world hello-world;
```
Docker will now download the "hello-world" docker image and try to execute it. After the download you should see a message starting with "Hello from Docker!".
> NOTE: If the download of the image fails (e.g with "connection timed out" message), ensure that you have correctly set the proxy for the docker daemon. Refer to ["Docker Daemon Proxy Configuration" in the "Pitfalls" section](#docker-daemon-proxy-configuration)
You should also check, that the version of docker installed by you is newer than "1.20". To check this, just run
To check your docker installation, you should execute the docker with --version:
``` shell
docker --version
```
#### [Docker Compose](https://docs.docker.com/compose/cli-command/#installing-compose-v2)
To check your docker-compose installation, please run the following command. It uses the "hello-world" image from the previous section:
``` shell
docker-compose -f - up <<EOF
version: "3.9"
services:
hello-world:
image: hello-world
EOF
```
After executing the command, you should again see the message starting with "Hello from Docker!".
You should also ensure, that the version of docker-compose installed by you is newer than "2.XX". To check this, just run
The Version should be higher than "20.10.1". Otherwise you will have problems starting the bridgehead. The next step is to check ``` docker-compose``` with:
``` shell
docker-compose --version
```
The recomended version is "2.XX" and higher. If docker-compose was not installed with docker follow these [instructions](https://docs.docker.com/compose/install/#install-compose-as-standalone-binary-on-linux-systems). To futher check your docker and docker-compose installation, please run the following command.
``` shell
docker-compose -f - up <<EOF
version: "3.7"
services:
hello-world:
image: hello-world
EOF
```
Docker will now download the "hello-world" docker image and try to execute it. After the download you should see a message starting with "Hello from Docker!".
> NOTE: If the download of the image fails (e.g with "connection timed out" message), ensure that you have correctly set the proxy for the docker daemon. Refer to ["Docker Daemon Proxy Configuration" in the "Pitfalls" section](#docker-daemon-proxy-configuration)
#### [systemd](https://systemd.io/)
You shouldn't need to install it yourself. If systemd is not available on your system you should get another system.
You shouldn't need to install it yourself, If systemd is not available on your system you should get another system.
To check if systemd is available on your system, please execute
``` shell
systemctl --version
```
If systemd is not installed, you can start the bridgehead. However, for productive use we recomend using systemd.
---
## Getting Started
### Installation
If your system passed all checks from ["Requirements" section], you are now ready to download the bridgehead.
First, clone the repository to the directory "/srv/docker/bridgehead":
u
``` shell
sudo mkdir -p /srv/docker/;
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead;
```
Next, you need to configure a set of variables, specific for your site with not so high security concerns. You can visit the configuration template at [GitHub](https://github.com/samply/bridgehead-config). You can download the repositories contents and add them to the "bridgehead-config" directory.
It is recomended to create a user for the bridgehead service. This should be done after clone the repository. Since not all linux distros support ```adduser```, we provide an action for the systemcall ```useradd```. You should try the first one, when the systm can't create the user you should try the second one.
``` shell
sudo git submodule add -f https://github.com/samply/bridgehead-config.git ./site-config;
adduser --no-create-home --disabled-login --ingroup docker --gecos "" bridgehead
```
``` shell
useradd -M -g docker -N -s /sbin/nologin bridgehead
```
After adding the User you need to change the ownership of the directory to the bridgehead user.
``` shell
chown bridgehead /srv/docker/bridgehead/ -R
```
### Configuration
> NOTE: If you are part of the CCP-IT we will provide you another link for the configuration.
