aboutsummaryrefslogtreecommitdiff
path: root/app/directory
diff options
context:
space:
mode:
authorQuentin <quentin@dufour.io>2021-01-18 08:18:21 +0100
committerQuentin <quentin@dufour.io>2021-01-18 08:18:21 +0100
commitad6017eea058f7cb6fdf078783f992a4f45a3e15 (patch)
tree6620bcc9e1ea61a5689b763b9ad8280275e35e76 /app/directory
parent79b7273ff2a487d6721d393682c8ad3927467a75 (diff)
parentc642370def01f09d966b3b9c643cfe416ea115cf (diff)
downloadinfrastructure-ad6017eea058f7cb6fdf078783f992a4f45a3e15.tar.gz
infrastructure-ad6017eea058f7cb6fdf078783f992a4f45a3e15.zip
Merge pull request 'Reorganize app/ and add script for secret management' (#29) from test_reorganize into master
Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/infrastructure/pulls/29
Diffstat (limited to 'app/directory')
-rw-r--r--app/directory/config/bottin/config.json31
-rw-r--r--app/directory/config/guichet/config.json.tpl30
-rw-r--r--app/directory/deploy/directory.hcl114
3 files changed, 175 insertions, 0 deletions
diff --git a/app/directory/config/bottin/config.json b/app/directory/config/bottin/config.json
new file mode 100644
index 0000000..7867ff0
--- /dev/null
+++ b/app/directory/config/bottin/config.json
@@ -0,0 +1,31 @@
+{
+ "suffix": "dc=deuxfleurs,dc=fr",
+ "bind": "0.0.0.0:389",
+ "consul_host": "http://consul.service.2.cluster.deuxfleurs.fr:8500",
+ "log_level": "debug",
+ "acl": [
+ "*,dc=deuxfleurs,dc=fr::read:*:* !userpassword",
+ "*::read modify:SELF:*",
+ "ANONYMOUS::bind:*,ou=users,dc=deuxfleurs,dc=fr:",
+ "ANONYMOUS::bind:cn=admin,dc=deuxfleurs,dc=fr:",
+ "*,ou=services,ou=users,dc=deuxfleurs,dc=fr::bind:*,ou=users,dc=deuxfleurs,dc=fr:*",
+ "*,ou=services,ou=users,dc=deuxfleurs,dc=fr::read:*:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=invitations,dc=deuxfleurs,dc=fr:*",
+ "ANONYMOUS::bind:*,ou=invitations,dc=deuxfleurs,dc=fr:",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::delete:SELF:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=nextcloud,dc=deuxfleurs,dc=fr:*",
+
+ "cn=admin,dc=deuxfleurs,dc=fr::read add modify delete:*:*",
+ "*:cn=admin,ou=groups,dc=deuxfleurs,dc=fr:read add modify delete:*:*"
+ ]
+}
diff --git a/app/directory/config/guichet/config.json.tpl b/app/directory/config/guichet/config.json.tpl
new file mode 100644
index 0000000..98e2297
--- /dev/null
+++ b/app/directory/config/guichet/config.json.tpl
@@ -0,0 +1,30 @@
+{
+ "http_bind_addr": ":9991",
+ "ldap_server_addr": "ldap://bottin2.service.2.cluster.deuxfleurs.fr:389",
+
+ "base_dn": "dc=deuxfleurs,dc=fr",
+ "user_base_dn": "ou=users,dc=deuxfleurs,dc=fr",
+ "user_name_attr": "cn",
+ "group_base_dn": "ou=groups,dc=deuxfleurs,dc=fr",
+ "group_name_attr": "cn",
+
+ "invitation_base_dn": "ou=invitations,dc=deuxfleurs,dc=fr",
+ "invitation_name_attr": "cn",
+ "invited_mail_format": "{}@deuxfleurs.fr",
+ "invited_auto_groups": [
+ "cn=email,ou=groups,dc=deuxfleurs,dc=fr",
+ "cn=seafile,ou=groups,dc=deuxfleurs,dc=fr",
+ "cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr"
+ ],
+
+ "web_address": "https://guichet.deuxfleurs.fr",
+ "mail_from": "coucou@deuxfleurs.fr",
+ "smtp_server": "adnab.me:25",
+ "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
+ "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",
+
+ "admin_account": "cn=admin,dc=deuxfleurs,dc=fr",
+ "group_can_admin": "cn=admin,ou=groups,dc=deuxfleurs,dc=fr",
+ "group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr"
+}
+
diff --git a/app/directory/deploy/directory.hcl b/app/directory/deploy/directory.hcl
new file mode 100644
index 0000000..a6eb885
--- /dev/null
+++ b/app/directory/deploy/directory.hcl
@@ -0,0 +1,114 @@
+job "directory" {
+ datacenters = ["dc1"]
+ type = "service"
+ priority = 90
+
+ constraint {
+ attribute = "${attr.cpu.arch}"
+ value = "amd64"
+ }
+
+ group "bottin" {
+ count = 1
+
+ network {
+ port "ldap_port" {
+ static = 389
+ to = 389
+ }
+ }
+
+ task "bottin" {
+ driver = "docker"
+ config {
+ image = "lxpz/bottin_amd64:20"
+ network_mode = "host"
+ readonly_rootfs = true
+ ports = [ "ldap_port" ]
+ volumes = [
+ "secrets/config.json:/config.json"
+ ]
+ }
+
+ resources {
+ memory = 100
+ }
+
+ template {
+ data = file("../config/bottin/config.json")
+ destination = "secrets/config.json"
+ }
+
+ service {
+ tags = ["bottin"]
+ port = "ldap_port"
+ address_mode = "host"
+ name = "bottin2"
+ check {
+ type = "tcp"
+ port = "ldap_port"
+ interval = "60s"
+ timeout = "5s"
+ check_restart {
+ limit = 3
+ grace = "90s"
+ ignore_warnings = false
+ }
+ }
+ }
+ }
+ }
+
+ group "guichet" {
+ count = 1
+
+ network {
+ port "web_port" { to = 9991 }
+ }
+
+ task "guichet" {
+ driver = "docker"
+ config {
+ image = "lxpz/guichet_amd64:10"
+ readonly_rootfs = true
+ ports = [ "web_port" ]
+ volumes = [
+ "secrets/config.json:/config.json"
+ ]
+ }
+
+ template {
+ data = file("../config/guichet/config.json.tpl")
+ destination = "secrets/config.json"
+ }
+
+ resources {
+ memory = 200
+ }
+
+ service {
+ name = "guichet"
+ tags = [
+ "guichet",
+ "traefik.enable=true",
+ "traefik.frontend.entryPoints=https,http",
+ "traefik.frontend.rule=Host:guichet.deuxfleurs.fr",
+ ]
+ port = "web_port"
+ address_mode = "host"
+ check {
+ type = "tcp"
+ port = "web_port"
+ interval = "60s"
+ timeout = "5s"
+ check_restart {
+ limit = 3
+ grace = "90s"
+ ignore_warnings = false
+ }
+ }
+ }
+ }
+ }
+}
+