diff --git a/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml b/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml
index 0b6dcf80..eaa7ee23 100644
--- a/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml
+++ b/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml
@@ -31,6 +31,7 @@
revprox_client_server_domainname
InternalReverseProxy
+ hide_secret
server_ca
diff --git a/seed/applicationservice/2022.03.08/apache/templates/server.crt b/seed/applicationservice/2022.03.08/apache/templates/server.crt
index 36e5562b..da844246 100644
--- a/seed/applicationservice/2022.03.08/apache/templates/server.crt
+++ b/seed/applicationservice/2022.03.08/apache/templates/server.crt
@@ -1 +1 @@
-%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name="InternalReverseProxy")
+%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name="InternalReverseProxy", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/apache/templates/server.key b/seed/applicationservice/2022.03.08/apache/templates/server.key
index 53e9ce02..e8593618 100644
--- a/seed/applicationservice/2022.03.08/apache/templates/server.key
+++ b/seed/applicationservice/2022.03.08/apache/templates/server.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name="InternalReverseProxy")
+%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name="InternalReverseProxy", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/base-debian-bullseye/dictionaries/00-debian-bullseye.xml b/seed/applicationservice/2022.03.08/base-debian-bullseye/dictionaries/00-debian-bullseye.xml
index 3a16d808..a5dd7cf8 100644
--- a/seed/applicationservice/2022.03.08/base-debian-bullseye/dictionaries/00-debian-bullseye.xml
+++ b/seed/applicationservice/2022.03.08/base-debian-bullseye/dictionaries/00-debian-bullseye.xml
@@ -6,10 +6,8 @@
-
-
- bullseye
-
-
+
+ bullseye
+
diff --git a/seed/applicationservice/2022.03.08/base-debian/dictionaries/00-debian-base.xml b/seed/applicationservice/2022.03.08/base-debian/dictionaries/00-debian-base.xml
deleted file mode 100644
index 2c6876f6..00000000
--- a/seed/applicationservice/2022.03.08/base-debian/dictionaries/00-debian-base.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-
-
-
-
- /tmpfiles.d/0tmp.conf
- /etc/default/locale
-
-
-
-
-
-
- Debian
-
-
- /etc/ssl-localca
-
-
- /etc/ssl/certs
-
-
- /etc/ssl/private
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/base-debian/dictionaries/11-debian-base.xml b/seed/applicationservice/2022.03.08/base-debian/dictionaries/11-debian-base.xml
new file mode 100644
index 00000000..03d4922b
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-debian/dictionaries/11-debian-base.xml
@@ -0,0 +1,15 @@
+
+
+
+
+ /tmpfiles.d/0tmp.conf
+ /etc/default/locale
+
+
+
+
+ Debian
+
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base-debian/dictionaries/17-debian-base.xml b/seed/applicationservice/2022.03.08/base-debian/dictionaries/17-debian-base.xml
new file mode 100644
index 00000000..b17a9da7
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-debian/dictionaries/17-debian-base.xml
@@ -0,0 +1,17 @@
+
+
+
+
+
+
+
+ /etc/ssl-localca
+
+
+ /etc/ssl/certs
+
+
+ /etc/ssl/private
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/00-fedora-35.xml b/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/00-fedora-35.xml
deleted file mode 100644
index 038e8cb9..00000000
--- a/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/00-fedora-35.xml
+++ /dev/null
@@ -1,10 +0,0 @@
-
-
-
-
-
- 35
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/11-fedora-35.xml b/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/11-fedora-35.xml
new file mode 100644
index 00000000..ef17a8e5
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-fedora-35/dictionaries/11-fedora-35.xml
@@ -0,0 +1,8 @@
+
+
+
+
+ 35
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/00-fedora-version.xml b/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/00-fedora-version.xml
deleted file mode 100644
index 2d7cea1a..00000000
--- a/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/00-fedora-version.xml
+++ /dev/null
@@ -1,10 +0,0 @@
-
-
-
-
-
- 36
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/11-fedora-version.xml b/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/11-fedora-version.xml
new file mode 100644
index 00000000..9e1b8cb0
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-fedora-36/dictionaries/11-fedora-version.xml
@@ -0,0 +1,8 @@
+
+
+
+
+ 36
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base-fedora/dictionaries/00-fedora-base.xml b/seed/applicationservice/2022.03.08/base-fedora/dictionaries/00-fedora-base.xml
deleted file mode 100644
index 7da1647b..00000000
--- a/seed/applicationservice/2022.03.08/base-fedora/dictionaries/00-fedora-base.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-
-
-
-
-
- /tmpfiles.d/fedora.conf
-
-
-
-
-
- Fedora
-
-
- /etc/pki/ca-trust/source/anchors
-
-
- /etc/pki/tls/certs
-
-
- /etc/pki/tls/private
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/base-fedora/dictionaries/11-fedora-base.xml b/seed/applicationservice/2022.03.08/base-fedora/dictionaries/11-fedora-base.xml
new file mode 100644
index 00000000..fe122088
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-fedora/dictionaries/11-fedora-base.xml
@@ -0,0 +1,13 @@
+
+
+
+
+ /tmpfiles.d/fedora.conf
+
+
+
+
+ Fedora
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base-fedora/dictionaries/17-fedora-base.xml b/seed/applicationservice/2022.03.08/base-fedora/dictionaries/17-fedora-base.xml
new file mode 100644
index 00000000..09f1c24c
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/base-fedora/dictionaries/17-fedora-base.xml
@@ -0,0 +1,17 @@
+
+
+
+
+
+
+
+ /etc/pki/ca-trust/source/anchors
+
+
+ /etc/pki/tls/certs
+
+
+ /etc/pki/tls/private
+
+
+
diff --git a/seed/applicationservice/2022.03.08/base/dictionaries/00-base.xml b/seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml
similarity index 58%
rename from seed/applicationservice/2022.03.08/base/dictionaries/00-base.xml
rename to seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml
index a8e25115..ba360184 100644
--- a/seed/applicationservice/2022.03.08/base/dictionaries/00-base.xml
+++ b/seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml
@@ -6,24 +6,21 @@
-
+
+ False
+
+
-
-
-
- False
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
@@ -34,16 +31,12 @@
ip
ip_dns
-
- zones_name
- number_of_interfaces
-
zones_name
zones_list
- number_of_interfaces
+ zones_name
interfaces_list
@@ -75,10 +68,6 @@
gateway_eth
-
- 1
- number_of_interfaces
-
diff --git a/seed/applicationservice/2022.03.08/base/funcs/funcs.py b/seed/applicationservice/2022.03.08/base/funcs/funcs.py
index 8792841f..c9deac13 100644
--- a/seed/applicationservice/2022.03.08/base/funcs/funcs.py
+++ b/seed/applicationservice/2022.03.08/base/funcs/funcs.py
@@ -1,4 +1,5 @@
import __main__
+from typing import List
from secrets import token_urlsafe as _token_urlsafe, token_hex as _token_hex
from string import ascii_letters as _ascii_letters
from random import choice as _choice
@@ -6,6 +7,9 @@ from os.path import dirname as _dirname, abspath as _abspath, join as _join, isf
from os import makedirs as _makedirs
+from risotto.utils import load_domains, DOMAINS
+
+
_HERE = _dirname(_abspath(__main__.__file__))
_PASSWORD_DIR = _join(_HERE, 'password')
@@ -14,9 +18,12 @@ def get_password(server_name: str,
username: str,
description: str,
type: str,
+ hide: bool,
length: int=20,
temporary: bool=True,
) -> str:
+ if hide:
+ return "XXXXX"
def gen_password():
return _token_urlsafe(length)[:length]
return _set_password(server_name,
@@ -32,8 +39,11 @@ def get_password_alpha_num(server_name,
username: str,
description: str,
length,
+ hide: bool,
starts_with_char=False,
):
+ if hide:
+ return "XXXXX"
def gen_password():
password = _token_hex()
if starts_with_char:
@@ -72,14 +82,8 @@ def _set_password(server_name: str,
return file_content
-def get_range(stop):
- return list(range(stop))
-
-
-def get_number_of_interfaces(zones):
- if zones is None:
- return 1
- return len(zones)
+def get_range(lst):
+ return list(range(max(1, len(lst))))
def get_zone_name(zones: list,
@@ -97,3 +101,13 @@ def get_domain_name(server_name: str,
if index == 0:
return server_name
return extra_domainnames[index - 1]
+
+
+def get_ip(server_name: str,
+ zones_name: List[str],
+ index: str,
+ ) -> str:
+ load_domains()
+ host_name, domain_name = server_name.split('.', 1)
+ domain = DOMAINS[domain_name]
+ return domain[1][domain[0].index(host_name)]
diff --git a/seed/applicationservice/2022.03.08/base/manual/install/diff.py b/seed/applicationservice/2022.03.08/base/manual/install/diff.py
index f5780f60..ef9c1a92 100755
--- a/seed/applicationservice/2022.03.08/base/manual/install/diff.py
+++ b/seed/applicationservice/2022.03.08/base/manual/install/diff.py
@@ -11,6 +11,8 @@ from datetime import datetime, timezone
os_name = argv[1]
OLD_DIR = argv[2]
NEW_DIR = argv[3]
+WEBSITE = len(argv) != 5
+
FILES = []
def diff_files(dcmp):
for name in dcmp.diff_files:
@@ -25,7 +27,8 @@ diff_files(dcmp)
date = datetime.now(timezone.utc).isoformat()
title = f"Nouvelle version de la configuration de {os_name}"
subtitle = f"Différence entre les fichiers de configuration de {os_name}"
-print(f"""+++
+if WEBSITE:
+ print(f"""+++
title = "{title}"
description = "{subtitle}"
date = {date}
@@ -41,7 +44,15 @@ lead = "{subtitle}."