You should now be able to run a bridgehead instance. To check if everything works, execute the following:
Next, you need to configure a set of variables, specific for your site with not so high security concerns. You can clone the configuration template at [GitHub](https://github.com/samply/bridgehead-config). The confiugration of the bridgehead should be located in /etc/bridghead.
``` shell
sudo ./lib/init-test-environment.sh;
sudo ./start-bridgehead.sh <dktk/gbn/c4>;
sudo git clone https://github.com/samply/bridgehead-config.git /etc/bridgehead;
```
You should now be able to access the landing page on your system, e.g "http://<your-host>/"
After cloning or forking the repository you need to add value to the template. If you are a part of the CCP-IT you will get an already filled out config repo.
To remove the test-environment, run (make sure you don't have other docker services installed on this system, docker volume prune is destructive!)
### Testing your bridgehead
We recomend to run first with the start and stop script. If you have trouble starting the bridghead have a look at the troubleshooting section.
Now you ready to run a bridgehead instance. The bridgehead scripts checks if your configuration is correct. To check if everything works, execute the following:
``` shell
sudo ./stop-bridgehead.sh <dktk/gbn/c4>;
sudo docker volume prune;
/srv/docker/bridgehead/bridgehead start <Project>
```
For a server, we highly recommend that you install the system units for managing the bridgehead, provided by us. . You can do this by executing the [setup-bridgehead-units.sh](./lib/setup-bridgehead-units.sh) script:
You should now be able to access the landing page on your system, e.g "https://<your-host>/".
To shutdown the bridgehead just run.
``` shell
sudo ./lib/setup-bridgehead-units.sh
/srv/docker/bridgehead/bridgehead stop <Project>
```
Finally, you need to configure your sites secrets. These are places as configuration for each bridgeheads system unit. Refer to the section for your specific project:
### Systemd service configuration
For a server, we highly recommend that you install the system units for managing the bridgehead, provided by us. You can do this by executing the [bridgehead](./bridgehead) script:
``` shell
sudo /srv/docker/bridgehead/bridgehead install <Project>
```
This will install the systemd units to run and update the bridghead.
Finally, you need to configure your sites secrets. These are places as configuration for each bridgehead system unit. Refer to the section for your specific project:
For Every project you need to set the proxy this way, if you have one. This is done with the ```systemctl edit``` comand.
``` shell
sudo systemctl edit bridgehead@<project>.service;
sudo systemctl edit bridgehead-update@<project>.service;
```
``` conf
[Service]
Environment=http_proxy=<proxy-url>
Environment=https_proxy=<proxy-url>
```
There a further configurations for each project.
#### CCP(DKTK/C4)
For the federate search please follow the basic auth configuration step.
### DKTK/C4
You can create the site specific configuration with:
``` shell
sudo systemctl edit bridgehead@dktk.service;
```
This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor and define your machines secrets. You share some of the ID-Management secrets with the central patientlist (Mainz) and controlnumbergenerator (Frankfurt). Refer to the ["Configuration" section](#configuration) for this.
``` conf
[Service]
Environment=HOSTIP=
Environment=HOST=
Environment=HTTP_PROXY_USER=
Environment=HTTP_PROXY_PASSWORD=
Environment=HTTPS_PROXY_USER=
Environment=HTTPS_PROXY_PASSWORD=
Environment=CONNECTOR_POSTGRES_PASS=
Environment=ML_DB_PASS=
Environment=MAGICPL_API_KEY=
Environment=MAGICPL_MAINZELLISTE_API_KEY=
Environment=MAGICPL_API_KEY_CONNECTOR=
Environment=MAGICPL_MAINZELLISTE_CENTRAL_API_KEY=
Environment=MAGICPL_CENTRAL_API_KEY=
Environment=MAGICPL_OIDC_CLIENT_ID=
Environment=MAGICPL_OIDC_CLIENT_SECRET=
Environment=http_proxy=
Environment=https_proxy=
```
To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service:
``` shell
sudo systemctl daemon-reload;
sudo systemctl bridgehead@dktk.service;
