diff --git a/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml b/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml index 62fb7c5d..0b6dcf80 100644 --- a/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml +++ b/seed/applicationservice/2022.03.08/apache/dictionaries/20_web.xml @@ -2,6 +2,7 @@ + /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt /etc/httpd/conf/httpd.conf /etc/httpd/conf.d/risotto.conf /etc/httpd/conf.d/ssl.conf @@ -13,9 +14,11 @@ - - apache - + + + apache + + 300 diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_host b/seed/applicationservice/2022.03.08/base/manual/install/install_host index 68faef08..03ab9aa1 100755 --- a/seed/applicationservice/2022.03.08/base/manual/install/install_host +++ b/seed/applicationservice/2022.03.08/base/manual/install/install_host @@ -1,4 +1,4 @@ -#!/bin/bash -xe +#!/bin/bash -e HOST_NAME=$1 if [ -z "$HOST_NAME" ]; then @@ -24,4 +24,6 @@ systemctl restart systemd-resolved #nft 'add rule nat postrouting ip saddr 192.168.45.10 oif enp0s8 tcp dport 53 snat to 10.0.3.15' #nft 'add rule nat postrouting ip saddr 192.168.45.10 oif enp0s8 udp dport 53 snat to 10.0.3.15' +echo "install host OK" + exit 0 diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_image b/seed/applicationservice/2022.03.08/base/manual/install/install_image index 36a3b5db..b412782c 100755 --- a/seed/applicationservice/2022.03.08/base/manual/install/install_image +++ b/seed/applicationservice/2022.03.08/base/manual/install/install_image @@ -1,4 +1,4 @@ -#!/bin/bash -xe +#!/bin/bash -e HOST_NAME=$1 IMAGE_NAME=$2 @@ -14,7 +14,7 @@ rm -rf "$IMAGE_NAME_RISOTTO_IMAGE_DIR" tmp mkdir -p "$RISOTTO_IMAGE_DIR" PKG="" BASE_DIR="" -for script in $(ls $IMAGE_NAME/preinstall/*.sh 2> /dev/null); do +for script in $(ls $IMAGE_NAME/manual/preinstall/*.sh 2> /dev/null); do . "$script" done @@ -46,7 +46,7 @@ function new_package_base() { OPT=$(dnf_opt "$BASE_DIR" "$BASE_PKG") dnf --assumeno $OPT | grep ^" " > "$BASE_PKGS_FILE".new else - debootstrap --include="$BASE_PKG" --variant=minbase "$RELEASEVER" "$BASE_DIR" + debootstrap --include="$BASE_PKG" --variant=minbase "$RELEASEVER" "$BASE_DIR" > /dev/null chroot "$BASE_DIR" dpkg-query -f '${binary:Package} ${source:Version}\n' -W > "$BASE_PKGS_FILE".new fi } @@ -75,6 +75,7 @@ function install_pkg() { if [ ! -f "$BASE_LOCK" ]; then + echo " - reinstallation de l'image de base" rm -rf "$BASE_DIR" new_package_base diff -u "$BASE_PKGS_FILE" "$BASE_PKGS_FILE".new && NEW_BASE=false || NEW_BASE=true @@ -83,7 +84,7 @@ if [ ! -f "$BASE_LOCK" ]; then install_base cd "$IMAGE_BASE_RISOTTO_BASE_DIR" tar cf "$BASE_TAR" "$BASE_NAME" - cd - + cd - > /dev/null if [ -f "$BASE_PKGS_FILE" ]; then mv "$BASE_PKGS_FILE" "$BASE_PKGS_FILE".old fi @@ -100,8 +101,8 @@ if [ -n "$COPR" ]; then #FIXME signature... mkdir -p "$REPO_DIR" cd "$REPO_DIR" - wget "$COPR" - cd - + wget -q "$COPR" + cd - > /dev/null fi if [ "$FUSION" = true ]; then dnf -y install "https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$RELEASEVER.noarch.rpm" --installroot="$IMAGE_NAME_RISOTTO_IMAGE_DIR" @@ -109,19 +110,24 @@ fi # FIXME verifier s'il y a des modifs sur pre/post if [ -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR".base.pkgs ] && [ -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR".pkgs ]; then - echo "Différence(s) avec les paquets de base" + echo " - différence(s) avec les paquets de base" diff -u "$IMAGE_NAME_RISOTTO_IMAGE_DIR".base.pkgs "$BASE_PKGS_FILE" && NEW_BASE=false || NEW_BASE=true else NEW_BASE=true fi new_package if [ "$NEW_BASE" = false ]; then - echo "Différence(s) avec les paquets de l'image" + echo " - différence(s) avec les paquets de l'image" diff -u "$IMAGE_NAME_RISOTTO_IMAGE_DIR".pkgs "$IMAGE_NAME_RISOTTO_IMAGE_DIR".pkgs.new && INSTALL=false || INSTALL=true else INSTALL=true fi +find $IMAGE_NAME/manual -type f -exec md5sum '{}' \; > "$IMAGE_NAME_RISOTTO_IMAGE_DIR".md5sum.new +if [ "$NEW_BASE" = false ]; then + diff -u "$IMAGE_NAME_RISOTTO_IMAGE_DIR".md5sum "$IMAGE_NAME_RISOTTO_IMAGE_DIR".md5sum.new && INSTALL=false || INSTALL=true +fi if [ "$INSTALL" = true ]; then + echo " - installation" if [ -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR"_"$RELEASEVER".version ]; then VERSION=$(cat "$IMAGE_NAME_RISOTTO_IMAGE_DIR"_"$RELEASEVER".version) else @@ -145,7 +151,7 @@ if [ "$INSTALL" = true ]; then install_pkg sleep 2 - for script in $(ls $IMAGE_NAME/postinstall/*.sh 2> /dev/null); do + for script in $(ls $IMAGE_NAME/manual/postinstall/*.sh 2> /dev/null); do . "$script" done @@ -161,11 +167,13 @@ if [ "$INSTALL" = true ]; then fi tar cf "$IMAGE_NAME_RISOTTO_IMAGE_NAME" "$IMAGE_NAME" sha256sum "$IMAGE_NAME_RISOTTO_IMAGE_NAME" > "$IMAGE_NAME_RISOTTO_IMAGE_NAME".sha - cd - + cd - > /dev/null cp -f "$BASE_PKGS_FILE" "$IMAGE_NAME_RISOTTO_IMAGE_DIR".base.pkgs mv -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR".pkgs.new "$IMAGE_NAME_RISOTTO_IMAGE_DIR".pkgs + mv -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR".md5sum.new "$IMAGE_NAME_RISOTTO_IMAGE_DIR".md5sum VERSION=$((VERSION + 1)) echo "$VERSION" > "$IMAGE_NAME_RISOTTO_IMAGE_DIR"_"$RELEASEVER".version fi rm -rf "$IMAGE_NAME_RISOTTO_IMAGE_DIR" +echo " => OK" exit 0 diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_images b/seed/applicationservice/2022.03.08/base/manual/install/install_images index 31df9cdf..c9f5f2db 100755 --- a/seed/applicationservice/2022.03.08/base/manual/install/install_images +++ b/seed/applicationservice/2022.03.08/base/manual/install/install_images @@ -1,4 +1,4 @@ -#!/bin/bash -xe +#!/bin/bash -e HOST_NAME=$1 if [ -z "$HOST_NAME" ]; then echo "usage: $0 host name" @@ -8,6 +8,8 @@ fi rm -f $IMAGE_BASE_RISOTTO_BASE_DIR*.build for image in *; do if [ -d "$image" ]; then + echo + echo "Install image $image" ./install_image "$HOST_NAME" "$image" fi done diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_machine b/seed/applicationservice/2022.03.08/base/manual/install/install_machine index ca04cf4f..d6aec7b6 100755 --- a/seed/applicationservice/2022.03.08/base/manual/install/install_machine +++ b/seed/applicationservice/2022.03.08/base/manual/install/install_machine @@ -1,4 +1,4 @@ -#!/bin/bash -xe +#!/bin/bash -e HOST_NAME=$1 IMAGE_NAME=$2 MACHINE=$3 @@ -26,19 +26,19 @@ if [ -L "$MACHINE_MACHINES_DIR" ] || [ -d "$MACHINE_MACHINES_DIR" ]; then diff -q --no-dereference -Nru "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" || NEW_CONF=true fi if [ "$NEW_IMAGE" = true ] || [ "$NEW_CONF" = true ]; then + echo " - stop $IMAGE_NAME" machinectl stop "$MACHINE" 2> /dev/null || true while true; do machinectl status "$MACHINE" > /dev/null 2>&1 || break sleep 1 - echo "retry..." done fi if [ "$NEW_IMAGE" = true ]; then - echo "SUPPRIME ANCIENNE IMAGE" + echo " - delete old image" rm -rf "$MACHINE_MACHINES_DIR" fi if [ "$NEW_CONF" = true ]; then - echo "SUPPRIME ANCIENNE CONF" + echo " - delete old settings" ./diff.py "$MACHINE" "$MACHINE_RISOTTO_CONFIG_DIR" "$MACHINE_RISOTTO_CONFIG_DIR_LOCAL" > "$MACHINE_RISOTTO_CONFIG_DIR"_changelog.md rm -rf "$MACHINE_RISOTTO_CONFIG_DIR" fi @@ -58,7 +58,8 @@ if [ ! -d "$MACHINE_MACHINES_DIR" ]; then mkdir -p "$SHA_MACHINE_DIR" cp -a "$IMAGE_NAME_RISOTTO_IMAGE_NAME".sha "$SHA_MACHINE" mv "$IMAGE_NAME" "$MACHINE_MACHINES_DIR" - cd - + cd - > /dev/null fi +echo " => OK" exit 0 diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_machines b/seed/applicationservice/2022.03.08/base/manual/install/install_machines index 70e5f0dd..f053a5f4 100755 --- a/seed/applicationservice/2022.03.08/base/manual/install/install_machines +++ b/seed/applicationservice/2022.03.08/base/manual/install/install_machines @@ -1,4 +1,4 @@ -#!