From 3be2659aa19abfb7e676d33e9e7e1357c790a383 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Wed, 24 Aug 2022 21:06:48 +0200
Subject: Make service addressable by zones

---
 .../prod/app/core/config/bottin/config.json.tpl    |  26 ++++
 cluster/prod/app/core/deploy/core.hcl              | 173 ++++++++++++++++++++-
 .../prod/app/core/secrets/directory/ldap_base_dn   |   1 +
 .../app/directory/config/bottin/config.json.tpl    |  26 ----
 .../app/directory/config/guichet/config.json.tpl   |  34 ----
 cluster/prod/app/directory/deploy/directory.hcl    | 140 -----------------
 .../secrets/directory/guichet/mail_domain          |   1 -
 .../directory/secrets/directory/guichet/mail_from  |   1 -
 .../secrets/directory/guichet/s3_access_key        |   1 -
 .../directory/secrets/directory/guichet/s3_bucket  |   1 -
 .../secrets/directory/guichet/s3_endpoint          |   1 -
 .../directory/secrets/directory/guichet/s3_region  |   1 -
 .../secrets/directory/guichet/s3_secret_key        |   1 -
 .../directory/secrets/directory/guichet/smtp_pass  |   1 -
 .../secrets/directory/guichet/smtp_server          |   1 -
 .../directory/secrets/directory/guichet/smtp_user  |   1 -
 .../secrets/directory/guichet/web_hostname         |   1 -
 .../app/directory/secrets/directory/ldap_base_dn   |   1 -
 .../prod/app/frontend/deploy/frontend-tricot.hcl   |  90 -----------
 .../app/guichet/config/guichet/config.json.tpl     |  34 ++++
 cluster/prod/app/guichet/deploy/directory.hcl      |  56 +++++++
 .../guichet/secrets/directory/guichet/mail_domain  |   1 +
 .../guichet/secrets/directory/guichet/mail_from    |   1 +
 .../secrets/directory/guichet/s3_access_key        |   1 +
 .../guichet/secrets/directory/guichet/s3_bucket    |   1 +
 .../guichet/secrets/directory/guichet/s3_endpoint  |   1 +
 .../guichet/secrets/directory/guichet/s3_region    |   1 +
 .../secrets/directory/guichet/s3_secret_key        |   1 +
 .../guichet/secrets/directory/guichet/smtp_pass    |   1 +
 .../guichet/secrets/directory/guichet/smtp_server  |   1 +
 .../guichet/secrets/directory/guichet/smtp_user    |   1 +
 .../guichet/secrets/directory/guichet/web_hostname |   1 +
 cluster/prod/app/plume/deploy/plume.hcl            |   2 +-
 cluster/prod/ssh_config                            |  12 +-
 ssh_known_hosts                                    |   3 +
 35 files changed, 305 insertions(+), 315 deletions(-)
 create mode 100644 cluster/prod/app/core/config/bottin/config.json.tpl
 create mode 100644 cluster/prod/app/core/secrets/directory/ldap_base_dn
 delete mode 100644 cluster/prod/app/directory/config/bottin/config.json.tpl
 delete mode 100644 cluster/prod/app/directory/config/guichet/config.json.tpl
 delete mode 100644 cluster/prod/app/directory/deploy/directory.hcl
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/mail_domain
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/mail_from
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/s3_access_key
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/s3_bucket
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/s3_endpoint
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/s3_region
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/s3_secret_key
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/smtp_pass
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/smtp_server
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/smtp_user
 delete mode 100644 cluster/prod/app/directory/secrets/directory/guichet/web_hostname
 delete mode 100644 cluster/prod/app/directory/secrets/directory/ldap_base_dn
 delete mode 100644 cluster/prod/app/frontend/deploy/frontend-tricot.hcl
 create mode 100644 cluster/prod/app/guichet/config/guichet/config.json.tpl
 create mode 100644 cluster/prod/app/guichet/deploy/directory.hcl
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/mail_domain
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/mail_from
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/s3_access_key
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/s3_bucket
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/s3_endpoint
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/s3_region
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/s3_secret_key
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/smtp_pass
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/smtp_server