type = "installe"
+++
""")
+ TITLE = True
+else:
+ TITLE = False
for filename in FILES:
+ if not TITLE:
+ print(title)
+ print("=" * len(title))
+ print()
+ TITLE = True
print(f'- mise à jour du fichier {filename} :\n')
try:
with open(join(OLD_DIR, filename[1:]), 'r') as ori:
@@ -51,7 +62,9 @@ for filename in FILES:
except UnicodeDecodeError:
print('fichier binaire')
else:
- print('```diff')
+ if WEBSITE:
+ print('```diff')
for line in unified_diff(ori_content, new_content, fromfile=filename, tofile=filename):
print(line.rstrip())
- print('```')
+ if WEBSITE:
+ print('```')
diff --git a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
index 3383139c..fff7eca5 100644
--- a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
+++ b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
@@ -50,17 +50,24 @@
-
- 587
- 993
-
+
+
+ 587
+ 993
+
+
-
- dovecot
-
-
- postfix
-
+
+
+ all
+
+
+ dovecot
+
+
+ postfix
+
+
@@ -187,12 +194,5 @@
mail_domains
well_knowns
-
- all
- ldap_server_address
- client_family
- domain_name_eth0
- mail_domains_calc
-
diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/ca_IMAPServer.crt b/seed/applicationservice/2022.03.08/dovecot/templates/ca_IMAPServer.crt
index deacd1ec..d0097871 100644
--- a/seed/applicationservice/2022.03.08/dovecot/templates/ca_IMAPServer.crt
+++ b/seed/applicationservice/2022.03.08/dovecot/templates/ca_IMAPServer.crt
@@ -1 +1 @@
-%%get_chain(%%domain_name_eth0, "IMAPServer")
+%%get_chain(%%domain_name_eth0, "IMAPServer", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/ca_MailServer.crt b/seed/applicationservice/2022.03.08/dovecot/templates/ca_MailServer.crt
index 10f316a5..7b251cee 100644
--- a/seed/applicationservice/2022.03.08/dovecot/templates/ca_MailServer.crt
+++ b/seed/applicationservice/2022.03.08/dovecot/templates/ca_MailServer.crt
@@ -1 +1 @@
-%%get_chain(%%domain_name_eth0, "MailServer")
+%%get_chain(%%domain_name_eth0, "MailServer", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/dovecot-ldap.conf.ext b/seed/applicationservice/2022.03.08/dovecot/templates/dovecot-ldap.conf.ext
index 1bdb6c45..4e3bf82d 100644
--- a/seed/applicationservice/2022.03.08/dovecot/templates/dovecot-ldap.conf.ext
+++ b/seed/applicationservice/2022.03.08/dovecot/templates/dovecot-ldap.conf.ext
@@ -34,8 +34,8 @@ uris = ldaps://%%ldap_server_address
# Password for LDAP server, if dn is specified.
#dnpass =
#>GNUNUX
-dn = %%ldapclient_remote_user
-dnpass = %%ldapclient_remote_user_password
+dn = %%ldapclient_user
+dnpass = %%ldapclient_user_password
#
-
- 2222
-
+
+
+ 2222
+
+
Gitea: Git avec une tasse de thé
@@ -54,7 +56,9 @@
RS256
-
+
+
+
@@ -63,6 +67,7 @@
secret_key
gitea
cleartext
+ hide_secret
105
gitea_secret_key
@@ -71,6 +76,7 @@
internal_token
gitea
cleartext
+ hide_secret
105
gitea_internal_token
@@ -79,6 +85,7 @@
lfs_jwt_secret
gitea
cleartext
+ hide_secret
43
gitea_lfs_jwt_secret
diff --git a/seed/applicationservice/2022.03.08/imap-client/templates/ca_IMAPServer.crt b/seed/applicationservice/2022.03.08/imap-client/templates/ca_IMAPServer.crt
index 9334b3a2..ed24ab89 100644
--- a/seed/applicationservice/2022.03.08/imap-client/templates/ca_IMAPServer.crt
+++ b/seed/applicationservice/2022.03.08/imap-client/templates/ca_IMAPServer.crt
@@ -1 +1 @@
-%%get_chain(%%imap_address, 'IMAPServer')
+%%get_chain(%%imap_address, 'IMAPServer', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/20_ldap-client-debian.xml b/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/20_ldap-client-debian.xml
deleted file mode 100644
index c30b952e..00000000
--- a/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/20_ldap-client-debian.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
-
-
-
- /etc/ldap/ldap.conf
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/22_ldap-client-debian.xml b/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/22_ldap-client-debian.xml
new file mode 100644
index 00000000..85905435
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/ldap-client-debian/dictionaries/22_ldap-client-debian.xml
@@ -0,0 +1,13 @@
+
+
+
+
+
+
+
+ /etc/ldap/ldap.conf
+
+
+
+
+
diff --git a/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/20_ldap-client-fedora.xml b/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/20_ldap-client-fedora.xml
deleted file mode 100644
index e0c77bb2..00000000
--- a/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/20_ldap-client-fedora.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
-
-
-
- /etc/openldap/ldap.conf
-
-
-
-
diff --git a/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/22_ldap-client-fedora.xml b/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/22_ldap-client-fedora.xml
new file mode 100644
index 00000000..23e3d61b
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/ldap-client-fedora/dictionaries/22_ldap-client-fedora.xml
@@ -0,0 +1,13 @@
+
+
+
+
+
+
+
+ /etc/openldap/ldap.conf
+
+
+
+
+
diff --git a/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml b/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml
index 6b962541..53eeddca 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml
+++ b/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml
@@ -10,34 +10,34 @@
-
-
-
-
-
-
-
-
-
-
-
-
- root
-
-
- root
-
+
+
+
+
+ 636
+
+
+
+
+
+
+
+
+
+
+
+ root
+
+
+ root
+
+
- ldap_base_dn
-
-
- ldap_base_dn
- ldapclient_family
ldapclient_base_dn
-
+
tls_ca_directory
ca_LDAP.crt
@@ -56,35 +56,32 @@
/
ldap_key_file
-
- ldap_server_address
- clients
- domain_name_eth0
+
+ ldap_server_address
+ clients
+ domain_name_eth0
+ client_family
+ ldapclient_family
+ True
dn
+ ldapclient_user
+
+
+ ldap_server_address
+ ldapclient_user
+ remote account
+ cleartext
+ hide_secret
+ True
+ ldapclient_user_password
+
+
+ ldap_server_address
+ client_password
+ ldapclient_user_password
+ base_dn
domain_name_eth0
- ldapclient_remote_user
+ ldapclient_base_dn
-
- ldap_server_address
- client_password
- domain_name_eth0
- ldapclient_remote_user_password
-
-
- ldap_server_address
- ldap_dn
- ldap_base_dn
-
-
- ldap_server_address
- ldap_port
- ldap_port
-
-
- ldap_server_address
- client_family
- domain_name_eth0
- ldapclient_family
-
diff --git a/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py b/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py
index 830b1886..59789164 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py
+++ b/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py
@@ -7,15 +7,24 @@ def valid_base_dn(base_dn: str) -> None:
def calc_ldapclient_base_dn(ldap_base_dn: str,
- family_name: str,
- accounts: bool=False,
+ family_name: str=None,
+ base: bool=False,
+ group: bool=False,
) -> str:
- base = f'ou=accounts,{ldap_base_dn}'
- if accounts:
- return base
+ if family_name == 'all':
+ family_name = None
+ base = True
+ if group:
+ return f'ou=groups,{ldap_base_dn}'
+ if not ldap_base_dn.startswith('ou=accounts,'):
+ base_name = f'ou=accounts,{ldap_base_dn}'
+ else:
+ base_name = ldap_base_dn
+ if base:
+ return base_name
if not family_name:
- return f'ou=users,{base}'
- families = f'ou=families,{base}'
+ return f'ou=users,{base_name}'
+ base_name = f'ou=families,{base_name}'
if family_name != '-':
- return f'ou={family_name},{families}'
- return families
+ base_name = f'ou={family_name},{base_name}'
+ return base_name
diff --git a/seed/applicationservice/2022.03.08/ldap-client/templates/ca_LDAP.crt b/seed/applicationservice/2022.03.08/ldap-client/templates/ca_LDAP.crt
index 86dff29e..d04f2f99 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/templates/ca_LDAP.crt
+++ b/seed/applicationservice/2022.03.08/ldap-client/templates/ca_LDAP.crt
@@ -1 +1 @@
-%%get_chain(%%ldap_server_address, 'LDAP')
+%%get_chain(%%ldap_server_address, 'LDAP', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf
index 0b20b64b..7c40a7f5 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf
+++ b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf
@@ -31,8 +31,8 @@ TLS_CACERT %%ldap_ca_file
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
-BINDDN %%ldapclient_remote_user
+BINDDN %%ldapclient_user
TIMELIMIT 10
NETWORK_TIMEOUT 10
TIMEOUT 10
-BINDPW %%ldapclient_remote_user_password
+BINDPW %%ldapclient_user_password
