media-async-upload must be in the matrix group

note: the group stanza is not mandatory
Synapse does not use GlusterFS anymore
2021-09-20 09:52:13 +02:00 · 2021-09-17 18:49:45 +02:00 · 2021-09-17 18:24:00 +02:00 · 2021-09-17 17:42:16 +02:00 · 2021-09-17 17:41:57 +02:00 · 2021-09-14 17:46:06 +02:00
354 changed files with 6923 additions and 3822 deletions
--- a/.gitmodules
+++ b/.gitmodules
@ -1,5 +1,5 @@
 [submodule "docker/static/goStatic"]
-	path = docker/static/goStatic
+	path = app/build/static/goStatic
 	url = https://github.com/PierreZ/goStatic
 [submodule "docker/blog/quentin.dufour.io"]
 	path = docker/blog-quentin/quentin.dufour.io
--- a/README.md
+++ b/README.md
@ -5,42 +5,53 @@ deuxfleurs.fr

 ## Our abstraction stack

-We try to build a generic abstraction stack between our different resources (CPU, RAM, disk, etc.) and our services (Chat, Storage, etc.):
+We try to build a generic abstraction stack between our different resources (CPU, RAM, disk, etc.) and our services (Chat, Storage, etc.), we develop our own tools when needed:

-  * ansible (physical node conf)
-  * nomad (schedule containers)
-  * consul (distributed key value store / lock / service discovery)
-  * glusterfs (file storage)
-  * stolon + postgresql (distributed relational database)
-  * docker (container tool)
-  * bottin (LDAP server, auth)
+  * **[garage](https://git.deuxfleurs.fr/Deuxfleurs/garage/):** S3-compatible lightweight object store for self-hosted geo-distributed deployments (we also have a legacy glusterfs cluster)
+  * **[diplonat](https://git.deuxfleurs.fr/Deuxfleurs/diplonat):** network automation (firewalling, upnp igd)
+  * **[bottin](https://git.deuxfleurs.fr/Deuxfleurs/bottin):** authentication and authorization (LDAP protocol, consul backend)
+  * **[guichet](https://git.deuxfleurs.fr/Deuxfleurs/guichet):** a dashboard for our users and administrators
+  * **ansible:** physical node configuration
+  * **nomad:** schedule containers and handle their lifecycle
+  * **consul:** distributed key value store + lock + service discovery
+  * **stolon + postgresql:** distributed relational database
+  * **docker:** package, distribute and isolate applications

 Some services we provide:

-  * Chat (Matrix/Riot)
-  * Email (Postfix/Dovecot/Sogo)
-  * Storage (Seafile)
+  * **Websites:** garage (static) + fediverse blog (plume)
+  * **Chat:** Synapse + Element Web (Matrix protocol)
+  * **Email:** Postfix SMTP + Dovecot IMAP + opendkim DKIM + Sogo webmail (legacy) | Alps webmail (experimental)
+  * **Storage:** Seafile (legacy) | Nextcloud (experimental)
+  * **Visio:** Jitsi

 As a generic abstraction is provided, deploying new services should be easy.

+## I am lost, how this repo works?