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/smtp_user
 create mode 100644 cluster/prod/app/guichet/secrets/directory/guichet/web_hostname

diff --git a/cluster/prod/app/core/config/bottin/config.json.tpl b/cluster/prod/app/core/config/bottin/config.json.tpl
new file mode 100644
index 0000000..844f7b7
--- /dev/null
+++ b/cluster/prod/app/core/config/bottin/config.json.tpl
@@ -0,0 +1,26 @@
+{
+  "suffix": "{{ key "secrets/directory/ldap_base_dn" }}",
+  "bind": "0.0.0.0:389",
+  "log_level": "debug",
+  "acl": [
+		"*,{{ key "secrets/directory/ldap_base_dn" }}::read:*:* !userpassword !user_secret !alternate_user_secrets !garage_s3_secret_key",
+		"*::read modify:SELF:*",
+		"ANONYMOUS::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"ANONYMOUS::bind:cn=admin,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::read:*:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"ANONYMOUS::bind:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::delete:SELF:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+		"cn=admin,{{ key "secrets/directory/ldap_base_dn" }}::read add modify delete:*:*",
+		"*:cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:read add modify delete:*:*"
+  ]
+}
diff --git a/cluster/prod/app/core/deploy/core.hcl b/cluster/prod/app/core/deploy/core.hcl
index 274cb5b..3625993 100644
--- a/cluster/prod/app/core/deploy/core.hcl
+++ b/cluster/prod/app/core/deploy/core.hcl
@@ -3,13 +3,8 @@ job "core" {
   type = "system"
   priority = 90
 
-  constraint {
-    attribute = "${attr.cpu.arch}"
-    value     = "amd64"
-  }
-
   update {
-    max_parallel     = 1
+    max_parallel = 1
     stagger = "1m"
   }
 
@@ -69,4 +64,170 @@ EOH
       }
     }
   }
+
+  group "tricot" {
+    constraint {
+      distinct_property = "${meta.site}"
+      value = "1"
+    }
+
+    network {
+      port "http_port" { static = 80 }
+      port "https_port" { static = 443 }
+    }
+
+    task "server" {
+      driver = "docker"
+
+      config {
+        image = "lxpz/amd64_tricot:42"
+        network_mode = "host"
+        readonly_rootfs = true
+        ports = [ "http_port", "https_port" ]
+        volumes = [
+          "secrets:/etc/tricot",
+        ]
+      }
+
+      resources {
+        cpu = 2000
+        memory = 200
+      }
+
+      restart {
+        interval = "30m"
+        attempts = 2
+        delay    = "15s"
+        mode     = "delay"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+        destination = "secrets/consul-ca.crt"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/consul-client.crt"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/consul-client.key"
+      }
+
+      template {
+        data = <<EOH
+TRICOT_NODE_NAME={{ env "attr.unique.consul.name" }}
+TRICOT_LETSENCRYPT_EMAIL=alex@adnab.me
+TRICOT_ENABLE_COMPRESSION=true
+TRICOT_CONSUL_HOST=https://consul.service.prod.consul:8501
+TRICOT_CONSUL_TLS_SKIP_VERIFY=true
+TRICOT_CONSUL_CLIENT_CERT=/etc/tricot/consul-client.crt
+TRICOT_CONSUL_CLIENT_KEY=/etc/tricot/consul-client.key
+TRICOT_HTTP_BIND_ADDR=[::]:80
+TRICOT_HTTPS_BIND_ADDR=[::]:443
+RUST_LOG=tricot=debug
+EOH
+        destination = "secrets/env"
+        env = true
+      }
+
+      service {
+        name = "tricot-http"
+        port = "http_port"
+        tags = [ "(diplonat (tcp_port 80))", "${meta.site}" ]
+        address_mode = "host"
+      }
+
+      service {
+        name = "tricot-https"
+        port = "https_port"
+        tags = [ "(diplonat (tcp_port 443))", "${meta.site}" ]
+        address_mode = "host"
+      }
+    }
+  }
+
+  group "bottin" {
+    constraint {
+      distinct_property = "${meta.site}"
+      value = "1"
+    }
+
+    network {
+      port "ldap_port" {
+        static = 389
+        to = 389
+      }
+    }
+
+    task "bottin" {
+      driver = "docker"
+      config {
+        image = "superboum/bottin_amd64:22"
+        network_mode = "host"
+        readonly_rootfs = true
+        ports = [ "ldap_port" ]
+        volumes = [
+          "secrets/config.json:/config.json",
+          "secrets:/etc/bottin",
+        ]
+      }
+
+      resources {
+        memory = 100
+      }
+
+      template {
+        data = file("../config/bottin/config.json.tpl")
+        destination = "secrets/config.json"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul.crt\" }}"
