From 2e8923b383eb06c53261eee8e5c442b857fb67e4 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 24 Aug 2022 15:42:47 +0200 Subject: [PATCH] Move app files into cluster subdirectories; add prod garage --- app/bad.csi-s3/deploy/dummy-volume.hcl | 20 + app/dummy/deploy/.gitignore | 1 - app/secretmgr.py | 381 +++++++++++++++++- .../prod/app}/cryptpad/build/README.md | 0 .../prod/app}/cryptpad/build/common.nix | 0 .../prod/app}/cryptpad/build/default.nix | 0 .../prod/app}/cryptpad/build/docker.nix | 0 .../app}/cryptpad/build/nix.lock/bower.json | 0 .../app}/cryptpad/build/nix.lock/bower.nix | 0 .../app}/cryptpad/build/nix.lock/node-env.nix | 0 .../cryptpad/build/nix.lock/node-packages.nix | 0 .../prod/app}/cryptpad/build/nix.lock/npm.nix | 0 .../cryptpad/build/nix.lock/package-lock.json | 0 .../app}/cryptpad/build/nix.lock/package.json | 0 .../prod/app}/cryptpad/build/shell.nix | 0 .../cryptpad/config/application_config.js | 0 .../prod/app}/cryptpad/config/config.js | 0 .../prod/app}/cryptpad/deploy/backup.hcl | 0 .../prod/app}/cryptpad/deploy/cryptpad.hcl | 0 .../cryptpad_backup/backup_aws_access_key_id | 0 .../backup_aws_secret_access_key | 0 .../cryptpad_backup/backup_restic_password | 0 .../cryptpad_backup/backup_restic_repository | 0 .../prod/app}/drone-ci/config/litestream.yml | 0 .../prod/app}/drone-ci/deploy/server.hcl | 0 .../prod/app}/drone-ci/integration/README.md | 0 .../drone-ci/integration/docker-compose.yml | 0 .../drone-ci/secrets/drone-ci/cookie_secret | 0 .../drone-ci/secrets/drone-ci/db_enc_secret | 0 .../drone-ci/secrets/drone-ci/oauth_client_id | 0 .../secrets/drone-ci/oauth_client_secret | 0 .../app}/drone-ci/secrets/drone-ci/rpc_secret | 0 .../prod/app}/drone-ci/secrets/drone-ci/s3_ak | 0 .../drone-ci/secrets/drone-ci/s3_db_bucket | 0 .../prod/app}/drone-ci/secrets/drone-ci/s3_sk | 0 .../secrets/drone-ci/s3_storage_bucket | 0 .../frontend/deploy/frontend-tricot-prod.hcl | 0 ...command-line-args-parameters-setting.patch | 0 .../build/jitsi-conference-focus/Dockerfile | 0 .../jitsi/build/jitsi-conference-focus/jicofo | 0 .../app}/jitsi/build/jitsi-meet/Dockerfile | 0 .../0001-Remove-deprecated-argument.patch | 0 .../jitsi/build/jitsi-videobridge/Dockerfile | 0 .../jitsi/build/jitsi-videobridge/jvb_run | 0 .../app}/jitsi/build/jitsi-xmpp/Dockerfile | 0 .../app}/jitsi/build/jitsi-xmpp/xmpp_prosody | 0 .../prod/app}/jitsi/config/config.js | 0 .../prod/app}/jitsi/config/jicofo.conf | 0 .../prod/app}/jitsi/config/nginx.conf | 0 .../prod/app}/jitsi/config/prosody.cfg.lua | 0 .../prod/app}/jitsi/config/videobridge.conf | 0 .../prod/app}/jitsi/deploy/jitsi.hcl | 0 .../prod/app}/jitsi/integration/README.md | 0 .../app}/jitsi/integration/docker-compose.yml | 0 .../app}/jitsi/integration/jicofo/jicofo.conf | 0 .../jitsi/integration/jvb/logging.properties | 0 .../jitsi/integration/jvb/videobridge.conf | 0 .../app}/jitsi/integration/meet/config.js | 0 .../app}/jitsi/integration/meet/nginx.conf | 0 .../jitsi/integration/prosody/prosody.cfg.lua | 0 .../integration/prosody/prosody.cfg.lua.back | 0 .../app}/jitsi/secrets/jitsi/auth.jitsi.crt | 0 .../app}/jitsi/secrets/jitsi/auth.jitsi.key | 0 .../prod/app}/jitsi/secrets/jitsi/jicofo_pass | 0 .../prod/app}/jitsi/secrets/jitsi/jitsi.crt | 0 .../prod/app}/jitsi/secrets/jitsi/jitsi.key | 0 .../prod/app}/jitsi/secrets/jitsi/jvb_pass | 0 cluster/prod/garage/config/garage.toml | 24 ++ cluster/prod/garage/deploy/garage.hcl | 131 ++++++ .../prod/garage/secrets/garage}/rpc_secret | 0 .../directory/config/bottin/config.json.tpl | 0 .../directory/config/guichet/config.json.tpl | 0 .../app}/directory/deploy/directory.hcl | 0 .../secrets/directory/guichet/mail_domain | 0 .../secrets/directory/guichet/mail_from | 0 .../secrets/directory/guichet/s3_access_key | 0 .../secrets/directory/guichet/s3_bucket | 0 .../secrets/directory/guichet/s3_endpoint | 0 .../secrets/directory/guichet/s3_region | 0 .../secrets/directory/guichet/s3_secret_key | 0 .../secrets/directory/guichet/smtp_pass | 0 .../secrets/directory/guichet/smtp_server | 0 .../secrets/directory/guichet/smtp_user | 0 .../secrets/directory/guichet/web_hostname | 0 .../directory/secrets/directory/ldap_base_dn | 0 .../staging/app}/docker-compose.yml | 0 .../staging/app}/drone-ci/build/.gitignore | 0 .../staging/app}/drone-ci/build/Makefile | 0 .../app}/drone-ci/build/build-qcow2.nix | 0 .../app}/drone-ci/build/machine-config.nix | 0 .../app}/drone-ci/deploy/bad-runner-vm.hcl | 0 .../app}/drone-ci/deploy/runner-docker.hcl | 0 .../app}/frontend/deploy/frontend-tricot.hcl | 0 .../staging/app/garage}/config/garage.toml | 0 .../staging/app/garage}/deploy/garage.hcl | 0 .../garage/secrets/garage-staging/rpc_secret | 1 + .../app}/im/build/matrix-synapse/Dockerfile | 0 .../im/build/matrix-synapse/entrypoint.sh | 0 .../im/build/matrix-synapse/matrix-s3-async | 0 .../matrix-synapse/matrix-s3-async-sqlite | 0 .../staging/app}/im/config/homeserver.yaml | 0 .../staging/app}/im/config/litestream.yml | 0 .../app}/im/config/synapse.log.config.yaml | 0 {app => cluster/staging/app}/im/deploy/im.hcl | 0 .../app}/im/secrets/synapse/form_secret | 0 .../im/secrets/synapse/macaroon_secret_key | 0 .../synapse/registration_shared_secret | 0 .../app}/im/secrets/synapse/s3_access_key | 0 .../app}/im/secrets/synapse/s3_secret_key | 0 .../app}/im/secrets/synapse/signing_key | 0 .../app}/telemetry/config/apm-config.yaml | 0 .../app}/telemetry/config/filebeat.yml | 0 .../telemetry/config/grafana-litestream.yml | 0 .../provisioning/datasources/elastic.yaml | 0 .../app}/telemetry/config/otel-config.yaml | 0 .../telemetry/deploy/telemetry-system.hcl | 0 .../app}/telemetry/deploy/telemetry.hcl | 0 117 files changed, 556 insertions(+), 2 deletions(-) create mode 100644 app/bad.csi-s3/deploy/dummy-volume.hcl delete mode 100644 app/dummy/deploy/.gitignore mode change 120000 => 100755 app/secretmgr.py rename {app => cluster/prod/app}/cryptpad/build/README.md (100%) rename {app => cluster/prod/app}/cryptpad/build/common.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/default.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/docker.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/bower.json (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/bower.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/node-env.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/node-packages.