add piwigo

doc/certificates.md

@@ -1,68 +1,73 @@
 # Généré des certificats via la PKI interne de mini_risotto
 
-## Génération des certificates sur le serveur
+## Génération du certificate sur le serveur
 
-Création la variable contenant la chain :
+### Sous Fedora
 
 ```
-<variables>
+<file>/etc/pki/ca-trust/source/anchors/ca_<AUTHORITY_NAME>.crt</file>
-  <variable name='service_ca_chain' description="CA certificate" hidden='True'/>
+<file>/etc/pki/tls/certs/<SERVICE>.crt</file>
+<file owner="root" group="<SERVICE>" mode="440">/etc/pki/tls/private/<SERVICE>.key</file>
+```
+
+### Les templates
+
+Dans le template ca_<AUTHORITY_NAME>.crt :
+
+```
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="<AUTHORITY_NAME>")
+```
+
+Dans le template <SERVICE>.crt :
+
+```
+%%get_certificate(%%domain_name_eth0, '<AUTHORITY_NAME>')
+```
+
+Dans le template <SERVICE>.key :
+
+```
+%%get_private_key(%%domain_name_eth0, '<AUTHORITY_NAME>')
+```
+
+## Génération du certificat client
+
+### Sous Fedora
+
+```
+<services>
+  <service name="<SERVICE>client" manage="False">
+    <file>/etc/pki/ca-trust/source/anchors/ca_<AUTHORITY_NAME>.crt</file>
+    <file>/etc/pki/tls/certs/<SERVICE>.crt</file>
+    <file owner_type="variable" owner="<VARIABLE_NAME>" mode="400">/etc/pki/tls/private/<SERVICE>.key</file>
+  </service>
+</services>
+```
+
+### La variable
+
+```
+<variable name="<VARIABLE_NAME>" type="unix_user" description="Key owner" mandatory="True">
+  <value>DEFAULT_VALUE</value>
 </variable>
 ```
 
-Création d'une autorité avec le nom "AuthorityName" (le nom est un terme en CamelCase) :
+### Les templates
+
+Dans le template ca_<AUTHORITY_NAME>.crt :
 
 ```
-<fill name="get_chain">
+%%get_chain(authority_cn=<SERVER_DOMAINNAME>, authority_name="<AUTHORITY_NAME>")
-  <param name="cn" type="information">server_name</param>
-  <param name="authority_cn" type="information">server_name</param>
-  <param name="authority_name">AuthorityName</param>
-  <target>service_chain</target>
-</fill>
 ```
 
-La création du fichier de CA est simple, il suffit d'utiliser la variable "service_ca_chain".
+Dans le template <SERVICE>.crt :
-
-Puis il faut créer le certificat avec un template qui contient :
 
 ```
-%%get_certificate(%%domain_name_eth0, authority_name="AuthorityName")
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=<SERVER_DOMAINNAME>, authority_name='<AUTHORITY_NAME>', type="client")
 ```
 
-Si l'autorité n'est pas gérer par le serveur courant, il faut précicer le nom du serveur responsable de l'autorité :
+Dans le template <SERVICE>.key :
 
 ```
-%%get_certificate(%%domain_name_eth0, authority_cn=%%server, authority_name="AuthorityName")
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=<SERVER_DOMAINNAME>, authority_name='<AUTHORITY_NAME>', type="client")
-```
-
-Enfin, le certificat peut avoir plusieurs nom de domaine, dans ce cas on peut le gérer par exemple en faisant :
-
-```
-%set %%extra_domainnames = []
-%for %%idx in %%range(1, %%number_of_interfaces)
-  %%extra_domainnames.append(%%getVar('domain_name_eth' + %%str(%%idx)))
-%end for
-%%get_certificate(%%domain_name_eth0, 'LDAP', extra_domainnames=%%extra_domainnames)
-```
-
-Enfin on peut récupérer la clef privée (attention APRÉS avoir récupérer le certificat) :
-
-```
-%get_private_key(%%domain_name_eth0, %%server)
-```
-
-Comme le certificat, l'autorité peut ne pas être de la responsabilité du serveur courant :
-
-```
-%get_private_key(%%domain_name_eth0, authority_cn=%%server, authority_name="ReverseProxy")
-```
-
-## PKI sous Fedora
-
-Création des fichiers pour l'autorité "AuthorityName" pour le service "service" :
-
-```
-<file>/etc/pki/ca-trust/source/anchors/ca_AuthorityName.crt</file>
-<file>/etc/pki/tls/certs/service.crt</file>
-<file owner="root" group="root" mode="400">/etc/pki/tls/private/service.key</file>
 ```

seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml

@@ -6,13 +6,16 @@
       <file>/etc/httpd/conf.d/risotto.conf</file>
       <file>/etc/httpd/conf.d/ssl.conf</file>
       <file>/etc/httpd/ssl/server.ca</file>
-      <file>/etc/httpd/ssl/server.key</file>
       <file>/etc/httpd/ssl/server.crt</file>
+      <file>/etc/httpd/ssl/server.key</file>
       <file engine="none" source="sysuser-httpd.conf">/sysusers.d/httpd.conf</file>
       <file engine="none" source="tmpfile-httpd.conf">/tmpfiles.d/0httpd.conf</file>
     </service>
   </services>
   <variables>
+    <variable name="php_fpm_user" redefine="True" exists="True">
+      <value>apache</value>
+    </variable>
     <family name="apache" description="Apache" help="Paramètrage avancé du serveur web Apache">
       <variable name="apache_timeout" type="number" description="Temps en secondes pendant lequel le serveur va attendre des entrées/sorties avant de considérer qu'une requête a échoué">
         <value>300</value>

seed/applicationservice/2022.03.08/base/funcs/funcs.py

@@ -17,8 +17,6 @@ def get_password(server_name: str,
                  length: int=20,
                  temporary: bool=True,
                  ) -> str:
-    if type != 'cleartext':
-        raise Exception('only cleartext is supported')
     def gen_password():
         return _token_urlsafe(length)[:length]
     return _set_password(server_name,
@@ -26,6 +24,7 @@ def get_password(server_name: str,
                          description,
                          gen_password,
                          temporary,
+                         type,
                          )
 
 
@@ -45,6 +44,7 @@ def get_password_alpha_num(server_name,
                          description,
                          gen_password,
                          True,
+                         'cleartext',
                          )
 
 
@@ -53,7 +53,10 @@ def _set_password(server_name: str,
                   description: str,
                   gen_password,
                   temporary,
+                  type,
                   ) -> str:
+    if type != 'cleartext':
+        raise Exception('only cleartext is supported')
     if not server_name or not username:
         return
     dir_name = _join(_PASSWORD_DIR, server_name, description)
@@ -65,7 +68,8 @@ def _set_password(server_name: str,
         with open(file_name, 'w') as fh:
             fh.write(password)
     with open(file_name, 'r') as fh:
-        return fh.read().strip()
+        file_content = fh.read().strip()
+        return file_content
 
 
 def get_range(stop):

seed/applicationservice/2022.03.08/base/manual/install/config_machine.sh

@@ -1,6 +1,7 @@
 # machine configuration
 MACHINE_RISOTTO_SRV_DIR_LOCAL="srv/$MACHINE"
 MACHINE_RISOTTO_SRV_DIR="$RISOTTO_SRV_DIR/$MACHINE"
+RISOTTO_JOURNALD_DIR="$RISOTTO_DIR/journals/$MACHINE"
 MACHINE_RISOTTO_CONFIG_DIR_LOCAL="$IMAGE_NAME/configurations/$MACHINE"
 MACHINE_RISOTTO_CONFIG_DIR="$RISOTTO_CONFIG_DIR/$MACHINE"
 MACHINE_MACHINES_DIR="$MACHINES_DIR/$MACHINE"

seed/applicationservice/2022.03.08/base/manual/install/install_host

@@ -5,7 +5,7 @@ if [ -z "$HOST_NAME" ]; then
     echo "usage: $0 host name"
     exit 1
 fi
-apt install --yes systemd-container dnf jq debootstrap htop gettext patch
+apt install --yes systemd-container dnf jq debootstrap htop gettext patch unzip mlocate
 systemd-tmpfiles --create --clean --remove $PWD/host/configurations/$HOST_NAME/tmpfiles.d/0asystemd-nspawn.conf
 systemd-tmpfiles --create --clean --remove $PWD/host/configurations/$HOST_NAME/tmpfiles.d/0rougail.conf
 systemctl daemon-reload

seed/applicationservice/2022.03.08/base/manual/install/install_machine

@@ -17,18 +17,30 @@ if [ ! -f "$IMAGE_NAME_RISOTTO_IMAGE_NAME" ]; then
     echo "PAS D'IMAGE $IMAGE_NAME_RISOTTO_IMAGE_NAME"
     exit 1
 fi
+NEW_IMAGE=false
+NEW_CONF=false
 if [ -L "$MACHINE_MACHINES_DIR" ] || [ -d "$MACHINE_MACHINES_DIR" ]; then
+    # is the base image divergent?
+    diff -q "$IMAGE_NAME_RISOTTO_IMAGE_NAME".sha "$SHA_MACHINE" || NEW_IMAGE=true
+    # is the configuration divergent?
+    diff -q --no-dereference -Nru "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" || NEW_CONF=true
+fi
+if [ "$NEW_IMAGE" = true ] || [ "$NEW_CONF" = true ]; then
     machinectl stop "$MACHINE" 2> /dev/null || true
     while true; do
         machinectl status "$MACHINE" > /dev/null 2>&1 || break
         sleep 1
         echo "retry..."
     done
-    diff -q "$IMAGE_NAME_RISOTTO_IMAGE_NAME".sha "$SHA_MACHINE" || rm -rf "$MACHINE_MACHINES_DIR"
 fi
-if [ -d "$MACHINE_RISOTTO_CONFIG_DIR" ]; then
+if [ "$NEW_IMAGE" = true ]; then
-    # fait un diff
+    echo "SUPPRIME ANCIENNE IMAGE"
-    diff -q --no-dereference -Nru "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" || ( ./diff.py "$MACHINE" "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" > "$MACHINE_RISOTTO_CONFIG_DIR"_changelog.md; rm -rf "$MACHINE_RISOTTO_CONFIG_DIR" )
+    rm -rf "$MACHINE_MACHINES_DIR"
+fi
+if [ "$NEW_CONF" = true ]; then
+    echo "SUPPRIME ANCIENNE CONF"
+    ./diff.py "$MACHINE" "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" > "$MACHINE_RISOTTO_CONFIG_DIR"_changelog.md
+    rm -rf "$MACHINE_RISOTTO_CONFIG_DIR"
 fi
 
 cp -a "$MACHINE_NAME_NSPAWN_LOCAL" "$MACHINE_NAME_NSPAWN"
@@ -39,6 +51,7 @@ fi
 if [ ! -d "$MACHINE_RISOTTO_SRV_DIR" ] && [ -d "$MACHINE_RISOTTO_SRV_DIR_LOCAL" ]; then
     mkdir -p "$MACHINE_RISOTTO_SRV_DIR"
 fi
+mkdir -p "$RISOTTO_JOURNALD_DIR"
 if [ ! -d "$MACHINE_MACHINES_DIR" ]; then
     cd "$MACHINES_DIR"
     tar xf "$IMAGE_NAME_RISOTTO_IMAGE_NAME"

seed/applicationservice/2022.03.08/gitea/templates/app.ini

@@ -88,7 +88,7 @@ ADAPTER = redis
 ;; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
 ;; memcache: `127.0.0.1:11211`
 ;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
-HOST = network=tcp,addr=%%redis_client_server_domainname:6379,password=%%redis_client_password,db=0,pool_size=100,idle_timeout=180
+HOST = network=tcp,addr=%%redis_client_server_domainname:6379,username=%%redis_client_username,password=%%redis_client_password,db=0,pool_size=100,idle_timeout=180
 ;;
 ;; Time to keep items in cache if not used, default is 16 hours.
 ;; Setting it to 0 disables caching

seed/applicationservice/2022.03.08/host-systemd-machined/extras/machined/00-machined.xml

