From 42879ad5a11d5938625f71b51c3cc3911298933a Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Thu, 18 Aug 2022 16:38:37 +0200 Subject: [PATCH 1/3] add risotto target --- seed/base-machine/manual/install/diff.py | 20 ++++++++++--------- seed/dovecot/templates/dovecot-init.service | 2 +- seed/gitea/templates/gitea.service | 2 +- .../dictionaries/21_ldap-client.xml | 2 +- .../ldap-client/templates/ldap-client.service | 8 ++++++++ .../lemonldap-ng-fastcgi-server.service | 3 +-- seed/mailman/templates/mailman3.service | 2 +- seed/mailman/templates/postorius.service | 2 +- .../dictionaries/20_mariadb.xml | 2 +- .../templates/mariadbclient.service | 3 ++- seed/nextcloud/templates/nextcloud.service | 2 +- seed/nsd/templates/nsd.service | 2 +- .../dictionaries/30_oauth2_client.xml | 3 +++ .../manual/image/preinstall/oauth2-client.sh | 1 + .../templates/oauth2-client.service | 7 +++++++ seed/piwigo/templates/piwigo.service | 2 +- .../dictionaries/23_postgresql.xml | 2 +- .../templates/postgresqlclient.service | 3 ++- seed/roundcube/templates/roundcube.service | 2 +- seed/systemd/dictionaries/15-systemd.xml | 1 + seed/systemd/templates/risotto.target | 5 +++++ 21 files changed, 52 insertions(+), 24 deletions(-) create mode 100644 seed/ldap-client/templates/ldap-client.service create mode 100644 seed/oauth2-client/manual/image/preinstall/oauth2-client.sh create mode 100644 seed/oauth2-client/templates/oauth2-client.service create mode 100644 seed/systemd/templates/risotto.target diff --git a/seed/base-machine/manual/install/diff.py b/seed/base-machine/manual/install/diff.py index 510dcc5..b203086 100755 --- a/seed/base-machine/manual/install/diff.py +++ b/seed/base-machine/manual/install/diff.py @@ -1,12 +1,11 @@ #!/usr/bin/env python3 -from os.path import join from filecmp import dircmp from difflib import unified_diff from sys import stdout, argv from os import walk -from os.path import join +from os.path import join, islink from datetime import datetime, timezone @@ -87,10 +86,13 @@ for filename in old - new: for filename in new - old: - print(f'\n- fichier {filename} ajouté :\n') - with open(join(NEW_DIR, filename), 'r') as fh: - if WEBSITE: - print('```') - print(fh.read()) - if WEBSITE: - print('```') + if islink(join(NEW_DIR, filename)): + print(f'\n- lien {filename} ajouté\n') + else: + print(f'\n- fichier {filename} ajouté :\n') + with open(join(NEW_DIR, filename), 'r') as fh: + if WEBSITE: + print('```') + print(fh.read()) + if WEBSITE: + print('```') diff --git a/seed/dovecot/templates/dovecot-init.service b/seed/dovecot/templates/dovecot-init.service index b4f9cec..1df2ef4 100644 --- a/seed/dovecot/templates/dovecot-init.service +++ b/seed/dovecot/templates/dovecot-init.service @@ -1,5 +1,5 @@ [Unit] -After=network.target +After=risotto.target [Service] ExecStart= diff --git a/seed/gitea/templates/gitea.service b/seed/gitea/templates/gitea.service index 9f19bf7..abb4929 100644 --- a/seed/gitea/templates/gitea.service +++ b/seed/gitea/templates/gitea.service @@ -1,7 +1,7 @@ #ORIGIN https://raw.githubusercontent.com/go-gitea/gitea/main/contrib/systemd/gitea.service [Unit] Description=Gitea (Git with a cup of tea) -After=network.target postgresqlclient.service +After=risotto.target [Service] # Modify these two values and uncomment them if you have diff --git a/seed/ldap-client/dictionaries/21_ldap-client.xml b/seed/ldap-client/dictionaries/21_ldap-client.xml index ac1ce2f..b0835e4 100644 --- a/seed/ldap-client/dictionaries/21_ldap-client.xml +++ b/seed/ldap-client/dictionaries/21_ldap-client.xml @@ -2,7 +2,7 @@ - + ldap_client_file ldap_ca_file