+
+To ease the development, we make the choice of a fully integrated environment
+
+  1. `os` the base os for the cluster
+      1. `build`: where you will build our OS image based on Debian that you will install on your server
+      2. `config`: our Ansible recipes to configure and update your freshly installed server
+  2. `apps` apps we deploy on the cluster
+      1. `build`: our Docker files to build immutable images of our applications
+      2. `integration`: Our Docker compose files to test locally how our built images interact together
+      3. `config`: Files containing application configurations to be deployed on Consul Key Value Store
+      4. `deployment`: Files containing application definitions to be deployed on Nomad Scheduler
+  3. `op_guide`: Guides to explain you operations you can do cluster wide (like configuring postgres)
+
+
 ## Start hacking

-### Clone the repository
-
-```
-git clone https://gitlab.com/superboum/deuxfleurs.fr.git
-git submodule init
-git submodule update
-```
-
 ### Deploying/Updating new services is done from your machine

-*The following instructions are provided for ops that already have access to the servers.*
+*The following instructions are provided for ops that already have access to the servers (meaning: their SSH public key is known by the cluster).*

 Deploy Nomad on your machine:

 ```bash
-export NOMAD_VER=0.9.1
+export NOMAD_VER=1.0.1
 wget https://releases.hashicorp.com/nomad/${NOMAD_VER}/nomad_${NOMAD_VER}_linux_amd64.zip
 unzip nomad_${NOMAD_VER}_linux_amd64.zip
 sudo mv nomad /usr/local/bin
@ -50,7 +61,7 @@ rm nomad_${NOMAD_VER}_linux_amd64.zip
 Deploy Consul on your machine:

 ```bash
-export CONSUL_VER=1.5.1
+export CONSUL_VER=1.9.0
 wget https://releases.hashicorp.com/consul/${CONSUL_VER}/consul_${CONSUL_VER}_linux_amd64.zip
 unzip consul_${CONSUL_VER}_linux_amd64.zip
 sudo mv consul /usr/local/bin
@ -63,14 +74,37 @@ Create an alias (and put it in your `.bashrc`) to bind APIs on your machine:
 alias bind_df="ssh \
  -p110 \
  -N \
+  -L 1389:bottin2.service.2.cluster.deuxfleurs.fr:389 \
  -L 4646:127.0.0.1:4646 \
+  -L 5432:psql-proxy.service.2.cluster.deuxfleurs.fr:5432 \
+  -L 8082:traefik-admin.service.2.cluster.deuxfleurs.fr:8082 \
  -L 8500:127.0.0.1:8500 \
-  -L 8082:traefik.service.2.cluster.deuxfleurs.fr:8082 \
  <a server from the cluster>"
 ```

 and run: 

+    bind_df
+
+Adrien uses `.ssh/config` configuration instead. I works basically the same. Here it goes:
+
 ```
-bind_df
+# in ~/.ssh/config 
+
+Host deuxfleurs
+    User adrien
+    Hostname deuxfleurs.fr
+    # If you don't use the default ~/.ssh/id_rsa to connect to Deuxfleurs
+    IdentityFile <some_key_path>
+    PubKeyAuthentication yes
+    ForwardAgent No
+    LocalForward 1389 bottin2.service.2.cluster.deuxfleurs.fr:389
+    LocalForward 4646 127.0.0.1:4646
+    LocalForward 5432 psql-proxy.service.2.cluster.deuxfleurs.fr:5432
+    LocalForward 8082 traefik-admin.service.2.cluster.deuxfleurs.fr:8082
+    LocalForward 8500 127.0.0.1:8500
 ```
+
+Now, to connect, do the following:
+
+    ssh deuxfleurs -N 
--- a/administratif/.gitignore
+++ b/administratif/.gitignore
@ -1,5 +0,0 @@
-*.aux
-*.fdb_latexmk
-*.fls
-*.log
-*.pdf
--- a/administratif/2020-01-13-pv-ag.tex
+++ b/administratif/2020-01-13-pv-ag.tex
@ -1,68 +0,0 @@
-\documentclass[a4paper,DIV=12]{scrartcl}
-\usepackage[french]{babel}
-
-% On abuse komafont pour réduire la place prise par le titre
-\addtokomafont{title}{\vspace*{-3em}}
-\addtokomafont{author}{\vspace*{-1em}}
-\addtokomafont{date}{\vspace*{-0.5em}}
-
-% On ajoute "Article" devant les sections
-\renewcommand\sectionformat{Article\enskip\thesection~:\hspace{1em}}
-
-% On réduit la taille des sections
-\addtokomafont{section}{\large}
-
-% On rajoute un peu d'espace entre les paragraphes
-\setlength{\parskip}{.8em}
-
-% On enlève de la place après les titres
-% (je n'ai pas pu utiliser le paquet dédié titlesec car il cause plein d'erreurs)
-%\titlespacing\section{1pt}{*4}{*1.5}
-\let\oldsection\section
-\renewcommand{\section}[1]{\oldsection{#1}\vspace{-1em}}
-
-\title{Procès-verbal de l’assemblée générale constitutive de l'association Deuxfleurs}
-\date{13 janvier 2020}
-\author{Association Deuxfleurs\\10A Allée de Lanvaux, 35700 Rennes}
-\begin{document}
-
-\maketitle
-Le 13 janvier 2020 à 19 heures, les fondateurs de l’association Deuxfleurs se sont réunis en assemblée générale constitutive au 24 rue des Tanneurs à Rennes. Sont présents Adrien, Alex, Anaïs, Axelle, Louison, Maximilien, Quentin, Rémi et Vincent.