/bin/bash -xe +#!/bin/bash -e HOST_NAME=$1 if [ -z "$HOST_NAME" ]; then echo "usage: $0 host name" @@ -14,6 +14,8 @@ for image in *; do if [ -f "host/configurations/$HOST_NAME/etc/systemd/nspawn/$osname.nspawn" ]; then MACHINES="$MACHINES$osname " fi + echo + echo "Install machine $image" ./install_machine "$HOST_NAME" "$image" "$osname" fi done diff --git a/seed/applicationservice/2022.03.08/dovecot/applicationservice.yml b/seed/applicationservice/2022.03.08/dovecot/applicationservice.yml index 3482af25..61f85e88 100644 --- a/seed/applicationservice/2022.03.08/dovecot/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/dovecot/applicationservice.yml @@ -5,4 +5,4 @@ depends: - relay-mail-client - ldap-client-fedora - oauth2-client - - nginx-common + - nginx-https diff --git a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml index 9a4717e2..61ea6f29 100644 --- a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml +++ b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml @@ -7,7 +7,6 @@ /tmpfiles.d/0postfix.conf /etc/postfix/main.cf /etc/postfix/master.cf - /etc/postfix/ldapsource.cf /etc/postfix/relay_passwd /etc/pki/ca-trust/source/anchors/ca_MailServer.crt /etc/pki/tls/certs/postfix.crt @@ -22,9 +21,6 @@ well_known_filenames - revprox_ca_file - revprox_cert_file - revprox_key_file /sysusers.d/1dovecot.conf @@ -69,7 +65,7 @@ - @@ -88,11 +84,11 @@ - - @@ -115,24 +111,6 @@ domain_name_eth0 mail_domains - - tls_ca_directory - ca_InternalReverseProxy.crt - / - revprox_ca_file - - - tls_cert_directory - revprox.crt - / - revprox_cert_file - - - tls_key_directory - revprox.key - / - revprox_key_file - /etc/pki/tls/certs/imap_ imap_domainname @@ -159,7 +137,6 @@ mail_domains - True mail_domains_calc @@ -172,7 +149,7 @@ well_known_filenames - revprox_server_domainname + revprox_client_server_domainname revprox_clients revprox_location /.well-known/autoconfig/mail/config-v1.1.xml @@ -183,7 +160,7 @@ mail_domains_calc - revprox_server_domainname + revprox_client_server_domainname revprox_clients revprox_location /autodiscover/autodiscover.xml diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/10-mail.conf b/seed/applicationservice/2022.03.08/dovecot/templates/10-mail.conf index a6dcb173..8edb816b 100644 --- a/seed/applicationservice/2022.03.08/dovecot/templates/10-mail.conf +++ b/seed/applicationservice/2022.03.08/dovecot/templates/10-mail.conf @@ -28,7 +28,7 @@ # # #>GNUNUX -mail_location = maildir:/srv/mail/%u +mail_location = maildir:~/ # -#mail_uid = -#mail_gid = +mail_uid = vmail +mail_gid = vmail # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/auth-ldap.conf.ext b/seed/applicationservice/2022.03.08/dovecot/templates/auth-ldap.conf.ext index 1b459c0f..2db1a3cb 100644 --- a/seed/applicationservice/2022.03.08/dovecot/templates/auth-ldap.conf.ext +++ b/seed/applicationservice/2022.03.08/dovecot/templates/auth-ldap.conf.ext @@ -16,13 +16,14 @@ passdb { # driver = prefetch #} -# GNUNUX userdb { -# GNUNUX driver = ldap -# GNUNUX args = /etc/dovecot/dovecot-ldap.conf.ext -# GNUNUX -# GNUNUX # Default fields can be used to specify defaults that LDAP may override -# GNUNUX #default_fields = home=/home/virtual/%u -# GNUNUX } +userdb { + driver = ldap +# GNUNUX args = /etc/dovecot/dovecot-ldap.conf.ext + args = /etc/dovecot/dovecot-ldap.conf.ext + + # Default fields can be used to specify defaults that LDAP may override + #default_fields = home=/home/virtual/%u +} # If you don't have any user-specific settings, you can avoid the userdb LDAP # lookup by using userdb static instead of userdb ldap, for example: @@ -31,9 +32,3 @@ passdb { #driver = static #args = uid=vmail gid=vmail home=/var/vmail/%u #} -#>GNUNUX -userdb { - driver = static - args = uid=vmail gid=vmail home=/srv/mail/%u -} -#GNUNUX auth_bind = yes -auth_bind_userdn = cn=%u,ou=users,%%ldap_base_dn +auth_bind_userdn = cn=%u,%%ldapclient_base_dn #GNUNUX +user_attrs = homeDirectory=home +# + /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt /sysusers.d/0gitea.conf /tmpfiles.d/0gitea.conf /etc/gitea/app.ini diff --git a/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml b/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml index 1972067c..cf7751b2 100644 --- a/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml +++ b/seed/applicationservice/2022.03.08/ldap-client/dictionaries/21_ldap-client.xml @@ -12,9 +12,11 @@ + diff --git a/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py b/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py index 1e606da9..43efc52e 100644 --- a/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py +++ b/seed/applicationservice/2022.03.08/ldap-client/funcs/openldap_client.py @@ -4,3 +4,11 @@ def valid_base_dn(base_dn: str) -> None: break else: raise ValueError('La racine doit débuter par une organisation (o=), une composante du domaine (dc=) ou une unité organisationnelle (ou=)') + + +def calc_ldapclient_base_dn(ldap_base_dn: str, + family_name: str, + ) -> str: + if not family_name: + return f'ou=users,{ldap_base_dn}' + return f'ou={family_name},ou=families,{ldap_base_dn}' diff --git a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf index 907b9751..0b20b64b 100644 --- a/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf +++ b/seed/applicationservice/2022.03.08/ldap-client/templates/ldap.conf @@ -6,7 +6,7 @@ # This file should be world readable but not world writable. #BASE dc=example,dc=com -BASE ou=users,%%ldap_base_dn +BASE %%ldapclient_base_dn #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 URI ldaps://%%ldap_server_address:%%ldap_port diff --git a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json index 03bd7d8c..3410a9f4 100644 --- a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json +++ b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json @@ -13,13 +13,14 @@ commentStartToken = § "ldapPpolicyControl" : 1, "ldapAllowResetExpiredPassword" : 1, "ldapChangePasswordAsUser" : 1, - "ldapBase" : "ou=users,%%ldap_base_dn", + "ldapBase" : "%%ldapclient_base_dn", "ldapExportedVars" : { "uid" : "uid", "cn" : "cn", "sn" : "sn", "mail" : "mail", - "givenName" : "givenName" + "givenName" : "givenName", + "home" : "homeDirectory" }, "ldapGroupAttributeName" : "memberUid", "ldapGroupAttributeNameUser" : "cn", @@ -99,7 +100,8 @@ commentStartToken = § "email" : "mail", "family_name" : "sn", "name" : "cn", - "nickname" : "uid" + "nickname" : "uid", + "home" : "home" %if %%len_app - 1 == %%idx } %else diff --git a/seed/applicationservice/2022.03.08/mailman/manual/image/postinstall/postorius.sh b/seed/applicationservice/2022.03.08/mailman/manual/image/postinstall/postorius.sh index 41d27a0a..9e99d579 100644 --- a/seed/applicationservice/2022.03.08/mailman/manual/image/postinstall/postorius.sh +++ b/seed/applicationservice/2022.03.08/mailman/manual/image/postinstall/postorius.sh @@ -1,7 +1,7 @@ PYTHON="usr/lib/python3.10/site-packages" -cp -a "mailman/postinstall/lemonldap" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/$PYTHON/allauth/socialaccount/providers/" -cp -a "mailman/postinstall/risotto" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/$PYTHON/allauth/socialaccount/providers/" -cp -a "mailman/postinstall/postorius" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/share/postorius" +cp -a "mailman/manual/postinstall/lemonldap" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/$PYTHON/allauth/socialaccount/providers/" +cp -a "mailman/manual/postinstall/risotto" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/$PYTHON/allauth/socialaccount/providers/" +cp -a "mailman/manual/postinstall/postorius" "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/share/postorius" chmod +x "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/share/postorius/manage.py" ln -s /etc/mailman3.d/postorius.py "$IMAGE_NAME_RISOTTO_IMAGE_DIR/usr/share/postorius/m_postorius/settings_local.py" ln -s ../../django_mailman3/static/django-mailman3 "$IMAGE_NAME_RISOTTO_IMAGE_DIR/$PYTHON/postorius/static/" diff --git a/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init b/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init index 5d6e74f5..3279d880 100644 --- a/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init +++ b/seed/applicationservice/2022.03.08/nextcloud/templates/nextcloud.init @@ -29,9 +29,9 @@ fi /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapPort "%%ldap_port" /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentName "%%ldapclient_remote_user" /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapAgentPassword "%%ldapclient_remote_user_password" -/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBase "ou=users,%%ldap_base_dn" -/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseUsers "ou=users,%%ldap_base_dn" -/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseGroups "ou=users,%%ldap_base_dn" +/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBase "%%ldapclient_base_dn" +/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseUsers "%%ldapclient_base_dn" +/usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapBaseGroups "%%ldapclient_base_dn" /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapExperiencedAdmin "0" /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapExpertUUIDUserAttr "cn" /usr/bin/php /usr/share/nextcloud/occ ldap:set-config s01 ldapLoginFilter "(&(cn=%uid)(ObjectClass=inetOrgPerson))" diff --git a/seed/applicationservice/2022.03.08/nginx-common/dictionaries/20_nginx.xml b/seed/applicationservice/2022.03.08/nginx-common/dictionaries/20_nginx.xml index 4230d192..70bab6ec 100644 --- a/seed/applicationservice/2022.03.08/nginx-common/dictionaries/20_nginx.xml +++ b/seed/applicationservice/2022.03.08/nginx-common/dictionaries/20_nginx.xml @@ -4,18 +4,26 @@ /etc/nginx/nginx.conf /etc/nginx/sites-available/default - /etc/nginx/default.d/risotto.conf - + /etc/nginx/default.d/default.conf /var/www/html/index.html /etc/nginx/conf.d/options.conf /var/www/html/error.html /sysusers.d/nginx.conf /tmpfiles.d/nginx.conf + revprox_ca_file + /etc/pki/tls/certs/nginx.crt + /etc/pki/tls/private/nginx.key - + + + /usr/share/nginx/html + + 128 128 @@ -25,13 +33,10 @@ 32 + - - domain_name_eth0 - nginx_default - Fedora nginx_fedora @@ -40,5 +45,15 @@ nginx_default + + False + nginx_https + + + tls_ca_directory + ca_InternalReverseProxy.crt + / + revprox_ca_file + diff --git a/seed/applicationservice/2022.03.08/nginx-common/templates/default-nginx-ssl.conf b/seed/applicationservice/2022.03.08/nginx-common/templates/default-nginx-ssl.conf deleted file mode 100644 index 44597472..00000000 --- a/seed/applicationservice/2022.03.08/nginx-common/templates/default-nginx-ssl.conf +++ /dev/null @@ -1,10 +0,0 @@ -#FIXME server { -#FIXME listen 443 ssl; -#FIXME ssl_certificate %%nginx_certificate[%%revprox_domainnames_all.index(%%nginx_default)]; -#FIXME ssl_certificate_key %%nginx_private_key[%%revprox_domainnames_all.index(%%nginx_default)]; -#FIXME ssl_client_certificate /etc/ssl/certs/ca.crt; -#FIXME server_name _ default; -#FIXME rewrite ^(.*) https://%%nginx_default$1; -#FIXME break; -#FIXME } - diff --git a/seed/applicationservice/2022.03.08/nginx-common/templates/nginx.conf b/seed/applicationservice/2022.03.08/nginx-common/templates/nginx.conf index 05531f0d..9d4ecd95 100644 --- a/seed/applicationservice/2022.03.08/nginx-common/templates/nginx.conf +++ b/seed/applicationservice/2022.03.08/nginx-common/templates/nginx.conf @@ -52,11 +52,12 @@ http { # for more information. include /etc/nginx/conf.d/*.conf; %if %%os_name == 'Fedora' + %if %%nginx_default server { listen 80; listen [::]:80; server_name _; - root /usr/share/nginx/html; + root %%nginx_root; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; @@ -69,35 +70,40 @@ http { location = /50x.html { } } + %end if +# Settings for a TLS enabled server. +# + %if %%nginx_https + server { + listen 443 ssl http2; + server_name %%domain_name_eth0; + root %%nginx_root; + + # ssl_certificate "/etc/pki/nginx/server.crt"; + # ssl_certificate_key "/etc/pki/nginx/private/server.key"; + ssl_certificate /etc/pki/tls/certs/nginx.crt; + ssl_certificate_key /etc/pki/tls/private/nginx.key; + ssl_client_certificate /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 10m; + ssl_ciphers PROFILE=SYSTEM; + ssl_prefer_server_ciphers on; + + # Load configuration files for the default server block. + include /etc/nginx/default.d/*.conf; + + error_page 404 /404.html; + location = /40x.html { + } + + error_page 500 502 503 504 /50x.html; + location = /50x.html { + } + } + %end if %else include /etc/nginx/sites-enabled/*; %end if -# Settings for a TLS enabled server. -# -# server { -# listen 443 ssl http2; -# listen [::]:443 ssl http2; -# server_name _; -# root /usr/share/nginx/html; -# -# ssl_certificate "/etc/pki/nginx/server.crt"; -# ssl_certificate_key "/etc/pki/nginx/private/server.key"; -# ssl_session_cache shared:SSL:1m; -# ssl_session_timeout 10m; -# ssl_ciphers PROFILE=SYSTEM; -# ssl_prefer_server_ciphers on; -# -# # Load configuration files for the default server block. -# include /etc/nginx/default.d/*.conf; -# -# error_page 404 /404.html; -# location = /40x.html { -# } -# -# error_page 500 502 503 504 /50x.html; -# location = /50x.html { -# } -# } - } diff --git a/seed/applicationservice/2022.03.08/nginx-https/applicationservice.yml b/seed/applicationservice/2022.03.08/nginx-https/applicationservice.yml index 076ecac6..f8097545 100644 --- a/seed/applicationservice/2022.03.08/nginx-https/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/nginx-https/applicationservice.yml @@ -2,3 +2,4 @@ format: '0.1' description: Nginx as reverse proxy depends: - nginx-common + - reverse-proxy-client diff --git a/seed/applicationservice/2022.03.08/nginx-https/dictionaries/25_nginx.xml b/seed/applicationservice/2022.03.08/nginx-https/dictionaries/25_nginx.xml index c34612cc..65ec9bb6 100644 --- a/seed/applicationservice/2022.03.08/nginx-https/dictionaries/25_nginx.xml +++ b/seed/applicationservice/2022.03.08/nginx-https/dictionaries/25_nginx.xml @@ -2,19 +2,38 @@ - /etc/nginx/conf.d/risotto.conf - /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt - /etc/pki/tls/certs/nginx.crt - /etc/pki/tls/private/nginx.key + /etc/nginx/default.d/risotto.conf - - - nginx - - - / - + + + True + + + nginx + + + + / + + + + + nginx + + + + + nginx + + + + + + nginx_default_risotto + nginx_locations + + diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/ca_InternalReverseProxy.crt b/seed/applicationservice/2022.03.08/nginx-https/templates/ca_InternalReverseProxy.crt deleted file mode 100644 index 55ee9059..00000000 --- a/seed/applicationservice/2022.03.08/nginx-https/templates/ca_InternalReverseProxy.crt +++ /dev/null @@ -1 +0,0 @@ -%%get_chain(authority_cn=%%domain_name_eth0, authority_name="InternalReverseProxy") diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt index 73d46b2b..4ea9946c 100644 --- a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt +++ b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.crt @@ -1 +1,2 @@ -%%get_certificate(cn=%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy') +%%get_certificate(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type="server") +%%get_chain(%%revprox_client_server_domainname, 'InternalReverseProxy') diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key index 9edabbb6..a02eba1e 100644 --- a/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key +++ b/seed/applicationservice/2022.03.08/nginx-https/templates/nginx.key @@ -1 +1 @@ -%%get_private_key(cn=%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy') +%%get_private_key(%%domain_name_eth0, authority_cn=%%revprox_client_server_domainname, authority_name='InternalReverseProxy', type='server') diff --git a/seed/applicationservice/2022.03.08/nginx-https/templates/risotto.conf b/seed/applicationservice/2022.03.08/nginx-https/templates/risotto.conf index cf541f89..e7d34a48 100644 --- a/seed/applicationservice/2022.03.08/nginx-https/templates/risotto.conf +++ b/seed/applicationservice/2022.03.08/nginx-https/templates/risotto.conf @@ -1,44 +1,30 @@ -server { - listen 443 default ssl; - server_name %%domain_name_eth0; - - ssl_certificate /etc/pki/tls/certs/nginx.crt; - ssl_certificate_key /etc/pki/tls/private/nginx.key; - ssl_client_certificate /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt; - - error_page 403 404 502 503 504 /error.html; - location = /error.html{ - root /var/www/html; - } - - add_header X-Frame-Options "SAMEORIGIN"; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Robots-Tag none; - add_header X-Download-Options noopen; - add_header X-Permitted-Cross-Domain-Policies none; - add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains;'; - add_header Referrer-Policy no-referrer always; +add_header X-Frame-Options "SAMEORIGIN"; +add_header X-Content-Type-Options nosniff; +add_header X-XSS-Protection "1; mode=block"; +add_header X-Robots-Tag none; +add_header X-Download-Options noopen; +add_header X-Permitted-Cross-Domain-Policies none; +add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains;'; +add_header Referrer-Policy no-referrer always; %for %%location in %%nginx_locations - location %%location { +location %%location { %if %%location == '/' - root %slurp + root %slurp %else - alias %slurp + alias %slurp %end if %%nginx_root_directory; %if not %%getVar('php_fpm_installed', False) - index index.html; + index index.html; %else - index index.php; - location ~ ^(?.+?\.php)(?/.*)?$ { - fastcgi_pass php-fpm; - fastcgi_index index.php; - fastcgi_param SCRIPT_FILENAME $request_filename; - include fastcgi_params; - } -%end if + index index.php; + location ~ ^(?.+?\.php)(?/.*)?$ { + fastcgi_pass php-fpm; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $request_filename; + include fastcgi_params; } -%end for +%end if } +%end for diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml index 93c8f95f..09f818b7 100644 --- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml +++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml @@ -5,7 +5,6 @@ /etc/nginx/conf.d/options-rp.conf /etc/nginx/conf.d/risotto.conf - /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt nginx_certificate_filename nginx_private_key_filename @@ -19,7 +18,7 @@ - + - - /roundcube/ + + /usr/share/roundcubemail/ + + / + + + + diff --git a/seed/applicationservice/2022.03.08/roundcube/manual/image/postinstall/roundcube.sh b/seed/applicationservice/2022.03.08/roundcube/manual/image/postinstall/roundcube.sh new file mode 100644 index 00000000..ea098519 --- /dev/null +++ b/seed/applicationservice/2022.03.08/roundcube/manual/image/postinstall/roundcube.sh @@ -0,0 +1,8 @@ +#!