@@ -11,6 +11,7 @@
     <family name="machine_" description="Machine " dynamic="machined.machines">
       <variable name="external_ports_" description="External ports for " hidden="True" type="port" multi="True" provider="external_ports"/>
       <variable name="srv_dir_" description="Directory with srv volume for " hidden="True" type="filename" provider="machine_srv"/>
+      <variable name="journal_dir_" description="Directory with journal volume for " hidden="True" type="filename" provider="machine_journal"/>
       <variable name="config_dir_" description="Directory with configuration volume for " hidden="True" type="filename" provider="machine_config" mandatory="True"/>
       <variable name="zones_" description="Zones for " hidden="True" provider="machine_zones" mandatory="True" multi="True"/>
     </family>

seed/applicationservice/2022.03.08/host-systemd-machined/templates/nspawn

@@ -6,6 +6,7 @@ PrivateUsersChown=false
 %if %%container['srv_dir_' + %%name]
 Bind=%%container['srv_dir_' + %%name]:/srv
 %end if
+Bind=%%container['journal_dir_' + %%name]:/var/log/journal/
 BindReadOnly=%%container['config_dir_' + %%name]:/usr/local/lib
 %set zones = %%container['zones_' + %%name]
 %if %%zones

seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py

@@ -1,16 +1,3 @@
-def get_default_base_dn(server_name: str) -> str:
-    if not server_name or '.' not in server_name:
-        return None
-    values = server_name.split('.')
-    # cannot calculated base dn should be server.domain.tld
-    # remove 'server' in dn
-    if len(values) < 3:
-        return None
-    domain = ['ou=' + domain for domain in values[1:-2]]
-    domain.append(f'o={values[-2]},o={values[-1]}')
-    return ','.join(domain)
-
-
 def valid_base_dn(base_dn: str) -> None:
     for att in ['o', 'dc', 'ou']:
         if base_dn.startswith(att + '='):

seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml

@@ -9,6 +9,7 @@
       <file engine="none">/static/silique_folder.png</file>
       <file engine="none">/static/silique_note.png</file>
       <file engine="none">/static/silique_video.png</file>
+      <file engine="none">/static/silique_image.png</file>
       <file engine="none">/static/risotto.css</file>
       <file>/var/lib/lemonldap-ng/conf/lmConf-1.json</file>
       <file engine="none">/etc/lemonldap-ng/lemonldap-ng.ini</file>

seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml

@@ -14,6 +14,9 @@
       <file source="config-nginx.conf">/etc/nginx/conf.d/postorius.conf</file>
       <file source="postorius-settings.py">/etc/mailman3.d/postorius.py</file>
     </service>
+    <service name="postgresqlclient" target="multi-user" engine="creole">
+      <file owner="postorius" mode="400">/etc/pki/tls/private/postgresql_postorius.key</file>
+    </service>
   </services>
   <variables>
     <family name="mailman" description="Gestionnaire de liste">
@@ -42,6 +45,11 @@
       </variable>
       <variable name="oauth2_client_external" redefine="True" remove_fill="True"/>
     </family>
+    <family name="postgresql">
+      <variable name="pg_client_key_owner" redefine="True">
+        <value>mailman</value>
+      </variable>
+    </family>
   </variables>
   <constraints>
     <fill name="get_password">

seed/applicationservice/2022.03.08/mailman/templates/mailman.cfg

@@ -24,7 +24,7 @@ layout: fhs
 #>GNUNUX
 [database]  
 class: mailman.database.postgresql.PostgreSQLDatabase  
-url: postgresql://%%pg_client_username:%%pg_client_password@%%pg_client_server_domainname/%%pg_client_database?sslmode=verify-full
+url: postgresql://%%pg_client_username:%%pg_client_password@%%pg_client_server_domainname/%%pg_client_database?sslmode=verify-full&sslcert=/etc/pki/tls/certs/postgresql.crt&sslkey=/etc/pki/tls/private/postgresql.key&sslrootcert=/etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt
 
 [mta]
 lmtp_host: %%ip_eth0

seed/applicationservice/2022.03.08/mailman/templates/postgresql_postorius.key

@@ -0,0 +1 @@
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client")

seed/applicationservice/2022.03.08/mailman/templates/postorius-settings.py

@@ -10,7 +10,7 @@ DATABASES = {
         'HOST': '%%pg_client_server_domainname',      # Database server
         'PORT': '',               # Database port (leave blank for default)
         'CONN_MAX_AGE': 300,      # Max database connection age
-        'OPTIONS': {'sslmode': 'verify-full'},
+        'OPTIONS': {'sslmode': 'verify-full', 'sslcert': '/etc/pki/tls/certs/postgresql.crt', 'sslkey': '/etc/pki/tls/private/postgresql_postorius.key', 'sslrootcert': '/etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt'},
     }
 }
 ALLOWED_HOSTS = ['%%revprox_client_external_domainname']

seed/applicationservice/2022.03.08/mariadb-client/dictionaries/20_mariadb.xml

@@ -1,5 +1,8 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <rougail version="0.10">
+  <services>
+    <service name="mariadbclient" target="multi-user" engine="creole"/>
+  </services>
   <variables>
     <family name="mariadb" description="MariaDB">
       <variable name="mariadb_client_server_domainname" type="domainname" description="Nom de domaine du serveur MariaDB" mandatory="True"/>

seed/applicationservice/2022.03.08/mariadb-client/templates/mariadbclient.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Waiting for mariadb server
+Before=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/timeout 90 sh -c 'while ! 3<> /dev/tcp/%%mariadb_client_server_domainname/3306; do sleep 1; done; echo "MARIADB STARTED"'

seed/applicationservice/2022.03.08/nextcloud/dictionaries/31_nextcloud.xml

@@ -32,7 +32,7 @@
         <value>Plateforme de collaboration Nextcloud</value>
       </variable>
       <variable name="oauth2_client_category" redefine='True'>
-        <value>Collaboration</value>
+        <value>Diffusion</value>
       </variable>
       <variable name="oauth2_client_logo" redefine='True'>
         <value>silique_folder.png</value>

seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud-config.php

@@ -37,7 +37,7 @@ $CONFIG = array (
   'dbtableprefix' => 'oc_',
   'dbuser' => '%%pg_client_username',
   'dbpassword' => '%%pg_client_password',
-  'dbdriveroptions' => array('sslmode' => 'verify-full'),
+  'dbdriveroptions' => array('sslmode' => 'verify-full', 'sslcert' => '/etc/pki/tls/certs/postgresql.crt', 'sslkey' => '/etc/pki/tls/private/postgresql.key', 'sslrootcert' => '/etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt'),
   'passwordsalt' => '{{SALT}}',
   'secret' => '{{SECRET}}',
   'instanceid' => '%%nextcloud_instance_id',
@@ -53,9 +53,15 @@ $CONFIG = array (
   'filelocking.enabled' => true,
   'redis' => [
      'host' => '%%redis_client_server_domainname',
-     'port' => 6379,
+     'port' => 6380,
+     'user' => '%%redis_client_username',
      'password' => '%%redis_client_password',
      'dbindex' => 0,
+      'ssl_context' => [
+         'local_cert' => '/etc/pki/tls/certs/redis.crt',
+         'local_pk' => '/etc/pki/tls/private/redis.key',
+         'cafile' => '/etc/pki/ca-trust/source/anchors/ca_Redis.crt',
+      ]
   ],
   'default_phone_region' => 'FR',
 //OIDC login

seed/applicationservice/2022.03.08/nginx-https/applicationservice.yml

@@ -0,0 +1,4 @@
+format: '0.1'
+description: Nginx as reverse proxy
+depends:
+  - nginx-common

seed/applicationservice/2022.03.08/nginx-https/dictionaries/25_nginx.xml

@@ -0,0 +1,20 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<rougail version="0.10">
+  <services>
+    <service name='nginx'>
+      <file>/etc/nginx/conf.d/risotto.conf</file>
+      <file>/etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt</file>
+      <file mode="600">/etc/pki/tls/certs/nginx.crt</file>
+      <file mode="600">/etc/pki/tls/private/nginx.key</file>
+    </service>
+  </services>
+  <variables>
+    <variable name="nginx_root_directory" type="filename" mandatory="True"/>
+    <variable name="php_fpm_user" redefine="True" exists="True">
+      <value>nginx</value>
+    </variable>
+    <variable name="nginx_locations" type="filename" multi="True" mandatory="True">
+      <value>/</value>
+    </variable>
+  </variables>
+</rougail>

seed/applicationservice/2022.03.08/nginx-https/templates/ca_InternalReverseProxy.crt

@@ -0,0 +1 @@
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="InternalReverseProxy")

seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt

@@ -0,0 +1 @@
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy')

seed/applicationservice/2022.03.08/nginx-https/templates/nginx.index.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Welcome</title>
+<style>
+</style>
+</head>
+<body>
+</body>
+</html>

seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key

@@ -0,0 +1 @@
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy')

seed/applicationservice/2022.03.08/nginx-https/templates/risotto.conf

@@ -0,0 +1,44 @@
+server {
+  listen        443 default ssl;
+  server_name %%domain_name_eth0;
+
+  ssl_certificate              /etc/pki/tls/certs/nginx.crt;
+  ssl_certificate_key          /etc/pki/tls/private/nginx.key;
+  ssl_client_certificate       /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt;
+
+  error_page   403 404 502 503 504  /error.html;
+  location = /error.html{
+    root /var/www/html;
+  }
+
+  add_header                    X-Frame-Options "SAMEORIGIN";
+  add_header                    X-Content-Type-Options nosniff;
+  add_header                    X-XSS-Protection "1; mode=block";
+  add_header                    X-Robots-Tag none;
+  add_header                    X-Download-Options noopen;
+  add_header                    X-Permitted-Cross-Domain-Policies none;
+  add_header                    Strict-Transport-Security 'max-age=31536000; includeSubDomains;';
+  add_header                    Referrer-Policy no-referrer always;
+
+%for %%location in %%nginx_locations
+  location %%location {
+%if %%location == '/'
+    root                        %slurp
+%else
+    alias                       %slurp
+%end if
+%%nginx_root_directory;
+%if not %%getVar('php_fpm_installed', False)
+    index                       index.html;
+%else
+    index                       index.php;
+    location ~ ^(?<script_name>.+?\.php)(?<path_info>/.*)?$ {
+      fastcgi_pass              php-fpm;
+      fastcgi_index             index.php;
+      fastcgi_param             SCRIPT_FILENAME $request_filename;
+      include                   fastcgi_params;
+    }
+%end if
+  }
+%end for
+}

seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/ca_InternalReverseProxy.crt