ldap_cert_file diff --git a/seed/ldap-client/templates/ldap-client.service b/seed/ldap-client/templates/ldap-client.service new file mode 100644 index 0000000..6cbf68c --- /dev/null +++ b/seed/ldap-client/templates/ldap-client.service @@ -0,0 +1,8 @@ +[Unit] +After=network-online.target +Before=risotto.target + +[Service] +Type=oneshot +ExecStart=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/%%ldap_server_address/%%ldap_port; do sleep 1; done' + diff --git a/seed/lemonldap/templates/lemonldap-ng-fastcgi-server.service b/seed/lemonldap/templates/lemonldap-ng-fastcgi-server.service index f61277e..adbfcf3 100644 --- a/seed/lemonldap/templates/lemonldap-ng-fastcgi-server.service +++ b/seed/lemonldap/templates/lemonldap-ng-fastcgi-server.service @@ -1,7 +1,6 @@ [Unit] -After=nginx.service +After=risotto.target nginx.service [Service] -ExecStartPre=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/%%ldap_server_address/%%ldap_port; do sleep 1; done' ExecStartPost=-/usr/bin/timeout 10 bash -c 'while ! /usr/local/lib/sbin/interne_well_known.pl > /var/www/html/.well-known/openid-configuration/int; do sleep 1; done' ExecStartPost=-/bin/bash -c '/usr/local/lib/sbin/interne_well_known.pl no > /var/www/html/.well-known/openid-configuration/ext' diff --git a/seed/mailman/templates/mailman3.service b/seed/mailman/templates/mailman3.service index 58932c6..5727c46 100644 --- a/seed/mailman/templates/mailman3.service +++ b/seed/mailman/templates/mailman3.service @@ -1,6 +1,6 @@ [Unit] Description=Postorius WSGI Service -After=postgresqlclient.service +After=risotto.target [Service] %for %%domain in %%mailman_domains diff --git a/seed/mailman/templates/postorius.service b/seed/mailman/templates/postorius.service index 1f29c6c..83374d6 100644 --- a/seed/mailman/templates/postorius.service +++ b/seed/mailman/templates/postorius.service @@ -1,6 +1,6 @@ [Unit] Description=Postorius WSGI Service -After=network.target postgresqlclient.service +After=risotto.target [Service] Type=notify diff --git a/seed/mariadb-client/dictionaries/20_mariadb.xml b/seed/mariadb-client/dictionaries/20_mariadb.xml index 39ac585..36155f6 100644 --- a/seed/mariadb-client/dictionaries/20_mariadb.xml +++ b/seed/mariadb-client/dictionaries/20_mariadb.xml @@ -1,7 +1,7 @@ - + diff --git a/seed/mariadb-client/templates/mariadbclient.service b/seed/mariadb-client/templates/mariadbclient.service index 0b583e1..007e422 100644 --- a/seed/mariadb-client/templates/mariadbclient.service +++ b/seed/mariadb-client/templates/mariadbclient.service @@ -1,6 +1,7 @@ [Unit] Description=Waiting for mariadb server -Before=network.target +After=network-online.target +Before=risotto.target [Service] Type=oneshot diff --git a/seed/nextcloud/templates/nextcloud.service b/seed/nextcloud/templates/nextcloud.service index 0a9339f..16c79b5 100644 --- a/seed/nextcloud/templates/nextcloud.service +++ b/seed/nextcloud/templates/nextcloud.service @@ -1,6 +1,6 @@ [Unit] Description=Nextcloud management -After=postgresqlclient.service +After=risotto.target Before=apache.service php-fpm.service [Service] diff --git a/seed/nsd/templates/nsd.service b/seed/nsd/templates/nsd.service index 6f45f4e..f48cf18 100644 --- a/seed/nsd/templates/nsd.service +++ b/seed/nsd/templates/nsd.service @@ -1,2 +1,2 @@ [Unit] -After=network.target +After=risotto.target diff --git a/seed/oauth2-client/dictionaries/30_oauth2_client.xml b/seed/oauth2-client/dictionaries/30_oauth2_client.xml index cc6e415..80a28a6 100644 --- a/seed/oauth2-client/dictionaries/30_oauth2_client.xml +++ b/seed/oauth2-client/dictionaries/30_oauth2_client.xml @@ -1,5 +1,8 @@ + + + diff --git a/seed/oauth2-client/manual/image/preinstall/oauth2-client.sh b/seed/oauth2-client/manual/image/preinstall/oauth2-client.sh new file mode 100644 index 0000000..c6335d9 --- /dev/null +++ b/seed/oauth2-client/manual/image/preinstall/oauth2-client.sh @@ -0,0 +1 @@ +PKG="$PKG curl" diff --git a/seed/oauth2-client/templates/oauth2-client.service b/seed/oauth2-client/templates/oauth2-client.service new file mode 100644 index 0000000..c2bb776 --- /dev/null +++ b/seed/oauth2-client/templates/oauth2-client.service @@ -0,0 +1,7 @@ +[Unit] +After=network-online.target +Before=risotto.target + +[Service] +Type=oneshot +ExecStart=/usr/bin/timeout 90 bash -c 'while ! [ "$(/usr/bin/curl --write-out '%{http_code}' --silent --output /dev/null https://%%oauth2_client_server_domainname/.well-known/openid-configuration)" = 200 ]; do sleep 1; done;' diff --git a/seed/piwigo/templates/piwigo.service b/seed/piwigo/templates/piwigo.service index e75c1c1..16b5b98 100644 --- a/seed/piwigo/templates/piwigo.service +++ b/seed/piwigo/templates/piwigo.service @@ -1,6 +1,6 @@ [Unit] Description=Piwigo management -After=mariadbclient.service +After=risotto.target Before=nginx.service php-fpm.service [Service] diff --git a/seed/postgresql-client/dictionaries/23_postgresql.xml b/seed/postgresql-client/dictionaries/23_postgresql.xml index 138f7d3..9afde85 100644 --- a/seed/postgresql-client/dictionaries/23_postgresql.xml +++ b/seed/postgresql-client/dictionaries/23_postgresql.xml @@ -1,7 +1,7 @@ - + /secrets/postgresql.pass /etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt /etc/pki/tls/certs/postgresql.crt diff --git a/seed/postgresql-client/templates/postgresqlclient.service b/seed/postgresql-client/templates/postgresqlclient.service index 7addde1..fd8b647 100644 --- a/seed/postgresql-client/templates/postgresqlclient.service +++ b/seed/postgresql-client/templates/postgresqlclient.service @@ -1,6 +1,7 @@ [Unit] Description=Waiting for postgresql server -Before=network.target +After=network-online.target +Before=risotto.target [Service] Type=oneshot diff --git a/seed/roundcube/templates/roundcube.service b/seed/roundcube/templates/roundcube.service index 92913e3..19b462b 100644 --- a/seed/roundcube/templates/roundcube.service +++ b/seed/roundcube/templates/roundcube.service @@ -1,6 +1,6 @@ [Unit] Description=Roundcube database init -After=postgresqlclient.service +After=risotto.target Before=nginx.service php-fpm.service [Service] diff --git a/seed/systemd/dictionaries/15-systemd.xml b/seed/systemd/dictionaries/15-systemd.xml index 6819b86..deaf2e7 100644 --- a/seed/systemd/dictionaries/15-systemd.xml +++ b/seed/systemd/dictionaries/15-systemd.xml @@ -29,6 +29,7 @@ /secrets/root.pwd /tmpfiles.d/risotto-volatile.conf + diff --git a/seed/systemd/templates/risotto.target b/seed/systemd/templates/risotto.target new file mode 100644 index 0000000..8f4c5e6 --- /dev/null +++ b/seed/systemd/templates/risotto.target @@ -0,0 +1,5 @@ +[Unit] +Description=Waiting for all dependencies +Before=multi-user.target +After=network-online.target +Wants=network-online.target From 6ce90c458006e7f0f2f1a23a2b81459e44ffb1fb Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 19 Aug 2022 20:30:13 +0200 Subject: [PATCH 2/3] simplify nginx configuration --- .../manual/install/install_machines | 38 +++++++++- seed/dovecot/dictionaries/26_dovecot.xml | 6 +- seed/dovecot/templates/autoconfig.conf | 14 +--- .../dictionaries/70_lemonldap_ng.xml | 2 +- seed/lemonldap/templates/wget.pl | 1 - seed/mailman/applicationservice.yml | 2 +- seed/mailman/dictionaries/31_mailman.xml | 7 +- seed/mailman/templates/config-nginx.conf | 71 ++++++++----------- .../{20_nginx.xml => 21_nginx.xml} | 1 + seed/nginx-common/templates/nginx-common.yml | 13 ++++ seed/nginx-common/templates/nginx.conf | 18 ++++- seed/nginx-common/tests/test_nginx_commmon.py | 50 +++++++++++++ seed/nginx-https/dictionaries/25_nginx.xml | 21 ++---- .../dictionaries/20_nginx.xml | 8 +++ .../dictionaries/25_nginx.xml | 5 +- .../nginx-reverse-proxy/templates/ca_HTTP.crt | 3 + seed/nginx-reverse-proxy/templates/nginx.crt | 2 + seed/nginx-reverse-proxy/templates/nginx.key | 1 + .../templates/revprox-nginx.conf | 2 +- .../nginx-reverse-proxy/tests/test_revprox.py | 13 +--- seed/peertube/applicationservice.yml | 2 +- seed/peertube/dictionaries/30_peertube.xml | 6 +- seed/peertube/templates/nginx.peertube.conf | 39 +++++----- .../templates/nginx.peertube.conf.d.conf | 4 ++ seed/piwigo/dictionaries/31_piwigo.xml | 9 +-- .../templates/piwigo.nginx.conf} | 18 +++-- seed/pleroma/dictionaries/30_pleroma.xml | 2 +- seed/postgresql/DEBUG.md | 1 + seed/reverse-proxy-client/tests/revprox.py | 2 +- 29 files changed, 222 insertions(+), 139 deletions(-) rename seed/nginx-common/dictionaries/{20_nginx.xml => 21_nginx.xml} (98%) create mode 100644 seed/nginx-common/templates/nginx-common.yml create mode 100644 seed/nginx-common/tests/test_nginx_commmon.py create mode 100644 seed/nginx-reverse-proxy/dictionaries/20_nginx.xml create mode 100644 seed/nginx-reverse-proxy/templates/ca_HTTP.crt create mode 100644 seed/nginx-reverse-proxy/templates/nginx.crt create mode 100644 seed/nginx-reverse-proxy/templates/nginx.key create mode 100644 seed/peertube/templates/nginx.peertube.conf.d.conf rename seed/{nginx-https/templates/risotto.conf => piwigo/templates/piwigo.nginx.conf} (82%) create mode 100644 seed/postgresql/DEBUG.md diff --git a/seed/base-machine/manual/install/install_machines b/seed/base-machine/manual/install/install_machines index f053a5f..82388f3 100755 --- a/seed/base-machine/manual/install/install_machines +++ b/seed/base-machine/manual/install/install_machines @@ -14,7 +14,7 @@ for image in *; do if [ -f "host/configurations/$HOST_NAME/etc/systemd/nspawn/$osname.nspawn" ]; then MACHINES="$MACHINES$osname " fi - echo + echo echo "Install machine $image" ./install_machine "$HOST_NAME" "$image" "$osname" fi @@ -23,5 +23,39 @@ for image in *; do done machinectl enable $MACHINES machinectl start $MACHINES +STARTED="" +DEGRADED="" +found=true +idx=0 +while [ $found = true ]; do + found=false + echo "tentative $idx" + for machine in $MACHINES; do + if ! echo $STARTED | grep -q " $machine "; then + status=$(machinectl -q shell $machine /usr/bin/systemctl is-system-running || true) + if echo "$status" | grep -q degraded; then + STARTED="$STARTED $machine " + DEGRADED="$DEGRADED $machine" + elif echo "$status" | grep -q running; then + STARTED="$STARTED $machine " + else + found=true + echo "status actuel de $machine : $status" + fi + fi + done + sleep 2 + idx=$((idx+1)) + if [ $idx = 60 ]; then + break + fi +done +retcode=0 +for machine in $DEGRADED; do + echo + echo "========= $machine" + machinectl -q shell $machine /usr/bin/systemctl --state=failed --no-legend --no-pager + retcode=1 +done -exit 0 +exit $retcode diff --git a/seed/dovecot/dictionaries/26_dovecot.xml b/seed/dovecot/dictionaries/26_dovecot.xml index 05e555e..89a5502 100644 --- a/seed/dovecot/dictionaries/26_dovecot.xml +++ b/seed/dovecot/dictionaries/26_dovecot.xml @@ -18,7 +18,7 @@ - /etc/nginx/conf.d/autoconfig.conf + /etc/nginx/default.d/autoconfig.conf well_known_filenames @@ -90,8 +90,8 @@ - - False + + /var/www/html diff --git