+        destination = "secrets/consul.crt"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/consul-client.crt"
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/consul-client.key"
+      }
+
+      template {
+        data = <<EOH
+CONSUL_HTTP_ADDR=https://consul.service.prod.consul:8501
+CONSUL_HTTP_SSL=true
+CONSUL_CACERT=/etc/bottin/consul.crt
+CONSUL_CLIENT_CERT=/etc/bottin/consul-client.crt
+CONSUL_CLIENT_KEY=/etc/bottin/consul-client.key
+EOH
+        destination = "secrets/env"
+        env = true
+      }
+
+      service {
+        tags = [ "${meta.site}" ]
+        port = "ldap_port"
+        address_mode = "host"
+        name = "bottin"
+        check {
+          type = "tcp"
+          port = "ldap_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
 }
diff --git a/cluster/prod/app/core/secrets/directory/ldap_base_dn b/cluster/prod/app/core/secrets/directory/ldap_base_dn
new file mode 100644
index 0000000..ea5c7ae
--- /dev/null
+++ b/cluster/prod/app/core/secrets/directory/ldap_base_dn
@@ -0,0 +1 @@
+USER LDAP base DN for everything (e.g. dc=example,dc=com)
diff --git a/cluster/prod/app/directory/config/bottin/config.json.tpl b/cluster/prod/app/directory/config/bottin/config.json.tpl
deleted file mode 100644
index 844f7b7..0000000
--- a/cluster/prod/app/directory/config/bottin/config.json.tpl
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "suffix": "{{ key "secrets/directory/ldap_base_dn" }}",
-  "bind": "0.0.0.0:389",
-  "log_level": "debug",
-  "acl": [
-		"*,{{ key "secrets/directory/ldap_base_dn" }}::read:*:* !userpassword !user_secret !alternate_user_secrets !garage_s3_secret_key",
-		"*::read modify:SELF:*",
-		"ANONYMOUS::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:",
-		"ANONYMOUS::bind:cn=admin,{{ key "secrets/directory/ldap_base_dn" }}:",
-		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
-		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::read:*:*",
-
-		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:*",
-		"ANONYMOUS::bind:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:",
-		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::delete:SELF:*",
-
-		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
-		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
-
-		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
-		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
-
-		"cn=admin,{{ key "secrets/directory/ldap_base_dn" }}::read add modify delete:*:*",
-		"*:cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:read add modify delete:*:*"
-  ]
-}
diff --git a/cluster/prod/app/directory/config/guichet/config.json.tpl b/cluster/prod/app/directory/config/guichet/config.json.tpl
deleted file mode 100644
index 1a843a8..0000000
--- a/cluster/prod/app/directory/config/guichet/config.json.tpl
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "http_bind_addr": ":9991",
-  "ldap_server_addr": "ldap://bottin.service.staging.consul:389",
-
-  "base_dn": "{{ key "secrets/directory/ldap_base_dn" }}",
-  "user_base_dn": "ou=users,{{ key "secrets/directory/ldap_base_dn" }}",
-  "user_name_attr": "cn",
-  "group_base_dn": "ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
-  "group_name_attr": "cn",
-
-  "invitation_base_dn": "ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}",
-  "invitation_name_attr": "cn",
-  "invited_mail_format": "{}@{{ key "secrets/directory/guichet/mail_domain" | trimSpace }}",
-  "invited_auto_groups": [
-    "cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}"
-  ],
-
-  "web_address": "https://{{ key "secrets/directory/guichet/web_hostname" }}",
-  "mail_from": "{{ key "secrets/directory/guichet/mail_from" }}",
-  "smtp_server": "{{ key "secrets/directory/guichet/smtp_server" }}",
-  "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
-  "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",
-
-  "admin_account": "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}",
-  "group_can_admin": "cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
-  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
-
-  "s3_endpoint": "{{ key "secrets/directory/guichet/s3_endpoint" }}",
-  "s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}",
-  "s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}",
-  "s3_region": "{{ key "secrets/directory/guichet/s3_region" }}",