sudo systemctl bridgehead@ccp.service;
```
### C4
You can create the site specific configuration with:
``` shell
@ -225,6 +247,8 @@ This will open your default editor allowing you to edit the docker system units
``` conf
[Service]
Environment=http_proxy=
Environment=https_proxy=
Environment=HOSTIP=
Environment=HOST=
Environment=HTTP_PROXY_USER=
@ -232,7 +256,6 @@ Environment=HTTP_PROXY_PASSWORD=
Environment=HTTPS_PROXY_USER=
Environment=HTTPS_PROXY_PASSWORD=
Environment=CONNECTOR_POSTGRES_PASS=
Environment=STORE_POSTGRES_PASS=
Environment=ML_DB_PASS=
Environment=MAGICPL_API_KEY=
Environment=MAGICPL_MAINZELLISTE_API_KEY=
@ -277,28 +300,38 @@ sudo systemctl daemon-reload;
sudo systemctl bridgehead@gbn.service;
```
### Developers
Because some developers machines doesn't support system units (e.g Windows Subsystem for Linux), we provide a dev environment [configuration script](./lib/init-test-environment.sh).
It is not recommended to use this script in production!
## Configuration
### Basic Auth
Some services we use authfication to protect the data. For example for local data managemnt like the blaze.
For Data protection we use basic authenfication for some services. To access those services you need an username and password combination. If you start the bridgehead without basic auth, then those services are not accesbile. We provide a script which set the needed config for you, just run the script and follow the instructions.
``` shell
add_user.sh
```
The result needs to be set in either in the systemd service or in your console.
#### Console
When just running the bridgehead you need to export the auth variable. Be aware that this export is only for the current session in the environment and after exit it will not be accessible anymore.
``` shell
export bc_auth_user=<output>
```
Cation: you need to escape occrring dollar signs.
#### systemd
The /auth direcotry contians for each project a file with user and password combination. If it is not present please create a file with just the project name. To add a combination use [htpasswdgenerator](https://htpasswdgenerator.de/) or use htpasswd on your maschine.
### HTTPS Access
We advise to use https for all service of your bridgehead. HTTPS is enabled on default. For starting the bridghead you need a ssl certificate. You can either create it yourself or get a signed one. You need to drop the certificates in /certs.
If you want to create it yourself, you can generate the necessary certs with:
``` shell
openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 365
```
The bridgehead create one autotmatic on the first start. However, it will be unsigned and we recomend to get a signed one.
### Locally Managed Secrets
@ -357,34 +390,34 @@ sudo systemctl start bridgehead-update@<dktk/c4/gbn>
#### Remove the Bridgehead System Units
If, for some reason you want to remove the installed bridgehead units, we added a [script](./lib/remove-bridgehead-units.sh) you can execute:
If, for some reason you want to remove the installed bridgehead units, we added a command to [bridgehead](./bridgehead):
``` shell
sudo ./lib/remove-bridgehead-units.sh
sudo /srv/docker/bridgehead/bridgehead uninstall <project>
```
### On Developers Machine
For developers, we provide additional scripts for starting and stopping the specif bridgehead:
#### Start
#### Start or stop
This shell script start a specified bridgehead. Choose between "dktk", "c4" and "gbn".
This command starts a specified bridgehead. Choose between "dktk", "c4" and "gbn".
``` shell
./start-bridgehead <dktk/c4/gbn>
/srv/docker/bridgehead/bridgehead start <dktk/c4/gbn>
```
#### Stop
This shell script stops a specified bridgehead. Choose between "dktk", "c4" and "gbn".
This command stops a specified bridgehead. Choose between "dktk", "c4" and "gbn".
``` shell
./stop-bridgehead <dktk/c4/gbn>
/srv/docker/bridgehead/bridgehead stop <dktk/c4/gbn>
```
#### Update
This shell script updates the configuration for all bridgeheads installed on your system.
``` shell
./update-bridgehead
/srv/docker/bridgehead/bridgehead update
```
> NOTE: If you want to regularly update your developing instance, you can create a CRON job that executes this script.