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/npm.nix (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/package-lock.json (100%) rename {app => cluster/prod/app}/cryptpad/build/nix.lock/package.json (100%) rename {app => cluster/prod/app}/cryptpad/build/shell.nix (100%) rename {app => cluster/prod/app}/cryptpad/config/application_config.js (100%) rename {app => cluster/prod/app}/cryptpad/config/config.js (100%) rename {app => cluster/prod/app}/cryptpad/deploy/backup.hcl (100%) rename {app => cluster/prod/app}/cryptpad/deploy/cryptpad.hcl (100%) rename {app => cluster/prod/app}/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id (100%) rename {app => cluster/prod/app}/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key (100%) rename {app => cluster/prod/app}/cryptpad/secrets/cryptpad_backup/backup_restic_password (100%) rename {app => cluster/prod/app}/cryptpad/secrets/cryptpad_backup/backup_restic_repository (100%) rename {app => cluster/prod/app}/drone-ci/config/litestream.yml (100%) rename {app => cluster/prod/app}/drone-ci/deploy/server.hcl (100%) rename {app => cluster/prod/app}/drone-ci/integration/README.md (100%) rename {app => cluster/prod/app}/drone-ci/integration/docker-compose.yml (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/cookie_secret (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/db_enc_secret (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/oauth_client_id (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/oauth_client_secret (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/rpc_secret (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/s3_ak (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/s3_db_bucket (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/s3_sk (100%) rename {app => cluster/prod/app}/drone-ci/secrets/drone-ci/s3_storage_bucket (100%) rename {app => cluster/prod/app}/frontend/deploy/frontend-tricot-prod.hcl (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-conference-focus/0001-Remove-broken-command-line-args-parameters-setting.patch (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-conference-focus/Dockerfile (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-conference-focus/jicofo (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-meet/Dockerfile (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-videobridge/0001-Remove-deprecated-argument.patch (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-videobridge/Dockerfile (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-videobridge/jvb_run (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-xmpp/Dockerfile (100%) rename {app => cluster/prod/app}/jitsi/build/jitsi-xmpp/xmpp_prosody (100%) rename {app => cluster/prod/app}/jitsi/config/config.js (100%) rename {app => cluster/prod/app}/jitsi/config/jicofo.conf (100%) rename {app => cluster/prod/app}/jitsi/config/nginx.conf (100%) rename {app => cluster/prod/app}/jitsi/config/prosody.cfg.lua (100%) rename {app => cluster/prod/app}/jitsi/config/videobridge.conf (100%) rename {app => cluster/prod/app}/jitsi/deploy/jitsi.hcl (100%) rename {app => cluster/prod/app}/jitsi/integration/README.md (100%) rename {app => cluster/prod/app}/jitsi/integration/docker-compose.yml (100%) rename {app => cluster/prod/app}/jitsi/integration/jicofo/jicofo.conf (100%) rename {app => cluster/prod/app}/jitsi/integration/jvb/logging.properties (100%) rename {app => cluster/prod/app}/jitsi/integration/jvb/videobridge.conf (100%) rename {app => cluster/prod/app}/jitsi/integration/meet/config.js (100%) rename {app => cluster/prod/app}/jitsi/integration/meet/nginx.conf (100%) rename {app => cluster/prod/app}/jitsi/integration/prosody/prosody.cfg.lua (100%) rename {app => cluster/prod/app}/jitsi/integration/prosody/prosody.cfg.lua.back (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/auth.jitsi.crt (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/auth.jitsi.key (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/jicofo_pass (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/jitsi.crt (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/jitsi.key (100%) rename {app => cluster/prod/app}/jitsi/secrets/jitsi/jvb_pass (100%) create mode 100644 cluster/prod/garage/config/garage.toml create mode 100644 cluster/prod/garage/deploy/garage.hcl rename {app/garage-staging/secrets/garage-staging => cluster/prod/garage/secrets/garage}/rpc_secret (100%) rename {app => cluster/staging/app}/directory/config/bottin/config.json.tpl (100%) rename {app => cluster/staging/app}/directory/config/guichet/config.json.tpl (100%) rename {app => cluster/staging/app}/directory/deploy/directory.hcl (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/mail_domain (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/mail_from (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/s3_access_key (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/s3_bucket (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/s3_endpoint (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/s3_region (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/s3_secret_key (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/smtp_pass (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/smtp_server (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/smtp_user (100%) rename {app => cluster/staging/app}/directory/secrets/directory/guichet/web_hostname (100%) rename {app => cluster/staging/app}/directory/secrets/directory/ldap_base_dn (100%) rename {app => cluster/staging/app}/docker-compose.yml (100%) rename {app => cluster/staging/app}/drone-ci/build/.gitignore (100%) rename {app => cluster/staging/app}/drone-ci/build/Makefile (100%) rename {app => cluster/staging/app}/drone-ci/build/build-qcow2.nix (100%) rename {app => cluster/staging/app}/drone-ci/build/machine-config.nix (100%) rename {app => cluster/staging/app}/drone-ci/deploy/bad-runner-vm.hcl (100%) rename {app => cluster/staging/app}/drone-ci/deploy/runner-docker.hcl (100%) rename {app => cluster/staging/app}/frontend/deploy/frontend-tricot.hcl (100%) rename {app/garage-staging => cluster/staging/app/garage}/config/garage.toml (100%) rename {app/garage-staging => cluster/staging/app/garage}/deploy/garage.hcl (100%) create mode 100644 cluster/staging/app/garage/secrets/garage-staging/rpc_secret rename {app => cluster/staging/app}/im/build/matrix-synapse/Dockerfile (100%) rename {app => cluster/staging/app}/im/build/matrix-synapse/entrypoint.sh (100%) rename {app => cluster/staging/app}/im/build/matrix-synapse/matrix-s3-async (100%) rename {app => cluster/staging/app}/im/build/matrix-synapse/matrix-s3-async-sqlite (100%) rename {app => cluster/staging/app}/im/config/homeserver.yaml (100%) rename {app => cluster/staging/app}/im/config/litestream.yml (100%) rename {app => cluster/staging/app}/im/config/synapse.log.config.yaml (100%) rename {app => cluster/staging/app}/im/deploy/im.hcl (100%) rename {app => cluster/staging/app}/im/secrets/synapse/form_secret (100%) rename {app => cluster/staging/app}/im/secrets/synapse/macaroon_secret_key (100%) rename {app => cluster/staging/app}/im/secrets/synapse/registration_shared_secret (100%) rename {app => cluster/staging/app}/im/secrets/synapse/s3_access_key (100%) rename {app => cluster/staging/app}/im/secrets/synapse/s3_secret_key (100%) rename {app => cluster/staging/app}/im/secrets/synapse/signing_key (100%) rename {app => cluster/staging/app}/telemetry/config/apm-config.yaml (100%) rename {app => cluster/staging/app}/telemetry/config/filebeat.yml (100%) rename {app => cluster/staging/app}/telemetry/config/grafana-litestream.yml (100%) rename {app => cluster/staging/app}/telemetry/config/grafana/provisioning/datasources/elastic.yaml (100%) rename {app => cluster/staging/app}/telemetry/config/otel-config.yaml (100%) rename {app => cluster/staging/app}/telemetry/deploy/telemetry-system.hcl (100%) rename {app => cluster/staging/app}/telemetry/deploy/telemetry.hcl (100%) diff --git a/app/bad.csi-s3/deploy/dummy-volume.hcl b/app/bad.csi-s3/deploy/dummy-volume.hcl new file mode 100644 index 0000000..67dfd39 --- /dev/null +++ b/app/bad.csi-s3/deploy/dummy-volume.hcl @@ -0,0 +1,20 @@ +id = "dummy-volume" +name = "dummy-volume" +type = "csi" +plugin_id = "csi-s3" + +capability { + access_mode = "single-node-writer" + attachment_mode = "file-system" +} + +secrets { + accessKeyId = "GKfd94f06139bb73de5642baf5" + secretAccessKey = "a4fa6c956d847b145a823c4615e4655126c67babf3cce2337b4d73cd381d7f06" + endpoint = "https://garage-staging.home.adnab.me" + region = "garage-staging" +} + +parameters { + mounter = "rclone" +} diff --git a/app/dummy/deploy/.gitignore b/app/dummy/deploy/.gitignore deleted file mode 100644 index 3af34ab..0000000 --- a/app/dummy/deploy/.gitignore +++ /dev/null @@ -1 +0,0 @@ -dummy-volume.hcl diff --git a/app/secretmgr.py b/app/secretmgr.py deleted file mode 120000 index 3364b32..0000000 --- a/app/secretmgr.py +++ /dev/null @@ -1 +0,0 @@ -../../infrastructure/app/secretmgr.py \ No newline at end of file diff --git a/app/secretmgr.py b/app/secretmgr.py new file mode 100755 index 0000000..8b17f61 --- /dev/null +++ b/app/secretmgr.py @@ -0,0 +1,380 @@ +#!/usr/bin/env python3 + +# DEPENDENCY: python-consul +import consul + +# DEPENDENCY: python-ldap +import ldap + +# DEPENDENCY: passlib +from passlib.hash import ldap_salted_sha1 + +import os +import sys +import glob +import subprocess +import getpass +import base64 +from secrets import token_bytes + + +""" +TODO: this will be a utility to handle secrets in the Consul database +for the various components of the Deuxfleurs infrastructure + +Functionnalities: +- check that secrets are correctly configured +- help user fill in secrets +- create LDAP service users and fill in corresponding secrets +- maybe one day: manage SSL certificates and keys + +It uses files placed in /secrets/* to know what secrets +it should handle. These secret files contain directives for what to do +about these secrets. + +Example directives: + +USER +(a secret that must be filled in by the user) + +USER_LONG +(the same, indicates that the secret fits on several lines) + +CMD +(a secret that is generated by running this command) + +CMD_ONCE +(same, but value is not changed when doing a regen) + +CONST +(the secret has a constant value set here) + +CONST_LONG + +(same) + +SERVICE_DN +(the LDAP DN of a service user) + +SERVICE_PASSWORD +(the LDAP password for the corresponding service user) + +SSL_CERT +(a SSL domain for the given domains) + +SSL_KEY +(the SSL key going with corresponding certificate) + +RSA_PUBLIC_KEY +(a public RSA key) + +RSA_PRIVATE_KEY +(the corresponding private RSA key) +""" + + +# Parameters +LDAP_URL = "ldap://localhost:1389" +SERVICE_DN_SUFFIX = "ou=services,ou=users,dc=deuxfleurs,dc=fr" +consul_server = consul.Consul() + + +# ---- + +USER = "USER" +USER_LONG = "USER_LONG" +CMD = "CMD" +CMD_ONCE = "CMD_ONCE" +CONST = "CONST" +CONST_LONG = "CONST_LONG" +SERVICE_DN = "SERVICE_DN" +SERVICE_PASSWORD = "SERVICE_PASSWORD" +SSL_CERT = "SSL_CERT" +SSL_KEY = "SSL_KEY" +RSA_PUBLIC_KEY = "RSA_PUBLIC_KEY" +RSA_PRIVATE_KEY = "RSA_PRIVATE_KEY" + +class bcolors: + HEADER = '\033[95m' + OKBLUE = '\033[94m' + OKCYAN = '\033[96m' + OKGREEN = '\033[92m' + WARNING = '\033[93m' + FAIL = '\033[91m' + ENDC = '\033[0m' + BOLD = '\033[1m' + UNDERLINE = '\033[4m' + +def read_secret(key, file_path): + lines = [l.strip() for l in open(file_path, "r")] + if len(lines) == 0: + print(bcolors.FAIL, "ERROR:", bcolors.ENDC, "Empty file in", file_path) + sys.exit(-1) + l0 = lines[0].split(" ") + stype = l0[0] + secret = {"type": stype, "key": key} + if stype in [USER, USER_LONG]: + secret["desc"] = " ".join(l0[1:]) + elif stype in [CMD, CMD_ONCE]: + secret["cmd"] = " ".join(l0[1:]) + elif stype == CONST: + secret["value"] = " ".join(l0[1:]) + elif stype == CONST_LONG: + secret["value"] = "\n".join(lines[1:]) + elif stype in [SERVICE_DN, SERVICE_PASSWORD]: + secret["service"] = l0[1] + if stype == SERVICE_DN: + secret["service_desc"] = " ".join(l0[2:]) + elif stype in [SSL_CERT, SSL_KEY]: + secret["cert_name"] = l0[1] + if stype == SSL_CERT: + secret["cert_domains"] = l0[2:] + elif stype in [RSA_PUBLIC_KEY, RSA_PRIVATE_KEY]: + secret["key_name"] = l0[1] + if stype == RSA_PUBLIC_KEY: + secret["key_desc"] = " ".join(l0[2:]) + else: + print(bcolors.FAIL, "ERROR:", bcolors.ENDC, "Invalid secret type", stype, "in", file_path) + sys.exit(-1) + + return secret + +def read_secrets(module_list): + secrets = {} + for mod in module_list: + for file_path in glob.glob(mod.strip('/') + "/secrets/**", recursive=True): + if os.path.isfile(file_path): + key = '/'.join(file_path.split("/")[1:]) + secrets[key] = read_secret(key, file_path) + return secrets + +def get_secrets_services(secrets): + services = {} + for key, secret in secrets.items(): + if secret["type"] not in [SERVICE_DN, SERVICE_PASSWORD]: + continue + svc = secret["service"] + print(svc, "@", key, bcolors.OKCYAN, "...", bcolors.ENDC) + if svc not in services: + services[svc] = { + "dn": "cn=%s,%s"%(svc, SERVICE_DN_SUFFIX), + "desc": "(not provided)", + "pass": None, + "dn_at": [], + "pass_at": [], + } + if secret["type"] == SERVICE_DN: + services[svc]["dn_at"].append(key) + services[svc]["desc"] = secret["service_desc"] + + if secret["type"] == SERVICE_PASSWORD: + services[svc]["pass_at"].append(key) + _, data = consul_server.kv.get(key) + if data is not None: + if services[svc]["pass"] is None: + services[svc]["pass"] = data["Value"].decode('ascii').strip() + + return services + +ldap_admin_conn = None +def get_ldap_admin_conn(): + global ldap_admin_conn + if ldap_admin_conn is None: + ldap_admin_conn = ldap.initialize(LDAP_URL) + ldap_user = input("LDAP admin user (full DN, please!): ") + ldap_pass = getpass.getpass("LDAP admin password: ") + ldap_admin_conn.simple_bind_s(ldap_user, ldap_pass) + return ldap_admin_conn + +# ---- CHECK COMMAND ---- + +def check_secrets(module_list): + secrets = read_secrets(module_list) + print("Found", len(secrets), "secrets to check") + print() + + check_secrets_presence(secrets) + check_secrets_services(secrets) + +def check_secrets_presence(secrets): + print("Checking secrets presence...") + for key in secrets.keys(): + _, data = consul_server.kv.get(key) + if data is None: + print(key, bcolors.FAIL, "x", bcolors.ENDC) + else: + print(key, bcolors.OKGREEN, "✓", bcolors.ENDC) + print() + +def check_secrets_services(secrets): + print("Checking secrets for LDAP service users...") + services = get_secrets_services(secrets) + + for svc_name, svc in services.items(): + for dn_key in svc["dn_at"]: + _, data = consul_server.kv.get(dn_key) + if data is not None: + got_val = data["Value"].decode('ascii').strip() + if got_val != svc["dn"]: + print(svc_name, "wrong DN at", dn_key, bcolors.FAIL, "x", bcolors.ENDC) + print("got:", got_val, "instead of:", svc["dn"]) + + if svc["pass"] is None: + print(svc_name, bcolors.FAIL, "no password stored", bcolors.ENDC) + else: + for pass_key in svc["pass_at"]: + _, data = consul_server.kv.get(pass_key) + if data is not None: + got_val = data["Value"].decode('ascii').strip() + if got_val != svc["pass"]: + print(svc_name, "wrong pass at", dn_key, bcolors.FAIL, "x", bcolors.ENDC) + + l = ldap.initialize(LDAP_URL) + try: + l.simple_bind_s(svc["dn"], svc["pass"]) + print(svc_name, bcolors.OKGREEN, "✓", bcolors.ENDC) + except Exception as e: + print(svc_name, bcolors.FAIL, e, bcolors.ENDC) + print() + + +# ---- GEN COMMAND ---- + +def gen_secrets(module_list, regen): + secrets = read_secrets(module_list) + print("Found", len(secrets), "secrets to check and maybe generate") + print() + + gen_secrets_base(secrets, regen) + gen_secrets_services(secrets, regen) + + check_secrets_presence(secrets) + check_secrets_services(secrets) + +def gen_secrets_base(secrets, regen): + print("Filling in user secrets and cmd secrets...") + + for key, secret in secrets.items(): + _, data = consul_server.kv.get(key) + if data is not None and not regen: + continue + + if secret["type"] == USER: + print("----") + print(key) + print("Description:", secret["desc"]) + print("Enter value for secret, or ^C to skip:") + try: + val = input().strip() + consul_server.kv.put(key, val) + print(bcolors.OKCYAN, "Value set.", bcolors.ENDC) + except KeyboardInterrupt: + print(bcolors.WARNING, "Skipped.", bcolors.ENDC) + + if secret["type"] == USER_LONG: + print("----") + print(key) + print("Description:", secret["desc"]) + print("Enter value for secret, or ^C to skip:") + print("THIS IS A LONG VALUE, ENTER SEVERAL LINES AND FINISH WITH A LINE CONTAINING A SINGLE .") + try: + lines = [] + while True: + line = input().strip() + if line == ".": + break + lines.append(line) + val = "\n".join(lines) + consul_server.kv.put(key, val) + print(bcolors.OKCYAN, "Value set.", bcolors.ENDC) + except KeyboardInterrupt: + print(bcolors.WARNING, "Skipped.", bcolors.ENDC) + + if secret["type"] in [CONST, CONST_LONG]: + print("----") + print(key) + print("Resetting to constant value.") + consul_server.kv.put(key, secret["value"]) + print(bcolors.OKCYAN, "Value set.", bcolors.ENDC) + + if secret["type"] == CMD or (secret["type"] == CMD_ONCE and data is None): + print("----") + print(key) + print("Executing command:", secret["cmd"]) + val = subprocess.check_output(["sh", "-c", secret["cmd"]]) + consul_server.kv.put(key, val) + print(bcolors.OKCYAN, "Value set.", bcolors.ENDC) + + print() + +def gen_secrets_services(secrets, regen): + print("Generating LDAP service accounts...") + services = get_secrets_services(secrets) + + for svc_name, svc in services.items(): + print("----") + print("Service:", svc_name) + print("Description:", svc["desc"]) + + for dn_key in svc["dn_at"]: + _, data = consul_server.kv.get(dn_key) + if data is None or data["Value"].decode('ascii').strip() != svc["dn"]: + print(bcolors.OKCYAN, "Setting DN", bcolors.ENDC, "at", dn_key) + consul_server.kv.put(dn_key, svc["dn"]) + + if svc["pass"] is None or regen: + print(bcolors.OKCYAN, "Generating new password", bcolors.ENDC) + svc["pass"] = base64.urlsafe_b64encode(token_bytes(12)).decode('ascii') + + l = ldap.initialize(LDAP_URL) + try: + l.simple_bind_s(svc["dn"], svc["pass"]) + except: + fix_service_user(svc) + + for pass_key in svc["pass_at"]: + _, data = consul_server.kv.get(pass_key) + if data is None or data["Value"].decode('ascii').strip() != svc["pass"]: + print(bcolors.OKCYAN, "Setting password", bcolors.ENDC, "at", pass_key) + consul_server.kv.put(pass_key, svc["pass"]) + + print() + +def fix_service_user(svc): + print("Fixing service user", svc["dn"], "...") + l = get_ldap_admin_conn() + res = l.search_s(svc["dn"], ldap.SCOPE_BASE, "objectclass=*") + pass_crypt = ldap_salted_sha1.hash(svc["pass"]) + if res is None or len(res) == 0: + print(bcolors.OKCYAN, "Creating entity...", bcolors.ENDC) + l.add_s(svc["dn"], + [ + ("objectclass", [b"person", b"top"]), + ("displayname", [svc["desc"].encode('ascii')]), + ("userpassword", [pass_crypt.encode('ascii')]), + ]) + else: + print(bcolors.OKCYAN, "Resetting entity password", bcolors.ENDC) + l.modify_s(svc["dn"], + [ + (ldap.MOD_REPLACE, "userpassword", [pass_crypt.encode('ascii')]) + ]) + +# ---- MAIN ---- + +if __name__ == "__main__": + for i, val in enumerate(sys.argv): + if val == "check": + check_secrets(sys.argv[i+1:]) + break + elif val == "gen": + gen_secrets(sys.argv[i+1:], False) + break + elif val == "regen": + gen_secrets(sys.argv[i+1:], True) + break + else: + print("Usage:") + print(" secretmgr.py [check|gen|regen] ...") + + diff --git a/app/cryptpad/build/README.md b/cluster/prod/app/cryptpad/build/README.md similarity index 100% rename from app/cryptpad/build/README.md rename to cluster/prod/app/cryptpad/build/README.md diff --git a/app/cryptpad/build/common.nix b/cluster/prod/app/cryptpad/build/common.nix similarity index 100% rename from app/cryptpad/build/common.nix rename to cluster/prod/app/cryptpad/build/common.nix diff --git a/app/cryptpad/build/default.nix b/cluster/prod/app/cryptpad/build/default.nix similarity index 100% rename from app/cryptpad/build/default.nix rename to cluster/prod/app/cryptpad/build/default.nix diff --git a/app/cryptpad/build/docker.nix b/cluster/prod/app/cryptpad/build/docker.nix similarity index 100% rename from app/cryptpad/build/docker.nix rename to cluster/prod/app/cryptpad/build/docker.nix diff --git a/app/cryptpad/build/nix.lock/bower.json b/cluster/prod/app/cryptpad/build/nix.lock/bower.json similarity index 100% rename from app/cryptpad/build/nix.lock/bower.json rename to cluster/prod/app/cryptpad/build/nix.lock/bower.json diff --git a/app/cryptpad/build/nix.lock/bower.nix b/cluster/prod/app/cryptpad/build/nix.lock/bower.nix similarity index 100% rename from app/cryptpad/build/nix.lock/bower.nix rename to cluster/prod/app/cryptpad/build/nix.lock/bower.nix diff --git a/app/cryptpad/build/nix.lock/node-env.nix b/cluster/prod/app/cryptpad/build/nix.lock/node-env.nix similarity index 100% rename from app/cryptpad/build/nix.lock/node-env.nix rename to cluster/prod/app/cryptpad/build/nix.lock/node-env.nix diff --git a/app/cryptpad/build/nix.lock/node-packages.nix b/cluster/prod/app/cryptpad/build/nix.lock/node-packages.nix similarity index 100% rename from app/cryptpad/build/nix.lock/node-packages.nix rename to cluster/prod/app/cryptpad/build/nix.lock/node-packages.nix diff --git a/app/cryptpad/build/nix.lock/npm.nix b/cluster/prod/app/cryptpad/build/nix.lock/npm.nix similarity index 100% rename from app/cryptpad/build/nix.lock/npm.nix rename to cluster/prod/app/cryptpad/build/nix.lock/npm.nix diff --git a/app/cryptpad/build/nix.lock/package-lock.json b/cluster/prod/app/cryptpad/build/nix.lock/package-lock.json similarity index 100% rename from app/cryptpad/build/nix.lock/package-lock.json rename to cluster/prod/app/cryptpad/build/nix.lock/package-lock.json diff --git a/app/cryptpad/build/nix.lock/package.json b/cluster/prod/app/cryptpad/build/nix.lock/package.json similarity index 100% rename from app/cryptpad/build/nix.lock/package.json rename to cluster/prod/app/cryptpad/build/nix.lock/package.json diff --git a/app/cryptpad/build/shell.nix