-  "s3_bucket": "{{ key "secrets/directory/guichet/s3_bucket" }}"
-}
-
diff --git a/cluster/prod/app/directory/deploy/directory.hcl b/cluster/prod/app/directory/deploy/directory.hcl
deleted file mode 100644
index cd503fc..0000000
--- a/cluster/prod/app/directory/deploy/directory.hcl
+++ /dev/null
@@ -1,140 +0,0 @@
-job "directory" {
-  datacenters = ["dc1", "neptune"]
-  type = "service"
-  priority = 90
-
-  constraint {
-    attribute = "${attr.cpu.arch}"
-    value     = "amd64"
-  }
-
-  group "bottin" {
-    count = 1
-
-    network {
-      port "ldap_port" {
-        static = 389
-        to = 389
-      }
-    }
-
-    task "bottin" {
-      driver = "docker"
-      config {
-        image = "superboum/bottin_amd64:22"
-        network_mode = "host"
-        readonly_rootfs = true
-        ports = [ "ldap_port" ]
-        volumes = [
-          "secrets/config.json:/config.json",
-          "secrets:/etc/bottin",
-        ]
-      }
-
-      resources {
-        memory = 100
-      }
-
-      template {
-        data = file("../config/bottin/config.json.tpl")
-        destination = "secrets/config.json"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul.crt\" }}"
-        destination = "secrets/consul.crt"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
-        destination = "secrets/consul-client.crt"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul-client.key\" }}"
-        destination = "secrets/consul-client.key"
-      }
-
-      template {
-        data = <<EOH
-CONSUL_HTTP_ADDR=https://consul.service.prod.consul:8501
-CONSUL_HTTP_SSL=true
-CONSUL_CACERT=/etc/bottin/consul.crt
-CONSUL_CLIENT_CERT=/etc/bottin/consul-client.crt
-CONSUL_CLIENT_KEY=/etc/bottin/consul-client.key
-EOH
-        destination = "secrets/env"
-        env = true
-      }
-
-      service {
-        tags = ["bottin"]
-        port = "ldap_port"
-        address_mode = "host"
-        name = "bottin"
-        check {
-          type = "tcp"
-          port = "ldap_port"
-          interval = "60s"
-          timeout = "5s"
-          check_restart {
-            limit = 3
-            grace = "90s"
-            ignore_warnings = false
-          }
-        }
-      }
-    }
-  }
-
-  group "guichet" {
-    count = 1
-
-    network {
-      port "web_port" { to = 9991 }
-    }
-
-    task "guichet" {
-      driver = "docker"
-      config {
-        image = "superboum/guichet_amd64:15"
-        readonly_rootfs = true
-        ports = [ "web_port" ]
-        volumes = [
-          "secrets/config.json:/config.json"
-        ]
-      }
-
-      template {
-        data = file("../config/guichet/config.json.tpl")
-        destination = "secrets/config.json"
-      }
-
-      resources {
-        memory = 200
-      }
-
-      service {
-        name = "guichet"
-        tags = [
-          "guichet",
-          "tricot guichet-new.deuxfleurs.fr",
-        ]
-        port = "web_port"
-        address_mode = "host"
-        check {
-          type = "tcp"
-          port = "web_port"
-          interval = "60s"
-          timeout = "5s"
-          check_restart {
-            limit = 3
-            grace = "90s"
-            ignore_warnings = false
-          }
-        }
-      }
-    }
-  }
-}
-
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/mail_domain b/cluster/prod/app/directory/secrets/directory/guichet/mail_domain
deleted file mode 100644
index 5db1ba3..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/mail_domain
+++ /dev/null
@@ -1 +0,0 @@
-USER E-mail domain for new users (e.g. example.com)
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/mail_from b/cluster/prod/app/directory/secrets/directory/guichet/mail_from
deleted file mode 100644
index 9075cbf..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/mail_from
+++ /dev/null
@@ -1 +0,0 @@
-USER E-mail address from which to send welcome emails to new users
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/s3_access_key b/cluster/prod/app/directory/secrets/directory/guichet/s3_access_key
deleted file mode 100644
index e5b37ff..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/s3_access_key
+++ /dev/null
@@ -1 +0,0 @@
-USER Garage access key for Guichet profile pictures
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/s3_bucket b/cluster/prod/app/directory/secrets/directory/guichet/s3_bucket
deleted file mode 100644