68
bridgehead Executable file
View File

@ -0,0 +1,68 @@
#!/bin/bash -e
baseDir() {
# see https://stackoverflow.com/questions/59895
SOURCE=${BASH_SOURCE[0]}
while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink
DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd )
SOURCE=$(readlink "$SOURCE")
[[ $SOURCE != /* ]] && SOURCE=$DIR/$SOURCE # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
done
DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd )
echo $DIR
}
BASE=$(baseDir)
cd $BASE
source ./lib/functions.sh
ACTION=$1
export PROJECT=$2
if [[ -z $1 || -z $2 ]]; then
printUsage
exit 1
fi
case "$PROJECT" in
ccp)
#nothing extra to do
;;
nngm)
#nothing extra to do
;;
gbn)
#nothing extra to do
;;
*)
printUsage
exit 1
;;
esac
case "$ACTION" in
start)
checkRequirements
fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1
exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf up
;;
stop)
exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.conf down
;;
update)
exec ./lib/update-bridgehead.sh $PROJECT
;;
install)
exec ./lib/setup-bridgehead-units.sh $PROJECT
;;
uninstall)
exec ./lib/remove-bridgehead-units.sh $PROJECT
;;
*)
printUsage
exit 1
;;
esac
exit 0

102
ccp/docker-compose.yml Normal file
View File

@ -0,0 +1,102 @@
version: "3.7"
services:
traefik:
container_name: bridgehead-traefik
image: traefik:latest
command:
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --providers.docker=true
- --api.dashboard=true
- --accesslog=true # print access-logs
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
labels:
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
- "traefik.http.routers.dashboard.entrypoints=websecure"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.dashboard.tls=true"
- "traefik.http.routers.dashboard.middlewares=auth"
- "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}"
ports:
- 80:80
- 443:443
volumes:
- ../certs:/tools/certs
- /var/run/docker.sock:/var/run/docker.sock:ro
forward_proxy:
container_name: bridgehead-forward-proxy
image: samply/bridgehead-forward-proxy:develop
environment:
http_proxy: ${http_proxy}
https_proxy: ${https_proxy}
volumes:
- "bridgehead-proxy:/var/log/squid"
landing:
container_name: bridgehead-landingpage
image: samply/bridgehead-landingpage:master
labels:
- "traefik.enable=true"
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
- "traefik.http.services.landing.loadbalancer.server.port=80"
- "traefik.http.routers.landing.tls=true"
environment:
HOST: ${HOST}
PROJECT: ${PROJECT}
SITE_NAME: ${SITE_NAME}
blaze:
image: "samply/blaze:0.17"
container_name: bridgehead-ccp-blaze
environment:
BASE_URL: "http://blaze:8080"
JAVA_TOOL_OPTIONS: "-Xmx4g"
LOG_LEVEL: "debug"
ENFORCE_REFERENTIAL_INTEGRITY: "false"
volumes:
- "blaze-data:/app/data"
labels:
- "traefik.enable=true"
- "traefik.http.middlewares.ccp-auth.basicauth.users=${bc_auth_users}"
- "traefik.http.routers.blaze_ccp.rule=PathPrefix(`/ccp-localdatamanagement`)"
- "traefik.http.middlewares.ccp_b_strip.stripprefix.prefixes=/ccp-localdatamanagement"
- "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080"
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,ccp-auth"
- "traefik.http.routers.blaze_ccp.tls=true"
ccp-search-share:
image: "samply/dktk-fed-search-share:main"
container_name: bridgehead-ccp-share
environment:
APP_BASE_URL: "http://dktk-fed-search-share:8080"
APP_BROKER_BASEURL: "https://dktk-fed-search.verbis.dkfz.de/broker/rest/searchbroker"
APP_BROKER_MAIL: ${CCP_SEARCHBROKER_USERNAME}
APP_BROKER_AUTHTOKEN: ${CCP_SEARCHBROKER_PASSWORD}
APP_STORE_BASEURL: "http://bridgehead-ccp-blaze:8080/fhir"
SPRING_DATASOURCE_URL: "jdbc:postgresql://bridgehead-ccp-share-db:5432/postgres"
JAVA_TOOL_OPTIONS: -Xmx1g -Dhttp.proxyHost=bridgehead-forward-proxy -Dhttp.proxyPort=3128 -Dhttps.proxyHost=bridgehead-forward-proxy -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts="bridgehead-*"
depends_on:
- ccp-search-share-db
- blaze
labels:
- "traefik.enable=true"
- "traefik.http.routers.dktk-fed-search.rule=PathPrefix(`/ccp-connector`)"
- "traefik.http.services.dktk-fed-search.loadbalancer.server.port=8080"
ccp-search-share-db:
image: "postgres:14"
container_name: bridgehead-ccp-share-db
environment:
POSTGRES_USER: "postgres"
POSTGRES_PASSWORD: "postgres"
POSTGRES_DB: "dktk-fed-search-share"
volumes:
- "ccp-search-share-db-data:/var/lib/postgresql/data"
volumes:
blaze-data:
bridgehead-proxy:
ccp-search-share-db-data:

100
gbn/docker-compose.yml Normal file
View File

@ -0,0 +1,100 @@
version: '3.7'
volumes:
gbn-connector-logs:
gbn-connector-db-data:
gbn-store-db-data:
services:
traefik:
container_name: bridgehead-traefik
image: traefik:2
command:
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --providers.docker=true
- --api.dashboard=true
- --accesslog=true # print access-logs
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
labels:
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
- "traefik.http.routers.dashboard.entrypoints=websecure"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.dashboard.tls=true"
- "traefik.http.routers.dashboard.middlewares=auth"
- "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}"
ports:
- 80:80
- 443:443
volumes:
- ../certs:/tools/certs
- /var/run/docker.sock:/var/run/docker.sock:ro
extra_hosts:
- "host.docker.internal:host-gateway"
forward_proxy:
container_name: bridgehead-forward-proxy
image: ubuntu/squid
environment:
http_proxy: ${http_proxy}
https_proxy: ${https_proxy}
volumes:
- "bridgehead-proxy:/var/log/squid"
landing:
container_name: bridgehead-landingpage
image: samply/bridgehead-landingpage
labels:
- "traefik.enable=true"
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
- "traefik.http.services.landing.loadbalancer.server.port=80"
- "traefik.http.routers.landing.tls=true"
environment:
HOST: ${HOST}
PROJECT: ${PROJECT}
SITE_NAME: ${SITE_NAME}
blaze:
image: "samply/blaze:0.17"
container_name: bridgehead-gbn-blaze
environment:
BASE_URL: "http://blaze:8080"
JAVA_TOOL_OPTIONS: "-Xmx4g"
LOG_LEVEL: "debug"
ENFORCE_REFERENTIAL_INTEGRITY: "false"
volumes:
- "blaze-data:/app/data"
labels:
- "traefik.enable=true"
- "traefik.http.middlewares.gbn-auth.basicauth.users=${bc_auth_users}"
- "traefik.http.routers.blaze_gbn.rule=PathPrefix(`/gbn-localdatamanagement`)"
- "traefik.http.middlewares.gbn_b_strip.stripprefix.prefixes=/gbn-localdatamanagement"
- "traefik.http.services.blaze_gbn.loadbalancer.server.port=8080"
- "traefik.http.routers.blaze_gbn.middlewares=gbn_b_strip,gbn-auth"
- "traefik.http.routers.blaze_gbn.tls=true"
gbn-connector:
container_name: bridgehead-gbn-connector
image: "samply/share-client:gbn-feature-environmentPreconfiguration"
environment:
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS}
volumes:
- "gbn-connector-logs:/usr/local/tomcat/logs"
labels:
- "traefik.enable=true"
- "traefik.http.routers.gbn_connector.rule=PathPrefix(`/gbn-connector`)"
- "traefik.http.services.gbn_connector.loadbalancer.server.port=8080"
depends_on:
- "gbn-connector-db"
restart: "always"
gbn-connector-db:
image: "postgres:10.17"
environment:
POSTGRES_DB: "samply.connector"
POSTGRES_USER: "samply"
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS}
volumes:
- "gbn-connector-db-data:/var/lib/postgresql/data"
restart: "always"

10
lib/add_bc_user.sh Executable file
View File

@ -0,0 +1,10 @@
#!/bin/bash -e
source lib/functions.sh
log "INFO" "This script add's a user with password to the bridghead"
read -p 'Username: ' bc_user
read -sp 'Password: ' bc_password
log "INFO" "\nPlease export the line in the your environment. Please replace the dollar signs with with \\\$"
docker run --rm -it httpd:latest htpasswd -nb $bc_user $bc_password

104
lib/functions.sh
View File

@ -2,11 +2,115 @@
exitIfNotRoot() {
if [ "$EUID" -ne 0 ]; then
<<<<<<< HEAD
echo "Please run as root"
=======
log "ERROR" "Please run as root"
>>>>>>> version-1
exit 1
fi
}
<<<<<<< HEAD
log() {
echo "$(date +'%Y-%m-%d %T')" "$1:" "$2"
}
=======
checkOwner(){
COUNT=$(find $1 ! -user $2 |wc -l)
if [ $COUNT -gt 0 ]; then
log ERROR "$COUNT files in $1 are not owned by user $2. Run find $1 ! -user $2 to see them, chown -R $2 $1 to correct this issue."
return 1
fi
return 0
}
log() {
echo -e "$(date +'%Y-%m-%d %T')" "$1:" "$2"
}
printUsage() {
echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME"
echo "PROJECTNAME should be one of ccp|nngm|gbn"
}
checkRequirements() {
if ! lib/prerequisites.sh; then
log "ERROR" "Validating Prerequisites failed, please fix the error(s) above this line."
exit 1
else
return 0
fi
}
fetchVarsFromVault() {
[ -e /etc/bridgehead/vault.conf ] && source /etc/bridgehead/vault.conf
if [ -z "$BW_MASTERPASS" ] || [ -z "$BW_CLIENTID" ] || [ -z "$BW_CLIENTSECRET" ]; then
log "ERROR" "Please supply correct credentials in /etc/bridgehead/vault.conf."
return 1
fi
set +e
PASS=$(BW_MASTERPASS="$BW_MASTERPASS" BW_CLIENTID="$BW_CLIENTID" BW_CLIENTSECRET="$BW_CLIENTSECRET" docker run --rm -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET -e http_proxy samply/bridgehead-vaultfetcher $@)
RET=$?
if [ $RET -ne 0 ]; then
echo "Code: $RET"
echo $PASS
return $RET
fi
eval $(echo -e "$PASS" | sed 's/\r//g')
set -e
return 0
}
fetchVarsFromVaultByFile() {
VARS_TO_FETCH=""
for line in $(cat $@); do
if [[ $line =~ .*=[\"]*\<VAULT\>[\"]*.* ]]; then
VARS_TO_FETCH+="$(echo -n $line | sed 's/=.*//') "
fi
done
if [ -z "$VARS_TO_FETCH" ]; then
return 0
fi
log INFO "Fetching $(echo $VARS_TO_FETCH | wc -w) secrets from Vault ..."
fetchVarsFromVault $VARS_TO_FETCH
return 0
}
assertVarsNotEmpty() {
MISSING_VARS=""
for VAR in $@; do
if [ -z "${!VAR}" ]; then
MISSING_VARS+="$VAR "
fi
done
if [ -n "$MISSING_VARS" ]; then
log "ERROR" "Mandatory variables not defined: $MISSING_VARS"
return 1
fi
return 0
}
##Setting Network properties
export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
export HOST=$(hostname)
export PRODUCTION="false";
if [ "$(git branch --show-current)" == "main" ]; then
export PRODUCTION="true";
fi
>>>>>>> version-1