diff --git a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.crt b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.crt
index 1b8dd519..bc9cf4fd 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.crt
+++ b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.crt
@@ -1 +1 @@
-%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%ldap_server_address, authority_name='LDAP', type='client')
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%ldap_server_address, authority_name='LDAP', type='client', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.key b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.key
index 65e88b1c..94134b17 100644
--- a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.key
+++ b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap_client.key
@@ -1,4 +1,4 @@
-%set %%key = %%get_private_key(cn=%%domain_name_eth0, authority_cn=%%ldap_server_address, authority_name='LDAP', type='client')
+%set %%key = %%get_private_key(cn=%%domain_name_eth0, authority_cn=%%ldap_server_address, authority_name='LDAP', type='client', hide=%%hide_secret)
%if not %%key
%raise Exception('empty key')
%end if
diff --git a/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml b/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
index e73c0719..816e2aaa 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
+++ b/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
@@ -28,14 +28,12 @@
+
+
+
+ all
+
+
+
-
-
- all
- ldap_server_address
- client_family
- domain_name_eth0
- lemon_mail_admin
-
-
diff --git a/seed/applicationservice/2022.03.08/lemonldap/doc.md b/seed/applicationservice/2022.03.08/lemonldap/doc.md
index cef4967c..0cb05caa 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/doc.md
+++ b/seed/applicationservice/2022.03.08/lemonldap/doc.md
@@ -7,6 +7,7 @@ Providers
- oauth2_token_signature_algo : algorithme de la signature du jeton
- oauth2_name : nom du service affiché à l'utilisateur
- oauth2_description : description du service affiché à l'utilisateur
-- oauth2_external : adresse du service (de type https://domaine/location/) c'est une variable multiple, dans ce cas plusieurs lien peuvent être généré pour accéder à ce service (par exemple un pour les utilisateurs + un différent pour une famille)
+- oauth2_host : adresse du service (de type https://domaine/location/) c'est une variable multiple, dans ce cas plusieurs lien peuvent être généré pour accéder à ce service (par exemple un pour les utilisateurs + un différent pour une famille)
+- oauth2_family : famille autoriser à accéder
- oauth2_logo : logo visible par l'utilisateur
- oauth2_category : catégorie qui permet de classer le service
diff --git a/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml b/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
index 56a6fec8..7c72c61d 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
+++ b/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
@@ -8,7 +8,12 @@
-
+
+
+
+ users
+
+
HS512
@@ -22,6 +27,7 @@
remote
cleartext
+ hide_secret
oauth2.oauth2_.secret_
diff --git a/seed/applicationservice/2022.03.08/lemonldap/templates/lemonldap-ng-fastcgi-server.service b/seed/applicationservice/2022.03.08/lemonldap/templates/lemonldap-ng-fastcgi-server.service
index f4e66392..2b1add61 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/templates/lemonldap-ng-fastcgi-server.service
+++ b/seed/applicationservice/2022.03.08/lemonldap/templates/lemonldap-ng-fastcgi-server.service
@@ -2,4 +2,5 @@
After=nginx.service
[Service]
+ExecStartPre=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/%%ldap_server_address/%%ldap_port; do sleep 1; done'
ExecStartPost=-/usr/bin/timeout 10 bash -c 'while ! /usr/local/lib/sbin/interne_well_known.pl > /var/www/html/.well-known/openid-configuration; do sleep 5; done'
diff --git a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
index 0a4fac4d..832fe91c 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
+++ b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
@@ -8,12 +8,12 @@ commentStartToken = §
"portalCustomCss": "risotto/risotto.css",
"authentication" : "LDAP",
"AuthLDAPFilter" : "(&(cn=$user)(objectClass=inetOrgPerson))",
- "managerDn" : "%%ldapclient_remote_user",
- "managerPassword" : "%%ldapclient_remote_user_password",
+ "managerDn" : "%%ldapclient_user",
+ "managerPassword" : "%%ldapclient_user_password",
"ldapPpolicyControl" : 1,
"ldapAllowResetExpiredPassword" : 1,
"ldapChangePasswordAsUser" : 1,
- "ldapBase" : "%%calc_ldapclient_base_dn(%%ldap_base_dn, None, accounts=True)",
+ "ldapBase" : "%%ldapclient_base_dn",
"ldapExportedVars" : {
"uid" : "uid",
"cn" : "cn",
@@ -22,9 +22,13 @@ commentStartToken = §
"givenName" : "givenName",
"home" : "homeDirectory"
},
- "ldapGroupAttributeName" : "memberUid",
+ "ldapGroupBase" : "%%ldapclient_base_dn",
+ "ldapGroupAttributeName" : "member",
"ldapGroupAttributeNameUser" : "cn",
- "ldapGroupObjectClass" : "group",
+ "ldapGroupAttributeNameGroup" : "dn",
+ "ldapGroupAttributeNameSearch" : "cn",
+ "ldapGroupAttributeNameUser" : "dn",
+ "ldapGroupObjectClass" : "groupOfNames",
"ldapPort" : "636",
"ldapServer" : "ldaps://%%ldap_server_address",
"ldapVerify" : "required",
@@ -61,18 +65,18 @@ commentStartToken = §
%set %%domains = []
%for %%app in %%oauth2.remotes
%set %%key = %%normalize_family(%%app)
- %set %%external = %%oauth2['oauth2_' + %%key]['external_' + %%key]
- § external is somethink like https://domain/
- %if %%external
+ § somethink like ['https://domain/']
+ %for %%external in %%oauth2['oauth2_' + %%key]['external_' + %%key]['hosts_' + %%key]
%set %%domain = %%str(%%external).split('/', 3)[-2]
%if %%domain not in %%domains
- },
- "%%domain" : {
- "^/logout" : "logout_sso",
- "default" : "accept"
+ },
+ "%%domain" : {
+ "^/logout" : "logout_sso",
+§ FIXME "default" : "$groups eq %%external['family_' + %%key]"
+ "default" : "accept"
%%domains.append(%%domain)%slurp
%end if
- %end if
+ %end for
%end for
}
},
@@ -148,9 +152,9 @@ commentStartToken = §
"loa-4" : 4,
"loa-5" : 5
},
-%set %%pub = '\\n'.join(%%get_public_key(%%domain_name_eth0).split("\n"))
+%set %%pub = '\\n'.join(%%get_public_key(%%domain_name_eth0, hide=%%hide_secret).split("\n"))
"oidcServicePublicKeySig" : "%%pub",
-%set %%priv = '\\n'.join(%%get_private_key(%%domain_name_eth0).split("\n"))
+%set %%priv = '\\n'.join(%%get_private_key(%%domain_name_eth0, hide=%%hide_secret).split("\n"))
"oidcServicePrivateKeySig" : "%%priv",
"passwordDB" : "LDAP",
"persistentStorage" : "Apache::Session::File",
@@ -176,7 +180,7 @@ commentStartToken = §
'description': %%description,
'logo': "risotto/" + %%oauth2['oauth2_' + %%key]['logo_' + %%key],
'name': %%oauth2['oauth2_' + %%key]['name_' + %%key],
- 'uri': %%oauth2['oauth2_' + %%key]['external_' + %%key]}
+ 'uri': %%oauth2['oauth2_' + %%key]['external_' + %%key]['hosts_' + %%key]}
%%remotes.setdefault(%%oauth2['oauth2_' + %%key]['category_' + %%key], []).append(%%dico)%slurp
%end for
"applicationList" : {
diff --git a/seed/applicationservice/2022.03.08/letsencrypt/dictionaries/20-letsencrypt.xml b/seed/applicationservice/2022.03.08/letsencrypt/dictionaries/20-letsencrypt.xml
index e305d5bb..30b8b7ed 100644
--- a/seed/applicationservice/2022.03.08/letsencrypt/dictionaries/20-letsencrypt.xml
+++ b/seed/applicationservice/2022.03.08/letsencrypt/dictionaries/20-letsencrypt.xml
@@ -14,6 +14,7 @@
plugin_name
credential_filename
email
+ hide_secret
domain_names
diff --git a/seed/applicationservice/2022.03.08/letsencrypt/funcs/letsencrypt.py b/seed/applicationservice/2022.03.08/letsencrypt/funcs/letsencrypt.py
index a104fd50..170ca950 100644
--- a/seed/applicationservice/2022.03.08/letsencrypt/funcs/letsencrypt.py
+++ b/seed/applicationservice/2022.03.08/letsencrypt/funcs/letsencrypt.py
@@ -17,7 +17,10 @@ def letsencrypt_certif(domain: str,
plugin_name: str,
credential_filename: str,
email: str,
+ hide_secret: bool,
) -> None:
+ if hide_secret:
+ return
if None in (domain, authority_cn, plugin_name, credential_filename, email):
return
authority_name = 'External'
diff --git a/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml b/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
index d219e806..1c71bb94 100644
--- a/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