-
-L’assemblée générale désigne Adrien Luxey en qualité de président de séance et Quentin Dufour en qualité de secrétaire de séance.
-Le président de séance met à la disposition des présents le projet de statuts de l’association et l’état des actes passés pour le compte de l’association en formation.
-
-Puis il rappelle que l’assemblée générale constitutive est appelée à statuer sur l’ordre du jour suivant :
-
-\begin{itemize}
-  \item présentation du projet de constitution de l’association ;
-  \item présentation du projet de statuts ;
-  \item adoption des statuts ;
-  \item désignation des premiers membres du conseil ;
-  \item pouvoirs en vue des formalités de déclaration et publication.
-\end{itemize}
-
-Enfin, le président de séance expose les motifs du projet de création de l’association et commente le projet de statuts.
-Il ouvre la discussion. Un débat s’instaure entre les membres de l’assemblée.
-
-Après quoi, personne ne demandant plus la parole, le président met successivement aux voix les délibérations suivantes.
-
-\paragraph{1\iere~délibération} L’assemblée générale adopte les statuts dont le projet lui a été soumis.
-Cette délibération est adoptée à l’unanimité.
-
-\paragraph{2\ieme~délibération} L’assemblée générale constitutive désigne en qualité de premiers membres du conseil d'administration :
-
-\begin{itemize}
-  \item Adrien Luxey
-  \item Alex Auvolat
-  \item Maximilien Richer
-  \item Quentin Dufour
-  \item Vincent Giraud
-\end{itemize}
-
-Conformément aux statuts, cette désignation est faite pour une durée expirant lors de l’assemblée générale qui sera appelée à statuer sur les comptes de l’exercice clos le 13 janvier 2021.
-Les membres du conseil ainsi désignés acceptent leurs fonctions
-
-Nom, prénom et signature du président et du secrétaire de séance
-
-\end{document}
--- a/administratif/2020-01-13-statuts.tex
+++ b/administratif/2020-01-13-statuts.tex
@ -1,104 +0,0 @@
-\documentclass[a4paper,DIV=12]{scrartcl}
-\usepackage[frenchb]{babel}
-
-% On abuse komafont pour réduire la place prise par le titre
-\addtokomafont{title}{\vspace*{-3em}}
-\addtokomafont{author}{\vspace*{-1em}}
-\addtokomafont{date}{\vspace*{-2em}}
-
-% On ajoute "Article" devant les sections
-\renewcommand\sectionformat{Article\enskip\thesection~:\hspace{1em}}
-
-% On réduit la taille des sections
-\addtokomafont{section}{\large}
-
-% On rajoute un peu d'espace entre les paragraphes
-\setlength{\parskip}{.8em}
-
-% On enlève de la place après les titres
-% (je n'ai pas pu utiliser le paquet dédié titlesec car il cause plein d'erreurs)
-%\titlespacing\section{1pt}{*4}{*1.5}
-\let\oldsection\section
-\renewcommand{\section}[1]{\oldsection{#1}\vspace{-1em}}
-
-\title{Statuts de l'association Deuxfleurs}
-\date{13 janvier 2020}
-
-\begin{document}
-
-\maketitle
-
-\section{Constitution et dénomination}
-Il est fondé entre les adhérents aux présents statuts une association régie par la loi 1901, ayant pour titre Deuxfleurs.
-
-\section{Buts}
-Cette association a pour but de défendre et promouvoir les libertés individuelles et collectives à travers la mise en place d'infrastuctures numériques libres.
-
-\section{Siège social}
-Le siège social est fixé au 10A, Allée de Lanvaux, 35700 Rennes.
-Il pourra être transféré suite à un vote par l'assemblée générale. 
-
-\section{Durée de l'association}
-L'association perdure tant qu'elle possède au moins un membre, ou jusqu'à sa dissolution décidée en assemblée générale.
-
-\section{Admission et adhésion}\label{article:admission}
-Pour faire partie de l'association, il faut être coopté par un membre de l'association, adhérer aux présents statuts et s'acquitter de la cotisation annuelle dont le montant est de 10 euros.
-
-\section{Composition de l'association}
-L'association se compose exclusivement de membres admis selon les dispositions de l'article~\ref{article:admission} et à jour de leur cotisation.
-Tout membre actif possède une voix lors des votes en assemblée générale.