42
lib/gitpassword.sh Executable file
View File

@ -0,0 +1,42 @@
#!/bin/bash
if [ "$1" != "get" ]; then
echo "Usage: $0 get"
exit 1
fi
baseDir() {
# see https://stackoverflow.com/questions/59895
SOURCE=${BASH_SOURCE[0]}
while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink
DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd )
SOURCE=$(readlink "$SOURCE")
[[ $SOURCE != /* ]] && SOURCE=$DIR/$SOURCE # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
done
DIR=$( cd -P "$( dirname "$SOURCE" )/.." >/dev/null 2>&1 && pwd )
echo $DIR
}
BASE=$(baseDir)
cd $BASE
source lib/functions.sh
assertVarsNotEmpty SITE_ID || exit 1
PARAMS="$(cat)"
GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g')
fetchVarsFromVault GIT_PASSWORD
if [ -z "${GIT_PASSWORD}" ]; then
log ERROR "Git password not found."
exit 1
fi
cat <<EOF
protocol=https
host=$GITHOST
username=bk-${SITE_ID}
password=${GIT_PASSWORD}
EOF

57
lib/prerequisites.sh
View File

@ -1,9 +1,24 @@
#!/bin/bash
<<<<<<< HEAD
## Check if user is a su
echo "Welcome to the starting a bridgehead. We will get your instance up and running in no time"
echo "First we will check if all prerequisites are met ..."
=======
source lib/functions.sh
if ! id "bridgehead" &>/dev/null; then
log ERROR "User bridgehead does not exist. Please consult readme for installation."
exit 1
fi
checkOwner . bridgehead || exit 1
checkOwner /etc/bridgehead bridgehead || exit 1
## Check if user is a su
log INFO "Checking if all prerequisites are met ..."
>>>>>>> version-1
prerequisites="git docker docker-compose"
for prerequisite in $prerequisites; do
$prerequisite --version 2>&1
@ -15,6 +30,7 @@ for prerequisite in $prerequisites; do
# TODO: Check for specific version
done
<<<<<<< HEAD
echo "Checking site.conf"
#check if site.conf is created
@ -52,3 +68,44 @@ if [ -d "site-config/${project}.env" ]; then
fi
echo "All prerequisites are met!"
=======
log INFO "Checking configuration ..."
## Download submodule
if [ ! -d "/etc/bridgehead/" ]; then
log ERROR "Please set up the config folder at /etc/bridgehead. Instruction are in the readme."
exit 1
fi
# TODO: Check all required variables here in a generic loop
#check if project env is present
if [ -d "/etc/bridgehead/${PROJECT}.conf" ]; then
log ERROR "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf."
exit 1
fi
# TODO: Make sure you're in the right directory, or, even better, be independent from the working directory.
log INFO "Checking ssl cert"
if [ ! -d "certs" ]; then
log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)"
mkdir -p certs
fi
if [ ! -e "certs/traefik.crt" ]; then
openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 3650 -subj "/CN=$HOST"
fi
if [ -e /etc/bridgehead/vault.conf ]; then
if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then
log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf."
exit 1
fi
fi
log INFO "Success - all prerequisites are met!"
exit 0
>>>>>>> version-1

25
lib/remove-bridgehead-units.sh Executable file
View File

@ -0,0 +1,25 @@
#!/bin/bash -e
source lib/functions.sh
if [ $# -eq 0 ]; then
log "ERROR" "Please provide a Project as argument"
exit 1
fi
if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then
log "ERROR" "Please provide a supported project like ccp, gbn or nngm"
exit 1
fi
export PROJECT=$1
#checkRequirements // not needed when uninstalling
log "INFO" "Stopping system units and removing bridgehead for ${PROJECT} ..."
systemctl disable --now bridgehead@${PROJECT}.service bridgehead-update@${PROJECT}.timer bridgehead-update@${PROJECT}.service
rm -v /etc/systemd/system/{bridgehead\@.service,bridgehead-update\@.timer,bridgehead-update\@.service}
log "INFO" "Successfully removed bridgehead for ${PROJECT} from your system"