+++ b/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
@@ -22,7 +22,7 @@
-
+
@@ -43,7 +43,9 @@
RS256
-
+
+
+
@@ -57,6 +59,7 @@
postorius
secret_key
cleartext
+ hide_secret
postorius_secret_key
diff --git a/seed/applicationservice/2022.03.08/mailman/templates/postgresql_postorius.key b/seed/applicationservice/2022.03.08/mailman/templates/postgresql_postorius.key
index 316de5e6..f87d892a 100644
--- a/seed/applicationservice/2022.03.08/mailman/templates/postgresql_postorius.key
+++ b/seed/applicationservice/2022.03.08/mailman/templates/postgresql_postorius.key
@@ -1 +1 @@
-%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client")
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/mariadb-client/templates/mariadbclient.service b/seed/applicationservice/2022.03.08/mariadb-client/templates/mariadbclient.service
index 60caeff3..0b583e18 100644
--- a/seed/applicationservice/2022.03.08/mariadb-client/templates/mariadbclient.service
+++ b/seed/applicationservice/2022.03.08/mariadb-client/templates/mariadbclient.service
@@ -4,4 +4,4 @@ Before=network.target
[Service]
Type=oneshot
-ExecStart=/usr/bin/timeout 90 sh -c 'while ! 3<> /dev/tcp/%%mariadb_client_server_domainname/3306; do sleep 1; done; echo "MARIADB STARTED"'
+ExecStart=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/%%mariadb_client_server_domainname/3306; do sleep 1; done; echo "MARIADB STARTED"'
diff --git a/seed/applicationservice/2022.03.08/mariadb/dictionaries/20_mariadb.xml b/seed/applicationservice/2022.03.08/mariadb/dictionaries/20_mariadb.xml
index 91f67a38..11e45311 100644
--- a/seed/applicationservice/2022.03.08/mariadb/dictionaries/20_mariadb.xml
+++ b/seed/applicationservice/2022.03.08/mariadb/dictionaries/20_mariadb.xml
@@ -19,6 +19,7 @@
root_password
mariadb
cleartext
+ hide_secret
50
mariadb_root_password
diff --git a/seed/applicationservice/2022.03.08/nextcloud/dictionaries/31_nextcloud.xml b/seed/applicationservice/2022.03.08/nextcloud/dictionaries/31_nextcloud.xml
index 42828bc2..2cc50fa2 100644
--- a/seed/applicationservice/2022.03.08/nextcloud/dictionaries/31_nextcloud.xml
+++ b/seed/applicationservice/2022.03.08/nextcloud/dictionaries/31_nextcloud.xml
@@ -14,9 +14,9 @@
-
+
-
+
@@ -53,6 +53,7 @@
admin_password
nextcloud
cleartext
+ hide_secret
nextcloud_admin_password
@@ -62,6 +63,7 @@
nextcloud
10
True
+ hide_secret
nextcloud_instance_id
diff --git a/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init b/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init
index 3279d880..f68c9595 100644
--- a/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init
+++ b/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init
@@ -27,8 +27,8 @@ fi
/usr/bin/php /usr/share/nextcloud/occ config:app:set user_ldap bgjRefreshInterval --value=300 -q
/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapHost "ldaps://%%ldap_server_address"
/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapPort "%%ldap_port"
-/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentName "%%ldapclient_remote_user"
-/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentPassword "%%ldapclient_remote_user_password"
+/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentName "%%ldapclient_user"
+/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentPassword "%%ldapclient_user_password"
/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBase "%%ldapclient_base_dn"
/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseUsers "%%ldapclient_base_dn"
/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseGroups "%%ldapclient_base_dn"
diff --git a/seed/applicationservice/2022.03.08/nginx-common/templates/nginx-options.conf b/seed/applicationservice/2022.03.08/nginx-common/templates/nginx-options.conf
index 9025b2ee..185ff4dc 100644
--- a/seed/applicationservice/2022.03.08/nginx-common/templates/nginx-options.conf
+++ b/seed/applicationservice/2022.03.08/nginx-common/templates/nginx-options.conf
@@ -2,7 +2,7 @@ client_max_body_size %%{nginx_post_max_size}M;
client_body_buffer_size 128k;
# Always trust ourself
-%for %%interface in %%range(%%number_of_interfaces)
+%for %%interface in %%range(%%len(%%zones_list))
set_real_ip_from %%getVar('ip_eth{0}'.format(%%interface));
%end for
diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt
index 4ea9946c..9a430003 100644
--- a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt
+++ b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt
@@ -1,2 +1,2 @@
-%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type="server")
-%%get_chain(%%revprox_client_server_domainname, 'InternalReverseProxy')
+%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type="server", hide=%%hide_secret)
+%%get_chain(%%revprox_client_server_domainname, 'InternalReverseProxy', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key
index a02eba1e..56d50e1e 100644
--- a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key
+++ b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type='server')
+%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type='server', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
index 3ccd39c8..910feb89 100644
--- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
+++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
@@ -10,10 +10,12 @@
-
- 80
- 443
-
+
+
+ 80
+ 443
+
+
diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/ca_InternalReverseProxy.crt b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/ca_InternalReverseProxy.crt
index 7aa65537..0342bded 100644
--- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/ca_InternalReverseProxy.crt
+++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/ca_InternalReverseProxy.crt
@@ -1,3 +1,3 @@
-%for %%idx in %%range(0, %%number_of_interfaces)
-%%get_chain(authority_cn=%%getVar('domain_name_eth' + %%str(%%idx)), authority_name="InternalReverseProxy")
+%for %%idx in %%range(%%len(%%zones_list))
+%%get_chain(authority_cn=%%getVar('domain_name_eth' + %%str(%%idx)), authority_name="InternalReverseProxy", hide=%%hide_secret)
%end for
diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/certificate.crt b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/certificate.crt
index 45a1426c..f604de8c 100644
--- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/certificate.crt
+++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/certificate.crt
@@ -1 +1 @@
-%%get_certificate(cn=%%rougail_variable, authority_cn=%%domain_name_eth0, authority_name='External')
+%%get_certificate(cn=%%rougail_variable, authority_cn=%%domain_name_eth0, authority_name='External', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/private.key b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/private.key
index 1662468a..1c195f41 100644
--- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/private.key
+++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/templates/private.key
@@ -1 +1 @@
-%%get_private_key(cn=%%rougail_variable, authority_cn=%%domain_name_eth0, authority_name='External')
+%%get_private_key(cn=%%rougail_variable, authority_cn=%%domain_name_eth0, authority_name='External', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/nsd/dictionaries/20_nsd.xml b/seed/applicationservice/2022.03.08/nsd/dictionaries/20_nsd.xml
index c50334ff..cb5bbdf4 100644
--- a/seed/applicationservice/2022.03.08/nsd/dictionaries/20_nsd.xml
+++ b/seed/applicationservice/2022.03.08/nsd/dictionaries/20_nsd.xml
@@ -14,7 +14,7 @@
-
+
127.0.0.1
diff --git a/seed/applicationservice/2022.03.08/nsd/templates/risotto.conf b/seed/applicationservice/2022.03.08/nsd/templates/risotto.conf
index a1f22d4f..9a40a9a2 100644
--- a/seed/applicationservice/2022.03.08/nsd/templates/risotto.conf
+++ b/seed/applicationservice/2022.03.08/nsd/templates/risotto.conf
@@ -1,6 +1,6 @@
server:
interface: 127.0.0.1
-%for %%interface in %%interfaces_list
+%for %%interface in %%range(%%len(%%zones_list))
interface: %%getVar('ip_eth' + %%str(%%interface))
%end for
do-ip4: yes
diff --git a/seed/applicationservice/2022.03.08/oauth2-client/dictionaries/30_oauth2_client.xml b/seed/applicationservice/2022.03.08/oauth2-client/dictionaries/30_oauth2_client.xml
index 8ab4358d..75f8671f 100644
--- a/seed/applicationservice/2022.03.08/oauth2-client/dictionaries/30_oauth2_client.xml
