Merge pull request 'Reorganize app/ and add script for secret management' (#29) from test_reorganize into master

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/infrastructure/pulls/29

10 files changed, 257 insertions, 0 deletions

diff --git a/app/plume/build/plume/Dockerfile b/app/plume/build/plume/Dockerfile
new file mode 100644
index 0000000..4e05424
--- /dev/null
+++ b/app/plume/build/plume/Dockerfile
@@ -0,0 +1,54 @@
+FROM rust:1.47.0-slim-buster as builder
+
+RUN apt-get update && \
+    apt-get install -y \
+      pkg-config \
+      git \
+      curl \
+      postgresql \
+      postgresql-contrib \
+      libpq-dev \
+      gettext \
+      git \
+      curl \
+      gcc \
+      make \
+      openssl \
+      libssl-dev \
+      libclang-dev
+
+ARG VERSION
+WORKDIR /opt
+RUN git clone -n https://git.joinplu.me/Plume/Plume.git plume
+
+WORKDIR /opt/plume
+RUN git checkout ${VERSION}
+
+RUN cargo install diesel_cli --no-default-features --features postgres --version '=1.3.0'
+
+# frontend
+RUN cargo install cargo-web
+RUN cargo web deploy -p plume-front --release
+# backend
+RUN cargo install --no-default-features --features postgres -f --path .
+# cli
+RUN cargo install --no-default-features --features postgres --path plume-cli
+RUN cargo clean
+
+#-----------------------------
+FROM debian:bullseye-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    libpq5 \
+    libssl1.1
+
+WORKDIR /app
+
+COPY --from=builder /opt/plume /app
+COPY --from=builder /usr/local/cargo/bin/diesel /usr/local/bin/
+COPY --from=builder /usr/local/cargo/bin/plm /usr/local/bin/
+COPY --from=builder /usr/local/cargo/bin/plume /usr/local/bin/
+COPY plm-start /usr/local/bin/
+
+CMD ["plm-start"]
diff --git a/app/plume/build/plume/README.md b/app/plume/build/plume/README.md
new file mode 100644
index 0000000..6d86d81
--- /dev/null
+++ b/app/plume/build/plume/README.md
@@ -0,0 +1,3 @@
+Try build:
+
+sudo docker build -t superboum/plume:v1 --build-arg VERSION=003dcf861a9f55720b03d52f2f95f5f59e338809 .
diff --git a/app/plume/build/plume/plm-start b/app/plume/build/plume/plm-start
new file mode 100755
index 0000000..da9d288
--- /dev/null
+++ b/app/plume/build/plume/plm-start
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+until plm migration run;
+  do sleep 2;
+done
+plm search init
+plm instance new --domain "$DOMAIN_NAME" --name "$INSTANCE_NAME" --private
+
+plume
diff --git a/app/plume/config/app.env b/app/plume/config/app.env
new file mode 100644
index 0000000..1c234e7
--- /dev/null
+++ b/app/plume/config/app.env
@@ -0,0 +1,30 @@
+BASE_URL=plume.deuxfleurs.fr
+# generate one with openssl rand -base64 32
+ROCKET_SECRET_KEY={{ key "secrets/plume/secret_key" | trimSpace }}
+
+# Mail settings
+#MAIL_SERVER=smtp.example.org
+#MAIL_USER=example
+#MAIL_PASSWORD=123456
+#MAIL_HELO_NAME=example.org
+
+# DATABASE SETUP
+POSTGRES_PASSWORD={{ key "secrets/plume/pgsql_pw" | trimSpace }}
+POSTGRES_USER=plume
+POSTGRES_DB=plume
+DATABASE_URL=postgres://plume:{{ key "secrets/plume/pgsql_pw" | trimSpace }}@psql-proxy.service.2.cluster.deuxfleurs.fr:5432/plume
+MIGRATION_DIRECTORY=migrations/postgres
+
+USE_HTTPS=0
+ROCKET_ADDRESS=::
+ROCKET_PORT={{ env "NOMAD_PORT_web_port" }}
+
+MEDIA_UPLOAD_DIRECTORY=/app/static/media
+SEARCH_INDEX=/app/search_index
+
+LDAP_ADDR=ldap://bottin2.service.2.cluster.deuxfleurs.fr:389
+LDAP_BASE_DN=ou=users,dc=deuxfleurs,dc=fr
+LDAP_USER_NAME_ATTR=cn
+LDAP_USER_MAIL_ATTR=mail
+LDAP_TLS=false
+
diff --git a/app/plume/deploy/plume.hcl b/app/plume/deploy/plume.hcl
new file mode 100644
index 0000000..0a82c57
--- /dev/null
+++ b/app/plume/deploy/plume.hcl
@@ -0,0 +1,69 @@
+job "plume" {
+  datacenters = ["dc1"]
+  type = "service"
+
+  constraint {
+    attribute = "${attr.cpu.arch}"
+    value     = "amd64"
+  }
+
+  group "plume" {
+    count = 1
+
+    network {
+      port "web_port" { }
+    }
+
+    task "plume" {
+      driver = "docker"
+      config {
+        image = "superboum/plume:v2"
+        network_mode = "host"
+        ports = [ "web_port" ]
+        #command = "cat"
+        #args = [ "/dev/stdout" ]
+        volumes = [
+           "/mnt/glusterfs/plume/media:/app/static/media",