@@ -1 +1,3 @@
-%%get_chain(authority_cn=%%domain_name_eth0, authority_name="InternalReverseProxy")
+%for %%idx in %%range(0, %%number_of_interfaces)
+%%get_chain(authority_cn=%%getVar('domain_name_eth' + %%str(%%idx)), authority_name="InternalReverseProxy")
+%end for

seed/applicationservice/2022.03.08/openldap/extras/accounts/00_account.xml

@@ -7,6 +7,10 @@
       <variable name="password_" description="Mot de passe" auto_save="True" hidden="True" provider="client_password"/>
       <variable name="read_only_" description="Le compte est en lecture seule" type="boolean"/>
     </family>
+    <family name="acl" description="Gestion des droits d'accès aux attributes" leadership="True">
+      <variable name='ldap_acl_attribute' type="string" description="ACL de l'attribut" multi="True"/>
+      <variable name='ldap_acl_rights' type="string" description="ACL de l'attribut" multi="True"/>
+    </family>
     <family name="users" description="Gestion des utilisateurs" leadership="True">
       <variable name='ldap_user_mail' type="mail" description="Adresse courriel du compte" multi="True"/>
       <variable name='ldap_user_aliases' type="mail" description="Aliases du mail" multi="True"/> <!-- FIXME -->
@@ -15,9 +19,16 @@
       <variable name='ldap_user_gn' type="string" description="Nom de famille" mandatory="True"/>
       <variable name='ldap_user_password' type="password" description="Mot de passe" mandatory="True" hidden="True"/>
     </family>
-    <family name="acl" description="Gestion des droits d'accès aux attributes" leadership="True">
+    <variable name="families" description="Familles" type="unix_user" multi="True"/>
-      <variable name='ldap_acl_attribute' type="string" description="ACL de l'attribut" multi="True"/>
+    <family name="family_" description="Gestion de la famille " dynamic="accounts.families">
-      <variable name='ldap_acl_rights' type="string" description="ACL de l'attribut" multi="True"/>
+      <family name="users_" description="Gestion des utilisateurs" leadership="True">
+        <variable name='ldap_user_mail_' type="mail" description="Adresse courriel du compte" multi="True"/>
+        <variable name='ldap_user_aliases_' type="mail" description="Aliases du mail" multi="True"/> <!-- FIXME -->
+        <variable name='ldap_user_uid_' type="unix_user" description="Nom de compte" mandatory="True"/>
+        <variable name='ldap_user_sn_' type="string" description="Prénom" mandatory="True"/>
+        <variable name='ldap_user_gn_' type="string" description="Nom de famille" mandatory="True"/>
+        <variable name='ldap_user_password_' type="password" description="Mot de passe" mandatory="True" hidden="True"/>
+      </family>
     </family>
   </variables>
   <constraints>
@@ -45,5 +56,13 @@
       <param name="temporary" type="boolean">True</param>
       <target>accounts.users.ldap_user_password</target>
     </fill>
+    <fill name="get_password">
+      <param name="server_name" type="variable">domain_name_eth0</param>
+      <param name="username" type='variable'>accounts.family_.users_.ldap_user_mail_</param>
+      <param name="description">ldap family user</param>
+      <param name="type">cleartext</param>
+      <param name="temporary" type="boolean">True</param>
+      <target>accounts.family_.users_.ldap_user_password_</target>
+    </fill>
   </constraints>
 </rougail>

seed/applicationservice/2022.03.08/openldap/funcs/ldap.py

@@ -1,12 +1,44 @@
+import __main__
 from os import urandom as _urandom
 from hashlib import sha1 as _sha1
 from base64 import encodebytes as _encodebytes, b64encode as _b64encode
+from json import load as _load, dump as _dump
+from os.path import dirname as _dirname, abspath as _abspath, join as _join, isfile as _isfile
+
+
+_HERE = _dirname(_abspath(__main__.__file__))
+_SSHA_PASSWORD_DIR = _join(_HERE, 'password', 'ssha.json')
 
 
 # unproudly borrowed from
 # http://www.openldap.org/faq/data/cache/347.html
 def ssha_encode(password):
+    # do not regenerate SSHA
+    if _isfile(_SSHA_PASSWORD_DIR):
+        with open(_SSHA_PASSWORD_DIR, 'r') as fh:
+            passwords = _load(fh)
+    else:
+        passwords = {}
+    if password in passwords:
+        return passwords[password]
     salt = _urandom(4)
     h = _sha1(password.encode())
     h.update(salt)
-    return _b64encode(b"{SSHA}" + _encodebytes(h.digest() + salt)[:-1]).decode()
+    ret = _b64encode(b"{SSHA}" + _encodebytes(h.digest() + salt)[:-1]).decode()
+    passwords[password] = ret
+    with open(_SSHA_PASSWORD_DIR, 'w') as fh:
+        _dump(passwords, fh)
+    return ret
+
+
+def get_default_base_dn(server_name: str) -> str:
+    if not server_name or '.' not in server_name:
+        return None
+    values = server_name.split('.')
+    # cannot calculated base dn should be server.domain.tld
+    # remove 'server' in dn
+    if len(values) < 3:
+        return None
+    domain = ['ou=' + domain for domain in values[1:-2]]
+    domain.append(f'o={values[-2]},o={values[-1]}')
+    return ','.join(domain)

seed/applicationservice/2022.03.08/openldap/templates/users.ldif

@@ -21,12 +21,12 @@ objectClass: top
 objectClass: inetOrgPerson
 
 %end for
+# Users
 dn: ou=users,%%ldap_base_dn
 ou: users
 objectClass: top
 objectClass: organizationalUnit
 
-# Users
 %for %%user in %%accounts.users.ldap_user_mail
 dn: cn=%%user,ou=users,%%ldap_base_dn
 cn: %%user
@@ -34,9 +34,33 @@ mail: %%user
 sn: %%user.ldap_user_sn
 givenName: %%user.ldap_user_gn
 uid: %%user.ldap_user_uid
-#%%user.ldap_user_password
 userPassword:: %%ssha_encode(%%user.ldap_user_password)
 objectClass: top
 objectClass: inetOrgPerson
 
 %end for
+# Families
+dn: ou=families,%%ldap_base_dn
+ou: families
+objectClass: top
+objectClass: organizationalUnit
+
+%for %%family in %%accounts.families
+dn: ou=%%family,ou=families,%%ldap_base_dn
+ou: %%family
+objectClass: top
+objectClass: organizationalUnit
+
+  %for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family]
+dn: cn=%%user,ou=families,%%ldap_base_dn
+cn: %%user
+mail: %%user
+sn: %%user['ldap_user_sn_' + %%family]
+givenName: %%user['ldap_user_gn_' + %%family]
+uid: %%user['ldap_user_uid_' + %%family]
+userPassword:: %%ssha_encode(%%user['ldap_user_password_' + %%family])
+objectClass: top
+objectClass: inetOrgPerson
+
+  %end for
+%end for

seed/applicationservice/2022.03.08/php-fpm/dictionaries/20_phpfpm.xml

@@ -3,8 +3,17 @@
   <services>
     <service name="php-fpm">
       <file engine="none">/etc/php-fpm.conf</file>
+      <file>/etc/php-fpm.d/www.conf</file>
       <file engine="none" source="sysuser-phpfpm.conf">/sysusers.d/phpfpm.conf</file>
-      <file engine="none" source="tmpfile-phpfpm.conf">/tmpfiles.d/0phpfpm.conf</file>
+      <file source="tmpfile-phpfpm.conf">/tmpfiles.d/0phpfpm.conf</file>
     </service>
   </services>
+  <variables>
+    <variable name="php_fpm_user" type="unix_user">
+      <value>root</value>
+    </variable>
+    <variable name="php_fpm_installed" type="boolean">
+      <value>True</value>
+    </variable>
+  </variables>
 </rougail>

seed/applicationservice/2022.03.08/php-fpm/manual/image/preinstall/phpfpm.sh

@@ -0,0 +1 @@
+PKG="$PKG php-fpm"

seed/applicationservice/2022.03.08/php-fpm/templates/tmpfile-phpfpm.conf

@@ -1 +1 @@
-d /var/lib/php/session 770 root apache - -
+d /var/lib/php/session 770 root %%php_fpm_user - -