-Est considéré actif tout membre présent à l'assemblée générale (physiquement, par visioconférence ou par procuration écrite donnée à un autre membre de l'association).
-
-\section{Perte de la qualité de membre}
-La qualité de membre se perd par :
-
-\begin{itemize}
-  \item la démission,
-  \item le non-renouvelement de la cotisation dans un délai de deux mois après le 1er Janvier de l'année courante,
-  \item le décès,
-  \item la radiation prononcée aux deux tiers des votes exprimés, lors d'un vote extraordinaire ou de l'assemblée générale.
-\end{itemize}
-
-\section{L'assemblée générale}\label{article:ag}
-L'assemblée générale ordinaire se réunit au moins une fois par an, convoquée par le conseil d'administration.
-L’assemblée générale extraordinaire est convoquée par le conseil d’administration, à la demande de celui-ci ou à la demande du quart au moins des membres de l'association. 
-
-L'assemblée générale (ordinaire ou extraordinaire) comprend tous les membres de l'association à jour de leur cotisation.
-Quinze jours au moins avant la date fixée, les membres de l'association sont convoqués via la liste de diffusion de l'association et l'ordre du jour est inscrit sur les convocations. 
-
-Le conseil d’administration anime l’assemblée générale.
-L’assemblée générale, après avoir délibéré, se  prononce  sur  le  rapport  moral  et/ou  d'activités.  
-Le  conseil  d’administration rend  compte de l'exercice financier clos et soumet le bilan de l’exercice clos à l’approbation de l’assemblée dans un délai de six mois après la clôture des comptes.
-L’assemblée générale délibère sur les orientations à venir et se prononce sur le budget prévisionnel de l’année en cours. 
-
-Elle pourvoit, au scrutin secret, à la nomination ou au renouvellement des membres du conseil d'administration via un scrutin de Condorcet Randomisé.
-Elle fixe le montant de la cotisation annuelle. 
-Les décisions de l'assemblée sont prises à la majorité des membres présents ou représentés. 
-Chaque membre présent ne peut détenir plus d'une procuration.
-
-\section{Membres mineurs}
-Les mineurs peuvent adhérer à l’association sous réserve d’un accord tacite ou d’une autorisation écrite de leurs parents ou tuteurs légaux.
-Ils sont membres à part entière de l’association.
-Seuls les membres âgés de 16 ans au moins au jour d’une élection sont autorisés à y voter, notamment au cours d'une assemblée générale.
-Pour les autres, leur droit de vote est transmis à leur représentant légal.
-
-\section{Le conseil d'administration}
-L'association est administrée par un conseil d'administration composé de 3 à 6 membres, élus pour 1 an dans les conditions fixées à l’article~\ref{article:ag}.
-Tous les membres de l’association à jour de leur cotisation sont éligibles.  
-En  cas  de  vacance  de  poste,  le  conseil  d'administration  peut pourvoir provisoirement  au remplacement  de  ses  membres. Ce remplacement est obligatoire quand le conseil d'administration compte moins de 3 membres.
-Il est procédé à leur remplacement  définitif  à  la  plus  prochaine assemblée  générale.
-Les pouvoirs des membres ainsi élus prennent fin à l'époque  où  devrait normalement expirer le mandat des membres remplacés. 
-
-Le conseil d’administration met en œuvre les décisions de l’assemblée générale, organise et anime la vie de l’association, dans  le cadre fixé par les statuts. 
-Chacun de ses membres peut être habilité par le conseil à remplir toutes les formalités de déclaration et de publication prescrites par la législation et  tout  autre  acte  nécessaire  au  fonctionnement  de l’association  et  décidé  par  le  conseil d’administration. 
-Tous les membres du conseil d’administration sont responsables des engagements contractés par l’association.
-Tout contrat ou convention passé entre l’association d'une part, et un membre du conseil d'administration,  son  conjoint  ou  un  proche,  d'autre part,  est  soumis  pour  autorisation  au  conseil d'administration et présenté pour information à la plus prochaine assemblée générale.
-Le conseil d’administration se réunit au moins 4 fois par an et toutes les fois qu'il est convoqué par le tiers de ses membres. 
-La présence de la moitié au moins des membres du conseil est nécessaire pour que le conseil d'administration puisse délibérer valablement.
-Les décisions sont prises au consensus et, à défaut, à la majorité des voix des présents. Le vote par procuration n'est pas autorisé.