a/seed/dovecot/templates/autoconfig.conf b/seed/dovecot/templates/autoconfig.conf index 8be4082..c4faeeb 100644 --- a/seed/dovecot/templates/autoconfig.conf +++ b/seed/dovecot/templates/autoconfig.conf @@ -1,12 +1,2 @@ -server { - listen 443 ssl; - server_name %%domain_name_eth0; - - ssl_client_certificate %%revprox_ca_file; - ssl_certificate %%revprox_cert_file; - ssl_certificate_key %%revprox_key_file; - - root /var/www/html/; - # To allow POST on static pages - error_page 405 =200 $uri; -} +# To allow POST on static pages +error_page 405 =200 $uri; diff --git a/seed/lemonldap/dictionaries/70_lemonldap_ng.xml b/seed/lemonldap/dictionaries/70_lemonldap_ng.xml index 37b7de8..d5b9eea 100644 --- a/seed/lemonldap/dictionaries/70_lemonldap_ng.xml +++ b/seed/lemonldap/dictionaries/70_lemonldap_ng.xml @@ -25,10 +25,10 @@ + diff --git a/seed/lemonldap/templates/wget.pl b/seed/lemonldap/templates/wget.pl index b46dc4b..ca4eda7 100644 --- a/seed/lemonldap/templates/wget.pl +++ b/seed/lemonldap/templates/wget.pl @@ -1,7 +1,6 @@ %echo "#!/usr/bin/env perl" use HTTP::Tiny; -use JSON qw(from_json to_json); my $response = HTTP::Tiny->new->get('https://%%domain_name_eth0/.well-known/openid-configuration'); diff --git a/seed/mailman/applicationservice.yml b/seed/mailman/applicationservice.yml index 769c586..17e1ec5 100644 --- a/seed/mailman/applicationservice.yml +++ b/seed/mailman/applicationservice.yml @@ -5,5 +5,5 @@ depends: - postgresql-client - relay-lmtp-client - reverse-proxy-client - - nginx-common + - nginx-https - oauth2-client diff --git a/seed/mailman/dictionaries/31_mailman.xml b/seed/mailman/dictionaries/31_mailman.xml index b705502..3bf09da 100644 --- a/seed/mailman/dictionaries/31_mailman.xml +++ b/seed/mailman/dictionaries/31_mailman.xml @@ -11,7 +11,7 @@ /etc/postorius/gunicorn_config.py /sysusers.d/0postorius.conf - /etc/nginx/conf.d/postorius.conf + /etc/nginx/default.d/postorius.conf /etc/mailman3.d/postorius.py @@ -47,6 +47,11 @@ + + + /usr/share/webapps/postorius + + mailman diff --git a/seed/mailman/templates/config-nginx.conf b/seed/mailman/templates/config-nginx.conf index 5c928d7..56b0747 100644 --- a/seed/mailman/templates/config-nginx.conf +++ b/seed/mailman/templates/config-nginx.conf @@ -1,42 +1,31 @@ -server { - listen 443 ssl; - server_name %%domain_name_eth0; - - ssl_client_certificate %%revprox_ca_file; - ssl_certificate %%revprox_cert_file; - ssl_certificate_key %%revprox_key_file; - - charset utf-8; - client_max_body_size 75M; - root /usr/share/webapps/postorius; - - location /mailman/postorius_static { - alias /usr/lib/python3.10/site-packages/postorius/static; - } - #FIXME user-profile seems to be in hyperkitty redirect in existing page - location /mailman/user-profile { - proxy_pass http://127.0.0.1:8002/postorius/users; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Port $server_port; - proxy_set_header X-Forwarded-Server $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -%for %%location in ['accounts', 'admin', 'postorius'] - location /mailman/%%location { - proxy_pass http://127.0.0.1:8002/%%location; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Port $server_port; - proxy_set_header X-Forwarded-Server $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -%end for - location /mailman { - rewrite ^(/mailman/.