seed/applicationservice/2022.03.08/php-fpm/templates/www.conf

@@ -0,0 +1,439 @@
+; Start a new pool named 'www'.
+; the variable $pool can be used in any directive and will be replaced by the
+; pool name ('www' here)
+[www]
+
+; Per pool prefix
+; It only applies on the following directives:
+; - 'access.log'
+; - 'slowlog'
+; - 'listen' (unixsocket)
+; - 'chroot'
+; - 'chdir'
+; - 'php_values'
+; - 'php_admin_values'
+; When not set, the global prefix (or @php_fpm_prefix@) applies instead.
+; Note: This directive can also be relative to the global prefix.
+; Default Value: none
+;prefix = /path/to/pools/$pool
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+; RPM: apache user chosen to provide access to the same directories as httpd
+user = %%php_fpm_user
+; RPM: Keep a group allowed to write in log dir.
+group = %%php_fpm_user
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+listen = /run/php-fpm/www.sock
+
+; Set listen(2) backlog.
+; Default Value: 511
+;listen.backlog = 511
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server.
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+;listen.owner = nobody
+;listen.group = nobody
+;listen.mode = 0660
+
+; When POSIX Access Control Lists are supported you can set them using
+; these options, value is a comma separated list of user/group names.
+; When set, listen.owner and listen.group are ignored
+listen.acl_users = %%php_fpm_user
+;listen.acl_groups =
+
+; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
+; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
+; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
+; must be separated by a comma. If this value is left blank, connections will be
+; accepted from any ip address.
+; Default Value: any
+listen.allowed_clients = 127.0.0.1
+
+; Specify the nice(2) priority to apply to the pool processes (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool processes will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
+; or group is differrent than the master process user. It allows to create process
+; core dump and ptrace the process for the pool user.
+; Default Value: no
+; process.dumpable = yes
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 50
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
+pm.start_servers = 5
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 5
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 35
+
+; The number of seconds after which an idle process will be killed.
+; Note: Used only when pm is set to 'ondemand'
+; Default Value: 10s
+;pm.process_idle_timeout = 10s;
+
+; The number of requests each child process should execute before respawning.
+; This can be useful to work around memory leaks in 3rd party libraries. For
+; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
+; Default Value: 0
+;pm.max_requests = 500
+
+; The URI to view the FPM status page. If this value is not set, no URI will be
+; recognized as a status page. It shows the following informations:
+;   pool                 - the name of the pool;
+;   process manager      - static, dynamic or ondemand;
+;   start time           - the date and time FPM has started;
+;   start since          - number of seconds since FPM has started;
+;   accepted conn        - the number of request accepted by the pool;
+;   listen queue         - the number of request in the queue of pending
+;                          connections (see backlog in listen(2));
+;   max listen queue     - the maximum number of requests in the queue
+;                          of pending connections since FPM has started;
+;   listen queue len     - the size of the socket queue of pending connections;
+;   idle processes       - the number of idle processes;
+;   active processes     - the number of active processes;
+;   total processes      - the number of idle + active processes;
+;   max active processes - the maximum number of active processes since FPM
+;                          has started;
+;   max children reached - number of times, the process limit has been reached,
+;                          when pm tries to start more children (works only for
+;                          pm 'dynamic' and 'ondemand');
+; Value are updated in real time.
+; Example output:
+;   pool:                 www
+;   process manager:      static
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          62636
+;   accepted conn:        190460
+;   listen queue:         0
+;   max listen queue:     1
+;   listen queue len:     42
+;   idle processes:       4
+;   active processes:     11
+;   total processes:      15
+;   max active processes: 12
+;   max children reached: 0
+;
+; By default the status page output is formatted as text/plain. Passing either
+; 'html', 'xml' or 'json' in the query string will return the corresponding
+; output syntax. Example:
+;   http://www.foo.bar/status
+;   http://www.foo.bar/status?json
+;   http://www.foo.bar/status?html
+;   http://www.foo.bar/status?xml
+;
+; By default the status page only outputs short status. Passing 'full' in the
+; query string will also return status for each pool process.
+; Example:
+;   http://www.foo.bar/status?full
+;   http://www.foo.bar/status?json&full
+;   http://www.foo.bar/status?html&full
+;   http://www.foo.bar/status?xml&full
+; The Full status returns for each process:
+;   pid                  - the PID of the process;
+;   state                - the state of the process (Idle, Running, ...);
+;   start time           - the date and time the process has started;
+;   start since          - the number of seconds since the process has started;
+;   requests             - the number of requests the process has served;
+;   request duration     - the duration in µs of the requests;
+;   request method       - the request method (GET, POST, ...);
+;   request URI          - the request URI with the query string;
+;   content length       - the content length of the request (only with POST);
+;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
+;   script               - the main script called (or '-' if not set);
+;   last request cpu     - the %cpu the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because CPU calculation is done when the request
+;                          processing has terminated;
+;   last request memory  - the max amount of memory the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because memory calculation is done when the request
+;                          processing has terminated;
+; If the process is in Idle state, then informations are related to the
+; last request the process has served. Otherwise informations are related to
+; the current request being served.
+; Example output:
+;   ************************
+;   pid:                  31330
+;   state:                Running
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          63087
+;   requests:             12808
+;   request duration:     1250261
+;   request method:       GET
+;   request URI:          /test_mem.php?N=10000
+;   content length:       0
+;   user:                 -
+;   script:               /home/fat/web/docs/php/test_mem.php
+;   last request cpu:     0.00
+;   last request memory:  0
+;
+; Note: There is a real-time FPM status monitoring sample web page available
+;       It's available in: @EXPANDED_DATADIR@/fpm/status.html
+;
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;pm.status_path = /status
+
+; The ping URI to call the monitoring page of FPM. If this value is not set, no
+; URI will be recognized as a ping page. This could be used to test from outside
+; that FPM is alive and responding, or to
+; - create a graph of FPM availability (rrd or such);
+; - remove a server from a group if it is not responding (load balancing);
+; - trigger alerts for the operating team (24/7).
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;ping.path = /ping
+
+; This directive may be used to customize the response of a ping request. The
+; response is formatted as text/plain with a 200 response code.
+; Default Value: pong
+;ping.response = pong
+
+; The access log file
+; Default: not set
+;access.log = log/$pool.access.log
+
+; The access log format.
+; The following syntax is allowed
+;  %%: the '%' character
+;  %C: %CPU used by the request
+;      it can accept the following format:
+;      - %{user}C for user CPU only
+;      - %{system}C for system CPU only
+;      - %{total}C  for user + system CPU (default)
+;  %d: time taken to serve the request
+;      it can accept the following format:
+;      - %{seconds}d (default)
+;      - %{miliseconds}d
+;      - %{mili}d
+;      - %{microseconds}d
+;      - %{micro}d
+;  %e: an environment variable (same as $_ENV or $_SERVER)
+;      it must be associated with embraces to specify the name of the env
+;      variable. Some exemples:
+;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+;  %f: script filename
+;  %l: content-length of the request (for POST request only)
+;  %m: request method
+;  %M: peak of memory allocated by PHP
+;      it can accept the following format:
+;      - %{bytes}M (default)
+;      - %{kilobytes}M
+;      - %{kilo}M
+;      - %{megabytes}M
+;      - %{mega}M
+;  %n: pool name
+;  %o: output header
+;      it must be associated with embraces to specify the name of the header:
+;      - %{Content-Type}o
+;      - %{X-Powered-By}o
+;      - %{Transfert-Encoding}o
+;      - ....
+;  %p: PID of the child that serviced the request
+;  %P: PID of the parent of the child that serviced the request
+;  %q: the query string
+;  %Q: the '?' character if query string exists
+;  %r: the request URI (without the query string, see %q and %Q)
+;  %R: remote IP address
+;  %s: status (response code)
+;  %t: server time the request was received
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %T: time the log has been written (the request has finished)
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %u: remote user
+;
+; Default: "%R - %u %t \"%m %r\" %s"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+
+; The log file for slow requests
+; Default Value: not set
+; Note: slowlog is mandatory if request_slowlog_timeout is set
+slowlog = syslog
+
+; The timeout for serving a single request after which a PHP backtrace will be
+; dumped to the 'slowlog' file. A value of '0s' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_slowlog_timeout = 0
+
+; Depth of slow log stack trace.
+; Default Value: 20
+;request_slowlog_trace_depth = 20
+
+; The timeout for serving a single request after which the worker process will
+; be killed. This option should be used when the 'max_execution_time' ini option
+; does not stop script execution for some reason. A value of '0' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_terminate_timeout = 0
+
+; Set open file descriptor rlimit.
+; Default Value: system defined value
+;rlimit_files = 1024
+
+; Set max core size rlimit.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+
+; Chroot to this directory at the start. This value must be defined as an
+; absolute path. When this value is not set, chroot is not used.
+; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
+; of its subdirectories. If the pool prefix is not set, the global prefix
+; will be used instead.
+; Note: chrooting is a great security feature and should be used whenever
+;       possible. However, all PHP paths will be relative to the chroot
+;       (error_log, sessions.save_path, ...).
+; Default Value: not set
+;chroot =
+
+; Chdir to this directory at the start.
+; Note: relative path can be used.
+; Default Value: current directory or / when chroot
+;chdir = /var/www
+
+; Redirect worker stdout and stderr into main error log. If not set, stdout and
+; stderr will be redirected to /dev/null according to FastCGI specs.
+; Note: on highloaded environement, this can cause some delay in the page
+; process time (several ms).
+; Default Value: no
+;catch_workers_output = yes
+
+; Clear environment in FPM workers
+; Prevents arbitrary environment variables from reaching FPM worker processes
+; by clearing the environment in workers before env vars specified in this
+; pool configuration are added.
+; Setting to "no" will make all environment variables available to PHP code
+; via getenv(), $_ENV and $_SERVER.
+; Default Value: yes
+;clear_env = no
+
+; Limits the extensions of the main script FPM will allow to parse. This can
+; prevent configuration mistakes on the web server side. You should only limit
+; FPM to .php extensions to prevent malicious users to use other extensions to
+; execute php code.
+; Note: set an empty value to allow all extensions.
+; Default Value: .php
+;security.limit_extensions = .php .php3 .php4 .php5 .php7
+
+; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
+; the current environment.
+; Default Value: clean env
+;env[HOSTNAME] = $HOSTNAME
+;env[PATH] = /usr/local/bin:/usr/bin:/bin
+;env[TMP] = /tmp
+;env[TMPDIR] = /tmp
+;env[TEMP] = /tmp
+
+; Additional php.ini defines, specific to this pool of workers. These settings
+; overwrite the values previously defined in the php.ini. The directives are the
+; same as the PHP SAPI:
+;   php_value/php_flag             - you can set classic ini defines which can
+;                                    be overwritten from PHP call 'ini_set'.
+;   php_admin_value/php_admin_flag - these directives won't be overwritten by
+;                                     PHP call 'ini_set'
+; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
+
+; Defining 'extension' will load the corresponding shared extension from
+; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
+; overwrite previously defined php.ini values, but will append the new value
+; instead.
+
+; Note: path INI options can be relative and will be expanded with the prefix
+; (pool, global or @prefix@)
+
+; Default Value: nothing is defined by default except the values in php.ini and
+;                specified at startup with the -d argument
+;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
+;php_flag[display_errors] = off
+php_admin_value[error_log] = syslog
+php_admin_flag[log_errors] = on
+;php_admin_value[memory_limit] = 128M
+
+; Set the following data paths to directories owned by the FPM process user.
+;
+; Do not change the ownership of existing system directories, if the process
+; user does not have write permission, create dedicated directories for this
+; purpose.
+;
+; See warning about choosing the location of these directories on your system
+; at http://php.net/session.save-path
+php_value[session.save_handler] = redis
+;GNUNUX php_value[session.save_path]    = /var/lib/php/session
+;php_value[session.save_path]    = "tcp://%%redis_client_server_domainname:6379?auth[user]=%%redis_client_username&auth[pass]=%%redis_client_password"
+php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache
+;php_value[opcache.file_cache]  = /var/lib/php/opcache

seed/applicationservice/2022.03.08/php/DEBUG.md

@@ -0,0 +1,14 @@
+Test une session avec redis
+============================
+
+<?php
+session_id('jlnp3nfrq92ffquipn4534ojbe');
+session_start();
+if (!isset($_SESSION['count'])) {
+  $_SESSION['count'] = 0;
+} else {
+  $_SESSION['count']++;
+}
+print($_SESSION['count']);
+?>
+

seed/applicationservice/2022.03.08/php/applicationservice.yml

@@ -1,2 +1,4 @@
 format: '0.1'
 description: PHP configuration
+depends:
+  - redis-client

seed/applicationservice/2022.03.08/php/templates/php.ini

@@ -1329,7 +1329,11 @@ browscap = /etc/php/extra/browscap.ini
 [Session]
 ; Handler used to store/retrieve data.
 ; http://php.net/session.save-handler
-session.save_handler = files
+# GNUNUX session.save_handler = files
+session.save_handler = redis
+session.save_path    = "tcp://%%redis_client_server_domainname:6379?auth[user]=%%redis_client_username&auth[pass]=%%redis_client_password"
+;GNUNUX https://github.com/phpredis/phpredis/issues/2062
+#session.save_path    = "tls://%%redis_client_server_domainname:6379?auth[user]=%%redis_client_username&auth[pass]=%%redis_client_password&stream[verify_peer]=1&stream[cafile]=/etc/pki/ca-trust/source/anchors/ca_Redis.crt&stream[local_cert]=/etc/pki/tls/certs/redis.crt&stream[local_pk]=/etc/pki/tls/private/redis.key"
 
 ; Argument passed to save_handler.  In the case of files, this is the path
 ; where data files are stored. Note: Windows users have to change this
@@ -1424,7 +1428,7 @@ session.serialize_handler = php
 ; Development Value: 1
 ; Production Value: 1
 ; http://php.net/session.gc-probability
-session.gc_probability = 0
+session.gc_probability = 1
 