-
-\section{Modification des statuts de l'association}
-
-Sur demande d'un tiers des membres actifs, ou sur demande du conseil d'administration, des amendements aux statuts de l'association peuvent être discutés et soumis au vote lors d'une assemblée générale, selon les modalités de l'article~\ref{article:ag}.
-
-\end{document}
--- a/administratif/README.md
+++ b/administratif/README.md
@ -1,3 +0,0 @@
-# Documents administatifs
-
-__Statuts__ : Pour compiler les statuts, faites `latexmk -pdf statuts.tex`
--- a/ansible/README.md
+++ b/ansible/README.md
@ -1,15 +0,0 @@
-# ANSIBLE
-
-## How to proceed
-
-For each machine, **one by one** do:
-  - Check that cluster is healthy
-    - `sudo gluster peer status`
-    - `sudo gluster volume status all` (check Online Col, only `Y` must appear)
-    - Check that Nomad is healthy
-    - Check that Consul is healthy
-    - Check that Postgres is healthy
-  - Run `ansible-playbook -i production --limit <machine> site.yml`
-  - Reboot
-  - Check that cluster is healthy
-
--- a/ansible/production
+++ b/ansible/production
@ -1,4 +0,0 @@
-[cluster_nodes]
-veterini ansible_host=fbx-rennes2.machine.deuxfleurs.fr ansible_port=110 ansible_user=root public_ip=192.168.1.2 private_ip=192.168.1.2 interface=eno1 dns_server=80.67.169.40
-silicareux ansible_host=fbx-rennes2.machine.deuxfleurs.fr ansible_port=111 ansible_user=root public_ip=192.168.1.3 private_ip=192.168.1.3 interface=eno1 dns_server=80.67.169.40
-wonse ansible_host=fbx-rennes2.machine.deuxfleurs.fr ansible_port=112 ansible_user=root public_ip=192.168.1.4 private_ip=192.168.1.4 interface=eno1 dns_server=80.67.169.40
--- a/ansible/roles/consul/templates/resolv.conf.j2
+++ b/ansible/roles/consul/templates/resolv.conf.j2
@ -1,2 +0,0 @@
-nameserver {{ private_ip }}
-nameserver {{ dns_server }}
--- a/ansible/roles/network/files/rules.v6
+++ b/ansible/roles/network/files/rules.v6
@ -1,12 +0,0 @@
-# WARNING!! When rules.{v4,v6} are changed, the whole iptables configuration is reloaded.
-# This creates issues with Docker, which injects its own configuration in iptables when it starts.
-# In practice, most (all?) containers will break if rules.{v4,v6} are changed,
-# and docker will have to be restared.
-
-
-*filter
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]
-:OUTPUT ACCEPT [0:0]
-COMMIT
-
--- a/ansible/roles/network/tasks/main.yml
+++ b/ansible/roles/network/tasks/main.yml
@ -1,11 +0,0 @@
- name: "Deploy iptablesv4 configuration"
-  template: src=rules.v4.j2 dest=/etc/iptables/rules.v4
-
- name: "Deploy iptablesv6 configuration"
-  copy: src=rules.v6 dest=/etc/iptables/rules.v6
-
- name: "Activate IP forwarding"
-  sysctl:
-    name: net.ipv4.ip_forward
-    value: "1"
-    sysctl_set: yes
--- a/ansible/roles/nomad/templates/nomad.hcl.j2
+++ b/ansible/roles/nomad/templates/nomad.hcl.j2
@ -1,34 +0,0 @@
-addresses {
-  http = "0.0.0.0"
-  rpc = "0.0.0.0"
-  serf = "0.0.0.0"
-}
-
-advertise {
-  http = "{{ public_ip }}"
-  rpc = "{{ public_ip }}"
-  serf = "{{ public_ip }}"
-}
-
-data_dir = "/var/lib/nomad"
-
-server {
-  enabled          = true
-  bootstrap_expect = 3
-}
-
-consul {
-  address="127.0.0.1:8500"
-}
-
-client {
-  enabled = true
-  #cpu_total_compute = 4000
-  servers = ["127.0.0.1:4648"]
-  network_interface = "{{ interface }}"
-  options {
-    docker.privileged.enabled = "true"
-    docker.volumes.enabled = "true"
-  } 
-}
-
--- a/app/.gitignore
+++ b/app/.gitignore
@ -0,0 +1,2 @@
+env/
+__pycache__
--- a/app/README.md
+++ b/app/README.md
@ -0,0 +1,66 @@
+# Folder hierarchy
+
+- `<module>/build/<image_name>/`: folders with dockerfiles and other necessary resources for building container images
+- `<module>/config/`: folder containing configuration files, referenced by deployment file
+- `<module>/secrets/`: folder containing secrets, which can be synchronized with Consul using `secretmgr.py`
+- `<module>/deploy/`: folder containing the HCL file(s) necessary for deploying the module
+- `<module>/integration/`: folder containing files for integration testing using docker-compose
+
+# Secret Manager `secretmgr.py`
+
+The Secret Manager ensures that all secrets are present where they should in the cluster.