*)$ /mailman/postorius/ permanent; - } +charset utf-8; +client_max_body_size 75M; +location /mailman/postorius_static { + alias /usr/lib/python3.10/site-packages/postorius/static; +} +#FIXME user-profile seems to be in hyperkitty redirect in existing page +location /mailman/user-profile { + proxy_pass http://127.0.0.1:8002/postorius/users; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; +} +%for %%location in ['accounts', 'admin', 'postorius'] +location /mailman/%%location { + proxy_pass http://127.0.0.1:8002/%%location; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; +} +%end for +location /mailman { + rewrite ^(/mailman/.*)$ /mailman/postorius/ permanent; } diff --git a/seed/nginx-common/dictionaries/20_nginx.xml b/seed/nginx-common/dictionaries/21_nginx.xml similarity index 98% rename from seed/nginx-common/dictionaries/20_nginx.xml rename to seed/nginx-common/dictionaries/21_nginx.xml index 2279a56..0ab1a52 100644 --- a/seed/nginx-common/dictionaries/20_nginx.xml +++ b/seed/nginx-common/dictionaries/21_nginx.xml @@ -13,6 +13,7 @@ revprox_ca_file /etc/pki/tls/certs/nginx.crt /etc/pki/tls/private/nginx.key + /tests/nginx-common.yml diff --git a/seed/nginx-common/templates/nginx-common.yml b/seed/nginx-common/templates/nginx-common.yml new file mode 100644 index 0000000..4680042 --- /dev/null +++ b/seed/nginx-common/templates/nginx-common.yml @@ -0,0 +1,13 @@ +address: %%ip_eth0 +nginx_default_http: %slurp +%if %%getVar('nginx_default_http', False) and not %%getVar('revprox_client_external_domainnames', None) +true +%else +false +%end if +nginx_default_https: %slurp +%if %%getVar('nginx_default_https', False) and not %%getVar('revprox_client_external_domainnames', None) +true +%else +false +%end if diff --git a/seed/nginx-common/templates/nginx.conf b/seed/nginx-common/templates/nginx.conf index 758cb4d..b8cf422 100644 --- a/seed/nginx-common/templates/nginx.conf +++ b/seed/nginx-common/templates/nginx.conf @@ -76,14 +76,24 @@ http { %if %%nginx_default_https server { listen 443 ssl http2; - server_name %%domain_name_eth0; + %if %%getVar('revprox_client_external_domainnames', None) + %for %%domain in %%revprox_client_external_domainnames + server_name %%domain; + %end for + %else + server_name _; + %end if root %%nginx_root; # ssl_certificate "/etc/pki/nginx/server.crt"; # ssl_certificate_key "/etc/pki/nginx/private/server.key"; ssl_certificate /etc/pki/tls/certs/nginx.crt; ssl_certificate_key /etc/pki/tls/private/nginx.key; - ssl_client_certificate /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt; + %if %%getVar('revprox_client_external_domainnames', None) + ssl_client_certificate %%revprox_ca_file; + %else + ssl_client_certificate /etc/pki/ca-trust/source/anchors/ca_HTTP.crt; + %end if ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; @@ -105,5 +115,7 @@ http { %else include /etc/nginx/sites-enabled/*; %end if - +%if not %%getVar('revprox_client_external_domainnames', None) + include /etc/nginx/sites-enabled/*; +%end if } diff --git a/seed/nginx-common/tests/test_nginx_commmon.py b/seed/nginx-common/tests/test_nginx_commmon.py new file mode 100644 index 0000000..efbfc86 --- /dev/null +++ b/seed/nginx-common/tests/test_nginx_commmon.py @@ -0,0 +1,50 @@ +from yaml import load, SafeLoader +from os import environ +from pytest import raises + +import warnings +import socket +from requests import get +from requests.exceptions import SSLError + + +def req(url, ip, verify=True): + # Monkey patch to force IPv4 resolution + old_getaddrinfo = socket.getaddrinfo + def new_getaddrinfo(*args, **kwargs): + ret = old_getaddrinfo(*args, **kwargs) + dns = list(ret[0]) + dns[-1] = (ip, dns[-1][1]) + return [dns] + socket.getaddrinfo = new_getaddrinfo + if not verify: + with warnings.catch_warnings(): + warnings.simplefilter("ignore") + ret = get(url, verify=verify) + else: + ret = get(url, verify=verify) + ret_code = ret.status_code + content = ret.content + socket.getaddrinfo = old_getaddrinfo + return ret_code, content.decode() + + +def test_revprox(): + conf_file = f'{environ["MACHINE_TEST_DIR"]}/nginx-common.yml' + with open(conf_file) as yaml: + data = load(yaml, Loader=SafeLoader) + # test unknown domain + url = 'google.fr' + protocols = [] + if data['nginx_default_http']: + protocols.append('http') + if data['nginx_default_https']: + protocols.append('https') + # test certificate + with raises(SSLError): + # not certificat problem for https://{url} + req(f'https://{url}', data['address']) + for protocol in protocols: + ret_code, content = req(f'{protocol}://{url}', data['address'], verify=False) + assert ret_code == 200, f'{protocol}://{url} do not returns code 200 but {ret_code}' + assert "Test Page for the HTTP Server on Fedora" in content, f'{protocol}://{url} do not returns default fedora page' diff --git a/seed/nginx-https/dictionaries/25_nginx.xml b/seed/nginx-https/dictionaries/25_nginx.xml index f908f0b..1f24bfa 100644 --- a/seed/nginx-https/dictionaries/25_nginx.xml +++ b/seed/nginx-https/dictionaries/25_nginx.xml @@ -1,22 +1,16 @@ - - - /etc/nginx/default.d/risotto.conf - - - + + nginx - - - / - @@ -29,11 +23,4 @@ - - - - nginx_default_risotto - nginx_locations - - diff --git a/seed/nginx-reverse-proxy/dictionaries/20_nginx.xml b/seed/nginx-reverse-proxy/dictionaries/20_nginx.xml new file mode 100644 index 0000000..85ac9c5 --- /dev/null +++ b/seed/nginx-reverse-proxy/dictionaries/20_nginx.xml @@ -0,0 +1,8 @@ + + + + + /etc/pki/ca-trust/source/anchors/ca_HTTP.crt + + + diff --git a/seed/nginx-reverse-proxy/dictionaries/25_nginx.xml b/seed/nginx-reverse-proxy/dictionaries/25_nginx.xml index 3ed3d35..e4aa369 100644 --- a/seed/nginx-reverse-proxy/dictionaries/25_nginx.xml +++ b/seed/nginx-reverse-proxy/dictionaries/25_nginx.xml @@ -4,7 +4,7 @@ /etc/nginx/conf.d/options-rp.conf - /etc/nginx/conf.d/risotto.conf + /etc/nginx/sites-enabled/risotto.conf nginx.nginx_certificate_filename nginx.nginx_private_key_filename /tests/reverse-proxy.yml @@ -22,6 +22,9 @@ True + + True + diff --git a/seed/nginx-reverse-proxy/templates/ca_HTTP.crt b/seed/nginx-reverse-proxy/templates/ca_HTTP.crt new file mode 100644 index 0000000..dcbc3aa --- /dev/null +++ b/seed/nginx-reverse-proxy/templates/ca_HTTP.crt @@ -0,0 +1,3 @@ +%for %%idx in %%range(%%len(%%zones_list)) +%%get_chain(authority_cn=%%getVar('domain_name_eth' + %%str(%%idx)), authority_name="HTTP", hide=%%hide_secret) +%end for diff --git a/seed/nginx-reverse-proxy/templates/nginx.crt b/seed/nginx-reverse-proxy/templates/nginx.crt new file mode 100644 index 0000000..de2a8a1 --- /dev/null +++ b/seed/nginx-reverse-proxy/templates/nginx.crt @@ -0,0 +1,2 @@ +%%get_certificate(%%nginx_default, authority_cn=%%domain_name_eth0, authority_name='HTTP', type="server", hide=%%hide_secret) +%%get_chain(%%nginx_default, 'HTTP', hide=%%hide_secret) diff --git a/seed/nginx-reverse-proxy/templates/nginx.key b/seed/nginx-reverse-proxy/templates/nginx.key new file mode 100644 index 0000000..4d393c6 --- /dev/null +++ b/seed/nginx-reverse-proxy/templates/nginx.key @@ -0,0 +1 @@ +%%get_private_key(%%nginx_default, authority_cn=%%domain_name_eth0, authority_name='HTTP', type='server', hide=%%hide_secret) diff --git a/seed/nginx-reverse-proxy/templates/revprox-nginx.conf b/seed/nginx-reverse-proxy/templates/revprox-nginx.conf index c1c7ff6..0f48e77 100644 --- a/seed/nginx-reverse-proxy/templates/revprox-nginx.conf +++ b/seed/nginx-reverse-proxy/templates/revprox-nginx.conf @@ -41,7 +41,7 @@ server { proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Destination $dest; %end if - proxy_ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt; + proxy_ssl_trusted_certificate %%revprox_ca_file; proxy_ssl_verify on; proxy_ssl_verify_depth 2; proxy_ssl_session_reuse on; diff --git a/seed/nginx-reverse-proxy/tests/test_revprox.py b/seed/nginx-reverse-proxy/tests/test_revprox.py index d48cc78..592807d 100644 --- a/seed/nginx-reverse-proxy/tests/test_revprox.py +++ b/seed/nginx-reverse-proxy/tests/test_revprox.py @@ -32,19 +32,8 @@ def test_revprox(): conf_file = f'{environ["MACHINE_TEST_DIR"]}/reverse-proxy.yml' with open(conf_file) as yaml: data = load(yaml, Loader=SafeLoader) - # test unknown domain - url = 'google.fr' - ret_code, content = req(f'https://{url}', data['address'], verify=False) - assert ret_code == 200, f'https://{url} do not returns code 200 but {ret_code}' - assert "Test Page for the HTTP Server on Fedora" in content, f'https://{url} returns default fedora page' - # test certificate - try: - req(f'https://{url}', data['address']) - raise Exception(f'not certificat problem for https://{url}') - except SSLError: - pass # test known domains for url in data['urls']: ret_code, content = req(f'https://{url}', data['address']) assert ret_code == 200, f'https://{url} do not returns code 200 but {ret_code}' - assert "Test Page for the HTTP Server on Fedora" not in content, f'https://{url} returns default fedora page' + assert "Test Page for the HTTP Server on Fedora" not in content, f'https://{url} do returns default fedora page' diff --git a/seed/peertube/applicationservice.yml b/seed/peertube/applicationservice.yml index 6ae8b4b..1aa97ab 100644 --- a/seed/peertube/applicationservice.yml +++ b/seed/peertube/applicationservice.yml @@ -7,5 +7,5 @@ depends: - relay-mail-client - reverse-proxy-client - redis-client - - nginx-common + - nginx-https - oauth2-client diff --git a/seed/peertube/dictionaries/30_peertube.xml b/seed/peertube/dictionaries/30_peertube.xml index 47aa548..6e627f1 100644 --- a/seed/peertube/dictionaries/30_peertube.xml +++ b/seed/peertube/dictionaries/30_peertube.xml @@ -6,7 +6,8 @@ /sysusers.d/0peertube.conf /tmpfiles.d/0peertube.conf /etc/peertube/production.yaml - /etc/nginx/conf.d/peertube.conf + /etc/nginx/default.d/peertube.conf + /etc/nginx/conf.d/peertube.conf @@ -45,6 +46,9 @@ + + /usr/share/peertube + / diff --git a/seed/peertube/templates/nginx.peertube.conf b/seed/peertube/templates/nginx.peertube.conf index 145eee6..0f1fcf9 100644 --- a/seed/peertube/templates/nginx.peertube.conf +++ b/seed/peertube/templates/nginx.peertube.conf @@ -16,15 +16,14 @@ # GNUNUX location / { return 301 https://$host$request_uri; } # GNUNUX } -upstream %%domain_name_eth0 { -# GNUNUX server ${PEERTUBE_HOST}; - server localhost:9000; -} +# GNUNUX upstream %%domain_name_eth0 { +# GNUNUX server ${PEERTUBE_HOST}; +# GNUNUX } -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name %%domain_name_eth0; +# GNUNUX server { +# GNUNUX listen 443 ssl http2; +# GNUNUX listen [::]:443 ssl http2; +# GNUNUX server_name %%domain_name_eth0; # GNUNUX access_log /var/log/nginx/peertube.access.log; # reduce I/0 with buffer=10m flush=5m # GNUNUX error_log /var/log/nginx/peertube.error.log; @@ -35,11 +34,6 @@ server { ## # GNUNUX ssl_certificate /etc/letsencrypt/live/${WEBSERVER_HOST}/fullchain.pem; # GNUNUX ssl_certificate_key /etc/letsencrypt/live/${WEBSERVER_HOST}/privkey.pem; -#>GNUNUX - ssl_client_certificate %%revprox_ca_file; - ssl_certificate %%revprox_cert_file; - ssl_certificate_key %%revprox_key_file; -#/etc/piwigo/database.inc.php /sbin/piwigo.sh /etc/php-fpm.d/piwigo.conf + /etc/nginx/default.d/piwigo.conf