diff options
| -rw-r--r-- | app/directory/config/bottin/config.json.tpl | 26 | ||||
| -rw-r--r-- | app/directory/config/guichet/config.json.tpl | 34 | ||||
| -rw-r--r-- | app/directory/deploy/directory.hcl | 141 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/mail_domain | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/mail_from | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/s3_access_key | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/s3_bucket | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/s3_endpoint | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/s3_region | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/s3_secret_key | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/smtp_pass | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/smtp_server | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/smtp_user | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/guichet/web_hostname | 1 | ||||
| -rw-r--r-- | app/directory/secrets/directory/ldap_base_dn | 1 | ||||
| -rw-r--r-- | app/garage-staging/deploy/garage.hcl | 3 |
16 files changed, 216 insertions, 0 deletions
diff --git a/app/directory/config/bottin/config.json.tpl b/app/directory/config/bottin/config.json.tpl new file mode 100644 index 0000000..844f7b7 --- /dev/null +++ b/app/directory/config/bottin/config.json.tpl @@ -0,0 +1,26 @@ +{ + "suffix": "{{ key "secrets/directory/ldap_base_dn" }}", + "bind": "0.0.0.0:389", + "log_level": "debug", + "acl": [ + "*,{{ key "secrets/directory/ldap_base_dn" }}::read:*:* !userpassword !user_secret !alternate_user_secrets !garage_s3_secret_key", + "*::read modify:SELF:*", + "ANONYMOUS::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:", + "ANONYMOUS::bind:cn=admin,{{ key "secrets/directory/ldap_base_dn" }}:", + "*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*", + "*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::read:*:*", + + "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:*", + "ANONYMOUS::bind:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:", + "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::delete:SELF:*", + + "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*", + "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*", + + "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*", + "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*", + + "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}::read add modify delete:*:*", + "*:cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:read add modify delete:*:*" + ] +} diff --git a/app/directory/config/guichet/config.json.tpl b/app/directory/config/guichet/config.json.tpl new file mode 100644 index 0000000..871f3f0 --- /dev/null +++ b/app/directory/config/guichet/config.json.tpl @@ -0,0 +1,34 @@ +{ + "http_bind_addr": ":9991", + "ldap_server_addr": "ldap://bottin2.service.2.cluster.deuxfleurs.fr:389", + + "base_dn": "{{ key "secrets/directory/ldap_base_dn" }}", + "user_base_dn": "ou=users,{{ key "secrets/directory/ldap_base_dn" }}", + "user_name_attr": "cn", + "group_base_dn": "ou=groups,{{ key "secrets/directory/ldap_base_dn" }}", + "group_name_attr": "cn", + + "invitation_base_dn": "ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}", + "invitation_name_attr": "cn", + "invited_mail_format": "{}@{{ key "secrets/directory/guichet/mail_domain" | trimSpace }}", + "invited_auto_groups": [ + "cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}" + ], + + "web_address": "https://{{ key "secrets/directory/guichet/web_hostname" }}", + "mail_from": "{{ key "secrets/directory/guichet/mail_from" }}", + "smtp_server": "{{ key "secrets/directory/guichet/smtp_server" }}", + "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}", + "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}", + + "admin_account": "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}", + "group_can_admin": "cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}", + "group_can_invite": "cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}", + + "s3_endpoint": "{{ key "secrets/directory/guichet/s3_endpoint" }}", + "s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}", + "s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}", + "s3_region": "{{ key "secrets/directory/guichet/s3_region" }}", + "s3_bucket": "{{ key "secrets/directory/guichet/s3_bucket" }}" +} + diff --git a/app/directory/deploy/directory.hcl b/app/directory/deploy/directory.hcl new file mode 100644 index 0000000..405c321 --- /dev/null +++ b/app/directory/deploy/directory.hcl @@ -0,0 +1,141 @@ +job "directory" { + datacenters = ["dc1", "neptune"] + type = "service" + priority = 90 + + constraint { + attribute = "${attr.cpu.arch}" + value = "amd64" + } + + group "bottin" { + count = 1 + + network { + port "ldap_port" { + static = 389 + to = 389 + } + } + + task "bottin" { + driver = "docker" + config { + image = "superboum/bottin_amd64:22" + network_mode = "host" + readonly_rootfs = true + ports = [ "ldap_port" ] + volumes = [ + "secrets/config.json:/config.json", + "secrets:/etc/bottin", + ] + } + + resources { + memory = 100 + } + + template { + data = file("../config/bottin/config.json.tpl") + destination = "secrets/config.json" + } + + template { + data = "{{ key \"secrets/consul/consul-ca.crt\" }}" + destination = "secrets/consul-ca.crt" + } + + template { + data = "{{ key \"secrets/consul/consul-client.crt\" }}" + destination = "secrets/consul-client.crt" + } + + template { + data = "{{ key \"secrets/consul/consul-client.key\" }}" + destination = "secrets/consul-client.key" + } + + template { + data = <<EOH +CONSUL_HTTP_ADDR=https://localhost:8501 +CONSUL_HTTP_SSL=true +CONSUL_CACERT=/etc/bottin/consul-ca.crt +CONSUL_CLIENT_CERT=/etc/bottin/consul-client.crt +CONSUL_CLIENT_KEY=/etc/bottin/consul-client.key +EOH + destination = "secrets/env" + env = true + } + + service { + tags = ["bottin"] + port = "ldap_port" + address_mode = "host" + name = "bottin" + check { + type = "tcp" + port = "ldap_port" + interval = "60s" + timeout = "5s" + check_restart { + limit = 3 + grace = "90s" + ignore_warnings = false + } + } + } + } + } + + group "guichet" { + count = 1 + + network { + port "web_port" { to = 9991 } + } + + task "guichet" { + driver = "docker" + config { + image = "superboum/guichet_amd64:15" + readonly_rootfs = true + ports = [ "web_port" ] + volumes = [ + "secrets/config.json:/config.json" + ] + } + + template { + data = file("../config/guichet/config.json.tpl") + destination = "secrets/config.json" + } + + resources { + memory = 200 + } + + service { + name = "guichet" + tags = [ + "guichet", + "tricot guichet-staging.home.adnab.me", + "tricot guichet.staging.deuxfleurs.org", + ] + port = "web_port" + address_mode = "host" + check { + type = "tcp" + port = "web_port" + interval = "60s" + timeout = "5s" + check_restart { + limit = 3 + grace = "90s" + ignore_warnings = false + } + } + } + } + } +} + diff --git a/app/directory/secrets/directory/guichet/mail_domain b/app/directory/secrets/directory/guichet/mail_domain new file mode 100644 index 0000000..5db1ba3 --- /dev/null +++ b/app/directory/secrets/directory/guichet/mail_domain @@ -0,0 +1 @@ +USER E-mail domain for new users (e.g. example.com) diff --git a/app/directory/secrets/directory/guichet/mail_from b/app/directory/secrets/directory/guichet/mail_from new file mode 100644 index 0000000..9075cbf --- /dev/null +++ b/app/directory/secrets/directory/guichet/mail_from @@ -0,0 +1 @@ +USER E-mail address from which to send welcome emails to new users diff --git a/app/directory/secrets/directory/guichet/s3_access_key b/app/directory/secrets/directory/guichet/s3_access_key new file mode 100644 index 0000000..e5b37ff --- /dev/null +++ b/app/directory/secrets/directory/guichet/s3_access_key @@ -0,0 +1 @@ +USER Garage access key for Guichet profile pictures diff --git a/app/directory/secrets/directory/guichet/s3_bucket b/app/directory/secrets/directory/guichet/s3_bucket new file mode 100644 index 0000000..cb059cf --- /dev/null +++ b/app/directory/secrets/directory/guichet/s3_bucket @@ -0,0 +1 @@ +USER S3 bucket in which to store data files (such as profile pictures) diff --git a/app/directory/secrets/directory/guichet/s3_endpoint b/app/directory/secrets/directory/guichet/s3_endpoint new file mode 100644 index 0000000..b414269 --- /dev/null +++ b/app/directory/secrets/directory/guichet/s3_endpoint @@ -0,0 +1 @@ +USER S3 endpoint URL diff --git a/app/directory/secrets/directory/guichet/s3_region b/app/directory/secrets/directory/guichet/s3_region new file mode 100644 index 0000000..ef16924 --- /dev/null +++ b/app/directory/secrets/directory/guichet/s3_region @@ -0,0 +1 @@ +USER S3 region diff --git a/app/directory/secrets/directory/guichet/s3_secret_key b/app/directory/secrets/directory/guichet/s3_secret_key new file mode 100644 index 0000000..f3e7f0f --- /dev/null +++ b/app/directory/secrets/directory/guichet/s3_secret_key @@ -0,0 +1 @@ +USER Garage secret key for Guichet profile pictures diff --git a/app/directory/secrets/directory/guichet/smtp_pass b/app/directory/secrets/directory/guichet/smtp_pass new file mode 100644 index 0000000..fc9d1e3 --- /dev/null +++ b/app/directory/secrets/directory/guichet/smtp_pass @@ -0,0 +1 @@ +USER SMTP password diff --git a/app/directory/secrets/directory/guichet/smtp_server b/app/directory/secrets/directory/guichet/smtp_server new file mode 100644 index 0000000..c453935 --- /dev/null +++ b/app/directory/secrets/directory/guichet/smtp_server @@ -0,0 +1 @@ +USER SMTP server address (hostname:port) diff --git a/app/directory/secrets/directory/guichet/smtp_user b/app/directory/secrets/directory/guichet/smtp_user new file mode 100644 index 0000000..c9c8bd0 --- /dev/null +++ b/app/directory/secrets/directory/guichet/smtp_user @@ -0,0 +1 @@ +USER SMTP username diff --git a/app/directory/secrets/directory/guichet/web_hostname b/app/directory/secrets/directory/guichet/web_hostname new file mode 100644 index 0000000..afe2512 --- /dev/null +++ b/app/directory/secrets/directory/guichet/web_hostname @@ -0,0 +1 @@ +USER Public hostname from which Guichet is accessible via HTTP (e.g. guichet.example.com) diff --git a/app/directory/secrets/directory/ldap_base_dn b/app/directory/secrets/directory/ldap_base_dn new file mode 100644 index 0000000..ea5c7ae --- /dev/null +++ b/app/directory/secrets/directory/ldap_base_dn @@ -0,0 +1 @@ +USER LDAP base DN for everything (e.g. dc=example,dc=com) diff --git a/app/garage-staging/deploy/garage.hcl b/app/garage-staging/deploy/garage.hcl index e90e3ce..b97fd1d 100644 --- a/app/garage-staging/deploy/garage.hcl +++ b/app/garage-staging/deploy/garage.hcl @@ -57,6 +57,7 @@ job "garage-staging" { tags = [ "garage-staging-api", "tricot garage-staging.home.adnab.me", + "tricot garage.staging.deuxfleurs.org", "tricot-add-header Access-Control-Allow-Origin *", ] port = 3990 @@ -122,6 +123,8 @@ job "garage-staging" { tags = [ "garage-staging-web", "tricot *.garage-staging-web.home.adnab.me", + "tricot *.web.staging.deuxfleurs.org", + "tricot staging.deuxfleurs.org", "tricot matrix.home.adnab.me/.well-known/matrix/server", "tricot rust-docs", "tricot-add-header Access-Control-Allow-Origin *", |