+++ b/seed/applicationservice/2022.03.08/oauth2-client/dictionaries/30_oauth2_client.xml
@@ -9,7 +9,12 @@
-
+
+
+
+ users
+
+
Défaut
@@ -74,6 +79,13 @@
oauth2_client_id
oauth2_client_logo
+
+ oauth2_client_server_domainname
+ oauth2_family
+ oauth2_external
+ oauth2_client_id
+ oauth2_client_family
+
oauth2_client_server_domainname
oauth2_login
@@ -96,6 +108,7 @@
oauth2_client_name
oauth2_client_description
oauth2_client_external
+ oauth2_client_family
diff --git a/seed/applicationservice/2022.03.08/openldap/dictionaries/21_openldap-server.xml b/seed/applicationservice/2022.03.08/openldap/dictionaries/21_openldap-server.xml
index a815148f..4354fb32 100644
--- a/seed/applicationservice/2022.03.08/openldap/dictionaries/21_openldap-server.xml
+++ b/seed/applicationservice/2022.03.08/openldap/dictionaries/21_openldap-server.xml
@@ -13,87 +13,70 @@
/secrets/config_acl.ldif
/secrets/admin_ldap.pwd
/sysusers.d/risotto-openldap.conf
- /tmpfiles.d/0openldap-server.conf
+ /tmpfiles.d/0openldap-server.conf
-
-
-
- 636
-
-
-
-
-
- objectClass
- uid
- cn
- sn
-
- givenName
- mail
- entryCSN
- entryUUID
- contextCSN
+
+
+
+ /etc/openldap/schema/cosine.ldif
+ /etc/openldap/schema/inetorgperson.ldif
+ /etc/openldap/schema/nis.ldif
+ /etc/openldap/schema/misc.ldif
-
- eq
- pres
-
-
+
+
+ 0
+
+
+ 5000
+
+
+ 3600
+
+
+
+
+ 0
+
+
+ 268435456
+
+
+ 1
+
+
+ 262144
+
+
+ 10485760
+
+
+ 2097152
+
+
+ /srv/openldap/log
+
+
+ 5000
+
+
+ 5000
+
+
+ 5000
+
+
+
+
+
+
+
+
-
- /etc/openldap/schema/cosine.ldif
- /etc/openldap/schema/inetorgperson.ldif
- /etc/openldap/schema/nis.ldif
- /etc/openldap/schema/misc.ldif
-
-
- 0
-
-
- 5000
-
-
- 3600
-
-
-
-
-
-
- 0
-
-
- 268435456
-
-
- 1
-
-
- 262144
-
-
- 10485760
-
-
- 2097152
-
-
- /var/lib/ldap/logs
-
-
- 5000
-
-
- 5000
-
-
- 5000
-
@@ -104,34 +87,13 @@
domain_name_eth0
- ldap_base_dn
+ ldapclient_base_dn
cn=admin
- ldap_base_dn
+ ldapclient_base_dn
,
- ldap_admin_dn
-
-
- domain_name_eth0
- writer
- LDAP
- cleartext
- True
- ldap_admin_password
-
-
- ldap_admin_dn
- ldapclient_remote_user
-
-
- ldap_admin_password
- ldapclient_remote_user_password
-
-
- domain_name_eth0
- LDAP
- openldap_ca_chain
+ ldapclient_user
diff --git a/seed/applicationservice/2022.03.08/openldap/extras/accounts/00_account.xml b/seed/applicationservice/2022.03.08/openldap/extras/accounts/00_account.xml
index 8a891caa..63691336 100644
--- a/seed/applicationservice/2022.03.08/openldap/extras/accounts/00_account.xml
+++ b/seed/applicationservice/2022.03.08/openldap/extras/accounts/00_account.xml
@@ -3,14 +3,11 @@
-
-
-
-
-
-
-
-
+
+
+
+
+
@@ -22,38 +19,36 @@
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+ ldapclient_base_dn
+ accounts.remote_.family_
+ accounts.remote_.base_dn_
+
cn=
,
- ldap_base_dn
+ ldapclient_base_dn
accounts.remote_.dn_
-
- domain_name_eth0
-
- remote account
- cleartext
- True
- accounts.remote_.password_
-
domain_name_eth0
accounts.users.ldap_user_mail
ldap user
cleartext
+ hide_secret
True
accounts.users.ldap_user_password
@@ -62,6 +57,7 @@
accounts.family_.users_.ldap_user_mail_
ldap family user
cleartext
+ hide_secret
True
accounts.family_.users_.ldap_user_password_
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/admin_ldap.pwd b/seed/applicationservice/2022.03.08/openldap/templates/admin_ldap.pwd
index c8dab958..22610d3f 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/admin_ldap.pwd
+++ b/seed/applicationservice/2022.03.08/openldap/templates/admin_ldap.pwd
@@ -1 +1 @@
-%%ldap_admin_password%slurp
+%%ldapclient_user_password%slurp
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/config.ldif b/seed/applicationservice/2022.03.08/openldap/templates/config.ldif
index d434f92a..d01eed77 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/config.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/config.ldif
@@ -100,7 +100,7 @@ olcDatabase: {-1}frontend
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
-olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="%%ldap_admin_dn" write by * none
+olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="%%ldapclient_user" write by * none
dn: olcDatabase={1}monitor,cn=config
objectClass: olcDatabaseConfig
@@ -112,11 +112,17 @@ objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /srv/openldap
-olcRootDN: %%ldap_admin_dn
-olcRootPW:: %%ssha_encode(%%ldap_admin_password)
-olcSuffix: %%ldap_base_dn
+olcRootDN: %%ldapclient_user
+olcRootPW:: %%ssha_encode(%%ldapclient_user_password)
+olcSuffix: %%ldapclient_base_dn
olcSizeLimit: %%ldap_sizelimit
olcTimeLimit: %%ldap_timelimit
-%for %%attribute in %%ldap_index_attribute
-olcDbIndex: %%attribute %echo ','.join(%%attribute.ldap_index_indices)
-%end for
+olcDbIndex: objectClass eq,pres
+olcDbIndex: uid eq,pres
+olcDbIndex: cn eq,pres
+olcDbIndex: sn eq,pres
+olcDbIndex: givenName eq,pres
+olcDbIndex: mail eq,pres
+olcDbIndex: entryCSN eq,pres
+olcDbIndex: entryUUID eq,pres
+olcDbIndex: contextCSN eq,pres
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif b/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
index e74e8a50..86e1c008 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
@@ -1,7 +1,9 @@
%set %%dns = {}
+%set %%groups = []
%for %%remote in %%accounts.remotes
%set %%name = %%normalize_family(%%remote)
%set %%family = %%accounts['remote_' + %%name]['family_' + %%name]
+%%groups.append(%%accounts['remote_' + %%name]['dn_' + %%name])%slurp
%%dns.setdefault(%%family, []).append((%%accounts['remote_' + %%name]['dn_' + %%name], %%accounts['remote_' + %%name]['read_only_' + %%name]))%slurp
%end for
dn: olcDatabase={2}mdb,cn=config
@@ -11,27 +13,27 @@ olcAccess: {0}to attrs=userPassword
by self write
by anonymous auth
by * none
-%set %%aclidx = 1
+olcAccess: {1}to dn.subtree="%%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=None, group=True)"
+%for group in %%groups
+ by dn="%%group" read
+%end for
+ by * none
+%set %%aclidx = 2
%for %%family, %%remotes in %%dns.items()
%if %%family == 'all'
-olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldap_base_dn, None, accounts=True)"
+olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=None, base=True)"
%else
-olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)"
+olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldapclient_base_dn, %%family)"
%end if
by self read
%for %%remote in %%remotes
by dn="%%remote[0]" %slurp
%if %%remote[1]
-read%slurp
+read
%else
-write%slurp
+write
%end if
%end for
%set %%aclidx += 1
-
by * none
%end for
-%for %%idx, %%acl in %%enumerate(%%accounts.acl.ldap_acl_attribute)
- %set %%aclidx += 1
-olcAccess: {%%aclidx}to %%acl %echo ' '.join(%%acl.ldap_acl_rights)
-%end for
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/openldap.crt b/seed/applicationservice/2022.03.08/openldap/templates/openldap.crt
index e53ea995..098fcae5 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/openldap.crt
+++ b/seed/applicationservice/2022.03.08/openldap/templates/openldap.crt
@@ -1,5 +1,5 @@
%set %%extra_domainnames = []
-%for %%idx in %%range(1, %%number_of_interfaces)
+%for %%idx in %%range(%%len(%%zones_list))
%%extra_domainnames.append(%%getVar('domain_name_eth' + %%str(%%idx)))
%end for
-%%get_certificate(%%domain_name_eth0, 'LDAP', extra_domainnames=%%extra_domainnames)
+%%get_certificate(%%domain_name_eth0, 'LDAP', extra_domainnames=%%extra_domainnames, hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/openldap.key b/seed/applicationservice/2022.03.08/openldap/templates/openldap.key
index 3f464d05..48aa6898 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/openldap.key
+++ b/seed/applicationservice/2022.03.08/openldap/templates/openldap.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, 'LDAP')
+%%get_private_key(cn=%%domain_name_eth0, authority_name='LDAP', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/slapd.service b/seed/applicationservice/2022.03.08/openldap/templates/slapd.service
index 9b4b2539..8a3c0566 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/slapd.service
+++ b/seed/applicationservice/2022.03.08/openldap/templates/slapd.service
@@ -11,6 +11,6 @@ ExecStart=
# remove none tls port
ExecStart=+/usr/sbin/slapd -u ldap -h ldaps:///
#waiting for ldap server...