b/cluster/prod/app/cryptpad/build/shell.nix similarity index 100% rename from app/cryptpad/build/shell.nix rename to cluster/prod/app/cryptpad/build/shell.nix diff --git a/app/cryptpad/config/application_config.js b/cluster/prod/app/cryptpad/config/application_config.js similarity index 100% rename from app/cryptpad/config/application_config.js rename to cluster/prod/app/cryptpad/config/application_config.js diff --git a/app/cryptpad/config/config.js b/cluster/prod/app/cryptpad/config/config.js similarity index 100% rename from app/cryptpad/config/config.js rename to cluster/prod/app/cryptpad/config/config.js diff --git a/app/cryptpad/deploy/backup.hcl b/cluster/prod/app/cryptpad/deploy/backup.hcl similarity index 100% rename from app/cryptpad/deploy/backup.hcl rename to cluster/prod/app/cryptpad/deploy/backup.hcl diff --git a/app/cryptpad/deploy/cryptpad.hcl b/cluster/prod/app/cryptpad/deploy/cryptpad.hcl similarity index 100% rename from app/cryptpad/deploy/cryptpad.hcl rename to cluster/prod/app/cryptpad/deploy/cryptpad.hcl diff --git a/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id similarity index 100% rename from app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id rename to cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id diff --git a/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key similarity index 100% rename from app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key rename to cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key diff --git a/app/cryptpad/secrets/cryptpad_backup/backup_restic_password b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password similarity index 100% rename from app/cryptpad/secrets/cryptpad_backup/backup_restic_password rename to cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password diff --git a/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository similarity index 100% rename from app/cryptpad/secrets/cryptpad_backup/backup_restic_repository rename to cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository diff --git a/app/drone-ci/config/litestream.yml b/cluster/prod/app/drone-ci/config/litestream.yml similarity index 100% rename from app/drone-ci/config/litestream.yml rename to cluster/prod/app/drone-ci/config/litestream.yml diff --git a/app/drone-ci/deploy/server.hcl b/cluster/prod/app/drone-ci/deploy/server.hcl similarity index 100% rename from app/drone-ci/deploy/server.hcl rename to cluster/prod/app/drone-ci/deploy/server.hcl diff --git a/app/drone-ci/integration/README.md b/cluster/prod/app/drone-ci/integration/README.md similarity index 100% rename from app/drone-ci/integration/README.md rename to cluster/prod/app/drone-ci/integration/README.md diff --git a/app/drone-ci/integration/docker-compose.yml b/cluster/prod/app/drone-ci/integration/docker-compose.yml similarity index 100% rename from app/drone-ci/integration/docker-compose.yml rename to cluster/prod/app/drone-ci/integration/docker-compose.yml diff --git a/app/drone-ci/secrets/drone-ci/cookie_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret similarity index 100% rename from app/drone-ci/secrets/drone-ci/cookie_secret rename to cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret diff --git a/app/drone-ci/secrets/drone-ci/db_enc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret similarity index 100% rename from app/drone-ci/secrets/drone-ci/db_enc_secret rename to cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret diff --git a/app/drone-ci/secrets/drone-ci/oauth_client_id b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id similarity index 100% rename from app/drone-ci/secrets/drone-ci/oauth_client_id rename to cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id diff --git a/app/drone-ci/secrets/drone-ci/oauth_client_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret similarity index 100% rename from app/drone-ci/secrets/drone-ci/oauth_client_secret rename to cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret diff --git a/app/drone-ci/secrets/drone-ci/rpc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret similarity index 100% rename from app/drone-ci/secrets/drone-ci/rpc_secret rename to cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret diff --git a/app/drone-ci/secrets/drone-ci/s3_ak b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak similarity index 100% rename from app/drone-ci/secrets/drone-ci/s3_ak rename to cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak diff --git a/app/drone-ci/secrets/drone-ci/s3_db_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket similarity index 100% rename from app/drone-ci/secrets/drone-ci/s3_db_bucket rename to cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket diff --git a/app/drone-ci/secrets/drone-ci/s3_sk b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk similarity index 100% rename from app/drone-ci/secrets/drone-ci/s3_sk rename to cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk diff --git a/app/drone-ci/secrets/drone-ci/s3_storage_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket similarity index 100% rename from app/drone-ci/secrets/drone-ci/s3_storage_bucket rename to cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket diff --git a/app/frontend/deploy/frontend-tricot-prod.hcl b/cluster/prod/app/frontend/deploy/frontend-tricot-prod.hcl similarity index 100% rename from app/frontend/deploy/frontend-tricot-prod.hcl rename to cluster/prod/app/frontend/deploy/frontend-tricot-prod.hcl diff --git a/app/jitsi/build/jitsi-conference-focus/0001-Remove-broken-command-line-args-parameters-setting.patch b/cluster/prod/app/jitsi/build/jitsi-conference-focus/0001-Remove-broken-command-line-args-parameters-setting.patch similarity index 100% rename from app/jitsi/build/jitsi-conference-focus/0001-Remove-broken-command-line-args-parameters-setting.patch rename to cluster/prod/app/jitsi/build/jitsi-conference-focus/0001-Remove-broken-command-line-args-parameters-setting.patch diff --git a/app/jitsi/build/jitsi-conference-focus/Dockerfile b/cluster/prod/app/jitsi/build/jitsi-conference-focus/Dockerfile similarity index 100% rename from app/jitsi/build/jitsi-conference-focus/Dockerfile rename to cluster/prod/app/jitsi/build/jitsi-conference-focus/Dockerfile diff --git a/app/jitsi/build/jitsi-conference-focus/jicofo b/cluster/prod/app/jitsi/build/jitsi-conference-focus/jicofo similarity index 100% rename from app/jitsi/build/jitsi-conference-focus/jicofo rename to cluster/prod/app/jitsi/build/jitsi-conference-focus/jicofo diff --git a/app/jitsi/build/jitsi-meet/Dockerfile b/cluster/prod/app/jitsi/build/jitsi-meet/Dockerfile similarity index 100% rename from app/jitsi/build/jitsi-meet/Dockerfile rename to cluster/prod/app/jitsi/build/jitsi-meet/Dockerfile diff --git a/app/jitsi/build/jitsi-videobridge/0001-Remove-deprecated-argument.patch b/cluster/prod/app/jitsi/build/jitsi-videobridge/0001-Remove-deprecated-argument.patch similarity index 100% rename from app/jitsi/build/jitsi-videobridge/0001-Remove-deprecated-argument.patch rename to cluster/prod/app/jitsi/build/jitsi-videobridge/0001-Remove-deprecated-argument.patch