 ; Defines the probability that the 'garbage collection' process is started on every
 ; session initialization. The probability is calculated by using gc_probability/gc_divisor,

seed/applicationservice/2022.03.08/piwigo/applicationservice.yml

@@ -6,6 +6,6 @@ depends:
   - ldap-client-fedora
   - oauth2-client
   - relay-mail-client
-  - nginx-common
+  - nginx-https
   - php-fpm
   - reverse-proxy-client

seed/applicationservice/2022.03.08/piwigo/dictionaries/31_piwigo.xml

@@ -1,11 +1,56 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <rougail version="0.10">
   <services>
-    <service name="piwigo" manage="False">
+    <service name="piwigo" engine="creole" target="multi-user">
+      <file source="tmpfile-piwigo.conf">/tmpfiles.d/0piwigo.conf</file>
+      <file>/etc/piwigo/config.inc.php</file>
+      <file>/etc/piwigo/database.inc.php</file>
+      <file mode="755">/bin/piwigo.sh</file>
+      <file engine="none">/etc/php-fpm.d/piwigo.conf</file>
     </service>
   </services>
   <variables>
-    <family name="piwigo" description="Piwigo">
+    <variable name="piwigo_admin_email" type="mail" description="Adresse courriel de l'administrateur Piwigo" mandatory="True"/>
+    <variable name="piwigo_admin_password" type="password" auto_save="True" hidden="True"/>
+    <variable name="nginx_root_directory" mandatory="True" redefine="True">
+      <value>/usr/local/share/piwigo</value>
+    </variable>
+    <variable name="piwigo_title" type="string" description="Titre de l'album" mandatory="True">
+      <value>Album photographique</value>
+    </variable>
+    <family name="users" leadership="True">
+      <variable name="piwigo_users" type="unix_user" description="Utilisateur ayant un album" multi="True" mandatory="True"/>
+      <variable name="piwigo_email" type="mail" description="Adresse courriel" mandatory="True"/>
+    </family>
+    <family name="oauth2_client">
+      <variable name="oauth2_is_client_application" redefine='True'>
+        <value>True</value>
+      </variable>
+      <variable name="oauth2_client_name" redefine='True'>
+        <value>Album</value>
+      </variable>
+      <variable name="oauth2_client_description" redefine='True'>
+        <value>Album photographique Piwigo</value>
+      </variable>
+      <variable name="oauth2_client_category" redefine='True'>
+        <value>Diffusion</value>
+      </variable>
+      <variable name="oauth2_client_logo" redefine='True'>
+        <value>silique_image.png</value>
+      </variable>
     </family>
   </variables>
+  <constraints>
+    <fill name="get_password">
+      <param name="server_name" type="variable">domain_name_eth0</param>
+      <param name="username">admin_password</param>
+      <param name="description">piwigo</param>
+      <param name="type">cleartext</param>
+      <target>piwigo_admin_password</target>
+    </fill>
+    <fill name="get_locations">
+      <param name="usernames" type="variable">piwigo_users</param>
+      <target>nginx_locations</target>
+    </fill>
+  </constraints>
 </rougail>

seed/applicationservice/2022.03.08/piwigo/funcs/piwigo.sh

@@ -0,0 +1,6 @@
+from risotto.utils import multi_function as _multi_function
+
+
+@_multi_function
+def get_locations(usernames):
+    return ['/'] + ['/' + user for user in usernames]

seed/applicationservice/2022.03.08/piwigo/manual/image/postinstall/osmmap.php

@@ -0,0 +1,13 @@
+<?php
+define('PHPWG_ROOT_PATH','./');
+if (isset($_GET['v']) and $_GET['v'] == 1)
+  include_once( PHPWG_ROOT_PATH. 'plugins/piwigo-openstreetmap/osmmap.php');
+else if (isset($_GET['v']) and $_GET['v'] == 2)
+  include_once( PHPWG_ROOT_PATH. 'plugins/piwigo-openstreetmap/osmmap2.php');
+else if (isset($_GET['v']) and $_GET['v'] == 3)
+  include_once( PHPWG_ROOT_PATH. 'plugins/piwigo-openstreetmap/osmmap3.php');
+else if (isset($_GET['v']) and $_GET['v'] == 4)
+  include_once( PHPWG_ROOT_PATH. 'plugins/piwigo-openstreetmap/osmmap4.php');
+else
+  include_once( PHPWG_ROOT_PATH. 'plugins/piwigo-openstreetmap/osmmap3.php');
+?>

seed/applicationservice/2022.03.08/piwigo/manual/image/postinstall/piwigo.patch

@@ -0,0 +1,288 @@
+--- piwigo/admin/include/functions_install.inc.php
++++ piwigo/admin/include/functions_install.inc.php
+@@ -21,6 +21,7 @@
+  * @param string $replaced
+  * @param string $replacing
+  */
++
+ function execute_sqlfile($filepath, $replaced, $replacing, $dblayer)
+ {
+   $sql_lines = file($filepath);
+@@ -91,17 +92,15 @@ function activate_core_plugins()
+ }
+ 
+ /**
+- * Connect to database during installation. Uses $_POST.
++ * Connect to database during installation.
+  *
+- * @param array &$infos - populated with infos
+  * @param array &$errors - populated with errors
+  */
+-function install_db_connect(&$infos, &$errors)
++function install_db_connect($dbhost, $dbuser, $dbpasswd, $dbname, &$errors)
+ {
+   try
+   {
+-    pwg_db_connect($_POST['dbhost'], $_POST['dbuser'],
+-                   $_POST['dbpasswd'], $_POST['dbname']);
++    pwg_db_connect($dbhost, $dbuser, $dbpasswd, $dbname);
+     pwg_db_check_version();
+   }
+   catch (Exception $e)
+@@ -110,4 +109,101 @@ function install_db_connect(&$infos, &$errors)
+   }
+ }
+ 
+-?>
+\ No newline at end of file
++/**
++ * Create and initialize database
++ *
++ * @param object languages - languages informations
++ * @param string language - default language
++ * @param string prefixeTable - prefix of database names
++ */
++function initialize_db($languages, $language, $prefixeTable, &$errors=[])
++{
++  include_once(PHPWG_ROOT_PATH.PWG_LOCAL_DIR .'config/database.inc.php');
++  $result = pwg_query("SHOW TABLES LIKE '${prefixeTable}activity';");
++  if(pwg_db_num_rows($result))
++  {
++    $errors[] = l10n('The database is already imported');
++    return;
++  }
++  // tables creation, based on piwigo_structure.sql
++  execute_sqlfile(
++    PHPWG_ROOT_PATH.'install/piwigo_structure-mysql.sql',
++    DEFAULT_PREFIX_TABLE,
++    $prefixeTable,
++    'mysql'
++    );
++  // We fill the tables with basic informations
++  execute_sqlfile(
++    PHPWG_ROOT_PATH.'install/config.sql',
++    DEFAULT_PREFIX_TABLE,
++    $prefixeTable,
++    'mysql'
++    );
++
++  $query = '
++INSERT INTO '.$prefixeTable.'config (param,value,comment)
++ VALUES (\'secret_key\',md5('.pwg_db_cast_to_text(DB_RANDOM_FUNCTION.'()').'),
++ \'a secret key specific to the gallery for internal use\');';
++  pwg_query($query);
++
++  conf_update_param('piwigo_db_version', get_branch_from_version(PHPWG_VERSION));
++  conf_update_param('gallery_title', pwg_db_real_escape_string(l10n('Just another Piwigo gallery')));
++
++  conf_update_param(
++    'page_banner',
++    '<h1>%gallery_title%</h1>'."\n\n<p>".pwg_db_real_escape_string(l10n('Welcome to my photo gallery')).'</p>'
++    );
++
++  // fill languages table, only activate the current language
++  $languages->perform_action('activate', $language);
++
++  // fill $conf global array
++  load_conf_from_db();
++
++  // PWG_CHARSET is required for building the fs_themes array in the
++  // themes class
++  if (!defined('PWG_CHARSET'))
++  {
++    define('PWG_CHARSET', 'utf-8');
++  }
++  activate_core_themes();
++  activate_core_plugins();
++
++  $insert = array(
++    'id' => 1,
++    'galleries_url' => PHPWG_ROOT_PATH.'galleries/',
++    );
++  mass_inserts(SITES_TABLE, array_keys($insert), array($insert));
++
++}
++
++/**
++ * Add first admin in database
++ *
++ * @param string admin_name - admin name
++ * @param string admin_pass1 - admin password
++ * @param string admin_main - admin email
++ * @param string admin_language - language of admin
++ */
++function add_admin($admin_name, $admin_pass1, $admin_mail, $language)
++{
++  // webmaster admin user
++  $inserts = array(
++    array(
++      'id'           => 1,
++      'username'     => $admin_name,
++      'password'     => md5($admin_pass1),
++      'mail_address' => $admin_mail,
++      ),
++    array(
++      'id'           => 2,
++      'username'     => 'guest',
++      ),
++    );
++  mass_inserts(USERS_TABLE, array_keys($inserts[0]), $inserts);
++
++  create_user_infos(array(1,2), array('language' => $language));
++
++}
++
++?>
+--- piwigo/admin/include/functions_upgrade.php
++++ piwigo/admin/include/functions_upgrade.php
+@@ -319,4 +319,30 @@ function upgrade_db_connect()
+     my_error(l10n($e->getMessage()), true); 
+   }
+ }
++
++/**
++ * Mark all upgrades as done.
++ * Available upgrades must be ignored after a fresh installation. To
++ * make PWG avoid upgrading, we must tell it upgrades have already been
++ * made.
++ */
++function mark_all_upgrades_as_done() {
++  list($dbnow) = pwg_db_fetch_row(pwg_query('SELECT NOW();'));
++  define('CURRENT_DATE', $dbnow);
++  $datas = array();
++  foreach (get_available_upgrade_ids() as $upgrade_id)
++  {
++    $datas[] = array(
++      'id'          => $upgrade_id,
++      'applied'     => CURRENT_DATE,
++      'description' => 'upgrade included in installation',
++      );
++  }
++  mass_inserts(
++    UPGRADE_TABLE,
++    array_keys($datas[0]),
++    $datas
++  );
++}
++
+ ?>
+--- piwigo/install.php
++++ piwigo/install.php
+@@ -166,6 +166,7 @@ if (@file_exists($config_file))
+ 
+ include(PHPWG_ROOT_PATH . 'include/constants.php');
+ include(PHPWG_ROOT_PATH . 'admin/include/functions.php');
++include(PHPWG_ROOT_PATH . 'admin/include/functions_upgrade.php');
+ 
+ include(PHPWG_ROOT_PATH . 'admin/include/languages.class.php');
+ $languages = new languages('utf-8');
+@@ -253,11 +254,10 @@ if (!isset($step))
+ //---------------------------------------------------------------- form analyze
+ include(PHPWG_ROOT_PATH .'include/dblayer/functions_'.$dblayer.'.inc.php');
+ include(PHPWG_ROOT_PATH . 'admin/include/functions_install.inc.php');
+-include(PHPWG_ROOT_PATH . 'admin/include/functions_upgrade.php');
+ 
+ if (isset($_POST['install']))
+ {
+-  install_db_connect($infos, $errors);
++  install_db_connect($dbhost, $dbuser, $dbpasswd, $dbname, $errors);
+   pwg_db_check_charset();
+ 
+   $webmaster = trim(preg_replace('/\s{2,}/', ' ', $admin_name));
+@@ -328,93 +328,9 @@ define(\'DB_COLLATE\', \'\');
+     @fputs($fp, $file_content, strlen($file_content));
+     @fclose($fp);
+ 
+-    // tables creation, based on piwigo_structure.sql
+-    execute_sqlfile(
+-      PHPWG_ROOT_PATH.'install/piwigo_structure-mysql.sql',
+-      DEFAULT_PREFIX_TABLE,
+-      $prefixeTable,
+-      'mysql'
+-      );
+-    // We fill the tables with basic informations
+-    execute_sqlfile(
+-      PHPWG_ROOT_PATH.'install/config.sql',
+-      DEFAULT_PREFIX_TABLE,
+-      $prefixeTable,
+-      'mysql'
+-      );
+-
+-    $query = '
+-INSERT INTO '.$prefixeTable.'config (param,value,comment) 
+-   VALUES (\'secret_key\',md5('.pwg_db_cast_to_text(DB_RANDOM_FUNCTION.'()').'),
+-   \'a secret key specific to the gallery for internal use\');';
+-    pwg_query($query);
+-
+-    conf_update_param('piwigo_db_version', get_branch_from_version(PHPWG_VERSION));
+-    conf_update_param('gallery_title', pwg_db_real_escape_string(l10n('Just another Piwigo gallery')));
+-
+-    conf_update_param(
+-      'page_banner',
+-      '<h1>%gallery_title%</h1>'."\n\n<p>".pwg_db_real_escape_string(l10n('Welcome to my photo gallery')).'</p>'
+-      );
+-
+-    // fill languages table, only activate the current language
+-    $languages->perform_action('activate', $language);
+-
+-    // fill $conf global array
+-    load_conf_from_db();
+-
+-    // PWG_CHARSET is required for building the fs_themes array in the
+-    // themes class
+-    if (!defined('PWG_CHARSET'))
+-    {
+-      define('PWG_CHARSET', 'utf-8');
+-    }
+-    activate_core_themes();
+-    activate_core_plugins();
+-
+-    $insert = array(
+-      'id' => 1,
+-      'galleries_url' => PHPWG_ROOT_PATH.'galleries/',
+-      );
+-    mass_inserts(SITES_TABLE, array_keys($insert), array($insert));
+-
+-    // webmaster admin user
+-    $inserts = array(
+-      array(
+-        'id'           => 1,
+-        'username'     => $admin_name,
+-        'password'     => md5($admin_pass1),
+-        'mail_address' => $admin_mail,
+-        ),
+-      array(
+-        'id'           => 2,
+-        'username'     => 'guest',
+-        ),
+-      );
+-    mass_inserts(USERS_TABLE, array_keys($inserts[0]), $inserts);
+-
+-    create_user_infos(array(1,2), array('language' => $language));
+-
+-    // Available upgrades must be ignored after a fresh installation. To
+-    // make PWG avoid upgrading, we must tell it upgrades have already been
+-    // made.
+-    list($dbnow) = pwg_db_fetch_row(pwg_query('SELECT NOW();'));
+-    define('CURRENT_DATE', $dbnow);
+-    $datas = array();
+-    foreach (get_available_upgrade_ids() as $upgrade_id)
+-    {
+-      $datas[] = array(
+-        'id'          => $upgrade_id,
+-        'applied'     => CURRENT_DATE,
+-        'description' => 'upgrade included in installation',
+-        );
+-    }
+-    mass_inserts(
+-      UPGRADE_TABLE,
+-      array_keys($datas[0]),
+-      $datas
+-      );
+-
++    initialize_db($languages, $language, $prefixeTable);
++    add_admin($admin_name, $admin_pass1, $admin_mail, $language);
++    mark_all_upgrades_as_done();
+     if ($is_newsletter_subscribe)
+     {
+       fetchRemote(

