From e273e97d9cfa1fb351743ae4db4227e2ee6a368d Mon Sep 17 00:00:00 2001 From: Martin Lablans <6804500+lablans@users.noreply.github.com> Date: Mon, 17 Oct 2022 14:38:34 +0200 Subject: [PATCH 1/7] Certificate enrollment (#24) --- bridgehead | 8 ++++++++ ccp/vars | 2 ++ lib/functions.sh | 2 +- lib/prerequisites.sh | 11 ++++++++++- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/bridgehead b/bridgehead index 5c7d121..5548a7d 100755 --- a/bridgehead +++ b/bridgehead @@ -77,6 +77,14 @@ case "$ACTION" in uninstall) exec ./lib/remove-bridgehead-units.sh $PROJECT ;; + enroll) + if [ -e $PRIVATEKEYFILENAME ]; then + echo "Private key already exists at $PRIVATEKEYFILENAME. Please delete first to proceed." + exit 1 + fi + docker run --rm -ti -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $PROXY_ID --admin-email $SUPPORT_EMAIL + chmod 600 $PRIVATEKEYFILENAME + ;; preRun | preUpdate) fixPermissions ;; diff --git a/ccp/vars b/ccp/vars index 4152fa4..ce12d1a 100644 --- a/ccp/vars +++ b/ccp/vars @@ -5,3 +5,5 @@ SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | he SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}" REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)" REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}" +SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de +PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem diff --git a/lib/functions.sh b/lib/functions.sh index ded0cd9..5059829 100755 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -19,7 +19,7 @@ checkOwner(){ } printUsage() { - echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME" + echo "Usage: bridgehead start|stop|update|install|uninstall|enroll PROJECTNAME" echo "PROJECTNAME should be one of ccp|nngm|gbn" } diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh index f4fd3be..2709a6f 100755 --- a/lib/prerequisites.sh +++ b/lib/prerequisites.sh @@ -43,7 +43,7 @@ fi # TODO: Make sure you're in the right directory, or, even better, be independent from the working directory. -log INFO "Checking ssl cert" +log INFO "Checking ssl cert for accessing bridgehead via https" if [ ! -d "certs" ]; then log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)" @@ -60,6 +60,15 @@ if [ -e /etc/bridgehead/vault.conf ]; then fi fi +log INFO "Checking your beam proxy private key" + +if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then + log INFO "Success - private key found." +else + log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run bridgehead enroll ${PROJECT} and follow the instructions". + exit 1 +fi + log INFO "Success - all prerequisites are met!" hc_send log "Success - all prerequisites are met!" From f8b9aed7f52b1c0774b94afbbac20d23aad612eb Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Mon, 17 Oct 2022 15:09:18 +0200 Subject: [PATCH 2/7] Cleaning --- .gitignore | 8 +-- ccp/docker-compose.yml | 4 +- lib/generate.sh | 116 ----------------------------------------- lib/log.sh | 0 lib/prerequisites.sh | 20 +++---- site.dev.conf | 11 ---- 6 files changed, 13 insertions(+), 146 deletions(-) delete mode 100755 lib/generate.sh mode change 100644 => 100755 lib/log.sh delete mode 100644 site.dev.conf diff --git a/.gitignore b/.gitignore index d6c86b5..2c4c7ec 100644 --- a/.gitignore +++ b/.gitignore @@ -3,10 +3,4 @@ site-config/* ## Ignore site configuration -config/**/* -!config/**/*.default -landing/* -docker-compose.override.yml -site.conf -auth/* -certs/* +*/docker-compose.override.yml diff --git a/ccp/docker-compose.yml b/ccp/docker-compose.yml index 65343d6..2539d8e 100644 --- a/ccp/docker-compose.yml +++ b/ccp/docker-compose.yml @@ -25,8 +25,8 @@ services: - 80:80 - 443:443 volumes: - - ../certs:/tools/certs - - ../lib/traefik-configuration/:/configuration + - /etc/bridgehead/traefik-tls:/tools/certs:ro + - ../lib/traefik-configuration/:/configuration:ro - /var/run/docker.sock:/var/run/docker.sock:ro forward_proxy: diff --git a/lib/generate.sh b/lib/generate.sh deleted file mode 100755 index 9673055..0000000 --- a/lib/generate.sh +++ /dev/null @@ -1,116 +0,0 @@ -#!/bin/bash - -if [ ! -d ./landing ] -then - mkdir landing -fi - -if [ ! -f ./landing/index.html ] -then - touch index.html -fi - -CENTRAL_SERVICES=" - CCP-IT - Monitoring Service - " - -LOCAL_SERVICES=" - Bridgehead - Reverse Proxy Traefik - " - -if [ "$project" = "dktk" ] || [ "$project" = "c4" ] || [ "$project" = "dktk-fed" ] -then - CENTRAL_SERVICES+=" - CCP-IT - Zentrale Patientenliste - - - CCP-IT - Dezentrale Suche - - - CCP-IT - Zentrale Suche - - - CCP-IT - Deployment-Server - - - CCP-IT - Zentraler Kontrollnummernerzeuger - - " -fi - -if [ "$project" = "dktk-fed" ] -then - LOCAL_SERVICES+=" - DKTK - Blaze - - " -fi - -cat > ./landing/index.html < - - - - - - Bridgehead Overview - - - - - - - - - -