+           "/mnt/glusterfs/plume/search:/app/search_index"
+        ]
+      }
+
+      template {
+        data = file("../config/app.env")
+        destination = "secrets/app.env"
+        env = true
+      }
+
+      resources {
+        memory = 100
+        cpu = 100
+      }
+
+      service {
+        name = "plume"
+        tags = [
+          "plume",
+          "traefik.enable=true",
+          "traefik.frontend.entryPoints=https,http",
+          "traefik.frontend.rule=Host:plume.deuxfleurs.fr",
+        ]
+        port = "web_port"
+        address_mode = "host"
+        check {
+          type = "http"
+          protocol = "http"
+          port = "web_port"
+          path = "/"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "600s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+}
+
diff --git a/app/plume/integration/bottin.json b/app/plume/integration/bottin.json
new file mode 100644
index 0000000..a970762
--- /dev/null
+++ b/app/plume/integration/bottin.json
@@ -0,0 +1,31 @@
+{
+  "suffix": "dc=deuxfleurs,dc=fr",
+  "bind": "0.0.0.0:389",
+  "consul_host": "http://consul:8500",
+  "log_level": "debug",
+  "acl": [
+		"*,dc=deuxfleurs,dc=fr::read:*:* !userpassword",
+		"*::read modify:SELF:*",
+		"ANONYMOUS::bind:*,ou=users,dc=deuxfleurs,dc=fr:",
+		"ANONYMOUS::bind:cn=admin,dc=deuxfleurs,dc=fr:",
+		"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::bind:*,ou=users,dc=deuxfleurs,dc=fr:*",
+		"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::read:*:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=invitations,dc=deuxfleurs,dc=fr:*",
+		"ANONYMOUS::bind:*,ou=invitations,dc=deuxfleurs,dc=fr:",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::delete:SELF:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr:*",
+		"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=nextcloud,dc=deuxfleurs,dc=fr:*",
+
+		"cn=admin,dc=deuxfleurs,dc=fr::read add modify delete:*:*",
+		"*:cn=admin,ou=groups,dc=deuxfleurs,dc=fr:read add modify delete:*:*"
+  ]
+}
diff --git a/app/plume/integration/docker-compose.yml b/app/plume/integration/docker-compose.yml
new file mode 100644
index 0000000..b88de8a
--- /dev/null
+++ b/app/plume/integration/docker-compose.yml
@@ -0,0 +1,28 @@
+version: '3.4'
+services:
+  plume:
+    image: superboum/plume:v1
+    env_file:
+      - plume.env
+    depends_on:
+      - consul
+      - postgres
+    ports:
+      - "7878:7878"
+
+  postgres:
+    image: postgres:9.6.19
+    environment:
+      - POSTGRES_DB=plume
+      - POSTGRES_USER=plume
+      - POSTGRES_PASSWORD=plume
+
+  bottin:
+    image: lxpz/bottin_amd64:14
+    depends_on:
+      - consul
+    volumes:
+      - ./bottin.json:/config.json
+
+  consul:
+    image: consul:1.8.4
diff --git a/app/plume/integration/plume.env b/app/plume/integration/plume.env
new file mode 100644
index 0000000..88c62dc
--- /dev/null
+++ b/app/plume/integration/plume.env
@@ -0,0 +1,31 @@
+BASE_URL=integration.env
+# generate one with openssl rand -base64 32
+ROCKET_SECRET_KEY=cXZbKoxWIBo0wdaD8tbA1B3BlH2LBSUmgzdyZZr8QxI=
+
+# Mail settings
+#MAIL_SERVER=smtp.example.org
+#MAIL_USER=example
+#MAIL_PASSWORD=123456
+#MAIL_HELO_NAME=example.org
+
+# DATABASE SETUP
+POSTGRES_PASSWORD=plume
+POSTGRES_USER=plume
+POSTGRES_DB=plume
+DATABASE_URL=postgres://plume:plume@postgres:5432/plume
+MIGRATION_DIRECTORY=migrations/postgres
+
+USE_HTTPS=0
+ROCKET_ADDRESS=0.0.0.0
+ROCKET_PORT=7878
+
+MEDIA_UPLOAD_DIRECTORY=/app/static/media
+SEARCH_INDEX=/app/search_index
+DOMAIN_NAME="integration.env"
+INSTANCE_NAME="Integration Instance"
+
+LDAP_ADDR=ldap://bottin:389
+LDAP_BASE_DN=ou=users,dc=deuxfleurs,dc=fr
+LDAP_USER_NAME_ATTR=cn
+LDAP_USER_MAIL_ATTR=mail
+LDAP_TLS=false
diff --git a/app/plume/secrets/plume/pgsql_pw b/app/plume/secrets/plume/pgsql_pw
new file mode 100644
index 0000000..978be54
--- /dev/null
+++ b/app/plume/secrets/plume/pgsql_pw
@@ -0,0 +1 @@
+CMD openssl rand -base64 32
diff --git a/app/plume/secrets/plume/secret_key b/app/plume/secrets/plume/secret_key
new file mode 100644
index 0000000..978be54
--- /dev/null
+++ b/app/plume/secrets/plume/secret_key
@@ -0,0 +1 @@
+CMD openssl rand -base64 32