seed/applicationservice/2022.03.08/piwigo/manual/image/postinstall/piwigo.sh

@@ -1,3 +1,5 @@
+set -e
+ORIPWD=$PWD
 mkdir -p "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/local/share"
 cd "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/local/share"
 app=$(wget https://api.github.com/repos/Piwigo/Piwigo/releases/latest -q -O - | jq -r '.tag_name')
@@ -6,4 +8,65 @@ tar xf *tar.gz
 rm -f *tar.gz
 mv Piwigo-* piwigo
 chown -R root: piwigo
-cd -
+rm -rf piwigo/doc piwigo/README.md  # piwigo/install.php
+ln -s /etc/piwigo/config.inc.php piwigo/local/config/config.inc.php
+ln -s /etc/piwigo/database.inc.php piwigo/local/config/database.inc.php
+ln -s /srv/piwigo/data piwigo/_data
+ln -s /srv/piwigo/upload piwigo/upload
+ln -s /srv/piwigo/logs piwigo/logs
+cp $OLDPWD/piwigo/postinstall/osmmap.php piwigo/
+chmod 644 piwigo/osmmap.php
+patch -p0 < $OLDPWD/piwigo/postinstall/piwigo.patch
+cp $OLDPWD/piwigo/postinstall/piwigo_cli.php piwigo/
+# Plugins
+cd piwigo/plugins
+wget https://piwigo.org/ext/download.php?rid=7848 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+#
+wget https://piwigo.org/ext/download.php?rid=8014 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+#
+app=$(wget https://api.github.com/repos/Piwigo/piwigo-openstreetmap/releases/latest -q -O - | jq -r '.tag_name')
+wget -q "https://github.com/Piwigo/piwigo-openstreetmap/archive/refs/tags/$app.tar.gz"
+tar xf *tar.gz
+rm -f *tar.gz
+mv piwigo-openstreetmap-* piwigo-openstreetmap
+#
+wget https://piwigo.org/ext/download.php?rid=7744 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+# community
+wget https://piwigo.org/ext/download.php?rid=8160 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+echo """<?php
+$lang['Edit photos'] = 'Editer les photos';
+$lang['Edit Photos'] = 'Editer les photos';
+$lang['Edit your photos'] = 'Editer vos photos';
+$lang['Photos posted by %s'] = 'Photos postées par %s';
+$lang['Photos posted by %s in album %s'] = 'Photos postées par %s dans l\'album %s';
+$lang['Select at least one tag'] = 'Sélectionner au moins un tag';
+$lang['Select at least one photo'] = 'Sélectionner au moins une photo';
+$lang['No photo can be deleted'] = 'Aucune photo ne peut être supprimée';
+$lang['You need to confirm deletion'] = 'Vous devez confirmer la suppression';
+$lang['No photo selected, no action possible.'] = 'Aucune photo sélectionnée, aucune action possible.';
+?>
+""" >> community/language/fr_FR/plugin.lang.php
+# embedded
+wget https://fr.piwigo.org/ext/download.php?rid=7924 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+# user delete photo
+#wget https://fr.piwigo.org/ext/download.php?rid=7974 -O plugin.zip
+#unzip plugin.zip
+#rm -f plugin.zip
+# Theme
+cd ../themes/
+wget https://piwigo.org/ext/download.php?rid=8163 -O plugin.zip
+unzip plugin.zip
+rm -f plugin.zip
+ln -s /srv/piwigo/bootstrap_darkroom ../local/bootstrap_darkroom
+#
+cd $ORIPWD

seed/applicationservice/2022.03.08/piwigo/manual/image/postinstall/piwigo_cli.php

@@ -0,0 +1,288 @@
+#!/usr/bin/php
+<?php
+
+define('PHPWG_ROOT_PATH', dirname($argv[0]) . '/');
+include(PHPWG_ROOT_PATH . 'include/config_default.inc.php');
+@include(PHPWG_ROOT_PATH. 'local/config/config.inc.php');
+defined('PWG_LOCAL_DIR') or define('PWG_LOCAL_DIR', 'local/');
+define('DEFAULT_PREFIX_TABLE', 'piwigo_');
+include(PHPWG_ROOT_PATH.PWG_LOCAL_DIR .'config/database.inc.php');
+include(PHPWG_ROOT_PATH . 'include/dblayer/functions_'.$conf['dblayer'].'.inc.php');
+include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
+include(PHPWG_ROOT_PATH . 'admin/include/functions_install.inc.php');
+include(PHPWG_ROOT_PATH . 'admin/include/functions_upgrade.php');
+include(PHPWG_ROOT_PATH . 'include/constants.php');
+include(PHPWG_ROOT_PATH . 'include/ws_functions/pwg.extensions.php');
+include(PHPWG_ROOT_PATH . 'include/template.class.php');
+$filename = PHPWG_ROOT_PATH . 'plugins/OpenIdConnect/main.inc.php';
+
+if (is_file($filename))
+{
+  include($filename);
+  $OIDC_INSTALLED = true;
+}
+else
+{
+  $OIDC_INSTALLED = false;
+};
+
+// all namespaces with options
+$namespaces_data = array('db:install' => array('language:'),
+                         'user:create' => array('login:', 'mail_address:'),
+                         'user:admin:create' => array('login:', 'admin_pass:', 'mail_address:', 'language:'),
+                         'config:show' => array(),
+                         'config:modify' => array('conf_name:', 'value:', 'type:'),
+                         'config:show:array' => array('conf_name:'),
+                         'config:modify:array' => array('conf_name:', 'key:', 'value:', 'type:'),
+                         'config:show:json' => array('conf_name:'),
+                         'config:modify:json' => array('conf_name:', 'key:', 'value:', 'type:'),
+                         'plugin:activate' => array('plugin_name:'),
+                         'plugin:deactivate' => array('plugin_name:'),
+                         'theme:activate' => array('theme_name:'),
+);
+if ($OIDC_INSTALLED) {
+  $namespaces_data['user:create'][] = 'oidc';
+}
+if (is_file(PHPWG_ROOT_PATH . 'plugins/community/admin.php')) {
+  $namespaces_data['community:permission:add'] = array('type:', 'user_album', 'recursive', 'create_subcategories', 'moderated');
+}
+
+// command line must starts with -c namespace
+$namespaces = array_keys($namespaces_data);
+if ($argc < 3 || $argv[1] != '-c' || !in_array($argv[2], $namespaces)) {
+  $namespaces_str = implode('|', $namespaces);
+  exit("Usage: $argv[0]: -c [$namespaces_str]" . PHP_EOL);
+}
+
+// load extra parameter for this namespace
+$namespace = $argv[2];
+$rest_index = 0;
+$options = getopt('c:', $namespaces_data[$namespace], $rest_index);
+
+$error = false;
+$namespace_options = '';
+foreach ($namespaces_data[$namespace] as $parameter) {
+  if(str_ends_with($parameter, ':')) {
+    $parameter = substr($parameter, 0, -1);
+    $namespace_options .= " --$parameter <$parameter>";
+    if (!isset($options[$parameter])) {
+      $error = true;
+    }
+  } else {
+    $namespace_options .= " --$parameter";
+  }
+}
+if ($rest_index != count($argv)) {
+  exit("Error in arguments.". PHP_EOL . "Usage: $argv[0]: -c $namespace$namespace_options" . PHP_EOL);
+}
+if ($error) {
+  exit("Some arguments are missing.". PHP_EOL . "Usage: $argv[0]: -c $namespace$namespace_options" . PHP_EOL);
+}
+
+function get_all_languages()
+{
+  include(PHPWG_ROOT_PATH . 'admin/include/languages.class.php');
+  return new languages('utf-8');
+}
+
+function validate_language($language, $languages) {
+  $languages_available = array_keys($languages->fs_languages);
+  if (!in_array($language, $languages_available))
+  {
+    exit("Invalid language $language (not in " . implode(', ', $languages_available) . ") ". PHP_EOL . "Usage: $argv[0]: -c $namespace$namespace_options" . PHP_EOL);
+  }
+}
+
+function cast_value($type, $value)
+{
+  if ($type === 'boolean')
+  {
+    $value = get_boolean($value);
+  }
+  else if ($type === 'integer')
+  {
+    $value = intval($value);
+  }
+  return $value;
+}
+
+function custom_array_modify($ori_config, $options)
+{
+  $value = cast_value($options['type'], $options['value']);
+  $keys = array_reverse(explode('.', $options['key']));
+  $update = Array($keys[0] => $value);
+  for ($i=0; $i<count($keys)-1; $i++)
+  {
+    $update = Array($keys[$i+1] => $update);
+  }
+  return array_replace_recursive($ori_config, $update);
+}
+
+$errors = array();
+install_db_connect($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base'], $errors);
+if ( count( $errors ) !== 0 )
+{
+  for ($i=0; $i<count($errors); $i++)
+  {
+    print($errors[$i] . PHP_EOL);
+  }
+  exit(1);
+}
+if ($namespace == 'db:install') {
+  global $user;
+  $user = Array('status' => 'webmaster');
+  $language = $options['language'];
+  $languages = get_all_languages();
+  validate_language($language, $languages);
+  $errors = [];
+  initialize_db($languages, $language, $prefixeTable, $errors);
+  if ($errors) {
+    for ($i=0; $i<count($errors); $i++)
+    {
+      print($errors[$i] . PHP_EOL);
+    }
+    exit(1);
+  }
+//  mark_all_upgrades_as_done();
+}
+else if ($namespace == 'user:create')
+{
+  $password = random_pass();
+  global $user;
+  $user = Array('id' => 0);
+  $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+  session_start();
+  $id = register_user($options['login'], $password, $options['mail_address'], false);
+  if(array_key_exists('oidc', $options) && !$options['oidc'])
+  {
+    single_insert(OIDC_TABLE, [
+      'sub' => $options['mail_address'],
+      'user_id' => $id,
+    ]);
+  }
+}
+else if ($namespace == 'user:admin:create')
+{
+  $language = $options['language'];
+  $languages = get_all_languages();
+  validate_language($language, $languages);
+  add_admin($options['login'], $options['admin_pass'], $options['mail_address'], $options['language']);
+}
+else if ($namespace == 'config:show')
+{
+  load_conf_from_db();
+  $config = safe_unserialize($conf);
+  var_dump($config);
+}
+else if ($namespace == 'config:modify')
+{
+  $value = cast_value($options['type'], $options['value']);
+  load_conf_from_db();
+  conf_update_param($options['conf_name'], $value);
+}
+else if ($namespace == 'plugin:activate')
+{
+  global $user, $template;
+  $user = Array('status' => 'webmaster', 'id' => 0);
+  $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+  session_start();
+  $template = new Template(PHPWG_ROOT_PATH.'admin/themes', 'clear');
+  $conf['secret_key'] = 'secret';
+  $params =  array(
+        'action'    => 'activate',
+        'plugin'    => $options['plugin_name'],
+        'pwg_token' => get_pwg_token(),
+  );
+  $errors = ws_plugins_performAction($params, null);
+  if (! $errors) {
+    var_dump($errors);
+    exit(1);
+  }
+}
+else if ($namespace == 'plugin:deactivate')
+{
+  global $user, $template;
+  $user = Array('status' => 'webmaster');
+  $template = new Template(PHPWG_ROOT_PATH.'admin/themes', 'clear');
+  $conf['secret_key'] = 'secret';
+  $params =  array(
+        'action'    => 'deactivate',
+        'plugin'    => $options['plugin_name'],
+        'pwg_token' => get_pwg_token(),
+  );
+  $errors = ws_plugins_performAction($params, null);
+  if (! $errors) {
+    var_dump($errors);
+    exit(1);
+  }
+}
+else if ($namespace == 'config:show:array')
+{
+  load_conf_from_db();
+  $config = safe_unserialize($conf[$options['conf_name']]);
+  var_dump($config);
+}
+else if ($namespace == 'config:modify:array')
+{
+  load_conf_from_db();
+  $ori_config = safe_unserialize($conf[$options['conf_name']]);
+  $new_config = serialize(custom_array_modify($ori_config, $options));
+  conf_update_param($options['conf_name'], $new_config);
+}
+else if ($namespace == 'config:show:json')
+{
+  load_conf_from_db();
+  $config = json_decode($conf[$options['conf_name']], true);
+  var_dump($config);
+}
+else if ($namespace == 'config:modify:json')
+{
+  load_conf_from_db();
+  if(array_key_exists($options['conf_name'], $conf))
+  {
+    $ori_config = json_decode($conf[$options['conf_name']], true);
+  }
+  else
+  {
+    $ori_config = Array();
+  }
+  $new_config = json_encode(custom_array_modify($ori_config, $options));
+  conf_update_param($options['conf_name'], $new_config);
+}
+else if ($namespace == 'theme:activate')
+{
+  global $page, $template;
+  $template = new Template(PHPWG_ROOT_PATH.'admin/themes', 'clear');
+  $conf['mobile_theme'] = '';
+  $page = Array('page' => $options['theme_name']);
+  include(PHPWG_ROOT_PATH.'admin/themes_installed.php');
+  $themes = new themes();
+  $errors = $themes->perform_action('activate', $options['theme_name']);
+  if (!empty($errors)) {
+    var_dump($errors);
+    exit(1);
+  }
+}
+else if ($namespace == 'community:permission:add')
+{
+  include(PHPWG_ROOT_PATH . 'plugins/community/main.inc.php');
+  $insert = array(
+    'type' => $options['type'],
+    'group_id' => null,
+    'user_id' => null,
+    'category_id' => null,
+    'user_album' => array_key_exists('user_album', $options) ? 'true' : 'false',
+    '`recursive`' => array_key_exists('recursive', $options) ? 'true' : 'false',
+    'create_subcategories' => array_key_exists('create_subcategories', $options) ? 'true' : 'false',
+    'moderated' => array_key_exists('moderated', $options) ? 'true' : 'false',
+    'nb_photos' => -1,
+    'storage' => -1,
+    );
+  mass_inserts(
+    COMMUNITY_PERMISSIONS_TABLE,
+    array_keys($insert),
+    array($insert)
+    );
+}
+
+?>