-ExecStartPost=/usr/bin/timeout 90 sh -c 'while ! 3<> /dev/tcp/localhost/%%ldap_port; do sleep 1; done'
-ExecStartPost=-/usr/bin/ldapmodify -D %%ldap_admin_dn -y /usr/local/lib/secrets/admin_ldap.pwd -v -f /usr/local/lib/secrets/config_acl.ldif
-ExecStartPost=-/usr/bin/ldapmodify -D %%ldap_admin_dn -y /usr/local/lib/secrets/admin_ldap.pwd -v -f /usr/local/lib/secrets/users_mod.ldif
+ExecStartPost=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/localhost/%%ldap_port; do sleep 1; done'
+ExecStartPost=-/usr/bin/ldapmodify -D %%ldapclient_user -y /usr/local/lib/secrets/admin_ldap.pwd -v -f /usr/local/lib/secrets/config_acl.ldif
+ExecStartPost=-/usr/bin/ldapmodify -D %%ldapclient_user -y /usr/local/lib/secrets/admin_ldap.pwd -v -f /usr/local/lib/secrets/users_mod.ldif
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/tmpfile-openldap-server.conf b/seed/applicationservice/2022.03.08/openldap/templates/tmpfile-openldap-server.conf
index d08deaf7..97c2bc1e 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/tmpfile-openldap-server.conf
+++ b/seed/applicationservice/2022.03.08/openldap/templates/tmpfile-openldap-server.conf
@@ -1,2 +1,3 @@
d /srv/openldap 700 ldap ldap - -
+d %%db_log_directory 700 ldap ldap - -
d /etc/openldap/slapd.d 750 ldap ldap - -
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/users.ldif b/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
index 08c37c01..76848136 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
@@ -1,6 +1,7 @@
# BaseDN
-dn: %%ldap_base_dn
-%set %%attribute, %%organization = %%ldap_base_dn.split(',', 1)[0].split('=')
+%set groups = {}
+dn: %%ldapclient_base_dn
+%set %%attribute, %%organization = %%ldapclient_base_dn.split(',', 1)[0].split('=')
%%attribute: %%organization
objectClass: top
%if %%attribute == 'o'
@@ -22,21 +23,22 @@ objectClass: inetOrgPerson
%end for
# Accounts
-%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
-dn: %%calc_ldapclient_base_dn(%%ldap_base_dn, None, accounts=True)
+dn: %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=None, base=True)
ou: accounts
objectClass: top
objectClass: organizationalUnit
-## Users
-%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
+## Accounts users
+%set %%users = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=None)
dn: %%users
ou: users
objectClass: top
objectClass: organizationalUnit
%for %%user in %%accounts.users.ldap_user_mail
-dn: cn=%%user,%%users
+%set %%userdn = "cn=" + %%user + "," + %%users
+%%groups.setdefault('users', []).append(%%userdn)
+dn: %%userdn
cn: %%user
mail: %%user
sn: %%user.ldap_user_sn
@@ -59,20 +61,22 @@ objectClass: inetLocalMailRecipient
%end for
## Families
-dn: %%calc_ldapclient_base_dn(%%ldap_base_dn, '-')
+dn: %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name='-')
ou: families
objectClass: top
objectClass: organizationalUnit
%for %%family in %%accounts.families
-%set %%families = %%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)
+%set %%families = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=%%family)
dn: %%families
ou: %%family
objectClass: top
objectClass: organizationalUnit
%for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family]
-dn: cn=%%user,%%families
+%set %%userdn = "cn=" + %%user + "," + %%families
+%%groups.setdefault(%%family, []).append(%%userdn)
+dn: %%userdn
cn: %%user
mail: %%user
sn: %%user['ldap_user_sn_' + %%family]
@@ -95,3 +99,20 @@ objectClass: inetLocalMailRecipient
%end for
%end for
+## Groups
+%set %%groupdn = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=None, group=True)
+dn: %%groupdn
+ou: groups
+objectClass: top
+objectClass: organizationalUnit
+
+%for %%group, %%members in %%groups.items()
+dn: cn=%%group,%%groupdn
+cn: %%group
+objectclass: top
+objectclass: groupOfNames
+ %for %%member in %%members
+member: %%member
+ %end for
+
+%end for
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif b/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
index d22294dc..90427daf 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
@@ -8,7 +8,7 @@ userPassword:: %%ssha_encode(%%accounts['remote_' + %%name]['password_' + %%name
%end for
# Users
-%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
+%set %%users = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, '')
%for %%user in %%accounts.users.ldap_user_mail
dn: cn=%%user,%%users
changetype: modify
@@ -26,7 +26,7 @@ mailLocalAddress: %%alias
%end for
# Families
%for %%family in %%accounts.families
- %set %%families = %%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)
+ %set %%families = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, %%family)
%for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family]
dn: cn=%%user,%%families
changetype: modify
diff --git a/seed/applicationservice/2022.03.08/peertube/dictionaries/30_peertube.xml b/seed/applicationservice/2022.03.08/peertube/dictionaries/30_peertube.xml
index 2d30bd67..d54f2145 100644
--- a/seed/applicationservice/2022.03.08/peertube/dictionaries/30_peertube.xml
+++ b/seed/applicationservice/2022.03.08/peertube/dictionaries/30_peertube.xml
@@ -36,7 +36,9 @@
silique_video.png
-
+
+
+
diff --git a/seed/applicationservice/2022.03.08/piwigo/dictionaries/31_piwigo.xml b/seed/applicationservice/2022.03.08/piwigo/dictionaries/31_piwigo.xml
index a00d7b14..9274b5ad 100644
--- a/seed/applicationservice/2022.03.08/piwigo/dictionaries/31_piwigo.xml
+++ b/seed/applicationservice/2022.03.08/piwigo/dictionaries/31_piwigo.xml
@@ -11,7 +11,7 @@
-
+
/usr/local/share/piwigo
@@ -48,6 +48,7 @@
admin_password
piwigo
cleartext
+ hide_secret
piwigo_admin_password
diff --git a/seed/applicationservice/2022.03.08/pleroma/dictionaries/30_pleroma.xml b/seed/applicationservice/2022.03.08/pleroma/dictionaries/30_pleroma.xml
index 1720529f..b457600c 100644
--- a/seed/applicationservice/2022.03.08/pleroma/dictionaries/30_pleroma.xml
+++ b/seed/applicationservice/2022.03.08/pleroma/dictionaries/30_pleroma.xml
@@ -36,7 +36,9 @@
silique_video.png
-
+
+
+
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/dictionaries/30_postfix.xml b/seed/applicationservice/2022.03.08/postfix-relay/dictionaries/30_postfix.xml
index 37d0f69e..0033df29 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/dictionaries/30_postfix.xml
+++ b/seed/applicationservice/2022.03.08/postfix-relay/dictionaries/30_postfix.xml
@@ -32,16 +32,18 @@
-
- 25
-
+
+
+ 25
+
+
-
+
@@ -63,6 +65,7 @@
local authentification
cleartext
+ hide_secret
local_authentification_password_
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/templates/ca_MailServer.crt b/seed/applicationservice/2022.03.08/postfix-relay/templates/ca_MailServer.crt
index 8db50d45..13b8d621 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/templates/ca_MailServer.crt
+++ b/seed/applicationservice/2022.03.08/postfix-relay/templates/ca_MailServer.crt
@@ -1 +1 @@
-%%get_chain(authority_cn=%%domain_name_eth0, authority_name="MailServer")
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="MailServer", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.crt b/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.crt
index fbd3d864..b9d68a8c 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.crt
+++ b/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.crt
@@ -1 +1 @@
-%%get_certificate(%%domain_name_eth0, 'MailServer')
+%%get_certificate(%%domain_name_eth0, 'MailServer', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.key b/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.key
index 4febac3f..716da9ca 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.key
+++ b/seed/applicationservice/2022.03.08/postfix-relay/templates/postfix.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, 'MailServer')
+%%get_private_key(cn=%%domain_name_eth0, authority_name='MailServer', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/templates/sni b/seed/applicationservice/2022.03.08/postfix-relay/templates/sni
index 72acebe8..90df9ab4 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/templates/sni
+++ b/seed/applicationservice/2022.03.08/postfix-relay/templates/sni
@@ -1,4 +1,4 @@
-%for %%idx in %%range(0, %%number_of_interfaces)
+%for %%idx in %%range(%%len(%%zones_list))
%set %%domain = %%getVar('domain_name_eth' + %%str(%%idx))
%%domain /etc/postfix/certs/%%{domain}.pem
%end for
diff --git a/seed/applicationservice/2022.03.08/postfix-relay/templates/sni.pem b/seed/applicationservice/2022.03.08/postfix-relay/templates/sni.pem
index 8706e9de..92fdfd2b 100644
--- a/seed/applicationservice/2022.03.08/postfix-relay/templates/sni.pem
+++ b/seed/applicationservice/2022.03.08/postfix-relay/templates/sni.pem
@@ -1,4 +1,4 @@
-%set %%chain = %%get_chain(authority_cn=%%rougail_variable, authority_name="MailRelay")
-%set %%cert = %%get_certificate(%%rougail_variable, 'MailRelay')
-%%get_private_key(%%rougail_variable, 'MailRelay')
+%set %%chain = %%get_chain(authority_cn=%%rougail_variable, authority_name="MailRelay", hide=%%hide_secret)
+%set %%cert = %%get_certificate(cn=%%rougail_variable, authority_name='MailRelay', hide=%%hide_secret)
+%%get_private_key(cn=%%rougail_variable, authority_name='MailRelay', hide=%%hide_secret)
%%cert