diff --git a/app/jitsi/build/jitsi-videobridge/Dockerfile b/cluster/prod/app/jitsi/build/jitsi-videobridge/Dockerfile similarity index 100% rename from app/jitsi/build/jitsi-videobridge/Dockerfile rename to cluster/prod/app/jitsi/build/jitsi-videobridge/Dockerfile diff --git a/app/jitsi/build/jitsi-videobridge/jvb_run b/cluster/prod/app/jitsi/build/jitsi-videobridge/jvb_run similarity index 100% rename from app/jitsi/build/jitsi-videobridge/jvb_run rename to cluster/prod/app/jitsi/build/jitsi-videobridge/jvb_run diff --git a/app/jitsi/build/jitsi-xmpp/Dockerfile b/cluster/prod/app/jitsi/build/jitsi-xmpp/Dockerfile similarity index 100% rename from app/jitsi/build/jitsi-xmpp/Dockerfile rename to cluster/prod/app/jitsi/build/jitsi-xmpp/Dockerfile diff --git a/app/jitsi/build/jitsi-xmpp/xmpp_prosody b/cluster/prod/app/jitsi/build/jitsi-xmpp/xmpp_prosody similarity index 100% rename from app/jitsi/build/jitsi-xmpp/xmpp_prosody rename to cluster/prod/app/jitsi/build/jitsi-xmpp/xmpp_prosody diff --git a/app/jitsi/config/config.js b/cluster/prod/app/jitsi/config/config.js similarity index 100% rename from app/jitsi/config/config.js rename to cluster/prod/app/jitsi/config/config.js diff --git a/app/jitsi/config/jicofo.conf b/cluster/prod/app/jitsi/config/jicofo.conf similarity index 100% rename from app/jitsi/config/jicofo.conf rename to cluster/prod/app/jitsi/config/jicofo.conf diff --git a/app/jitsi/config/nginx.conf b/cluster/prod/app/jitsi/config/nginx.conf similarity index 100% rename from app/jitsi/config/nginx.conf rename to cluster/prod/app/jitsi/config/nginx.conf diff --git a/app/jitsi/config/prosody.cfg.lua b/cluster/prod/app/jitsi/config/prosody.cfg.lua similarity index 100% rename from app/jitsi/config/prosody.cfg.lua rename to cluster/prod/app/jitsi/config/prosody.cfg.lua diff --git a/app/jitsi/config/videobridge.conf b/cluster/prod/app/jitsi/config/videobridge.conf similarity index 100% rename from app/jitsi/config/videobridge.conf rename to cluster/prod/app/jitsi/config/videobridge.conf diff --git a/app/jitsi/deploy/jitsi.hcl b/cluster/prod/app/jitsi/deploy/jitsi.hcl similarity index 100% rename from app/jitsi/deploy/jitsi.hcl rename to cluster/prod/app/jitsi/deploy/jitsi.hcl diff --git a/app/jitsi/integration/README.md b/cluster/prod/app/jitsi/integration/README.md similarity index 100% rename from app/jitsi/integration/README.md rename to cluster/prod/app/jitsi/integration/README.md diff --git a/app/jitsi/integration/docker-compose.yml b/cluster/prod/app/jitsi/integration/docker-compose.yml similarity index 100% rename from app/jitsi/integration/docker-compose.yml rename to cluster/prod/app/jitsi/integration/docker-compose.yml diff --git a/app/jitsi/integration/jicofo/jicofo.conf b/cluster/prod/app/jitsi/integration/jicofo/jicofo.conf similarity index 100% rename from app/jitsi/integration/jicofo/jicofo.conf rename to cluster/prod/app/jitsi/integration/jicofo/jicofo.conf diff --git a/app/jitsi/integration/jvb/logging.properties b/cluster/prod/app/jitsi/integration/jvb/logging.properties similarity index 100% rename from app/jitsi/integration/jvb/logging.properties rename to cluster/prod/app/jitsi/integration/jvb/logging.properties diff --git a/app/jitsi/integration/jvb/videobridge.conf b/cluster/prod/app/jitsi/integration/jvb/videobridge.conf similarity index 100% rename from app/jitsi/integration/jvb/videobridge.conf rename to cluster/prod/app/jitsi/integration/jvb/videobridge.conf diff --git a/app/jitsi/integration/meet/config.js b/cluster/prod/app/jitsi/integration/meet/config.js similarity index 100% rename from app/jitsi/integration/meet/config.js rename to cluster/prod/app/jitsi/integration/meet/config.js diff --git a/app/jitsi/integration/meet/nginx.conf b/cluster/prod/app/jitsi/integration/meet/nginx.conf similarity index 100% rename from app/jitsi/integration/meet/nginx.conf rename to cluster/prod/app/jitsi/integration/meet/nginx.conf diff --git a/app/jitsi/integration/prosody/prosody.cfg.lua b/cluster/prod/app/jitsi/integration/prosody/prosody.cfg.lua similarity index 100% rename from app/jitsi/integration/prosody/prosody.cfg.lua rename to cluster/prod/app/jitsi/integration/prosody/prosody.cfg.lua diff --git a/app/jitsi/integration/prosody/prosody.cfg.lua.back b/cluster/prod/app/jitsi/integration/prosody/prosody.cfg.lua.back similarity index 100% rename from app/jitsi/integration/prosody/prosody.cfg.lua.back rename to cluster/prod/app/jitsi/integration/prosody/prosody.cfg.lua.back diff --git a/app/jitsi/secrets/jitsi/auth.jitsi.crt b/cluster/prod/app/jitsi/secrets/jitsi/auth.jitsi.crt similarity index 100% rename from app/jitsi/secrets/jitsi/auth.jitsi.crt rename to cluster/prod/app/jitsi/secrets/jitsi/auth.jitsi.crt diff --git a/app/jitsi/secrets/jitsi/auth.jitsi.key b/cluster/prod/app/jitsi/secrets/jitsi/auth.jitsi.key similarity index 100% rename from app/jitsi/secrets/jitsi/auth.jitsi.key rename to cluster/prod/app/jitsi/secrets/jitsi/auth.jitsi.key diff --git a/app/jitsi/secrets/jitsi/jicofo_pass b/cluster/prod/app/jitsi/secrets/jitsi/jicofo_pass similarity index 100% rename from app/jitsi/secrets/jitsi/jicofo_pass rename to cluster/prod/app/jitsi/secrets/jitsi/jicofo_pass diff --git a/app/jitsi/secrets/jitsi/jitsi.crt b/cluster/prod/app/jitsi/secrets/jitsi/jitsi.crt similarity index 100% rename from app/jitsi/secrets/jitsi/jitsi.crt rename to cluster/prod/app/jitsi/secrets/jitsi/jitsi.crt diff --git a/app/jitsi/secrets/jitsi/jitsi.key b/cluster/prod/app/jitsi/secrets/jitsi/jitsi.key similarity index 100% rename from app/jitsi/secrets/jitsi/jitsi.key rename to cluster/prod/app/jitsi/secrets/jitsi/jitsi.key diff --git a/app/jitsi/secrets/jitsi/jvb_pass b/cluster/prod/app/jitsi/secrets/jitsi/jvb_pass similarity index 100% rename from app/jitsi/secrets/jitsi/jvb_pass rename to cluster/prod/app/jitsi/secrets/jitsi/jvb_pass diff --git a/cluster/prod/garage/config/garage.toml b/cluster/prod/garage/config/garage.toml new file mode 100644 index 0000000..a721886 --- /dev/null +++ b/cluster/prod/garage/config/garage.toml @@ -0,0 +1,24 @@ +block_size = 1048576 + +metadata_dir = "/meta" +data_dir = "/data" + +replication_mode = "3" + +rpc_bind_addr = "[::]:3901" +rpc_secret = "{{ key "secrets/garage/rpc_secret" | trimSpace }}" + +sled_cache_capacity = 536870912 +sled_sync_interval_ms = 10000 + +[s3_api] +s3_region = "garage" +api_bind_addr = "[::]:3900" +root_domain = ".garage.deuxfleurs.fr" + +[s3_web] +bind_addr = "[::]:3902" +root_domain = ".web.deuxfleurs.fr" + +[admin] +api_bind_addr = "[::1]:3903" diff --git a/cluster/prod/garage/deploy/garage.hcl b/cluster/prod/garage/deploy/garage.hcl new file mode 100644 index 0000000..665515a --- /dev/null +++ b/cluster/prod/garage/deploy/garage.hcl @@ -0,0 +1,131 @@ +job "garage" { + datacenters = ["dc1", "saturne", "neptune"] + type = "system" + priority = 80 + + constraint { + attribute = "${attr.cpu.arch}" + value = "amd64" + } + + group "garage" { + network { + port "s3" { static = 3900 } + port "rpc" { static = 3901 } + port "web" { static = 3902 } + } + + update { + max_parallel = 1 + min_healthy_time = "30s" + healthy_deadline = "5m" + } + + task "server" { + driver = "docker" + config { + advertise_ipv6_address = true + image = "dxflrs/amd64_garage:v0.7.1" + command = "/garage" + args = [ "server" ] + network_mode = "host" + volumes = [ + "/mnt/storage/garage/data:/data", + "/mnt/ssd/garage/meta:/meta", + "secrets/garage.toml:/etc/garage.toml", + ] + logging { + type = "journald" + } + } + + template { + data = file("../config/garage.toml") + destination = "secrets/garage.toml" + } + + resources { + memory = 1500 + cpu = 1000 + } + + kill_signal = "SIGINT" + kill_timeout = "20s" + + service { + tags = [ + "garage_api", + "tricot garage.deuxfleurs.fr", + "tricot *.garage.deuxfleurs.fr", + ] + port = 3900 + address_mode = "driver" + name = "garage-api" + check { + type = "tcp" + port = 3900 + address_mode = "driver" + interval = "60s" + timeout = "5s" + check_restart { + limit = 3 + grace = "90s" + ignore_warnings = false + } + } + } + + service { + tags = ["garage-rpc"] + port = 3901 + address_mode = "driver" + name = "garage-rpc" + check { + type = "tcp" + port = 3901 + address_mode = "driver" + interval = "60s" + timeout = "5s" + check_restart { + limit = 3 + grace = "90s" + ignore_warnings = false + } + } + } + + service { + tags = [ + "garage-web", + "tricot * 1", + "tricot-add-header Content-Security-Policy default-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://code.jquery.com/; frame-ancestors 'self'", + "tricot-add-header Strict-Transport-Security max-age=63072000; includeSubDomains; preload", + "tricot-add-header X-Frame-Options SAMEORIGIN", + "tricot-add-header X-XSS-Protection 1; mode=block", + ] + port = 3902 + address_mode = "driver" + name = "garage-web" + check { + type = "tcp" + port = 3902 + address_mode = "driver" + interval = "60s" + timeout = "5s" + check_restart { + limit = 3 + grace = "90s" + ignore_warnings = false + } + } + } + + restart { + interval = "30m" + attempts = 10 + delay = "15s" + mode = "delay" + } + } + } +} diff --git a/app/garage-staging/secrets/garage-staging/rpc_secret b/cluster/prod/garage/secrets/garage/rpc_secret similarity index 100% rename from app/garage-staging/secrets/garage-staging/rpc_secret rename to cluster/prod/garage/secrets/garage/rpc_secret diff --git a/app/directory/config/bottin/config.json.tpl b/cluster/staging/app/directory/config/bottin/config.json.tpl similarity index 100% rename from app/directory/config/bottin/config.json.tpl rename to cluster/staging/app/directory/config/bottin/config.json.tpl diff --git a/app/directory/config/guichet/config.json.tpl b/cluster/staging/app/directory/config/guichet/config.json.tpl similarity index 100% rename from app/directory/config/guichet/config.json.tpl rename to cluster/staging/app/directory/config/guichet/config.json.tpl diff --git a/app/directory/deploy/directory.hcl b/cluster/staging/app/directory/deploy/directory.hcl similarity index 100% rename from app/directory/deploy/directory.hcl rename to cluster/staging/app/directory/deploy/directory.hcl diff --git a/app/directory/secrets/directory/guichet/mail_domain b/cluster/staging/app/directory/secrets/directory/guichet/mail_domain similarity index 100% rename from app/directory/secrets/directory/guichet/mail_domain rename to cluster/staging/app/directory/secrets/directory/guichet/mail_domain diff --git a/app/directory/secrets/directory/guichet/mail_from b/cluster/staging/app/directory/secrets/directory/guichet/mail_from similarity index 100% rename from app/directory/secrets/directory/guichet/mail_from rename to cluster/staging/app/directory/secrets/directory/guichet/mail_from diff --git a/app/directory/secrets/directory/guichet/s3_access_key b/cluster/staging/app/directory/secrets/directory/guichet/s3_access_key similarity index 100% rename from app/directory/secrets/directory/guichet/s3_access_key rename to cluster/staging/app/directory/secrets/directory/guichet/s3_access_key diff --git a/app/directory/secrets/directory/guichet/s3_bucket b/cluster/staging/app/directory/secrets/directory/guichet/s3_bucket similarity index 100% rename from app/directory/secrets/directory/guichet/s3_bucket rename to cluster/staging/app/directory/secrets/directory/guichet/s3_bucket diff --git a/app/directory/secrets/directory/guichet/s3_endpoint b/cluster/staging/app/directory/secrets/directory/guichet/s3_endpoint similarity index 100% rename from app/directory/secrets/directory/guichet/s3_endpoint rename to cluster/staging/app/directory/secrets/directory/guichet/s3_endpoint diff --git a/app/directory/secrets/directory/guichet/s3_region b/cluster/staging/app/directory/secrets/directory/guichet/s3_region similarity index 100% rename from app/directory/secrets/directory/guichet/s3_region rename to cluster/staging/app/directory/secrets/directory/guichet/s3_region diff --git a/app/directory/secrets/directory/guichet/s3_secret_key b/cluster/staging/app/directory/secrets/directory/guichet/s3_secret_key similarity index 100% rename from app/directory/secrets/directory/guichet/s3_secret_key rename to cluster/staging/app/directory/secrets/directory/guichet/s3_secret_key diff --git a/app/directory/secrets/directory/guichet/smtp_pass b/cluster/staging/app/directory/secrets/directory/guichet/smtp_pass similarity index 100% rename from app/directory/secrets/directory/guichet/smtp_pass rename to cluster/staging/app/directory/secrets/directory/guichet/smtp_pass diff --git a/app/directory/secrets/directory/guichet/smtp_server b/cluster/staging/app/directory/secrets/directory/guichet/smtp_server similarity index 100% rename from app/directory/secrets/directory/guichet/smtp_server rename to cluster/staging/app/directory/secrets/directory/guichet/smtp_server diff --git a/app/directory/secrets/directory/guichet/smtp_user b/cluster/staging/app/directory/secrets/directory/guichet/smtp_user similarity index 100% rename from app/directory/secrets/directory/guichet/smtp_user rename to cluster/staging/app/directory/secrets/directory/guichet/smtp_user diff --git a/app/directory/secrets/directory/guichet/web_hostname b/cluster/staging/app/directory/secrets/directory/guichet/web_hostname similarity index 100% rename from app/directory/secrets/directory/guichet/web_hostname rename to cluster/staging/app/directory/secrets/directory/guichet/web_hostname diff --git a/app/directory/secrets/directory/ldap_base_dn b/cluster/staging/app/directory/secrets/directory/ldap_base_dn similarity index 100% rename from app/directory/secrets/directory/ldap_base_dn rename to cluster/staging/app/directory/secrets/directory/ldap_base_dn diff --git a/app/docker-compose.yml b/cluster/staging/app/docker-compose.yml similarity index 100% rename from app/docker-compose.yml rename to cluster/staging/app/docker-compose.yml diff --git a/app/drone-ci/build/.gitignore b/cluster/staging/app/drone-ci/build/.gitignore similarity index 100% rename from app/drone-ci/build/.gitignore rename to cluster/staging/app/drone-ci/build/.gitignore diff --git a/app/drone-ci/build/Makefile b/cluster/staging/app/drone-ci/build/Makefile similarity index 100% rename from app/drone-ci/build/Makefile rename to cluster/staging/app/drone-ci/build/Makefile diff --git