+
+**You need access to the cluster** (SSH port forwarding) for it to find any secret on the cluster. Refer to the previous directory's [README](../README.md), at the bottom of the file.
+
+## How to install `secretmgr.py` dependencies
+
+```bash
+### Install system dependencies first:
+## On fedora
+
+dnf install -y openldap-devel cyrus-sasl-devel
+## On ubuntu
+apt-get install -y libldap2-dev libsasl2-dev
+
+### Now install the Python dependencies from requirements.txt:
+
+## Either using a virtual environment
+# (requires virtualenv python module)
+python3 -m virtualenv env 
+# Must be done everytime you create a new terminal window in this folder:
+. env/bin/activate 
+# Install the deps
+pip install -r requirements.txt
+
+## Either by installing the dependencies for your system user:
+pip3 install --user -r requirements.txt
+```
+
+## How to use `secretmgr.py`
+
+Check that all secrets are correctly deployed for app `dummy`:
+
+```bash
+./secretmgr.py check dummy
+```
+
+Generate secrets for app `dummy` if they don't already exist:
+
+```bash
+./secretmgr.py gen dummy
+```
+
+Rotate secrets for app `dummy`, overwriting existing ones (be careful, this is dangerous!):
+
+```bash
+./secretmgr.py regen dummy
+```
+
+# Upgrading one of our packaged apps to a new version
+
+ 1. Edit `docker-compose.yml`
+ 2. Change the `VERSION` variable to the desired version
+ 3. Increment the docker image tag by 1 (eg: superboum/riot:v13 -> superboum/riot:v14)
+ 4. Run `docker-compose build`
+ 5. Run `docker-compose push`
+ 6. Done
--- a/app/backup/build/backup-consul/Dockerfile
+++ b/app/backup/build/backup-consul/Dockerfile
@ -0,0 +1,28 @@
+FROM golang:buster as builder
+
+WORKDIR /root
+RUN git clone https://filippo.io/age && cd age/cmd/age && go build -o age .
+
+FROM amd64/debian:buster
+
+COPY --from=builder /root/age/cmd/age/age /usr/local/bin/age
+
+RUN apt-get update && \
+	apt-get -qq -y full-upgrade && \
+	apt-get install -y rsync wget openssh-client unzip && \
+	apt-get clean && \
+	rm -f /var/lib/apt/lists/*_*
+
+RUN mkdir -p /root/.ssh
+WORKDIR /root
+
+RUN wget https://releases.hashicorp.com/consul/1.8.5/consul_1.8.5_linux_amd64.zip && \
+	unzip consul_1.8.5_linux_amd64.zip && \
+	chmod +x consul && \
+	mv consul /usr/local/bin && \
+	rm consul_1.8.5_linux_amd64.zip
+
+COPY do_backup.sh /root/do_backup.sh
+
+CMD "/root/do_backup.sh"
+
--- a/app/backup/build/backup-consul/do_backup.sh
+++ b/app/backup/build/backup-consul/do_backup.sh
@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -x -e
+
+cd /root
+
+chmod 0600 .ssh/id_ed25519
+
+cat > .ssh/config <<EOF
+Host backuphost
+	HostName $TARGET_SSH_HOST
+	Port $TARGET_SSH_PORT
+	User $TARGET_SSH_USER
+EOF
+
+consul kv export | \
+	gzip | \
+	age -r "$(cat /root/.ssh/id_ed25519.pub)" | \
+	ssh backuphost "cat > $TARGET_SSH_DIR/consul/$(date --iso-8601=minute)_consul_kv_export.gz.age"
+
--- a/app/backup/build/backup-matrix/Dockerfile
+++ b/app/backup/build/backup-matrix/Dockerfile
@ -0,0 +1,22 @@
+FROM golang:buster as builder
+
+WORKDIR /root
+RUN git clone https://filippo.io/age && cd age/cmd/age && go build -o age .