diff --git a/seed/applicationservice/2022.03.08/postgresql-client/templates/ca_PostgreSQL.crt b/seed/applicationservice/2022.03.08/postgresql-client/templates/ca_PostgreSQL.crt
index d7868fd1..72b8123c 100644
--- a/seed/applicationservice/2022.03.08/postgresql-client/templates/ca_PostgreSQL.crt
+++ b/seed/applicationservice/2022.03.08/postgresql-client/templates/ca_PostgreSQL.crt
@@ -1,2 +1,2 @@
-%%get_chain(authority_cn=%%pg_client_server_domainname, authority_name="PostgreSQL")
+%%get_chain(authority_cn=%%pg_client_server_domainname, authority_name="PostgreSQL", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.crt b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.crt
index 1dbbe3db..31d9f7fa 100644
--- a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.crt
+++ b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.crt
@@ -1 +1 @@
-%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client")
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.key b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.key
index 316de5e6..f87d892a 100644
--- a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.key
+++ b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresql.key
@@ -1 +1 @@
-%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client")
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%pg_client_server_domainname, authority_name='PostgreSQL', type="client", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresqlclient.service b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresqlclient.service
index c25764ad..0dc6a152 100644
--- a/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresqlclient.service
+++ b/seed/applicationservice/2022.03.08/postgresql-client/templates/postgresqlclient.service
@@ -5,5 +5,5 @@ Before=network.target
[Service]
Type=oneshot
Environment=PGPASSFILE=/usr/local/lib/secrets/postgresql.pass
-ExecStart=/usr/bin/timeout 90 sh -c 'while ! 3<> /dev/tcp/%%pg_client_server_domainname/5432; do sleep 1; done; echo "POSTGRESQL STARTED"'
-ExecStart=/usr/bin/timeout 90 sh -c 'while ! /usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "\l"; do sleep 1; done; echo "POSTGRESQL READY"'
+ExecStart=/usr/bin/timeout 90 bash -c 'while ! 3<> /dev/tcp/%%pg_client_server_domainname/5432; do sleep 1; done; echo "POSTGRESQL STARTED"'
+ExecStart=/usr/bin/timeout 90 bash -c 'while ! /usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "\l"; do sleep 1; done; echo "POSTGRESQL READY"'
diff --git a/seed/applicationservice/2022.03.08/postgresql/templates/ca_PostgreSQL.crt b/seed/applicationservice/2022.03.08/postgresql/templates/ca_PostgreSQL.crt
index 25cbe11a..4abf995f 100644
--- a/seed/applicationservice/2022.03.08/postgresql/templates/ca_PostgreSQL.crt
+++ b/seed/applicationservice/2022.03.08/postgresql/templates/ca_PostgreSQL.crt
@@ -1 +1 @@
-%%get_chain(authority_cn=%%domain_name_eth0, authority_name="PostgreSQL")
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="PostgreSQL", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.crt b/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.crt
index 9b858de1..a8c406b3 100644
--- a/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.crt
+++ b/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.crt
@@ -1 +1 @@
-%%get_certificate(%%domain_name_eth0, 'PostgreSQL')
+%%get_certificate(%%domain_name_eth0, 'PostgreSQL', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.key b/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.key
index 929a99b0..fe777130 100644
--- a/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.key
+++ b/seed/applicationservice/2022.03.08/postgresql/templates/postgresql.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, 'PostgreSQL')
+%%get_private_key(cn=%%domain_name_eth0, authority_name='PostgreSQL', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/10-machined.xml b/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/10-machined.xml
new file mode 100644
index 00000000..16d589e1
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/10-machined.xml
@@ -0,0 +1,7 @@
+
+
+
+
+
+
+
diff --git a/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/21-machined.xml b/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/16-machined.xml
similarity index 83%
rename from seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/21-machined.xml
rename to seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/16-machined.xml
index e4b6b724..0e131b94 100644
--- a/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/21-machined.xml
+++ b/seed/applicationservice/2022.03.08/provider-systemd-machined/dictionaries/16-machined.xml
@@ -9,26 +9,28 @@
+
/var/lib/risotto/srv
+
/var/lib/risotto/configurations
+
/var/lib/risotto/journals
-
-
-
-
-
+
False
-
- host
-
+
+
+
+ host
+
+
diff --git a/seed/applicationservice/2022.03.08/provider-systemd-machined/extras/machine/11_systemd.xml b/seed/applicationservice/2022.03.08/provider-systemd-machined/extras/machine/11_systemd.xml
new file mode 100644
index 00000000..44514c6c
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/provider-systemd-machined/extras/machine/11_systemd.xml
@@ -0,0 +1,13 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/seed/applicationservice/2022.03.08/redis-client/templates/ca_Redis.crt b/seed/applicationservice/2022.03.08/redis-client/templates/ca_Redis.crt
index 2dac58eb..39aadb9b 100644
--- a/seed/applicationservice/2022.03.08/redis-client/templates/ca_Redis.crt
+++ b/seed/applicationservice/2022.03.08/redis-client/templates/ca_Redis.crt
@@ -1 +1 @@
-%%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis")
+%%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/redis-client/templates/redis.crt b/seed/applicationservice/2022.03.08/redis-client/templates/redis.crt
index d135a14b..cb3ea89f 100644
--- a/seed/applicationservice/2022.03.08/redis-client/templates/redis.crt
+++ b/seed/applicationservice/2022.03.08/redis-client/templates/redis.crt
@@ -1 +1 @@
-%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
+%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/redis-client/templates/redis.key b/seed/applicationservice/2022.03.08/redis-client/templates/redis.key
index 672f29f9..af63fbc5 100644
--- a/seed/applicationservice/2022.03.08/redis-client/templates/redis.key
+++ b/seed/applicationservice/2022.03.08/redis-client/templates/redis.key
@@ -1 +1 @@
-%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/redis-client/templates/redis.pem b/seed/applicationservice/2022.03.08/redis-client/templates/redis.pem
index 00f8956d..618f1e99 100644
--- a/seed/applicationservice/2022.03.08/redis-client/templates/redis.pem
+++ b/seed/applicationservice/2022.03.08/redis-client/templates/redis.pem
@@ -1,5 +1,5 @@
-%set %%ca_chain = %%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis")
-%set %%cert = %%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
-%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client")
+%set %%ca_chain = %%get_chain(authority_cn=%%redis_client_server_domainname, authority_name="Redis", hide=%%hide_secret)
+%set %%cert = %%get_certificate(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client", hide=%%hide_secret)
+%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%redis_client_server_domainname, authority_name='Redis', type="client", hide=%%hide_secret)
%%cert
%%ca_chain
diff --git a/seed/applicationservice/2022.03.08/redis/extras/account/00_account.xml b/seed/applicationservice/2022.03.08/redis/extras/account/00_account.xml
index fad45fc9..3202ce19 100644
--- a/seed/applicationservice/2022.03.08/redis/extras/account/00_account.xml
+++ b/seed/applicationservice/2022.03.08/redis/extras/account/00_account.xml
@@ -3,7 +3,7 @@
-
+
@@ -11,6 +11,7 @@
account.remote
redis
cleartext
+ hide_secret
account.password
diff --git a/seed/applicationservice/2022.03.08/redis/templates/ca_Redis.crt b/seed/applicationservice/2022.03.08/redis/templates/ca_Redis.crt
index f9587634..bcf1212c 100644
--- a/seed/applicationservice/2022.03.08/redis/templates/ca_Redis.crt
+++ b/seed/applicationservice/2022.03.08/redis/templates/ca_Redis.crt
@@ -1 +1 @@
-%%get_chain(authority_cn=%%domain_name_eth0, authority_name="Redis")
+%%get_chain(authority_cn=%%domain_name_eth0, authority_name="Redis", hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/redis/templates/redis.crt b/seed/applicationservice/2022.03.08/redis/templates/redis.crt
index 93f26f88..48c6f25c 100644
--- a/seed/applicationservice/2022.03.08/redis/templates/redis.crt
+++ b/seed/applicationservice/2022.03.08/redis/templates/redis.crt
@@ -1 +1 @@
-%%get_certificate(%%domain_name_eth0, 'Redis')
+%%get_certificate(%%domain_name_eth0, 'Redis', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/redis/templates/redis.key b/seed/applicationservice/2022.03.08/redis/templates/redis.key
index 3e26e9c0..4865bc0c 100644
--- a/seed/applicationservice/2022.03.08/redis/templates/redis.key
+++ b/seed/applicationservice/2022.03.08/redis/templates/redis.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, 'Redis')
+%%get_private_key(cn=%%domain_name_eth0, authority_name='Redis', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/relay-mail-client/templates/ca_MailRelay.crt b/seed/applicationservice/2022.03.08/relay-mail-client/templates/ca_MailRelay.crt