index cb059cf..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/s3_bucket
+++ /dev/null
@@ -1 +0,0 @@
-USER S3 bucket in which to store data files (such as profile pictures)
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/s3_endpoint b/cluster/prod/app/directory/secrets/directory/guichet/s3_endpoint
deleted file mode 100644
index b414269..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/s3_endpoint
+++ /dev/null
@@ -1 +0,0 @@
-USER S3 endpoint URL
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/s3_region b/cluster/prod/app/directory/secrets/directory/guichet/s3_region
deleted file mode 100644
index ef16924..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/s3_region
+++ /dev/null
@@ -1 +0,0 @@
-USER S3 region
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/s3_secret_key b/cluster/prod/app/directory/secrets/directory/guichet/s3_secret_key
deleted file mode 100644
index f3e7f0f..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/s3_secret_key
+++ /dev/null
@@ -1 +0,0 @@
-USER Garage secret key for Guichet profile pictures
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/smtp_pass b/cluster/prod/app/directory/secrets/directory/guichet/smtp_pass
deleted file mode 100644
index fc9d1e3..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/smtp_pass
+++ /dev/null
@@ -1 +0,0 @@
-USER SMTP password
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/smtp_server b/cluster/prod/app/directory/secrets/directory/guichet/smtp_server
deleted file mode 100644
index c453935..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/smtp_server
+++ /dev/null
@@ -1 +0,0 @@
-USER SMTP server address (hostname:port)
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/smtp_user b/cluster/prod/app/directory/secrets/directory/guichet/smtp_user
deleted file mode 100644
index c9c8bd0..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/smtp_user
+++ /dev/null
@@ -1 +0,0 @@
-USER SMTP username
diff --git a/cluster/prod/app/directory/secrets/directory/guichet/web_hostname b/cluster/prod/app/directory/secrets/directory/guichet/web_hostname
deleted file mode 100644
index afe2512..0000000
--- a/cluster/prod/app/directory/secrets/directory/guichet/web_hostname
+++ /dev/null
@@ -1 +0,0 @@
-USER Public hostname from which Guichet is accessible via HTTP (e.g. guichet.example.com)
diff --git a/cluster/prod/app/directory/secrets/directory/ldap_base_dn b/cluster/prod/app/directory/secrets/directory/ldap_base_dn
deleted file mode 100644
index ea5c7ae..0000000
--- a/cluster/prod/app/directory/secrets/directory/ldap_base_dn
+++ /dev/null
@@ -1 +0,0 @@
-USER LDAP base DN for everything (e.g. dc=example,dc=com)
diff --git a/cluster/prod/app/frontend/deploy/frontend-tricot.hcl b/cluster/prod/app/frontend/deploy/frontend-tricot.hcl
deleted file mode 100644
index fcc7c46..0000000
--- a/cluster/prod/app/frontend/deploy/frontend-tricot.hcl
+++ /dev/null
@@ -1,90 +0,0 @@
-job "frontend" {
-  datacenters = ["neptune"]
-  type = "service"
-  priority = 90
-
-  group "tricot" {
-    # Temporarily pin to single machine, remove this later
-    constraint {
-      attribute = "${attr.unique.hostname}"
-      value = "courgette"
-    }
-
-    network {
-      port "http_port" { static = 80 }
-      port "https_port" { static = 443 }
-    }
-
-    task "server" {
-      driver = "docker"
-
-      config {
-        image = "lxpz/amd64_tricot:42"
-        network_mode = "host"
-        readonly_rootfs = true
-        ports = [ "http_port", "https_port" ]
-        volumes = [
-          "secrets:/etc/tricot",
-        ]
-      }
-
-      resources {
-        cpu = 2000
-        memory = 200
-      }
-
-      restart {
-        interval = "30m"
-        attempts = 2
-        delay    = "15s"
-        mode     = "delay"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
-        destination = "secrets/consul-ca.crt"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
-        destination = "secrets/consul-client.crt"
-      }
-
-      template {
-        data = "{{ key \"secrets/consul/consul-client.key\" }}"
-        destination = "secrets/consul-client.key"
-      }
-
-      template {
-        data = <<EOH
-TRICOT_NODE_NAME={{ env "attr.unique.consul.name" }}
-TRICOT_LETSENCRYPT_EMAIL=alex@adnab.me
-TRICOT_ENABLE_COMPRESSION=true
-TRICOT_CONSUL_HOST=https://consul.service.prod.consul:8501