/bin/bash -ex + +echo """#!/bin/bash -e +/usr/bin/chgrp nginx /etc/roundcubemail/* +""" > "$IMAGE_NAME_RISOTTO_IMAGE_DIR/install.sh" +chmod +x "$IMAGE_NAME_RISOTTO_IMAGE_DIR/install.sh" +chroot "$IMAGE_NAME_RISOTTO_IMAGE_DIR" /install.sh +rm -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR/install.sh" diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php index d3d8ff82..5c7f05ba 100644 --- a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php +++ b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php @@ -1059,9 +1059,10 @@ $config['address_book_type'] = 'sql'; // Array key must contain only safe characters, ie. a-zA-Z0-9_ $config['ldap_public'] = []; #>GNUNUX +%if %%getVar('ldap_server_address', None) $config['ldap_public'] = array ( 'Local' => array ( - 'name' => "Contacts", + 'name' => "Ma famille", 'hosts' => array ( 0 => 'ldaps://%%ldap_server_address', ), @@ -1073,7 +1074,7 @@ $config['ldap_public'] = array ( 'auth_method' => '', 'vlv' => false, //Samba do not support Virtual List View functions 'user_specific' => false, - 'base_dn' => 'ou=users,%%ldap_base_dn', + 'base_dn' => 'ou=%%ldapclient_family,ou=families,%%ldap_base_dn', 'writable' => false, 'required_fields' => array ( 0 => 'cn', @@ -1104,6 +1105,7 @@ $config['ldap_public'] = array ( ), ), ); +%end if #GNUNUX -Alias /roundcube/skins/elastic/risotto/ /usr/local/lib/static/ - - Require all granted - -# - Require all granted -# GNUNUX -# GNUNUX # Apache 2.4 -# GNUNUX Require local -# GNUNUX -# GNUNUX -# GNUNUX # Apache 2.2 -# GNUNUX Order Deny,Allow -# GNUNUX Deny from all -# GNUNUX Allow from 127.0.0.1 -# GNUNUX Allow from ::1 -# GNUNUX - + location ~ ^/installer/(.+\.php)$ { + allow 127.0.0.1; + allow ::1; + deny all; -# Define who can access the installer -# keep this secured once configured + try_files $uri =404; + fastcgi_intercept_errors on; + include fastcgi_params; + fastcgi_param SERVER_NAME $host; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_pass php-fpm; + } - - Order Allow,Deny - Deny from all -# GNUNUX -# GNUNUX # Apache 2.4 -# GNUNUX Require local -# GNUNUX -# GNUNUX -# GNUNUX # Apache 2.2 -# GNUNUX Order Deny,Allow -# GNUNUX Deny from all -# GNUNUX Allow from 127.0.0.1 -# GNUNUX Allow from ::1 -# GNUNUX - + # Define who can access the Webmail + # You can enlarge permissions once configured -# Those directories should not be viewed by Web clients. - - Order Allow,Deny - Deny from all - - - Order Allow,Deny - Deny from all - + location ~ ^/(.+\.php)$ { +# GNUNUX allow 127.0.0.1; +# GNUNUX allow ::1; +# GNUNUX deny all; + + try_files $uri =404; + fastcgi_intercept_errors on; + include fastcgi_params; + fastcgi_param SERVER_NAME $host; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_pass php-fpm; + } +} + +location /skins/elastic/risotto { + alias /usr/local/lib/static/; +} diff --git a/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml b/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml index 849c935e..aa4e1ff7 100644 --- a/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml +++ b/seed/applicationservice/2022.03.08/vaultwarden/dictionaries/40_vaultwarden.xml @@ -3,6 +3,7 @@ + /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt /tmpfiles.d/0vaultwarden.conf /etc/vaultwarden/config.env