Merge pull request 'Reorganize app/ and add script for secret management' (#29) from test_reorganize into master

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/infrastructure/pulls/29

3 files changed, 175 insertions, 0 deletions

diff --git a/app/directory/config/bottin/config.json b/app/directory/config/bottin/config.json
new file mode 100644
index 0000000..7867ff0
--- /dev/null
+++ b/app/directory/config/bottin/config.json
@@ -0,0 +1,31 @@
+{
+  "suffix": "dc=deuxfleurs,dc=fr",
+  "bind": "0.0.0.0:389",
+  "consul_host": "http://consul.service.2.cluster.deuxfleurs.fr:8500",
+  "log_level": "debug",
+  "acl": [
+		"*,dc=deuxfleurs,dc=fr::read:*:* !userpassword",
+		"*::read modify:SELF:*",
+		"ANONYMOUS::bind:*,ou=users,dc=deuxfleurs,dc=fr:",
+		"ANONYMOUS::bind:cn=admin,dc=deuxfleurs,dc=fr:",
+		"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::bind:*,ou=users,dc=deuxfleurs,dc=fr:*",
+		"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::read:*:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=invitations,dc=deuxfleurs,dc=fr:*",
+		"ANONYMOUS::bind:*,ou=invitations,dc=deuxfleurs,dc=fr:",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::delete:SELF:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=nextcloud,dc=deuxfleurs,dc=fr:*",
+
+		"cn=admin,dc=deuxfleurs,dc=fr::read add modify delete:*:*",
+		"*:cn=admin,ou=groups,dc=deuxfleurs,dc=fr:read add modify delete:*:*"
+  ]
+}
diff --git a/app/directory/config/guichet/config.json.tpl b/app/directory/config/guichet/config.json.tpl
new file mode 100644
index 0000000..98e2297
--- /dev/null
+++ b/app/directory/config/guichet/config.json.tpl
@@ -0,0 +1,30 @@
+{
+  "http_bind_addr": ":9991",
+  "ldap_server_addr": "ldap://bottin2.service.2.cluster.deuxfleurs.fr:389",
+
+  "base_dn": "dc=deuxfleurs,dc=fr",
+  "user_base_dn": "ou=users,dc=deuxfleurs,dc=fr",
+  "user_name_attr": "cn",
+  "group_base_dn": "ou=groups,dc=deuxfleurs,dc=fr",
+  "group_name_attr": "cn",
+
+  "invitation_base_dn": "ou=invitations,dc=deuxfleurs,dc=fr",
+  "invitation_name_attr": "cn",
+  "invited_mail_format": "{}@deuxfleurs.fr",
+  "invited_auto_groups": [
+    "cn=email,ou=groups,dc=deuxfleurs,dc=fr",
+    "cn=seafile,ou=groups,dc=deuxfleurs,dc=fr",
+    "cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr"
+  ],
+
+  "web_address": "https://guichet.deuxfleurs.fr",
+  "mail_from": "coucou@deuxfleurs.fr",
+  "smtp_server": "adnab.me:25",
+  "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
+  "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",
+
+  "admin_account": "cn=admin,dc=deuxfleurs,dc=fr",
+  "group_can_admin": "cn=admin,ou=groups,dc=deuxfleurs,dc=fr",
+  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr"
+}
+
diff --git a/app/directory/deploy/directory.hcl b/app/directory/deploy/directory.hcl
new file mode 100644
index 0000000..a6eb885
--- /dev/null
+++ b/app/directory/deploy/directory.hcl
@@ -0,0 +1,114 @@
+job "directory" {
+  datacenters = ["dc1"]
+  type = "service"
+  priority = 90
+
+  constraint {
+    attribute = "${attr.cpu.arch}"
+    value     = "amd64"
+  }
+
+  group "bottin" {
+    count = 1
+
+    network {
+      port "ldap_port" {
+        static = 389
+        to = 389
+      }
+    }
+
+    task "bottin" {
+      driver = "docker"
+      config {
+        image = "lxpz/bottin_amd64:20"
+        network_mode = "host"
+        readonly_rootfs = true
+        ports = [ "ldap_port" ]
+        volumes = [
+          "secrets/config.json:/config.json"
+        ]
+      }
+
+      resources {
+        memory = 100
+      }
+
+      template {
+        data = file("../config/bottin/config.json")
+        destination = "secrets/config.json"
+      }
+
+      service {
+        tags = ["bottin"]
+        port = "ldap_port"
+        address_mode = "host"
+        name = "bottin2"
+        check {
+          type = "tcp"
+          port = "ldap_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+
+  group "guichet" {
+    count = 1
+
+    network {
+      port "web_port" { to = 9991 }
+    }
+
+    task "guichet" {
+      driver = "docker"
+      config {
+        image = "lxpz/guichet_amd64:10"
+        readonly_rootfs = true
+        ports = [ "web_port" ]
+        volumes = [
+          "secrets/config.json:/config.json"
+        ]
+      }
+
+      template {
+        data = file("../config/guichet/config.json.tpl")
+        destination = "secrets/config.json"
+      }
+
+      resources {
+        memory = 200
+      }
+
+      service {
+        name = "guichet"
+        tags = [
+          "guichet",
+          "traefik.enable=true",
+          "traefik.frontend.entryPoints=https,http",
+          "traefik.frontend.rule=Host:guichet.deuxfleurs.fr",
+        ]
+        port = "web_port"
+        address_mode = "host"
+        check {
+          type = "tcp"
+          port = "web_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+}
+