seed/applicationservice/2022.03.08/piwigo/manual/image/preinstall/piwigo.sh

@@ -0,0 +1 @@
+PKG="$PKG php-mysqlnd php-mbstring ImageMagick php-cli php-gd perl-Image-ExifTool"

seed/applicationservice/2022.03.08/piwigo/templates/config.inc.php

@@ -0,0 +1,50 @@
+<?php
+if(!isset($_SERVER) && isset($_ENV) && isset($_ENV['REQUEST_URI']))
+{
+  $_SERVER = Array('REQUEST_URI' => $_ENV['REQUEST_URI']);
+}
+
+%for %%idx, %%user in %%enumerate(%%piwigo_users)
+%if %%idx != 0
+}
+else %slurp
+%end if
+if(str_starts_with($_SERVER['REQUEST_URI'], '/%%user/')) {
+  $prefixe = '%%{user}';
+%end for
+}
+else
+{
+  $conf['OIDC'] = Array('issuer_url' => 'https://%%oauth2_client_server_domainname/',
+                        'client_id' => '%%oauth2_client_id',
+                        'client_secret' => '%%oauth2_client_secret',
+                        'scope' => 'openid profile email',
+                        );
+  require_once(PHPWG_ROOT_PATH . 'plugins/OpenIdConnect/oidc.php');
+  require_once(PHPWG_ROOT_PATH . 'include/functions.inc.php');
+  $oidc = get_oidc_client();
+  try {
+    $success = $oidc->authenticate();
+  } catch (Exception $e) {
+  }
+  if (isset($_REQUEST['code'])) {
+    $token_json = $oidc->getTokenResponse();
+    $oidc->setAccessToken($token_json->access_token);
+    $name = $oidc->requestUserInfo('nickname');
+    if(isset($name)) {
+      redirect('/' . $name . '/plugins/OpenIdConnect/auth.php');
+    };
+    print('unknown album');
+    die();
+  }
+}
+$conf['data_location'] = "_data/$prefixe/";
+$conf['log_dir'] = "logs/$prefixe";
+$conf['upload_dir'] = "./upload/$prefixe";
+$conf['graphics_library'] = 'ext_imagick';
+$conf['osm_add_osmmap.php'] = false;
+$conf['show_exif'] = false;
+$conf['derivative_default_size'] = 'large';
+#FOR GPX
+$conf['upload_form_all_types'] = true;
+?>

seed/applicationservice/2022.03.08/piwigo/templates/database.inc.php

@@ -0,0 +1,32 @@
+<?php
+$conf['dblayer'] = 'mysqli';
+$conf['db_base'] = '%%mariadb_client_database';
+$conf['db_user'] = '%%mariadb_client_username';
+$conf['db_password'] = '%%mariadb_client_password';
+$conf['db_host'] = '%%mariadb_client_server_domainname';
+
+if(!isset($_SERVER) && isset($_ENV) && isset($_ENV['REQUEST_URI']))
+{        
+  $_SERVER = Array('REQUEST_URI' => $_ENV['REQUEST_URI']);
+}       
+
+%for %%idx, %%user in %%enumerate(%%piwigo_users)
+%if %%idx != 0
+}
+else %slurp
+%end if
+if(str_starts_with($_SERVER['REQUEST_URI'], '/%%user/')) {
+  $prefixeTable = 'piwigo_%%{user}_';
+%end for
+}
+else
+{
+  die('unknown album');
+}
+
+
+define('PHPWG_INSTALLED', true);
+define('PWG_CHARSET', 'utf-8');
+define('DB_CHARSET', 'utf8');
+define('DB_COLLATE', '');
+?>

seed/applicationservice/2022.03.08/piwigo/templates/piwigo.conf

@@ -0,0 +1,2 @@
+[www]
+php_admin_value[error_reporting] = E_ALL & ~E_WARNING & ~E_DEPRECATED & ~E_STRICT

seed/applicationservice/2022.03.08/piwigo/templates/piwigo.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Piwigo management
+After=mariadbclient.service
+Before=nginx.service php-fpm.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/bin/piwigo.sh
+
+User=nginx
+Group=nginx
+
+[Install]
+WantedBy=multi-user.target

seed/applicationservice/2022.03.08/piwigo/templates/piwigo.sh

@@ -0,0 +1,85 @@
+%echo "#!/bin/bash"
+
+set -x
+
+cd /usr/local/share/piwigo
+%for %%user in %%piwigo_users
+export REQUEST_URI="/%%user/"
+/usr/bin/php piwigo_cli.php -c db:install --language fr_FR
+IMPORTED=$?
+if [ "$IMPORTED" = "0" ]; then
+  /usr/bin/php piwigo_cli.php -c user:admin:create --login admin --admin_pass %%piwigo_admin_password --mail_address %%piwigo_admin_email --language fr_FR
+fi
+#
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name picture_informations --key author --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name picture_informations --key rating_score --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name picture_informations --key visits --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name picture_informations --key categories --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name picture_informations --key posted_on --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name gallery_title --value "%%piwigo_title" --type string
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name page_banner --value "%%piwigo_title" --type string
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name allow_user_registration --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name allow_user_customization --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name nb_categories_page --value 40 --type string
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name picture_metadata_icon --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name picture_favorite_icon --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name picture_sizes_icon --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify --conf_name no_photo_yet --value false --type boolean
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name piwigo-openstreetmap
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key left_menu.enabled --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key left_menu.link --value "Voir sur la carte" --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key right_panel.enabled --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key category_description.enabled --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key category_description.height --value 500 --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key category_description.width --value 300 --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key main_menu.enabled --value false --type boolean
+#/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key left_menu.link --value Carte --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key batch.global_height --value 300 --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key batch.unit_height --value 300 --type string
+#/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key main_menu.height --value 300 --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key map.attrplugin --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key method --value resize --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name osm_conf --key method --value resize --type string
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name GDThumb
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name gdThumb --key margin --value 1 --type integer
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name gdThumb --key big_thumb --value false --type boolean
+#/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name gdThumb --key thumb_animate --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name gdThumb --key thumb_metamode --value hide --type string
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name rv_tscroller
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name gvideo
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name OpenIdConnect
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key issuer_url --value https://%%oauth2_client_server_domainname/ --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key client_id --value %%oauth2_client_id --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key client_secret --value %%oauth2_client_secret --type string
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key verify_host --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key verify_peer --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key register_new_users --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key redirect_new_to_profile --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key notify_admins_on_register --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key notify_user_on_register --value false --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key authorization_code_flow --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:array --conf_name OIDC --key password_flow --value false --type boolean
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name community
+if [ "$IMPORTED" = "0" ]; then
+  /usr/bin/php piwigo_cli.php -c community:permission:add --type any_registered_user --create_subcategories
+fi
+#
+/usr/bin/php piwigo_cli.php -c plugin:activate --plugin_name gvideo
+#
+/usr/bin/php piwigo_cli.php -c theme:activate --theme_name bootstrap_darkroom
+/usr/bin/php piwigo_cli.php -c config:modify:json --conf_name bootstrap_darkroom --key fluid_width --value true --type boolean
+/usr/bin/php piwigo_cli.php -c config:modify:json --conf_name bootstrap_darkroom --key page_header --value none --type string
+/usr/bin/php piwigo_cli.php -c config:modify:json --conf_name bootstrap_darkroom --key bootstrap_theme --value bootswatch-darkly --type string
+/usr/bin/php piwigo_cli.php -c config:modify:json --conf_name bootstrap_darkroom --key navbar_main_bg --value bg-primary --type string
+/usr/bin/php piwigo_cli.php -c config:modify:json --conf_name bootstrap_darkroom --key social_enabled --value false --type boolean
+#
+if [ "$IMPORTED" = "0" ]; then
+  /usr/bin/php piwigo_cli.php -c user:create --login %%user --mail_address %%user.piwigo_email --oidc
+fi
+%end for