37
lib/setup-bridgehead-units.sh Executable file
View File

@ -0,0 +1,37 @@
#!/bin/bash
source lib/functions.sh
exitIfNotRoot
if [ $# -eq 0 ]; then
log "ERROR" "Please provide a Project as argument"
exit 1
fi
if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then
log "ERROR" "Please provide a supported project like ccp, gbn or nngm"
exit 1
fi
export PROJECT=$1
checkRequirements
log "INFO" "Register system units for bridgehead and bridgehead-update"
cp -v \
lib/systemd/bridgehead\@.service \
lib/systemd/bridgehead-update\@.service \
lib/systemd/bridgehead-update\@.timer \
/etc/systemd/system/
systemctl daemon-reload
if ! systemctl is-active --quiet bridgehead@"${PROJECT}"; then
log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service"
systemctl enable bridgehead@"${PROJECT}"
log "INFO" "Enabling nightly updates for bridgehead@${PROJECT}.service ..."
systemctl enable --now bridgehead-update@"${PROJECT}".timer
fi
log "INFO" "\nDone - now start your bridgehead by running\n\tsystemctl start bridgehead@${PROJECT}.service\nor by rebooting your machine."

13
lib/systemd/bridgehead-update@.service
View File

@ -1,3 +1,4 @@
<<<<<<< HEAD
[Unit]
Description=Bridgehead (%i) Update Service
@ -8,3 +9,15 @@ ExecStart=/bin/bash -c "/srv/docker/bridgehead/update-bridgehead.sh %i"
[Install]
WantedBy=multi-user.target
=======
[Unit]
Description=Bridgehead (%i) Update Service
[Service]
Type=oneshot
User=bridgehead
ExecStart=/srv/docker/bridgehead/bridgehead update %i
[Install]
WantedBy=multi-user.target
>>>>>>> version-1

11
lib/systemd/bridgehead-update@.timer
View File

@ -1,3 +1,4 @@
<<<<<<< HEAD
[Unit]
Description=Nightly Updates of Bridgehead (%i)
@ -6,3 +7,13 @@ OnCalendar=*-*-* 03:00:00
[Install]
WantedBy=basic.target
=======
[Unit]
Description=Nightly Updates of Bridgehead (%i)
[Timer]
OnCalendar=*-*-* 03:00:00
[Install]
WantedBy=basic.target
>>>>>>> version-1

15
lib/systemd/bridgehead@.service
View File

@ -1,3 +1,4 @@
<<<<<<< HEAD
[Unit]
Description=Bridgehead (%i) Service
@ -13,3 +14,17 @@ ExecStop=/bin/bash -c '`which docker-compose` -f %i/docker-compose.yml --env-fil
[Install]
WantedBy=multi-user.target
=======
[Unit]
Description=Bridgehead (%i) Service
[Service]
User=bridgehead
Restart=always
RestartSec=30
ExecStart=/srv/docker/bridgehead/bridgehead start %i
ExecStop=/srv/docker/bridgehead/bridgehead stop %i
[Install]
WantedBy=multi-user.target
>>>>>>> version-1