-TRICOT_CONSUL_TLS_SKIP_VERIFY=true
-TRICOT_CONSUL_CLIENT_CERT=/etc/tricot/consul-client.crt
-TRICOT_CONSUL_CLIENT_KEY=/etc/tricot/consul-client.key
-TRICOT_HTTP_BIND_ADDR=[::]:80
-TRICOT_HTTPS_BIND_ADDR=[::]:443
-RUST_LOG=tricot=debug
-EOH
-        destination = "secrets/env"
-        env = true
-      }
-
-      service {
-        name = "tricot-http"
-        port = "http_port"
-        tags = [ "(diplonat (tcp_port 80))" ]
-        address_mode = "host"
-      }
-
-      service {
-        name = "tricot-https"
-        port = "https_port"
-        tags = [ "(diplonat (tcp_port 443))" ]
-        address_mode = "host"
-      }
-    }
-  }
-}
diff --git a/cluster/prod/app/guichet/config/guichet/config.json.tpl b/cluster/prod/app/guichet/config/guichet/config.json.tpl
new file mode 100644
index 0000000..ec0c201
--- /dev/null
+++ b/cluster/prod/app/guichet/config/guichet/config.json.tpl
@@ -0,0 +1,34 @@
+{
+  "http_bind_addr": ":9991",
+  "ldap_server_addr": "ldap://{{ env "meta.site" }}.bottin.service.prod.consul:389",
+
+  "base_dn": "{{ key "secrets/directory/ldap_base_dn" }}",
+  "user_base_dn": "ou=users,{{ key "secrets/directory/ldap_base_dn" }}",
+  "user_name_attr": "cn",
+  "group_base_dn": "ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_name_attr": "cn",
+
+  "invitation_base_dn": "ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}",
+  "invitation_name_attr": "cn",
+  "invited_mail_format": "{}@{{ key "secrets/directory/guichet/mail_domain" | trimSpace }}",
+  "invited_auto_groups": [
+    "cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}"
+  ],
+
+  "web_address": "https://{{ key "secrets/directory/guichet/web_hostname" }}",
+  "mail_from": "{{ key "secrets/directory/guichet/mail_from" }}",
+  "smtp_server": "{{ key "secrets/directory/guichet/smtp_server" }}",
+  "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
+  "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",
+
+  "admin_account": "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_can_admin": "cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+
+  "s3_endpoint": "{{ key "secrets/directory/guichet/s3_endpoint" }}",
+  "s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}",
+  "s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}",
+  "s3_region": "{{ key "secrets/directory/guichet/s3_region" }}",
+  "s3_bucket": "{{ key "secrets/directory/guichet/s3_bucket" }}"
+}
+
diff --git a/cluster/prod/app/guichet/deploy/directory.hcl b/cluster/prod/app/guichet/deploy/directory.hcl
new file mode 100644
index 0000000..bfd7e6d
--- /dev/null
+++ b/cluster/prod/app/guichet/deploy/directory.hcl
@@ -0,0 +1,56 @@
+job "guichet" {
+  datacenters = [ "neptune" ]
+  type = "service"
+  priority = 90
+
+  group "guichet" {
+    count = 1
+
+    network {
+      port "web_port" { to = 9991 }
+    }
+
+    task "guichet" {
+      driver = "docker"
+      config {
+        image = "superboum/guichet_amd64:15"
+        readonly_rootfs = true
+        ports = [ "web_port" ]
+        volumes = [
+          "secrets/config.json:/config.json"
+        ]
+      }
+
+      template {
+        data = file("../config/guichet/config.json.tpl")
+        destination = "secrets/config.json"
+      }
+
+      resources {
+        memory = 200
+      }
+
+      service {
+        name = "guichet"
+        tags = [
+          "guichet",
+          "tricot guichet-new.deuxfleurs.fr",
+        ]
+        port = "web_port"
+        address_mode = "host"
+        check {
+          type = "tcp"
+          port = "web_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+}
+
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/mail_domain b/cluster/prod/app/guichet/secrets/directory/guichet/mail_domain
new file mode 100644
index 0000000..5db1ba3
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/mail_domain
@@ -0,0 +1 @@
+USER E-mail domain for new users (e.g. example.com)
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/mail_from b/cluster/prod/app/guichet/secrets/directory/guichet/mail_from
new file mode 100644
index 0000000..9075cbf
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/mail_from
@@ -0,0 +1 @@
+USER E-mail address from which to send welcome emails to new users
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/s3_access_key b/cluster/prod/app/guichet/secrets/directory/guichet/s3_access_key
new file mode 100644