seed/applicationservice/2022.03.08/piwigo/templates/tmpfile-piwigo.conf

@@ -0,0 +1,6 @@
+%for %%user in %%piwigo_users
+d /srv/piwigo/logs/%%user 770 root nginx - -
+d /srv/piwigo/upload/%%user 770 root nginx - -
+d /srv/piwigo/data/%%user 770 root nginx - -
+%end for
+d /srv/piwigo/bootstrap_darkroom 770 root nginx - -

seed/applicationservice/2022.03.08/postfix-relay/templates/sni.pem

@@ -1,5 +1,4 @@
-%set %%chain = %%get_chain(%%rougail_variable, 'MailRelay')
+%set %%chain = %%get_chain(authority_cn=%%rougail_variable, authority_name="MailRelay")
 %set %%cert = %%get_certificate(%%rougail_variable, 'MailRelay')
 %%get_private_key(%%rougail_variable, 'MailRelay')
 %%cert
-%%chain

seed/applicationservice/2022.03.08/postgresql-client/dictionaries/23_postgresql.xml

@@ -5,7 +5,7 @@
       <file mode="400">/secrets/postgresql.pass</file>
       <file>/etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt</file>
       <file>/etc/pki/tls/certs/postgresql.crt</file>
-      <file owner_type="variable" owner="pg_client_key_owner" mode="440">/etc/pki/tls/private/postgresql.key</file>
+      <file owner_type="variable" owner="pg_client_key_owner" mode="400">/etc/pki/tls/private/postgresql.key</file>
     </service>
   </services>
   <variables>
@@ -15,7 +15,7 @@
       <variable name="pg_client_password" type="password" description="Client password" mandatory="True" hidden="True"/>
       <variable name="pg_client_database" description="Client database" mandatory="True" hidden="True"/>
       <variable name="pg_client_key_owner" type="unix_user" description="Key owner" mandatory="True">
-        <value>root</value>
+        <value>apache</value>
       </variable>
     </family>
   </variables>

seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/21-machined.xml

@@ -15,9 +15,13 @@
     <variable name="container_config_path" type="filename" description="Nom du répertoire racine des configurations">
       <value>/var/lib/risotto/configurations</value>
     </variable>
+    <variable name="container_journal_path" type="filename" description="Nom du répertoire racine des journaux">
+      <value>/var/lib/risotto/journals</value>
+    </variable>
     <variable name="host" type="domainname" description="Machine où est démarrer le conteneur" mandatory="True"/>
     <variable name="external_ports" type="port" description="Port exposé depuis l'extérieur" multi="True"/>
     <variable name="srv_dir" type="filename" hidden="True"/>
+    <variable name="journal_dir" type="filename" hidden="True" mandatory="True"/>
     <variable name="config_dir" type="filename" hidden="True" mandatory="True"/>
     <variable name="use_systemd_repart" redefine="True">
       <value>False</value>
@@ -38,6 +42,13 @@
       <param name="join"></param>
       <target>srv_dir</target>
     </fill>
+    <fill name="calc_value">
+      <param type="variable">container_journal_path</param>
+      <param>/</param>
+      <param type="variable">domain_name_eth0</param>
+      <param name="join"></param>
+      <target>journal_dir</target>
+    </fill>
     <fill name="calc_value">
       <param type="variable">container_config_path</param>
       <param>/</param>
@@ -62,6 +73,12 @@
       <param name="dynamic" type="variable">domain_name_eth0</param>
       <target>srv_dir</target>
     </check>
+    <check name="set_linked_configuration">
+      <param name="linked_server" type="variable">host</param>
+      <param name="linked_provider">machine_journal</param>
+      <param name="dynamic" type="variable">domain_name_eth0</param>
+      <target>journal_dir</target>
+    </check>
     <check name="set_linked_configuration">
       <param name="linked_server" type="variable">host</param>
       <param name="linked_provider">machine_config</param>

seed/applicationservice/2022.03.08/redis-client/dictionaries/23_redis.xml

@@ -1,10 +1,21 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <rougail version="0.10">
+  <services>
+    <service name="redisclient" manage="False">
+      <file>/etc/pki/ca-trust/source/anchors/ca_Redis.crt</file>
+      <file>/etc/pki/tls/certs/redis.crt</file>
+      <file owner_type="variable" owner="redis_client_key_owner" mode="400">/etc/pki/tls/private/redis.key</file>
+      <!--file owner_type="variable" owner="redis_client_key_owner" mode="400" source="redis.pem">/etc/pki/tls/redis.pem</file-->
+    </service>
+  </services>
   <variables>
     <family name="redis" description="Redis">
       <variable name="redis_client_server_domainname" type="domainname" description="Nom de domaine du serveur" mandatory="True"/>
       <variable name="redis_client_username" description="Nom d'utilisateur" mandatory="True" hidden="True"/>
       <variable name="redis_client_password" type="password" description="Mot de passe de connexion" mandatory="True" hidden="True"/>
+      <variable name="redis_client_key_owner" type="unix_user" description="Key owner" mandatory="True">
+        <value>apache</value>
+      </variable>
     </family>
   </variables>
   <constraints>

seed/applicationservice/2022.03.08/redis-client/templates/ca_Redis.crt

@@ -0,0 +1 @@
+%%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis")

seed/applicationservice/2022.03.08/redis-client/templates/redis.crt

@@ -0,0 +1 @@
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")

seed/applicationservice/2022.03.08/redis-client/templates/redis.key

@@ -0,0 +1 @@
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")

seed/applicationservice/2022.03.08/redis-client/templates/redis.pem

@@ -0,0 +1,5 @@
+%set %%ca_chain = %%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis")
+%set %%cert = %%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
+%%cert
+%%ca_chain

seed/applicationservice/2022.03.08/redis/dictionaries/90_redis.xml

@@ -6,6 +6,9 @@
       <ip ip_type='variable'>account.remote_ip</ip>
       <file engine="none" source="sysuser-redis.conf">/sysusers.d/0redis.conf</file>
       <file engine="none" source="tmpfile-redis.conf">/tmpfiles.d/0redis.conf</file>
+      <file>/etc/pki/ca-trust/source/anchors/ca_Redis.crt</file>
+      <file>/etc/pki/tls/certs/redis.crt</file>
+      <file owner="root" group="redis" mode="440">/etc/pki/tls/private/redis.key</file>
     </service>
   </services>
   <variables>

seed/applicationservice/2022.03.08/redis/extras/account/00_account.xml

@@ -3,7 +3,7 @@
   <variables>
     <variable name="remote" description="Remote client needing an account" type="domainname" provider="redis_client" mandatory="True"/>
     <variable name="remote_ip" description="Remote IP" type="ip" provider="redis_client_ip" mandatory="True"/>
-    <variable name="password" description="Remote password" auto_save="True" hidden="True" type="password" mandatory="True" provider="redis_client_password"/>
+    <variable name="password" auto_save="True" hidden="True" type="password" mandatory="True" provider="redis_client_password"/>
   </variables>
   <constraints>
     <fill name="get_password">

seed/applicationservice/2022.03.08/redis/templates/ca_Redis.crt

@@ -0,0 +1 @@
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="Redis")

seed/applicationservice/2022.03.08/redis/templates/redis.conf

@@ -99,6 +99,7 @@ protected-mode no
 
 # Accept connections on the specified port, default is 6379 (IANA #815344).
 # If port 0 is specified Redis will not listen on a TCP socket.
+# GNUNUX: for php/php-fpm
 port 6379
 
 # TCP listen() backlog.
@@ -141,7 +142,6 @@ timeout 0
 #tcp-keepalive 300
 tcp-keepalive %%redis_tcp_keepalive
 #<GNUNUX
-#FIXME TLS !!
 ################################# TLS/SSL #####################################
 
 # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
@@ -190,6 +190,12 @@ tcp-keepalive %%redis_tcp_keepalive
 #
 # tls-ca-cert-file ca.crt
 # tls-ca-cert-dir /etc/ssl/certs
+#>GNUNUX
+tls-port 6380
+tls-cert-file /etc/pki/tls/certs/redis.crt
+tls-key-file /etc/pki/tls/private/redis.key
+tls-ca-cert-file /etc/pki/ca-trust/source/anchors/ca_Redis.crt
+#<GNUNUX
 
 # By default, clients (including replica servers) on a TLS port are required
 # to authenticate using valid client side certificates.
@@ -896,6 +902,9 @@ replica-priority 100
 #
 # For more information about ACL configuration please refer to
 # the Redis web site at https://redis.io/topics/acl
+#>GNUNUX
+user %%normalize_family(%%account.remote) on >%%account.password ~* &* +@all
+#<GNUNUX
 
 # ACL LOG
 #

seed/applicationservice/2022.03.08/redis/templates/redis.crt

@@ -0,0 +1 @@
+%%get_certificate(%%domain_name_eth0, 'Redis')

seed/applicationservice/2022.03.08/redis/templates/redis.key

@@ -0,0 +1 @@
+%%get_private_key(%%domain_name_eth0, 'Redis')

seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml

@@ -25,12 +25,17 @@
         <value>Consulter ces courriels avec Roundcube</value>
       </variable>
       <variable name="oauth2_client_category" redefine='True'>
-        <value>Collaboration</value>
+        <value>Diffusion</value>
       </variable>
       <variable name="oauth2_client_logo" redefine='True'>
         <value>silique_email.png</value>
       </variable>
     </family>
+    <family name="nginx">
+      <variable name="revprox_client_local_location" redefine="True">
+        <value>/roundcube/</value>
+      </variable>
+    </family>
   </variables>
   <constraints>
     <fill name="get_password">

seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php

@@ -31,7 +31,7 @@ $config = [];
 //       e.g. 'mysql://roundcube:@localhost/roundcubemail?verify_server_cert=false'
 // GNUNUX $config['db_dsnw'] = 'mysql://roundcube:@localhost/roundcubemail';
 //>GNUNUX
-$config['db_dsnw'] = 'pgsql://%%pg_client_username:%%pg_client_password@%%pg_client_server_domainname/%%pg_client_database?sslmode=verify-full';
+$config['db_dsnw'] = 'pgsql://%%pg_client_username:%%pg_client_password@%%pg_client_server_domainname/%%pg_client_database?sslmode=verify-full&sslcert=/etc/pki/tls/certs/postgresql.crt&sslkey=/etc/pki/tls/private/postgresql.key&sslrootcert=/etc/pki/ca-trust/source/anchors/ca_PostgreSQL.crt';
 //<GNUNUX
 
 // Database DSN for read-only operations (if empty write database will be used)