index 8ffa12ca..e210e25e 100644
--- a/seed/applicationservice/2022.03.08/relay-mail-client/templates/ca_MailRelay.crt
+++ b/seed/applicationservice/2022.03.08/relay-mail-client/templates/ca_MailRelay.crt
@@ -1 +1 @@
-%%get_chain(%%smtp_relay_address, authority_name='MailRelay')
+%%get_chain(%%smtp_relay_address, authority_name='MailRelay', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/ca_InternalReverseProxy.crt b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/ca_InternalReverseProxy.crt
index 64f7daca..59b5b7a9 100644
--- a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/ca_InternalReverseProxy.crt
+++ b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/ca_InternalReverseProxy.crt
@@ -1 +1 @@
-%%get_chain(%%revprox_client_server_domainname, authority_name='InternalReverseProxy')
+%%get_chain(%%revprox_client_server_domainname, authority_name='InternalReverseProxy', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.crt b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.crt
index 4ea9946c..9a430003 100644
--- a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.crt
+++ b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.crt
@@ -1,2 +1,2 @@
-%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type="server")
-%%get_chain(%%revprox_client_server_domainname, 'InternalReverseProxy')
+%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type="server", hide=%%hide_secret)
+%%get_chain(%%revprox_client_server_domainname, 'InternalReverseProxy', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.key b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.key
index a02eba1e..56d50e1e 100644
--- a/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.key
+++ b/seed/applicationservice/2022.03.08/reverse-proxy-client/templates/revprox.key
@@ -1 +1 @@
-%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type='server')
+%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type='server', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml b/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
index 487cdbdb..1250b6c3 100644
--- a/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
+++ b/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
@@ -4,7 +4,7 @@
/etc/roundcubemail/config.inc.php
/etc/nginx/default.d/roundcubemail.conf
- /etc/roundcubemail/courriel.cloud.silique.fr.inc.php
+ roundcube_config
/secrets/roundcube-init.php
/static/silique_cloud.svg
/static/watermark.html
@@ -13,7 +13,13 @@
-
+
+
+
+
+
+
+
@@ -31,7 +37,9 @@
silique_email.png
-
+
+
+
@@ -40,6 +48,12 @@
/
+
+
+
+
+
+
@@ -48,7 +62,24 @@
roundcube
des_key
cleartext
+ hide_secret
roundcube_des_key
+
+ /etc/roundcubemail/
+ roundcube_domains
+ .inc.php
+
+ True
+ roundcube_config
+
+
+ roundcube_domains
+ revprox_client_external_domainnames
+
+
+ roundcube_family
+ ldapclient_family
+
diff --git a/seed/applicationservice/2022.03.08/roundcube/funcs/roundcube.py b/seed/applicationservice/2022.03.08/roundcube/funcs/roundcube.py
new file mode 100644
index 00000000..9d99bfa3
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/roundcube/funcs/roundcube.py
@@ -0,0 +1,10 @@
+def calc_roundcube_family(families):
+ if not families:
+ return
+ uniq_fam = set(families)
+ if len(set(families)) > 1:
+ return 'all'
+ if not uniq_fam[0]:
+ return
+ return uniq_fam[0]
+
diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/ca_MailServer.crt b/seed/applicationservice/2022.03.08/roundcube/templates/ca_MailServer.crt
index b379d100..ab69613a 100644
--- a/seed/applicationservice/2022.03.08/roundcube/templates/ca_MailServer.crt
+++ b/seed/applicationservice/2022.03.08/roundcube/templates/ca_MailServer.crt
@@ -1 +1 @@
-%%get_chain(%%imap_address, 'MailServer')
+%%get_chain(%%imap_address, 'MailServer', hide=%%hide_secret)
diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
index c80512aa..9fc53716 100644
--- a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
+++ b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
@@ -763,7 +763,10 @@ $config['useragent'] = null;
// try to load host-specific configuration
// see https://github.com/roundcube/roundcubemail/wiki/Configuration:-Multi-Domain-Setup
// for more details
-$config['include_host_config'] = array("%%revprox_client_external_domainname" => "%%{revprox_client_external_domainname}.inc.php"
+$config['include_host_config'] = array(
+%for %%domain in %%roundcube_domains
+ "%%domain" => "%%{domain}.inc.php",
+%end for
);
// path to a text file which will be added to each sent message
diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php b/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php
index 1e0bd579..a3692a7f 100644
--- a/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php
+++ b/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php
@@ -1,5 +1,9 @@
GNUNUX
+%set %%domain = %%roundcube_domains[%%rougail_index]
+$config['login_username_filter'] = '/^[a-z0-9_]+@%%{domain.roundcube_mail_domain}$/';
+%set %%family = %%domain.roundcube_family
+%if %%family
$config['ldap_public'] = array (
'Local' => array (
'name' => "Ma famille",
@@ -9,12 +13,12 @@ $config['ldap_public'] = array (
'port' => 636,
'use_tls' => false,
'bind_user' => '',
- 'bind_dn' => '%%ldapclient_remote_user',
- 'bind_pass' => '%%ldapclient_remote_user_password',
+ 'bind_dn' => '%%ldapclient_user',
+ 'bind_pass' => '%%ldapclient_user_password',
'auth_method' => '',
'vlv' => false, //Samba do not support Virtual List View functions
'user_specific' => false,
- 'base_dn' => 'ou=%%ldapclient_family,ou=families,%%ldap_base_dn',
+ 'base_dn' => '%%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=%%family)',
'writable' => false,
'required_fields' => array (
0 => 'cn',
@@ -45,5 +49,6 @@ $config['ldap_public'] = array (
),
),
);
+%end if
#
diff --git a/seed/applicationservice/2022.03.08/server/extras/accounts/00_accounts.xml b/seed/applicationservice/2022.03.08/server/extras/accounts/00_accounts.xml
index 9b7670bc..7f8a1f01 100644
--- a/seed/applicationservice/2022.03.08/server/extras/accounts/00_accounts.xml
+++ b/seed/applicationservice/2022.03.08/server/extras/accounts/00_accounts.xml
@@ -3,7 +3,7 @@
-
+
@@ -13,6 +13,7 @@
remote
cleartext
+ hide_secret
accounts.remote_.password_
diff --git a/seed/applicationservice/2022.03.08/systemd/dictionaries/00-systemd.xml b/seed/applicationservice/2022.03.08/systemd/dictionaries/15-systemd.xml
similarity index 78%
rename from seed/applicationservice/2022.03.08/systemd/dictionaries/00-systemd.xml
rename to seed/applicationservice/2022.03.08/systemd/dictionaries/15-systemd.xml
index 1971317c..6819b861 100644
--- a/seed/applicationservice/2022.03.08/systemd/dictionaries/00-systemd.xml
+++ b/seed/applicationservice/2022.03.08/systemd/dictionaries/15-systemd.xml
@@ -31,14 +31,16 @@
-
-
- zone_name
-
-
-
-
-
+
+
+
+
+
+
+ zone_name
+ host
+ zone_name
+
@@ -48,6 +50,7 @@
local connection
cleartext
True
+ hide_secret
root_password
diff --git a/seed/applicationservice/2022.03.08/unbound/dictionaries/20_unbound.xml b/seed/applicationservice/2022.03.08/unbound/dictionaries/20_unbound.xml
index 26dd7f41..5459f621 100644
--- a/seed/applicationservice/2022.03.08/unbound/dictionaries/20_unbound.xml
+++ b/seed/applicationservice/2022.03.08/unbound/dictionaries/20_unbound.xml
@@ -16,7 +16,7 @@
-
+
diff --git a/seed/applicationservice/2022.03.08/unbound/templates/risotto.conf b/seed/applicationservice/2022.03.08/unbound/templates/risotto.conf
index c488c411..9032e980 100644
--- a/seed/applicationservice/2022.03.08/unbound/templates/risotto.conf
+++ b/seed/applicationservice/2022.03.08/unbound/templates/risotto.conf
@@ -1,11 +1,11 @@
server:
-%for %%interface in %%interfaces_list
+%for %%interface in %%range(%%len(%%zones_list))
interface: %%getVar('ip_eth' + %%str(%%interface))
%end for
do-ip4: yes
do-ip6: no
use-syslog: yes
-%for %%interface in %%interfaces_list
+%for %%interface in %%range(%%len(%%zones_list))
access-control: %%getVar('ip_eth' + %%str(%%interface)) allow
%end for
%for %%allowed in %%unbound_allowed_client
diff --git a/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml b/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml
index 9a9b7e44..3bf7973b 100644
--- a/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml
+++ b/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml
@@ -22,12 +22,12 @@
-
+
risotto
-
-
+
+
20
@@ -48,6 +48,7 @@
vaultwarden
cleartext
vaultwarden_admin_password
+ hide_secret
vaultwarden_device_identifier
diff --git a/seed/applicationservice/2022.03.08/vaultwarden/templates/vaultwarden_config.env b/seed/applicationservice/2022.03.08/vaultwarden/templates/vaultwarden_config.env
index f90aa81e..e87abe1c 100644
--- a/seed/applicationservice/2022.03.08/vaultwarden/templates/vaultwarden_config.env
+++ b/seed/applicationservice/2022.03.08/vaultwarden/templates/vaultwarden_config.env
@@ -308,6 +308,7 @@ DOMAIN=https://%%revprox_client_external_domainname%%location
# ROCKET_WORKERS=10
# ROCKET_TLS={certs="/path/to/certs.pem",key="/path/to/key.pem"}
#>GNUNUX
+ROCKET_ADDRESS=0.0.0.0
ROCKET_PORT=443
ROCKET_TLS='{certs="/etc/pki/tls/certs/revprox.crt",key="/etc/pki/tls/private/revprox.key"}'
#