index 0000000..e5b37ff
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/s3_access_key
@@ -0,0 +1 @@
+USER Garage access key for Guichet profile pictures
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/s3_bucket b/cluster/prod/app/guichet/secrets/directory/guichet/s3_bucket
new file mode 100644
index 0000000..cb059cf
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/s3_bucket
@@ -0,0 +1 @@
+USER S3 bucket in which to store data files (such as profile pictures)
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/s3_endpoint b/cluster/prod/app/guichet/secrets/directory/guichet/s3_endpoint
new file mode 100644
index 0000000..b414269
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/s3_endpoint
@@ -0,0 +1 @@
+USER S3 endpoint URL
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/s3_region b/cluster/prod/app/guichet/secrets/directory/guichet/s3_region
new file mode 100644
index 0000000..ef16924
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/s3_region
@@ -0,0 +1 @@
+USER S3 region
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/s3_secret_key b/cluster/prod/app/guichet/secrets/directory/guichet/s3_secret_key
new file mode 100644
index 0000000..f3e7f0f
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/s3_secret_key
@@ -0,0 +1 @@
+USER Garage secret key for Guichet profile pictures
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/smtp_pass b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_pass
new file mode 100644
index 0000000..fc9d1e3
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_pass
@@ -0,0 +1 @@
+USER SMTP password
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/smtp_server b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_server
new file mode 100644
index 0000000..c453935
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_server
@@ -0,0 +1 @@
+USER SMTP server address (hostname:port)
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/smtp_user b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_user
new file mode 100644
index 0000000..c9c8bd0
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/smtp_user
@@ -0,0 +1 @@
+USER SMTP username
diff --git a/cluster/prod/app/guichet/secrets/directory/guichet/web_hostname b/cluster/prod/app/guichet/secrets/directory/guichet/web_hostname
new file mode 100644
index 0000000..afe2512
--- /dev/null
+++ b/cluster/prod/app/guichet/secrets/directory/guichet/web_hostname
@@ -0,0 +1 @@
+USER Public hostname from which Guichet is accessible via HTTP (e.g. guichet.example.com)
diff --git a/cluster/prod/app/plume/deploy/plume.hcl b/cluster/prod/app/plume/deploy/plume.hcl
index 266a665..3e9aa77 100644
--- a/cluster/prod/app/plume/deploy/plume.hcl
+++ b/cluster/prod/app/plume/deploy/plume.hcl
@@ -1,5 +1,5 @@
 job "plume-blog" {
-  datacenters = ["dc1"]
+  datacenters = ["orion"]
   type = "service"
 
   constraint {
diff --git a/cluster/prod/ssh_config b/cluster/prod/ssh_config
index 068f209..afae310 100644
--- a/cluster/prod/ssh_config
+++ b/cluster/prod/ssh_config
@@ -1,16 +1,16 @@
 UserKnownHostsFile ./ssh_known_hosts
 
 Host concombre
-	#HostName 2a06:a004:3025:1::31
-	HostName 192.168.1.31
+	HostName 2a06:a004:3025:1::31
+    #HostName 192.168.1.31
 
 Host courgette
-	#HostName 2a06:a004:3025:1::32
-	HostName 192.168.1.32
+	HostName 2a06:a004:3025:1::32
+    #HostName 192.168.1.32
 
 Host celeri
-	#HostName 2a06:a004:3025:1::33
-    HostName 192.168.1.33
+	HostName 2a06:a004:3025:1::33
+    #HostName 192.168.1.33
 
 Host dahlia
     HostName dahlia.machine.deuxfleurs.fr
diff --git a/ssh_known_hosts b/ssh_known_hosts
index 2104ac9..335555b 100644
--- a/ssh_known_hosts
+++ b/ssh_known_hosts
@@ -9,3 +9,6 @@
 doradille.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzVJB1XYBC/rMxb7UfAoCzKH/l6oE4NKsSErCv2wV94
 dahlia.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQsdIYUn4njMRAuT0/8GzqGn6zGn9014BAkT7VSVf2H
 diplotaxis.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFcVtfOj0ti6eYsFSq2gbBGhaf8E7p/QiO3/MVX1D32T
+2a06:a004:3025:1::33 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuY1CvhxBP9BtKkTlmOUu6Hhy8OQTB3R8OCFXbHA/RA
+2a06:a004:3025:1::31 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3N0QOFNGkCpVLuOHFdpnBaxIFH925KpdIHV/3F9+BR
+2a06:a004:3025:1::32 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCXJeo6yeQeTN7D7OZwLd8zbyU1jWywlhQ29yyk7x+G
-- 
cgit v1.2.3