73
lib/update-bridgehead.sh Executable file
View File

@ -0,0 +1,73 @@
#!/bin/bash
source lib/functions.sh
CONFFILE=/etc/bridgehead/$1.conf
if [ ! -e $CONFFILE ]; then
log ERROR "Configuration file $CONFFILE not found."
exit 1
fi
source $CONFFILE
assertVarsNotEmpty SITE_ID || exit 1
export SITE_ID
checkOwner . bridgehead || exit 1
checkOwner /etc/bridgehead bridgehead || exit 1
CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh"
# Check git updates
for DIR in /etc/bridgehead $(pwd); do
log "INFO" "Checking for updates to git repo $DIR ..."
if [ "$(git -C $DIR config --get credential.helper)" != "$CREDHELPER" ]; then
log "INFO" "Configuring repo to use bridgehead git credential helper."
git -C $DIR config credential.helper "$CREDHELPER"
fi
old_git_hash="$(git -C $DIR rev-parse --verify HEAD)"
git -C $DIR fetch 2>&1
git -C $DIR pull 2>&1
new_git_hash="$(git -C $DIR rev-parse --verify HEAD)"
git_updated="false"
if [ "$old_git_hash" != "$new_git_hash" ]; then
log "INFO" "Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash"
# NOTE: Link generation doesn't work on repositories placed at an self-hosted instance of bitbucket.
# See: https://community.atlassian.com/t5/Bitbucket-questions/BitBucket-4-14-diff-between-any-two-commits/qaq-p/632974
git_repository_url="$(git -C $DIR remote get-url origin)"
git_repository_url=${git_repository_url/.git/}
if [ "$( echo $git_repository_url | grep "github.com")" ]; then
# Ensure web link even if ssh is used
git_repository_url="${git_repository_url/git@github.com/https:\/\/github.com\/}"
log "INFO" "You can review all changes on the repository with $git_repository_url/compare/$old_git_hash...$new_git_hash"
elif [ "$( echo $git_repository_url | grep "git.verbis.dkfz.de")" ]; then
git_repository_url="${git_repository_url/ssh:\/\/git@git.verbis.dkfz.de/https:\/\/git.verbis.dkfz.de\/}"
git_repository_url="https://$(echo $git_repository_url | awk -F '@' '{print $2}')"
log "INFO" "You can review all changes on the repository with $git_repository_url/compare?from=$old_git_hash&to=$new_git_hash"
fi
git_updated="true"
fi
done
# Check docker updates
log "INFO" "Checking for updates to running docker images ..."
docker_updated="false"
for IMAGE in $(docker ps --filter "name=bridgehead" --format {{.Image}}); do
log "INFO" "Checking for Updates of Image: $IMAGE"
if docker pull $IMAGE | grep "Downloaded newer image"; then
log "INFO" "$IMAGE updated."
docker_updated="true"
fi
done
# If anything is updated, restart service
if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then
log "INFO" "Update detected, now restarting bridgehead"
systemctl restart 'bridgehead@*'
else
log "INFO" "Nothing updated, nothing to restart."
fi
exit 0
# TODO: Print last commit explicit

86
nngm/docker-compose.yml Normal file
View File

@ -0,0 +1,86 @@
version: "3.7"
services:
traefik:
container_name: bridgehead-traefik
image: traefik:2.4
command:
- --api.insecure=true
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --providers.docker=true
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
ports:
- 80:80
- 443:443
- 8080:8080
volumes:
- ../certs:/tools/certs
- /var/run/docker.sock:/var/run/docker.sock:ro
extra_hosts:
- "host.docker.internal:host-gateway"
### Does need to know the outside proxy to connect central components
forward_proxy:
container_name: bridgehead-squid
image: ubuntu/squid
environment:
http_proxy: ${http_proxy}
https_proxy: ${https_proxy}
volumes:
- "bridgehead-proxy:/var/log/squid"
## Needs internal proxy config
landing:
container_name: bridgehead-landingpage
image: samply/bridgehead-landingpage
labels:
- "traefik.enable=true"
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
- "traefik.http.services.landing.loadbalancer.server.port=80"
- "traefik.http.routers.landing.tls=true"
environment:
HOST: ${HOST}
PROJECT: ${PROJECT}
SITE_NAME: ${SITE_NAME}
nngm-connector:
container_name: bridgehead-nngm-connector
image: "samply/share-client:nngm-feature-environmentPreconfiguration"
environment:
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
NNGM_MAGICPL_APIKEY: ${NNGM_MAGICPL_APIKEY}
NNGM_MAINZELLISTE_APIKEY: ${NNGM_MAINZELLISTE_APIKEY}
NNGM_CTS_APIKEY: ${NNGM_CTS_APIKEY}
NNGM_CRYPTKEY: ${NNGM_CRYPTKEY}
volumes:
- "nngm-connector-logs:/usr/local/tomcat/logs"
labels:
- "traefik.enable=true"
- "traefik.http.routers.nngm_connector.rule=PathPrefix(`/nngm-connector`)"
- "traefik.http.services.nngm_connector.loadbalancer.server.port=8080"
- "traefik.http.routers.nngm_connector.tls=true"
depends_on:
- "nngm-connector-db"
- "forward_proxy"
ports:
- 5005:5005
restart: "always"
nngm-connector-db:
container_name: bridgehead-nngm-connector-db
image: "postgres:10.17"
environment:
POSTGRES_DB: "share_v2"
POSTGRES_USER: "samplyweb"
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
volumes:
- "nngm-connector-db-data:/var/lib/postgresql/data"
restart: "always"
volumes:
nngm-connector-db-data:
nngm-connector-logs:
bridgehead-proxy: