From e068298d3c6b7c191d79eebd0791c6221e4168bb Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 8 Jul 2022 10:25:53 +0200 Subject: [PATCH 01/12] backup with xz format --- seed/base-machine/manual/install/backup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/base-machine/manual/install/backup b/seed/base-machine/manual/install/backup index 14ebbf30..c31a8f4c 100755 --- a/seed/base-machine/manual/install/backup +++ b/seed/base-machine/manual/install/backup @@ -32,7 +32,7 @@ for machine in $MACHINES; do done BACKUP_FILE="$BACKUP_DIR/backup_$machine.tar.bz2" rm -f "$BACKUP_FILE" - tar -cvjf $BACKUP_FILE $machine + tar -cvJf $BACKUP_FILE $machine done if [ -z "$START" ]; then From 8941407f273a284df6841df4046f781e2f184edd Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 8 Jul 2022 10:27:35 +0200 Subject: [PATCH 02/12] test migration of ldap --- seed/dovecot/tests/test_imap.py | 2 +- seed/openldap/tests/test_openldap.py | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/seed/dovecot/tests/test_imap.py b/seed/dovecot/tests/test_imap.py index ba4a9b7e..6063348f 100644 --- a/seed/dovecot/tests/test_imap.py +++ b/seed/dovecot/tests/test_imap.py @@ -11,7 +11,7 @@ conf_file = f'{environ["MACHINE_TEST_DIR"]}/imap.yml' with open(conf_file) as yaml: data = load(yaml, Loader=SafeLoader) parameters = (('user', data['username'], data['password']), - ('family', data['username_family'], data['password_family']), + ('family', data['username_family'], data['password_family'] + "2"), ) diff --git a/seed/openldap/tests/test_openldap.py b/seed/openldap/tests/test_openldap.py index 62a89770..b5284cf6 100644 --- a/seed/openldap/tests/test_openldap.py +++ b/seed/openldap/tests/test_openldap.py @@ -23,7 +23,7 @@ def test_ldap_admin(): l.simple_bind_s(data['admin_dn'], data['admin_password']) assert l.search_s(data['base_account_dn'], SCOPE_SUBTREE,'(objectClass=inetOrgPerson)',['cn']) - + def test_ldap_accounts(): conf_file = f'{environ["MACHINE_TEST_DIR"]}/openldap.yml' @@ -70,13 +70,16 @@ def test_ldap_user(): l.simple_bind_s(data['user_dn'], data['user_password']) -def test_ldap_user_family(): +def test_ldap_migration(): conf_file = f'{environ["MACHINE_TEST_DIR"]}/openldap.yml' with open(conf_file) as yaml: data = load(yaml, Loader=SafeLoader) set_option(OPT_X_TLS_REQUIRE_CERT, OPT_X_TLS_NEVER) l = initialize(f'ldaps://{data["address"]}') - l.simple_bind_s(data['user_family_dn'], data['user_family_password']) + if 'FIRST_RUN' in environ: + l.simple_bind_s(data['admin_dn'], data['admin_password']) + l.passwd_s(data['user_family_dn'], data['user_family_password'], data['user_family_password'] + "2") + l.simple_bind_s(data['user_family_dn'], data['user_family_password'] + "2") def test_ldap_remote_auth(): From eff06d002279057117f34e8163bcedf5bfa8f7b5 Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 8 Jul 2022 10:27:53 +0200 Subject: [PATCH 03/12] mariadb in fedora 36 --- seed/mariadb/applicationservice.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/mariadb/applicationservice.yml b/seed/mariadb/applicationservice.yml index ed6250a8..5b07270d 100644 --- a/seed/mariadb/applicationservice.yml +++ b/seed/mariadb/applicationservice.yml @@ -2,5 +2,5 @@ format: '0.1' description: Mariadb depends: - server - - base-fedora-35 + - base-fedora-36 provider: MariaDB From ee2822e46f23ab6cade1c21f69b123a80cac3c3b Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 8 Jul 2022 10:28:00 +0200 Subject: [PATCH 04/12] ldap in fedora 36 --- seed/openldap/applicationservice.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/openldap/applicationservice.yml b/seed/openldap/applicationservice.yml index 1d656054..bc4841db 100644 --- a/seed/openldap/applicationservice.yml +++ b/seed/openldap/applicationservice.yml @@ -2,5 +2,5 @@ format: '0.1' description: OpenLDAP server depends: - ldap-client-fedora - - base-fedora-35 + - base-fedora-36 provider: LDAP From 1f6fddc7296b51a214948c47088f706713f1c881 Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Fri, 8 Jul 2022 13:23:01 +0200 Subject: [PATCH 05/12] redis in fedora 36 --- seed/redis/applicationservice.yml | 2 +- seed/redis/dictionaries/90_redis.xml | 1 + seed/redis/templates/redis.conf | 7 ++- seed/redis/templates/redis.yml | 3 ++ seed/redis/tests/test_redis.py | 68 ++++++++++++++++++++++++++++ 5 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 seed/redis/templates/redis.yml create mode 100644 seed/redis/tests/test_redis.py diff --git a/seed/redis/applicationservice.yml b/seed/redis/applicationservice.yml index d173f89b..b923a7e4 100644 --- a/seed/redis/applicationservice.yml +++ b/seed/redis/applicationservice.yml @@ -1,5 +1,5 @@ format: '0.1' description: Redis depends: - - base-fedora-35 + - base-fedora-36 provider: Redis diff --git a/seed/redis/dictionaries/90_redis.xml b/seed/redis/dictionaries/90_redis.xml index 43e9f074..dfd0b166 100644 --- a/seed/redis/dictionaries/90_redis.xml +++ b/seed/redis/dictionaries/90_redis.xml @@ -9,6 +9,7 @@ /etc/pki/ca-trust/source/anchors/ca_Redis.crt /etc/pki/tls/certs/redis.crt /etc/pki/tls/private/redis.key + /tests/redis.yml diff --git a/seed/redis/templates/redis.conf b/seed/redis/templates/redis.conf index 8448e98d..ece2dbdc 100644 --- a/seed/redis/templates/redis.conf +++ b/seed/redis/templates/redis.conf @@ -180,7 +180,9 @@ tcp-keepalive %%redis_tcp_keepalive # # tls-client-key-file-pass secret -# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange: +# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, +# required by older versions of OpenSSL (<3.0). Newer versions do not require +# this configuration and recommend against it. # # tls-dh-params-file redis.dh @@ -485,7 +487,10 @@ rdb-del-sync-files no # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. +#>GNUNUX +#dir /var/lib/redis dir /srv/redis +# Date: Sat, 16 Jul 2022 22:16:24 +0200 Subject: [PATCH 06/12] add gitea tests --- seed/dns-local/tests/mookdns.py | 44 ++++ seed/dovecot/templates/imap.yml | 4 +- seed/dovecot/tests/test_imap.py | 108 ++++++--- seed/gitea/DEBUG.md | 5 +- seed/gitea/dictionaries/31_gitea.xml | 1 + seed/gitea/templates/gitea.service | 2 +- seed/gitea/templates/gitea.yml | 9 + seed/gitea/tests/test_gitea.py | 226 ++++++++++++++++++ seed/lemonldap/templates/lmConf-1.json | 1 + .../nginx-reverse-proxy/tests/test_revprox.py | 11 +- seed/openldap/DEBUG.md | 6 +- seed/openldap/templates/openldap.yml | 19 +- seed/openldap/templates/users.ldif | 86 ++++--- seed/openldap/templates/users_mod.ldif | 42 ++-- seed/reverse-proxy-client/tests/revprox.py | 84 +++++++ 15 files changed, 547 insertions(+), 101 deletions(-) create mode 100644 seed/dns-local/tests/mookdns.py create mode 100644 seed/gitea/templates/gitea.yml create mode 100644 seed/gitea/tests/test_gitea.py create mode 100644 seed/reverse-proxy-client/tests/revprox.py diff --git a/seed/dns-local/tests/mookdns.py b/seed/dns-local/tests/mookdns.py new file mode 100644 index 00000000..8ab236f1 --- /dev/null +++ b/seed/dns-local/tests/mookdns.py @@ -0,0 +1,44 @@ +import socket +from shutil import copyfile, move +from os import remove +from os.path import isfile + + +class MookDns: + # Monkey patch to force IPv4 resolution + def __init__(self, ip): + self.ip = ip + + def __enter__(self): + self.old_getaddrinfo = socket.getaddrinfo + def new_getaddrinfo(*args, **kwargs): + ret = self.old_getaddrinfo(*args, **kwargs) + dns = list(ret[0]) + dns[-1] = (self.ip, dns[-1][1]) + return [dns] + socket.getaddrinfo = new_getaddrinfo + return self + + def __exit__(self, exc_type, exc, tb): + socket.getaddrinfo = self.old_getaddrinfo + + +class MookDnsSystem: + # Monkey patch to force IPv4 resolution + def __init__(self, dns, ip): + self.dns = dns + self.ip = ip + + def __enter__(self): + if not isfile('/etc/hosts.risotto'): + copyfile('/etc/hosts', '/etc/hosts.risotto') + with open('/etc/hosts.risotto', 'r') as risotto: + with open('/etc/hosts', 'w') as hosts: + for line in risotto.readlines(): + if self.dns not in line: + hosts.write(line) + hosts.write(f'{self.ip} {self.dns}') + + def __exit__(self, exc_type, exc, tb): + remove('/etc/hosts') + move('/etc/hosts.risotto', '/etc/hosts') diff --git a/seed/dovecot/templates/imap.yml b/seed/dovecot/templates/imap.yml index 1836ec5e..d5ef2bf4 100644 --- a/seed/dovecot/templates/imap.yml +++ b/seed/dovecot/templates/imap.yml @@ -4,7 +4,7 @@ address: %%ip_eth0 dns: %%domain_name_eth0 username: %%username -password: %%get_password(server_name=%%ldap_server_address, username=%%username, description="ldap user", type="cleartext", hide=%%hide_secret, temporary=True) +password: %%get_password(server_name='test', username=%%username, description="test", type="cleartext", hide=%%hide_secret, temporary=True) username_family: %%username_family -password_family: %%get_password(server_name=%%ldap_server_address, username=%%username_family, description="ldap family user", type="cleartext", hide=%%hide_secret, temporary=True) +password_family: %%get_password(server_name='test', username=%%username_family, description='test', type="cleartext", hide=%%hide_secret, temporary=True) name_family: %%name_family diff --git a/seed/dovecot/tests/test_imap.py b/seed/dovecot/tests/test_imap.py index 6063348f..9fb425b6 100644 --- a/seed/dovecot/tests/test_imap.py +++ b/seed/dovecot/tests/test_imap.py @@ -10,8 +10,8 @@ from smtplib import SMTP, SMTPNotSupportedError, SMTPAuthenticationError conf_file = f'{environ["MACHINE_TEST_DIR"]}/imap.yml' with open(conf_file) as yaml: data = load(yaml, Loader=SafeLoader) -parameters = (('user', data['username'], data['password']), - ('family', data['username_family'], data['password_family'] + "2"), +parameters = (('user', data['username'], [data['password']]), + ('family', data['username_family'], [data['password_family'], data['password_family'] + "2"]), ) @@ -19,8 +19,8 @@ def get_msg(username, msg='MESSAGE'): return f'From: {username}\r\nTo: {username}\r\n\r\nSubject: TEST\r\n{msg}\r\n' -@pytest.mark.parametrize('typ, username, password', parameters) -def test_imap_wrong_password(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_imap_wrong_password(typ, username, passwords): imap = IMAP4_SSL(data['address']) try: imap.LOGIN(username, 'b') @@ -30,17 +30,33 @@ def test_imap_wrong_password(typ, username, password): raise Exception('wrong login !') -@pytest.mark.parametrize('typ, username, password', parameters) -def test_imap_migration(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_imap_migration(typ, username, passwords): msg = get_msg(username, 'MIGRATION') if 'FIRST_RUN' in environ: smtp = SMTP(data['address'], '587') smtp.starttls() - smtp.login(username, password) + error = None + for password in passwords: + try: + smtp.login(username, password) + break + except SMTPAuthenticationError as err: + error = err + else: + raise error from error smtp.sendmail(username, username, msg) smtp.quit() imap = IMAP4_SSL(data['address']) - imap.LOGIN(username, password) + error = None + for password in passwords: + try: + imap.LOGIN(username, password) + break + except Exception as err: + error = err + else: + raise error from error imap.SELECT(readonly=True) typ, req = imap.SEARCH(None, 'ALL') assert typ == 'OK' @@ -53,49 +69,67 @@ def test_imap_migration(typ, username, password): imap.LOGOUT() -@pytest.mark.parametrize('typ, username, password', parameters) -def test_smtp_no_tls(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_smtp_no_tls(typ, username, passwords): smtp = SMTP(data['address'], '587') - try: - smtp.login(username, password) - raise Exception('no tls!') - except SMTPNotSupportedError: - pass + with pytest.raises(SMTPNotSupportedError): + smtp.login(username, passwords[0]) -@pytest.mark.parametrize('typ, username, password', parameters) -def test_smtp_wrong_passwd(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_smtp_wrong_passwd(typ, username, passwords): smtp = SMTP(data['address'], '587') smtp.starttls() - try: + with pytest.raises(SMTPAuthenticationError): smtp.login(username, 'a') - raise Exception('wrong password!') - except SMTPAuthenticationError: - pass smtp.quit() -@pytest.mark.parametrize('typ, username, password', parameters) -def test_smtp_login(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_smtp_login(typ, username, passwords): smtp = SMTP(data['address'], '587') smtp.starttls() - smtp.login(username, password) + error = None + for password in passwords: + try: + smtp.login(username, password) + break + except SMTPAuthenticationError as err: + error = err + else: + raise error from error smtp.quit() -@pytest.mark.parametrize('typ, username, password', parameters) -def test_smtp_sendmail(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_smtp_sendmail(typ, username, passwords): smtp = SMTP(data['address'], '587') smtp.starttls() - smtp.login(username, password) + error = None + for password in passwords: + try: + smtp.login(username, password) + break + except SMTPAuthenticationError as err: + error = err + else: + raise error from error smtp.sendmail(username, username, get_msg(username)) smtp.quit() -@pytest.mark.parametrize('typ, username, password', parameters) -def test_imap_read_mail(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_imap_read_mail(typ, username, passwords): imap = IMAP4_SSL(data['address']) - imap.LOGIN(username, password) + error = None + for password in passwords: + try: + imap.LOGIN(username, password) + break + except Exception as err: + error = err + else: + raise error from error imap.SELECT(readonly=True) typ, req = imap.SEARCH(None, 'ALL') assert typ == 'OK' @@ -111,10 +145,18 @@ def test_imap_read_mail(typ, username, password): imap.LOGOUT() -@pytest.mark.parametrize('typ, username, password', parameters) -def test_imap_delete_mail(typ, username, password): +@pytest.mark.parametrize('typ, username, passwords', parameters) +def test_imap_delete_mail(typ, username, passwords): imap = IMAP4_SSL(data['address']) - imap.LOGIN(username, password) + error = None + for password in passwords: + try: + imap.LOGIN(username, password) + break + except Exception as err: + error = err + else: + raise error from error imap.SELECT() typ, req = imap.SEARCH(None, 'ALL') msg_no = req[0].split() diff --git a/seed/gitea/DEBUG.md b/seed/gitea/DEBUG.md index ca0ce107..26232baa 100644 --- a/seed/gitea/DEBUG.md +++ b/seed/gitea/DEBUG.md @@ -3,5 +3,8 @@ Créer un utilisateur su - gitea -s /bin/bash -c "gitea admin user create --username gnunux --password Njw_csh7DeeZtWDxC6WVXDdB-9A --email gnunux@gnunux.info --admin -c /etc/gitea/app.ini" +DEBUG +===== - +sed -i 's/info/debug/g' /etc/gitea/app.ini +systemctl restart gitea diff --git a/seed/gitea/dictionaries/31_gitea.xml b/seed/gitea/dictionaries/31_gitea.xml index 812ea94e..f8ed6109 100644 --- a/seed/gitea/dictionaries/31_gitea.xml +++ b/seed/gitea/dictionaries/31_gitea.xml @@ -6,6 +6,7 @@ /sysusers.d/0gitea.conf /tmpfiles.d/0gitea.conf /etc/gitea/app.ini + /tests/gitea.yml diff --git a/seed/gitea/templates/gitea.service b/seed/gitea/templates/gitea.service index 3100900a..9f19bf7b 100644 --- a/seed/gitea/templates/gitea.service +++ b/seed/gitea/templates/gitea.service @@ -16,7 +16,7 @@ User=gitea Group=gitea WorkingDirectory=/srv/gitea/lib/ ExecStart=/usr/bin/gitea web --config /etc/gitea/app.ini -ExecStartPost=-/usr/bin/timeout 90 bash -c 'while ! /usr/bin/gitea admin auth list --config /etc/gitea/app.ini | grep "OAuth2"; do echo "TRY TO CONFIGURE"; /usr/bin/gitea admin auth add-oauth --name "%%domain_name_eth0" --provider "openidConnect" --key "%%oauth2_client_id" --secret "%%oauth2_client_secret" --scopes "profile email" --auto-discover-url "https://%%oauth2_client_server_domainname/.well-known/openid-configuration" --config /etc/gitea/app.ini; sleep 2; done; echo "CONFIGURATION DONE"' +ExecStartPre=-/bin/bash -c 'if /usr/bin/gitea admin auth list --config /etc/gitea/app.ini | grep "OAuth2"; then echo "UPDATE";id=$(/usr/bin/gitea --config /etc/gitea/app.ini admin auth list |tail -n 1|awk "{ print \$1}");/usr/bin/gitea admin auth update-oauth --id $id --name "%%domain_name_eth0" --provider "openidConnect" --key "%%oauth2_client_id" --secret "%%oauth2_client_secret" --scopes "profile email" --auto-discover-url "https://%%oauth2_client_server_domainname/.well-known/openid-configuration" --config /etc/gitea/app.ini;else echo "CONFIGURE"; /usr/bin/gitea admin auth add-oauth --name "%%domain_name_eth0" --provider "openidConnect" --key "%%oauth2_client_id" --secret "%%oauth2_client_secret" --scopes "profile email" --auto-discover-url "https://%%oauth2_client_server_domainname/.well-known/openid-configuration" --config /etc/gitea/app.ini;fi;sleep 2; echo "CONFIGURATION DONE"' Restart=always Environment=USER=gitea HOME=/srv/gitea/home GITEA_WORK_DIR=/srv/gitea/lib diff --git a/seed/gitea/templates/gitea.yml b/seed/gitea/templates/gitea.yml new file mode 100644 index 00000000..fcd66717 --- /dev/null +++ b/seed/gitea/templates/gitea.yml @@ -0,0 +1,9 @@ +%set %%username="rougail_test@silique.fr" +ip: %%ip_eth0 +revprox_ip: %%revprox_client_server_ip +base_url: https://%%revprox_client_external_domainname%%revprox_client_location[0] +auth_url: %%oauth2_client_external[0] +auth_server: %%oauth2_server_domainname +username: %%username +password: %%get_password(server_name='test', username=%%username, description='test', type="cleartext", hide=%%hide_secret, temporary=True) +gitea_title: "%%gitea_title" diff --git a/seed/gitea/tests/test_gitea.py b/seed/gitea/tests/test_gitea.py new file mode 100644 index 00000000..003aca09 --- /dev/null +++ b/seed/gitea/tests/test_gitea.py @@ -0,0 +1,226 @@ +from yaml import load, SafeLoader +from os import environ, makedirs +from os.path import expandvars, isfile, isdir, dirname, join +from re import search +from dulwich.porcelain import init, clone, add, commit, push + +from tempfile import TemporaryDirectory +from subprocess import run + + +from revprox import Authentication +from mookdns import MookDnsSystem + + +PORT = '3000' +GITEA_USERNAME = 'gitea' +KEY_FILE = expandvars("$HOME/tests/risotto") + + +AUTHENTICATION = None +DATA = None + + +def get_data(): + global DATA + if not DATA: + conf_file = f'{environ["MACHINE_TEST_DIR"]}/gitea.yml' + with open(conf_file) as yaml: + DATA = load(yaml, Loader=SafeLoader) + return DATA + + +def get_authentication(data): + global AUTHENTICATION + if not AUTHENTICATION: + AUTHENTICATION = Authentication(data['auth_url'], + data['auth_server'], + data['revprox_ip'], + data['username'], + data['password'], + f'{data["username"]} - Dashboard - {data["gitea_title"]}', + ) + return AUTHENTICATION + + +def get_info(authentication, + url, + with_uid=False, + with_data_id=False, + found_string=None + ): + # + pattern_csrf = r'name="_csrf" value="([a-zA-Z0-9\-\_=]+)"' + ret = authentication.get(url) + csrf = search(pattern_csrf, ret)[1] + ret_data = [] + if with_uid: + pattern_uid = r'input type="hidden" id="uid" name="uid" value="(\d)+"' + uid = search(pattern_uid, ret) + if uid is None: + ret_data.append(uid) + else: + ret_data.append(uid[1]) + if with_data_id: + pattern_uid = r'/user/settings/keys/delete?type=ssh" data-id="(\d)+"' + uid = search(pattern_uid, ret) + if uid is None: + ret_data.append(uid) + else: + ret_data.append(uid[1]) + if found_string: + ret_data.append(found_string in ret) + ret_data.append(csrf) + if len(ret_data) == 1: + return ret_data[0] + return ret_data + + +def add_ssh_key(authentication, data): + # Send key to gitea + url = f'{data["base_url"]}user/settings/keys' + is_already_key, csrf = get_info(authentication, url, found_string='test_key_risotto') + if is_already_key: + return + # Gen SSH key if needed + if not isfile(KEY_FILE): + key_dir = dirname(KEY_FILE) + if not isdir(key_dir): + makedirs(key_dir) + cmd = ['/usr/bin/ssh-keygen', '-N', '', '-f', KEY_FILE] + run(cmd) + with open(f'{KEY_FILE}.pub') as fh: + key = fh.read() + authentication.post(url, {'_csrf': csrf, 'title': 'test_key_risotto', 'content': key, 'type': 'ssh'}) + + +def delete_ssh_key(authentication, data): + url = f'{data["base_url"]}user/settings/keys' + is_already_key, csrf = get_info(authentication, url, found_string='test_key_risotto') + if is_already_key: + uid, csrf = get_info(authentication, url, with_data_id=True) + url = f'{data["base_url"]}user/settings/keys/delete?type=ssh' + authentication.post(url, {'_csrf': csrf, 'id': uid}) + is_already_key, csrf = get_info(authentication, url, found_string='test_key_risotto') + + +def test_gitea(): + data = get_data() + get_authentication(data) + + +def test_gitea_repos(): + data = get_data() + authentication = get_authentication(data) + if 'FIRST_RUN' in environ: + url = f'{data["base_url"]}repo/create' + uid, csrf = get_info(authentication, url, with_uid=True) + authentication.post(url, {'_csrf': csrf, 'uid': uid, 'repo_name': 'test_persistent'}) + url = f'{data["base_url"]}api/v1/repos/search?sort=updated&order=desc&uid=1&team_id=0&q=&page=1&mode=' + json = authentication.get(url, json=True) + assert json['ok'] + assert len(json['data']) == 1 + username = data['username'].split('@', 1)[0] + assert json['data'][0]['full_name'] == f'{username}/test_persistent' + + +def test_gitea_create_repo(): + data = get_data() + authentication = get_authentication(data) + url = f'{data["base_url"]}repo/create' + uid, csrf = get_info(authentication, url, with_uid=True) + authentication.post(url, {'_csrf': csrf, 'uid': uid, 'repo_name': 'test', 'default_branch': 'main'}) + url = f'{data["base_url"]}api/v1/repos/search?sort=updated&order=desc&uid=1&team_id=0&q=&page=1&mode=' + json = authentication.get(url, json=True) + assert json['ok'] + assert len(json['data']) == 2 + username = data['username'].split('@', 1)[0] + assert {dat['full_name'] for dat in json['data']} == set([f'{username}/test_persistent', f'{username}/test']) + + +def test_repo(): + data = get_data() + authentication = get_authentication(data) + if 'FIRST_RUN' in environ: + # delete_ssh_key(authentication, data) + add_ssh_key(authentication, data) + with TemporaryDirectory() as tmpdirname: + username = data['username'].split('@', 1)[0] + dns = data['base_url'].split('/', 3)[2] + ssh_url = f'ssh://{GITEA_USERNAME}@{dns}:2222/{username}/test.git' + with MookDnsSystem(dns, data['ip']): + filename = join(tmpdirname, 'test.txt') + with open(filename, 'w') as fh: + fh.write('test') + repo = init(tmpdirname) + add(repo, filename) + commit(repo, message=b'test commit') + push(repo=repo, + remote_location=ssh_url, + refspecs='master', + ) + lst = list(repo.get_walker()) + assert len(lst) == 1 + assert lst[0].commit.message == b'test commit' + + +def test_clone_http(): + data = get_data() + authentication = get_authentication(data) + if 'FIRST_RUN' in environ: + # delete_ssh_key(authentication, data) + add_ssh_key(authentication, data) + with TemporaryDirectory() as tmpdirname: + username = data['username'].split('@', 1)[0] + dns = data['base_url'].split('/', 3)[2] + http_url = f'{data["base_url"]}{username}/test.git' + with MookDnsSystem(dns, data['revprox_ip']): + repo = clone(http_url, tmpdirname) + lst = list(repo.get_walker()) + assert len(lst) == 1 + assert lst[0].commit.message == b'test commit' + + +def test_gitea_delete_repo(): + repo_name = 'test' + data = get_data() + authentication = get_authentication(data) + username = data['username'].split('@', 1)[0] + url = f'{data["base_url"]}{username}/{repo_name}/settings' + csrf = get_info(authentication, url) + authentication.post(url, {'_csrf': csrf, 'action': 'delete', 'repo_name': repo_name}) + url = f'{data["base_url"]}api/v1/repos/search?sort=updated&order=desc&uid=1&team_id=0&q=&page=1&mode=' + json = authentication.get(url, json=True) + assert json['ok'] + assert len(json['data']) == 1 + username = data['username'].split('@', 1)[0] + assert json['data'][0]['full_name'] == f'{username}/test_persistent' + + +def test_repo_persistent(): + data = get_data() + authentication = get_authentication(data) + if 'FIRST_RUN' in environ: + # delete_ssh_key(authentication, data) + add_ssh_key(authentication, data) + with TemporaryDirectory() as tmpdirname: + username = data['username'].split('@', 1)[0] + dns = data['base_url'].split('/', 3)[2] + ssh_url = f'ssh://{GITEA_USERNAME}@{dns}:2222/{username}/test_persistent.git' + with MookDnsSystem(dns, data['ip']): + if 'FIRST_RUN' in environ: + filename = join(tmpdirname, 'test.txt') + with open(filename, 'w') as fh: + fh.write('test') + repo = init(tmpdirname) + add(repo, filename) + commit(repo, message=b'test commit') + push(repo=repo, + remote_location=ssh_url, + refspecs='master', + ) + else: + repo = clone(ssh_url, tmpdirname) + lst = list(repo.get_walker()) + assert len(lst) == 1 + assert lst[0].commit.message == b'test commit' diff --git a/seed/lemonldap/templates/lmConf-1.json b/seed/lemonldap/templates/lmConf-1.json index c7dd06fd..38b37315 100644 --- a/seed/lemonldap/templates/lmConf-1.json +++ b/seed/lemonldap/templates/lmConf-1.json @@ -167,6 +167,7 @@ commentStartToken = § "portalDisplayResetPassword": 0, "portalMainLogo": "risotto/logo.png", "showLanguages": 0, + "requireToken": "$env->{REMOTE_ADDR} ne '%%gateway_eth0'", "whatToTrace" : "_whatToTrace", %set %%remotes = {} %for %%index, %%app in %%enumerate(%%oauth2.remotes) diff --git a/seed/nginx-reverse-proxy/tests/test_revprox.py b/seed/nginx-reverse-proxy/tests/test_revprox.py index ea50b26f..d48cc788 100644 --- a/seed/nginx-reverse-proxy/tests/test_revprox.py +++ b/seed/nginx-reverse-proxy/tests/test_revprox.py @@ -16,7 +16,12 @@ def req(url, ip, verify=True): dns[-1] = (ip, dns[-1][1]) return [dns] socket.getaddrinfo = new_getaddrinfo - ret = get(url, verify=verify) + if not verify: + with warnings.catch_warnings(): + warnings.simplefilter("ignore") + ret = get(url, verify=verify) + else: + ret = get(url, verify=verify) ret_code = ret.status_code content = ret.content socket.getaddrinfo = old_getaddrinfo @@ -29,9 +34,7 @@ def test_revprox(): data = load(yaml, Loader=SafeLoader) # test unknown domain url = 'google.fr' - with warnings.catch_warnings(): - warnings.simplefilter("ignore") - ret_code, content = req(f'https://{url}', data['address'], verify=False) + ret_code, content = req(f'https://{url}', data['address'], verify=False) assert ret_code == 200, f'https://{url} do not returns code 200 but {ret_code}' assert "Test Page for the HTTP Server on Fedora" in content, f'https://{url} returns default fedora page' # test certificate diff --git a/seed/openldap/DEBUG.md b/seed/openldap/DEBUG.md index 8b910629..a7607801 100644 --- a/seed/openldap/DEBUG.md +++ b/seed/openldap/DEBUG.md @@ -27,4 +27,8 @@ grep ldapAgentPassword /etc/nextcloud/nextcloud.init Search information with standard user: -ldapsearch -D cn=gnunux@gnunux.info,ou=users,ou=in,o=gnunux,o=info -w "1vCE09NRW2kxHIpf1PkehOS9bSLZual82saHSBj9RPM" -b cn=gnunux@gnunux.info,ou=users,ou=in,o=gnunux,o=info +ldapsearch -D cn=admin,ou=in,o=gnunux,o=info -w "1vCE09NRW2kxHIpf1PkehOS9bSLZual82saHSBj9RPM" -b cn=gnunux@gnunux.info,ou=users,ou=in,o=gnunux,o=info + +# Delete User + +ldapdelete -D cn=gnunux@gnunux.info,ou=users,ou=in,o=gnunux,o=info -y /usr/local/lib/secrets/admin_ldap.pwd cn=rougail_test@gnunux.info,ou=in,o=gnunux,o=info diff --git a/seed/openldap/templates/openldap.yml b/seed/openldap/templates/openldap.yml index 5466d094..50ef8b5d 100644 --- a/seed/openldap/templates/openldap.yml +++ b/seed/openldap/templates/openldap.yml @@ -1,13 +1,16 @@ %set %%username = "rougail_test@silique.fr" %set %%username_family = "rougail_test@gnunux.info" -%set %%familydn = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name='gnunux') +%set %%name_family = 'gnunux' +%set %%familydn = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=%%name_family) +%set %%userdn = 'cn=' + %%username + ',' + %%calc_ldapclient_base_dn(%%ldapclient_base_dn) +%set %%userfamilydn = 'cn=' + %%username_family + ',' + %%familydn address: %%ip_eth0 admin_dn: %%ldapclient_user admin_password: %%ldapclient_user_password -user_dn: cn=%%username,%%ldap_user_dn -user_password: %%get_password(server_name=%%ldap_server_address, username=%%username, description="ldap user", type="cleartext", hide=%%hide_secret, temporary=True) -user_family_dn: cn=%%username_family,%%familydn -user_family_password: %%get_password(server_name=%%ldap_server_address, username=%%username_family, description="ldap family user", type="cleartext", hide=%%hide_secret, temporary=True) +user_dn: %%userdn +user_password: %%get_password(server_name='test', username=%%username, description='test', type="cleartext", hide=%%hide_secret, temporary=True) +user_family_dn: %%userfamilydn +user_family_password: %%get_password(server_name='test', username=%%username_family, description="test", type="cleartext", hide=%%hide_secret, temporary=True) base_account_dn: %%ldap_account_dn base_user_dn: %%ldap_user_dn base_family_dn: %%familydn @@ -18,6 +21,8 @@ remote%%idx: cn=%%name,%%ldapclient_base_dn remote_password%%idx: %%get_password(server_name=%%domain_name_eth0, username=%%name, description="remote account", type="cleartext", hide=%%hide_secret, temporary=True) %end for users: + %%username: %%userdn + %%username_family: %%userfamilydn %for %%user in %%accounts.users.ldap_user_mail %%user: cn=%%user,%%ldap_user_dn %end for @@ -29,11 +34,15 @@ users: %end for groups: users: + - %%userdn %for %%user in %%accounts.users.ldap_user_mail - cn=%%user,%%ldap_user_dn %end for %for %%family in %%accounts.families %%family: + %if %%family == %%name_family + - %%userfamilydn + %end if %for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family] - cn=%%user,%%families %end for diff --git a/seed/openldap/templates/users.ldif b/seed/openldap/templates/users.ldif index 057c5bcc..ad6d0b8a 100644 --- a/seed/openldap/templates/users.ldif +++ b/seed/openldap/templates/users.ldif @@ -1,4 +1,6 @@ -%set name_family = 'gnunux' +%set %%username="rougail_test@silique.fr" +%set %%username_family="rougail_test@gnunux.info" +%set %%name_family="gnunux" # BaseDN %set groups = {} dn: %%ldapclient_base_dn @@ -44,30 +46,17 @@ ou: users objectClass: top objectClass: organizationalUnit +%set %%userdn = 'cn=' + %%username + ',' + %%calc_ldapclient_base_dn(%%ldapclient_base_dn) +%set %%userfamilydn = 'cn=' + %%username_family + ',' + %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=%%name_family) +%set %%acc = [(%%userdn, %%username, %%get_password(server_name='test', username=%%username, description="test", type="cleartext", hide=%%hide_secret, temporary=True), 'Rougail', 'Test', 'rougail_test', [], 'users'), + (%%userfamilydn, %%username_family, %%get_password(server_name='test', username=%%username_family, description='test', type="cleartext", hide=%%hide_secret, temporary=True), 'Rougail', 'Test', 'rougail_test_gnunux', [], %%name_family), + ] +%set %%groups['users'] = [%%userdn] +%set %%groups[%%name_family] = [%%userfamilydn] %for %%user in %%accounts.users.ldap_user_mail %set %%userdn = "cn=" + %%user + "," + %%users -%%groups.setdefault('users', []).append(%%userdn) -dn: %%userdn -cn: %%user -mail: %%user -sn: %%user.ldap_user_sn -givenName: %%user.ldap_user_gn -uid: %%user.ldap_user_uid -userPassword:: %%ssha_encode(%%user.ldap_user_password) -homeDirectory: /srv/home/users/%%user -mailLocalAddress: %%user - %if %%user.ldap_user_aliases - %for %%alias in %%user.ldap_user_aliases -mailLocalAddress: %%alias - %end for - %end if -uidNumber: 0 -gidNumber: 0 -objectClass: top -objectClass: inetOrgPerson -objectClass: posixAccount -objectClass: inetLocalMailRecipient - +%%acc.append((%%userdn, %%user, %%user.ldap_user_password, %%user.ldap_user_sn, %%user.ldap_user_gn, %%user.ldap_user_uid, %%user.ldap_user_aliases, 'users'))%slurp +%%groups.setdefault('users', []).append(%%userdn)%slurp %end for ## Families dn: %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name='-') @@ -84,21 +73,53 @@ objectClass: organizationalUnit %for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family] %set %%userdn = "cn=" + %%user + "," + %%families -%%groups.setdefault(%%family, []).append(%%userdn) +%%groups.setdefault(%%family, []).append(%%userdn)%slurp +%%acc.append((%%userdn, %%user, %%user['ldap_user_password_' + %%family], %%user['ldap_user_sn_' + %%family], %%user['ldap_user_gn_' + %%family], %%user['ldap_user_uid_' + %%family], %%user['ldap_user_aliases_' + %%family], %%family))%slurp +#pouet +#dn: %%userdn +#cn: %%user +#mail: %%user +#sn: +#givenName: +#uid: +#userPassword:: %%ssha_encode() +#homeDirectory: /srv/home/families/%%family/%%user +#mailLocalAddress: %%user +# %if %%user['ldap_user_aliases_' + %%family] +# %for %%alias in +#mailLocalAddress: %%alias +# %end for +# %end if +#uidNumber: 0 +#gidNumber: 0 +#objectClass: top +#objectClass: inetOrgPerson +#objectClass: posixAccount +#objectClass: inetLocalMailRecipient +# +# %end for +#%end for + %end for +%end for +%for %%userdn, %%user, %%password, %%sn, %%gn, %%uid, %%aliases, %%family in %%acc dn: %%userdn cn: %%user mail: %%user -sn: %%user['ldap_user_sn_' + %%family] -givenName: %%user['ldap_user_gn_' + %%family] -uid: %%user['ldap_user_uid_' + %%family] -userPassword:: %%ssha_encode(%%user['ldap_user_password_' + %%family]) +sn: %%sn +givenName: %%gn +uid: %%uid +userPassword:: %%ssha_encode(%%password) +%if %%family == 'users' +homeDirectory: /srv/home/users/%%user +%else homeDirectory: /srv/home/families/%%family/%%user +%end if mailLocalAddress: %%user - %if %%user['ldap_user_aliases_' + %%family] - %for %%alias in %%user['ldap_user_aliases_' + %%family] + %if %%aliases + %for %%alias in %%aliases mailLocalAddress: %%alias - %end for - %end if + %end for + %end if uidNumber: 0 gidNumber: 0 objectClass: top @@ -106,7 +127,6 @@ objectClass: inetOrgPerson objectClass: posixAccount objectClass: inetLocalMailRecipient - %end for %end for ## Groups %set %%groupdn = %%ldap_group_dn diff --git a/seed/openldap/templates/users_mod.ldif b/seed/openldap/templates/users_mod.ldif index f4fce200..e85ada38 100644 --- a/seed/openldap/templates/users_mod.ldif +++ b/seed/openldap/templates/users_mod.ldif @@ -1,4 +1,6 @@ -%set groups = {} +%set %%username="rougail_test@silique.fr" +%set %%username_family="rougail_test@gnunux.info" +%set %%name_family="gnunux" # Remote %set %%acc = [] %for %%idx in %%range(3) @@ -17,30 +19,29 @@ userPassword:: %%ssha_encode(%%password) %end for # Users +%set %%userdn = 'cn=' + %%username + ',' + %%ldapclient_base_dn +%set %%userfamilydn = 'cn=' + %%username_family + ',' + %%calc_ldapclient_base_dn(%%ldapclient_base_dn, family_name=%%name_family) +%set %%acc = [(%%userdn, %%username, ['alias_' + %%username]), + (%%userfamilydn, %%username_family, ['alias_' + %%username_family]), + ] +%set groups = {'users': [%%userdn], + %%name_family: [%%userfamilydn], + } %set %%users = %%ldap_user_dn %for %%user in %%accounts.users.ldap_user_mail %set %%userdn = 'cn=' + %%user + ',' + %%users -%%groups.setdefault('users', []).append(%%userdn)%slurp -dn: %%userdn -changetype: modify -#add: objectClass -#objectClass: inetLocalMailRecipient -#- -replace: mailLocalAddress -mailLocalAddress: %%user - %if %%user.ldap_user_aliases - %for %%alias in %%user.ldap_user_aliases -mailLocalAddress: %%alias - %end for - %end if - +%%groups['users'].append(%%userdn)%slurp +%%acc.append((%%userdn, %%user, %%user.ldap_user_aliases))%slurp %end for -# Families %for %%family in %%accounts.families %set %%families = %%calc_ldapclient_base_dn(%%ldapclient_base_dn, %%family) %for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family] %set %%userdn = 'cn=' + %%user + ',' + %%families %%groups.setdefault(%%family, []).append(%%userdn)%slurp +%%acc.append((%%userdn, %%user, %%user['ldap_user_aliases_' + %%family]))%slurp + %end for +%end for +%for %%userdn, %%user, %%aliases in %%acc dn: %%userdn changetype: modify #add: objectClass @@ -48,13 +49,12 @@ changetype: modify #- replace: mailLocalAddress mailLocalAddress: %%user - %if %%user['ldap_user_aliases_' + %%family] - %for %%alias in %%user['ldap_user_aliases_' + %%family] + %if %%aliases + %for %%alias in %%aliases mailLocalAddress: %%alias - %end for - %end if + %end for + %end if - %end for %end for # Groups %set %%groupdn = %%ldap_group_dn diff --git a/seed/reverse-proxy-client/tests/revprox.py b/seed/reverse-proxy-client/tests/revprox.py new file mode 100644 index 00000000..9b85bf50 --- /dev/null +++ b/seed/reverse-proxy-client/tests/revprox.py @@ -0,0 +1,84 @@ +from requests import get, post, session +from mookdns import MookDns + + +class Authentication: + def __init__(self, + auth_url, + portal_server, + ip, + username, + password, + title, + ): + self.ip = ip + with session() as req: + with MookDns(self.ip): + self.is_lemonldap(req, + auth_url, + ) + self.auth_lemonldap(req, + portal_server, + username, + password, + title, + ) + self.cookies = dict(req.cookies) + +# @staticmethod + def is_lemonldap(self, + req, + url, + ): + ret = req.get(url) + code = ret.status_code + content = ret.content + assert code == 200 + assert b'Authentication portal' in content + + def auth_lemonldap(self, + req, + portal_server, + username, + password, + title, + ): + # authentification + json = {'user': username, + 'password': password, + } + headers = {"Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json", + } + portal_url = f'https://{portal_server}/oauth2/' + ret = req.post(portal_url, data=json, headers=headers) + json = ret.json() + assert json['error'] + assert json['result'] == 1 + assert json['id'] == ret.cookies.get('lemonldap') + # authorization code + # curl -X POST -d user=dwho -d password=dwho -H 'Accept: application/json' 'https://oidctest.wsweet.org/oauth2/' + # curl -s -D - -o /dev/null -b lemonldap=0640f95827111f00ba7ad5863ba819fe46cfbcecdb18ce525836369fb4c8350b 'https://oidctest.wsweet.org/oauth2/authorize?response_type=code&client_id=private&scope=openid+profile+email&redirect_uri=http://localhost' | grep '^location' + authorize_url = f'{portal_url}authorize' + ret = req.get(authorize_url) + assert ret.status_code == 200 + assert title in ret.content.decode() + + def get(self, + url, + json=False, + ): + with MookDns(self.ip): + ret = get(url, cookies=self.cookies) + assert ret.status_code == 200, f'return code is {ret.status_code}' + if json: + return ret.json() + return ret.content.decode() + + def post(self, + url, + data, + ): + with MookDns(self.ip): + ret = post(url, cookies=self.cookies, data=data) + assert ret.status_code == 200, f'return code is {ret.status_code}' From b695cf1f99abd7f706fb6c63d8a5a0f00c8e5eda Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Sun, 17 Jul 2022 23:00:21 +0200 Subject: [PATCH 07/12] test for vaultwarden --- .../dictionaries/40_vaultwarden.xml | 8 +- seed/vaultwarden/funcs/risotto_setting.py | 6 - seed/vaultwarden/funcs/vaultwarden.py | 20 +- seed/vaultwarden/templates/vaultwarden.yml | 7 + seed/vaultwarden/tests/test_vaultwarden.py | 40 ++ seed/vaultwarden/tests/vaultwarden.py | 531 ++++++++++++++++++ 6 files changed, 601 insertions(+), 11 deletions(-) delete mode 100644 seed/vaultwarden/funcs/risotto_setting.py create mode 100644 seed/vaultwarden/templates/vaultwarden.yml create mode 100644 seed/vaultwarden/tests/test_vaultwarden.py create mode 100644 seed/vaultwarden/tests/vaultwarden.py diff --git a/seed/vaultwarden/dictionaries/40_vaultwarden.xml b/seed/vaultwarden/dictionaries/40_vaultwarden.xml index aeab9bcf..71ea3d0f 100644 --- a/seed/vaultwarden/dictionaries/40_vaultwarden.xml +++ b/seed/vaultwarden/dictionaries/40_vaultwarden.xml @@ -6,6 +6,7 @@ /etc/pki/ca-trust/source/anchors/ca_InternalReverseProxy.crt /tmpfiles.d/0vaultwarden.conf /etc/vaultwarden/config.env + /tests/vaultwarden.yml @@ -27,13 +28,13 @@ - - zones_name - zones_list - - - zones_name - interfaces_list - - server_name + domain_name_eth ip_eth - - - server_name - extra_domainnames - - domain_name_eth - - zones_name + zones_list zone_name_eth diff --git a/seed/base-machine/funcs/funcs.py b/seed/base-machine/funcs/funcs.py index 848abfaf..8e67ffdc 100644 --- a/seed/base-machine/funcs/funcs.py +++ b/seed/base-machine/funcs/funcs.py @@ -6,7 +6,7 @@ from os.path import dirname as _dirname, abspath as _abspath, join as _join, isf from os import makedirs as _makedirs -from risotto.utils import ZONES_SERVER +#from risotto.utils import ZONES_SERVER _HERE = _dirname(_abspath(__main__.__file__)) @@ -81,30 +81,8 @@ def _set_password(server_name: str, return file_content -def get_range(lst): - return list(range(max(1, len(lst)))) - - def get_zone_name(zones: list, index: str, ): if zones is not None: return zones[int(index)] - - -def get_domain_name(server_name: str, - extra_domainnames: list, - suffix: str, - ) -> str: - index = int(suffix) - if index == 0: - return server_name - return extra_domainnames[index - 1] - - -def get_provider_name(network_name: str, - provider: str, - ) -> str: - if network_name not in ZONES_SERVER['providers'] or provider not in ZONES_SERVER['providers'][network_name]: - return - return ZONES_SERVER['providers'][network_name][provider][0] diff --git a/seed/base/funcs/base.py b/seed/base/funcs/base.py index 10a4031f..6e3dde36 100644 --- a/seed/base/funcs/base.py +++ b/seed/base/funcs/base.py @@ -1,9 +1,26 @@ from typing import List from risotto.utils import load_domains, DOMAINS +from risotto.utils import multi_function as _multi_function +@_multi_function def get_ip(server_name: str) -> str: - load_domains() - host_name, domain_name = server_name.split('.', 1) - domain = DOMAINS[domain_name] - return domain[1][domain[0].index(host_name)] + if server_name is None: + return + if isinstance(server_name, list): + return_list = True + else: + return_list = False + server_name = [server_name] + lst = [] + for s_name in server_name: + host_name, domain_name = s_name.split('.', 1) + if not domain_name in DOMAINS: + raise ValueError(f'cannot find