a/app/drone-ci/build/build-qcow2.nix b/cluster/staging/app/drone-ci/build/build-qcow2.nix similarity index 100% rename from app/drone-ci/build/build-qcow2.nix rename to cluster/staging/app/drone-ci/build/build-qcow2.nix diff --git a/app/drone-ci/build/machine-config.nix b/cluster/staging/app/drone-ci/build/machine-config.nix similarity index 100% rename from app/drone-ci/build/machine-config.nix rename to cluster/staging/app/drone-ci/build/machine-config.nix diff --git a/app/drone-ci/deploy/bad-runner-vm.hcl b/cluster/staging/app/drone-ci/deploy/bad-runner-vm.hcl similarity index 100% rename from app/drone-ci/deploy/bad-runner-vm.hcl rename to cluster/staging/app/drone-ci/deploy/bad-runner-vm.hcl diff --git a/app/drone-ci/deploy/runner-docker.hcl b/cluster/staging/app/drone-ci/deploy/runner-docker.hcl similarity index 100% rename from app/drone-ci/deploy/runner-docker.hcl rename to cluster/staging/app/drone-ci/deploy/runner-docker.hcl diff --git a/app/frontend/deploy/frontend-tricot.hcl b/cluster/staging/app/frontend/deploy/frontend-tricot.hcl similarity index 100% rename from app/frontend/deploy/frontend-tricot.hcl rename to cluster/staging/app/frontend/deploy/frontend-tricot.hcl diff --git a/app/garage-staging/config/garage.toml b/cluster/staging/app/garage/config/garage.toml similarity index 100% rename from app/garage-staging/config/garage.toml rename to cluster/staging/app/garage/config/garage.toml diff --git a/app/garage-staging/deploy/garage.hcl b/cluster/staging/app/garage/deploy/garage.hcl similarity index 100% rename from app/garage-staging/deploy/garage.hcl rename to cluster/staging/app/garage/deploy/garage.hcl diff --git a/cluster/staging/app/garage/secrets/garage-staging/rpc_secret b/cluster/staging/app/garage/secrets/garage-staging/rpc_secret new file mode 100644 index 0000000..d831d53 --- /dev/null +++ b/cluster/staging/app/garage/secrets/garage-staging/rpc_secret @@ -0,0 +1 @@ +CMD_ONCE openssl rand -hex 32 diff --git a/app/im/build/matrix-synapse/Dockerfile b/cluster/staging/app/im/build/matrix-synapse/Dockerfile similarity index 100% rename from app/im/build/matrix-synapse/Dockerfile rename to cluster/staging/app/im/build/matrix-synapse/Dockerfile diff --git a/app/im/build/matrix-synapse/entrypoint.sh b/cluster/staging/app/im/build/matrix-synapse/entrypoint.sh similarity index 100% rename from app/im/build/matrix-synapse/entrypoint.sh rename to cluster/staging/app/im/build/matrix-synapse/entrypoint.sh diff --git a/app/im/build/matrix-synapse/matrix-s3-async b/cluster/staging/app/im/build/matrix-synapse/matrix-s3-async similarity index 100% rename from app/im/build/matrix-synapse/matrix-s3-async rename to cluster/staging/app/im/build/matrix-synapse/matrix-s3-async diff --git a/app/im/build/matrix-synapse/matrix-s3-async-sqlite b/cluster/staging/app/im/build/matrix-synapse/matrix-s3-async-sqlite similarity index 100% rename from app/im/build/matrix-synapse/matrix-s3-async-sqlite rename to cluster/staging/app/im/build/matrix-synapse/matrix-s3-async-sqlite diff --git a/app/im/config/homeserver.yaml b/cluster/staging/app/im/config/homeserver.yaml similarity index 100% rename from app/im/config/homeserver.yaml rename to cluster/staging/app/im/config/homeserver.yaml diff --git a/app/im/config/litestream.yml b/cluster/staging/app/im/config/litestream.yml similarity index 100% rename from app/im/config/litestream.yml rename to cluster/staging/app/im/config/litestream.yml diff --git a/app/im/config/synapse.log.config.yaml b/cluster/staging/app/im/config/synapse.log.config.yaml similarity index 100% rename from app/im/config/synapse.log.config.yaml rename to cluster/staging/app/im/config/synapse.log.config.yaml diff --git a/app/im/deploy/im.hcl b/cluster/staging/app/im/deploy/im.hcl similarity index 100% rename from app/im/deploy/im.hcl rename to cluster/staging/app/im/deploy/im.hcl diff --git a/app/im/secrets/synapse/form_secret b/cluster/staging/app/im/secrets/synapse/form_secret similarity index 100% rename from app/im/secrets/synapse/form_secret rename to cluster/staging/app/im/secrets/synapse/form_secret diff --git a/app/im/secrets/synapse/macaroon_secret_key b/cluster/staging/app/im/secrets/synapse/macaroon_secret_key similarity index 100% rename from app/im/secrets/synapse/macaroon_secret_key rename to cluster/staging/app/im/secrets/synapse/macaroon_secret_key diff --git a/app/im/secrets/synapse/registration_shared_secret b/cluster/staging/app/im/secrets/synapse/registration_shared_secret similarity index 100% rename from app/im/secrets/synapse/registration_shared_secret rename to cluster/staging/app/im/secrets/synapse/registration_shared_secret diff --git a/app/im/secrets/synapse/s3_access_key b/cluster/staging/app/im/secrets/synapse/s3_access_key similarity index 100% rename from app/im/secrets/synapse/s3_access_key rename to cluster/staging/app/im/secrets/synapse/s3_access_key diff --git a/app/im/secrets/synapse/s3_secret_key b/cluster/staging/app/im/secrets/synapse/s3_secret_key similarity index 100% rename from app/im/secrets/synapse/s3_secret_key rename to cluster/staging/app/im/secrets/synapse/s3_secret_key diff --git a/app/im/secrets/synapse/signing_key b/cluster/staging/app/im/secrets/synapse/signing_key similarity index 100% rename from app/im/secrets/synapse/signing_key rename to cluster/staging/app/im/secrets/synapse/signing_key diff --git a/app/telemetry/config/apm-config.yaml b/cluster/staging/app/telemetry/config/apm-config.yaml similarity index 100% rename from app/telemetry/config/apm-config.yaml rename to cluster/staging/app/telemetry/config/apm-config.yaml diff --git a/app/telemetry/config/filebeat.yml b/cluster/staging/app/telemetry/config/filebeat.yml similarity index 100% rename from app/telemetry/config/filebeat.yml rename to cluster/staging/app/telemetry/config/filebeat.yml diff --git a/app/telemetry/config/grafana-litestream.yml b/cluster/staging/app/telemetry/config/grafana-litestream.yml similarity index 100% rename from app/telemetry/config/grafana-litestream.yml rename to cluster/staging/app/telemetry/config/grafana-litestream.yml diff --git a/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml b/cluster/staging/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml similarity index 100% rename from app/telemetry/config/grafana/provisioning/datasources/elastic.yaml rename to cluster/staging/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml diff --git a/app/telemetry/config/otel-config.yaml b/cluster/staging/app/telemetry/config/otel-config.yaml similarity index 100% rename from app/telemetry/config/otel-config.yaml rename to cluster/staging/app/telemetry/config/otel-config.yaml diff --git a/app/telemetry/deploy/telemetry-system.hcl b/cluster/staging/app/telemetry/deploy/telemetry-system.hcl similarity index 100% rename from app/telemetry/deploy/telemetry-system.hcl rename to cluster/staging/app/telemetry/deploy/telemetry-system.hcl diff --git a/app/telemetry/deploy/telemetry.hcl b/cluster/staging/app/telemetry/deploy/telemetry.hcl similarity index 100% rename from app/telemetry/deploy/telemetry.hcl rename to cluster/staging/app/telemetry/deploy/telemetry.hcl