IP in domain name "{domain_name}" (for "{s_name}")') + domain = DOMAINS[domain_name] + ret = domain[1][domain[0].index(host_name)] + if not return_list: + return ret + if ret not in lst: + lst.append(ret) + return lst diff --git a/seed/dns-external/dictionaries/14-dns-external.xml b/seed/dns-external/dictionaries/14-dns-external.xml index 9cdb18b2..06f3b086 100644 --- a/seed/dns-external/dictionaries/14-dns-external.xml +++ b/seed/dns-external/dictionaries/14-dns-external.xml @@ -5,14 +5,7 @@ False - + - - - zone_name_eth0 - ExternalDNS - dns_client_address - - diff --git a/seed/dns-local/dictionaries/13-dns-local.xml b/seed/dns-local/dictionaries/13-dns-local.xml index 129bfc85..fb58cb48 100644 --- a/seed/dns-local/dictionaries/13-dns-local.xml +++ b/seed/dns-local/dictionaries/13-dns-local.xml @@ -10,21 +10,13 @@ - + - - zone_name_eth0 - LocalDNS - dns_client_address - - - dns_client_address - dns - ip_eth0 - ip + + dns_client_address ip_dns diff --git a/seed/dns-local/templates/dns-local.yml b/seed/dns-local/templates/dns-local.yml index 10e01013..1f5b1cef 100644 --- a/seed/dns-local/templates/dns-local.yml +++ b/seed/dns-local/templates/dns-local.yml @@ -3,13 +3,13 @@ addresses: %if %%getVar('dns_client_address', None) - dns_address: '%%dns_client_address' dns_ip: '%%ip_dns' -%elif %%getVar('unbound_forward_address', None) +%elif %%getVar('unbound_forward_address', None) is not None %for %%authority in %%unbound_forward_address - dns_address: %%authority dns_ip: %%get_ip(%%str(%%authority)) %end for %else - %for %%zone in %%nsd_zones_auto + %for %%zone in %%nsd_zones %set %%suffix = %%normalize_family(%%zone) %set %%hostnames = %%nsd["nsd_zone_" + %%suffix]["hostname_" + %%suffix]["hostname_" + %%suffix] %for %%nsd in %%hostnames diff --git a/seed/dovecot/applicationservice.yml b/seed/dovecot/applicationservice.yml index 5f39c6dd..8237e8e8 100644 --- a/seed/dovecot/applicationservice.yml +++ b/seed/dovecot/applicationservice.yml @@ -2,8 +2,7 @@ format: '0.1' description: Postfix et Dovecot depends: - base-fedora-36 - - relay-mail-client + - relay-lmtp-client - ldap-client-fedora - oauth2-client - nginx-https -provider: IMAP diff --git a/seed/dovecot/dictionaries/26_dovecot.xml b/seed/dovecot/dictionaries/26_dovecot.xml index 084e5e43..05e555eb 100644 --- a/seed/dovecot/dictionaries/26_dovecot.xml +++ b/seed/dovecot/dictionaries/26_dovecot.xml @@ -47,7 +47,7 @@ /etc/pki/tls/private/dovecot.key external_imap_crt external_imap_key - /tests/imap.yml + /tests/imap.yml @@ -71,9 +71,8 @@ - + @@ -81,36 +80,22 @@ - - smtp_relay_address - lmtp_server - domain_name_eth0 - mail_domains - - - smtp_relay_address - lmtp_criteria - domain_name_eth0 - mail_domains - /etc/pki/tls/certs/imap_ imap_domainname @@ -136,14 +121,12 @@ postfix_pem_files - mail_domains - mail_domains_calc + domain_name_eth0 + imap_internal_address - autoconfig mail_domains - . - mail_domains_calc_autoconfig + mail_domains_calc /var/www/html/mail/ @@ -154,49 +137,20 @@ True well_known_filenames - - revprox_client_server_domainname - revprox_clients - revprox_location - /mail/config-v1.1.xml - revprox_is_websocket - False - revprox_url - well_knowns - True - - mail_domains_calc_autoconfig - - - revprox_client_server_domainname - revprox_clients - revprox_location - /.well-known/autoconfig/mail/config-v1.1.xml - revprox_is_websocket - False - revprox_url - well_knowns - True - - mail_domains_calc - - - revprox_client_server_domainname - revprox_clients - revprox_location - /autodiscover/autodiscover.xml - revprox_is_websocket - False - revprox_url - well_knowns - True - - mail_domains_calc - + domain_name_eth0 mail_domains - well_knowns + revprox_client_web_address + + + mail_domains + revprox_client_external_domainnames + + + revprox_client_external_domainnames + + revprox_client_location diff --git a/seed/dovecot/funcs/dovecot.py b/seed/dovecot/funcs/dovecot.py index 415c5277..ea3be207 100644 --- a/seed/dovecot/funcs/dovecot.py +++ b/seed/dovecot/funcs/dovecot.py @@ -11,10 +11,29 @@ def sha512_crypt(password): @_multi_function -def calc_well_known(*args): - if None in args: - return +def calc_domains(domains): ret = [] - for dom in args[1]: - ret.append(f'https://{args[0]}/mail/{dom}/autodiscover/autodiscover.xml') + for domain in domains: + ret.append(domain) + ret.append(domain) + ret.append(f'autoconfig.{domain}') return ret + + +@_multi_function +def calc_locations(domain, index): + i = index//3 + if 3 * i == index: + # divisible by three + return '/autodiscover/autodiscover.xml' + elif 3 * i + 1 == index: + return '/.well-known/autoconfig/mail/config-v1.1.xml' + return '/mail/config-v1.1.xml' + + +@_multi_function +def calc_well_known(index, dns, doms): + if None in (dns, doms): + return None + i = index//3 + return f'https://{dns}/mail/{doms[i]}/autodiscover/autodiscover.xml' diff --git a/seed/dovecot/templates/dovecot-ldap.conf.ext b/seed/dovecot/templates/dovecot-ldap.conf.ext index 4e3bf82d..168da383 100644 --- a/seed/dovecot/templates/dovecot-ldap.conf.ext +++ b/seed/dovecot/templates/dovecot-ldap.conf.ext @@ -107,7 +107,7 @@ auth_bind = yes # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org # GNUNUX base = -base = %%ldapclient_base_dn +base = %%ldapclient_search_dn # Dereference: never, searching, finding, always #deref = never diff --git a/seed/dovecot/templates/ldapsource.cf b/seed/dovecot/templates/ldapsource.cf index 56068014..38555927 100644 --- a/seed/dovecot/templates/ldapsource.cf +++ b/seed/dovecot/templates/ldapsource.cf @@ -8,6 +8,6 @@ version = 3 bind = yes bind_dn = %%ldapclient_user bind_pw = %%ldapclient_user_password -search_base = %%ldapclient_base_dn +search_base = %%ldapclient_search_dn query_filter = (mailLocalAddress=%s) result_attribute = cn diff --git a/seed/gitea/dictionaries/31_gitea.xml b/seed/gitea/dictionaries/31_gitea.xml index f8ed6109..094c691e 100644 --- a/seed/gitea/dictionaries/31_gitea.xml +++ b/seed/gitea/dictionaries/31_gitea.xml @@ -25,9 +25,11 @@