+
+FROM amd64/debian:buster
+
+COPY --from=builder /root/age/cmd/age/age /usr/local/bin/age
+
+RUN apt-get update && \
+	apt-get -qq -y full-upgrade && \
+	apt-get install -y rsync wget openssh-client postgresql-client && \
+	apt-get clean && \
+	rm -f /var/lib/apt/lists/*_*
+
+RUN mkdir -p /root/.ssh
+WORKDIR /root
+
+COPY do_backup.sh /root/do_backup.sh
+
+CMD "/root/do_backup.sh"
+
--- a/app/backup/build/backup-matrix/do_backup.sh
+++ b/app/backup/build/backup-matrix/do_backup.sh
@ -0,0 +1,40 @@
+#!/bin/sh
+
+set -x -e
+
+cd /root
+
+chmod 0600 .ssh/id_ed25519
+
+cat > .ssh/config <<EOF
+Host backuphost
+	HostName $TARGET_SSH_HOST
+	Port $TARGET_SSH_PORT
+	User $TARGET_SSH_USER
+EOF
+
+echo "export sql"
+export PGPASSWORD=$REPL_PSQL_PWD
+pg_basebackup \
+		--pgdata=- \
+		--format=tar \
+		--max-rate=1M \
+		--no-slot \
+		--wal-method=none \
+		--gzip \
+		--compress=8 \
+		--checkpoint=spread \
+		--progress \
+		--verbose \
+		--status-interval=10 \
+		--username=$REPL_PSQL_USER \
+		--port=5432 \
+		--host=psql-proxy.service.2.cluster.deuxfleurs.fr | \
+	age -r "$(cat /root/.ssh/id_ed25519.pub)" | \
+	ssh backuphost "cat > $TARGET_SSH_DIR/matrix/db-$(date --iso-8601=minute).gz.age"
+
+MATRIX_MEDIA="/mnt/glusterfs/chat/matrix/synapse/media"
+echo "export local_content"
+tar -vzcf - ${MATRIX_MEDIA} | \
+	age -r "$(cat /root/.ssh/id_ed25519.pub)" | \
+	ssh backuphost "cat > $TARGET_SSH_DIR/matrix/media-$(date --iso-8601=minute).gz.age"
--- a/app/backup/deploy/backup-matrix.hcl
+++ b/app/backup/deploy/backup-matrix.hcl
@ -0,0 +1,62 @@
+job "backup_manual_matrix" {
+	datacenters = ["dc1"]
+
+	type = "batch"
+
+	task "backup-matrix" {
+		driver = "docker"
+
+			config {
+				image = "superboum/backup_matrix:4"
+				volumes = [
+					"secrets/id_ed25519:/root/.ssh/id_ed25519",
+					"secrets/id_ed25519.pub:/root/.ssh/id_ed25519.pub",
+					"secrets/known_hosts:/root/.ssh/known_hosts",
+					"/mnt/glusterfs/chat/matrix/synapse/media:/mnt/glusterfs/chat/matrix/synapse/media"
+				]
+				network_mode = "host"
+			}
+
+		env {
+			CONSUL_HTTP_ADDR = "http://consul.service.2.cluster.deuxfleurs.fr:8500"
+		}
+
+		template {
+			data = <<EOH
+TARGET_SSH_USER={{ key "secrets/backup/target_ssh_user" }}
+TARGET_SSH_PORT={{ key "secrets/backup/target_ssh_port" }}
+TARGET_SSH_HOST={{ key "secrets/backup/target_ssh_host" }}
+TARGET_SSH_DIR={{ key "secrets/backup/target_ssh_dir" }}
+REPL_PSQL_USER={{ key "secrets/postgres/keeper/pg_repl_username" }}
+REPL_PSQL_PWD={{ key "secrets/postgres/keeper/pg_repl_pwd" }}
+EOH
+
+			destination = "secrets/env_vars"
+			env = true
+		}
+
+		template {
+			data = "{{ key \"secrets/backup/id_ed25519\" }}"
+			destination = "secrets/id_ed25519"
+		}
+		template {
+			data = "{{ key \"secrets/backup/id_ed25519.pub\" }}"
+			destination = "secrets/id_ed25519.pub"
+		}
+		template {
+			data = "{{ key \"secrets/backup/target_ssh_fingerprint\" }}"
+			destination = "secrets/known_hosts"
+		}
+
+		resources {
+			memory = 200
+		}
+
+		restart {
+			attempts = 2
+			interval = "30m"
+			delay = "15s"
+			mode = "fail"
+		}
+	}
+}
--- a/app/backup/deploy/backup.hcl
+++ b/app/backup/deploy/backup.hcl
@ -0,0 +1,67 @@
+job "backup_periodic" {
+	datacenters = ["dc1"]
+
+	type = "batch"
+
+	periodic {
+	  // Launch every hour
+	  cron = "0 * * * * *"
+
+	  // Do not allow overlapping runs.
+	  prohibit_overlap = true
+	}
+
+	task "backup-consul" {
+		driver = "docker"
+
+			config {
+				image = "lxpz/backup_consul:12"
+				volumes = [
+					"secrets/id_ed25519:/root/.ssh/id_ed25519",
+					"secrets/id_ed25519.pub:/root/.ssh/id_ed25519.pub",
+					"secrets/known_hosts:/root/.ssh/known_hosts"
+				]
+				network_mode = "host"
+			}
+
+		env {
+			CONSUL_HTTP_ADDR = "http://consul.service.2.cluster.deuxfleurs.fr:8500"
+		}
+
+		template {
+			data = <<EOH
+TARGET_SSH_USER={{ key "secrets/backup/target_ssh_user" }}
+TARGET_SSH_PORT={{ key "secrets/backup/target_ssh_port" }}
+TARGET_SSH_HOST={{ key "secrets/backup/target_ssh_host" }}
+TARGET_SSH_DIR={{ key "secrets/backup/target_ssh_dir" }}
+EOH
+
+			destination = "secrets/env_vars"
+			env = true
+		}
+
+		template {
+			data = "{{ key \"secrets/backup/id_ed25519\" }}"
+			destination = "secrets/id_ed25519"
+		}
+		template {
+			data = "{{ key \"secrets/backup/id_ed25519.pub\" }}"
+			destination = "secrets/id_ed25519.pub"
+		}
+		template {
+			data = "{{ key \"secrets/backup/target_ssh_fingerprint\" }}"
+			destination = "secrets/known_hosts"
+		}
+
+		resources {
+			memory = 200
+		}
+
+		restart {
+			attempts = 2
+			interval = "30m"
+			delay = "15s"
+			mode = "fail"
+		}
+	}
+}
--- a/app/backup/secrets/backup/id_ed25519
+++ b/app/backup/secrets/backup/id_ed25519
@ -0,0 +1 @@
+USER_LONG Private ed25519 key of the container doing the backup
--- a/app/backup/secrets/backup/id_ed25519.pub
+++ b/app/backup/secrets/backup/id_ed25519.pub
@ -0,0 +1 @@
+USER Public ed25519 key of the container doing the backup (this key must be in authorized_keys on the backup target host)
--- a/app/backup/secrets/backup/target_ssh_dir
+++ b/app/backup/secrets/backup/target_ssh_dir
@ -0,0 +1 @@
+USER Directory where to store backups on target host
--- a/app/backup/secrets/backup/target_ssh_fingerprint
+++ b/app/backup/secrets/backup/target_ssh_fingerprint
@ -0,0 +1 @@
+USER SSH fingerprint of the target machine (format: copy here the corresponding line from your known_hosts file)
--- a/app/backup/secrets/backup/target_ssh_host
+++ b/app/backup/secrets/backup/target_ssh_host
@ -0,0 +1 @@
+USER Hostname of the backup target host
--- a/app/backup/secrets/backup/target_ssh_port
+++ b/app/backup/secrets/backup/target_ssh_port
@ -0,0 +1 @@
+USER SSH port number to connect to the target host
--- a/app/backup/secrets/backup/target_ssh_user
+++ b/app/backup/secrets/backup/target_ssh_user
@ -0,0 +1 @@
+USER SSH username to log in as on the target host
--- a/app/bagage/deploy/bagage.hcl
+++ b/app/bagage/deploy/bagage.hcl
@ -1,6 +1,7 @@
-job "webcap" {
+job "bagage" {
  datacenters = ["dc1"]
  type = "service"
+  priority = 90

  constraint {
    attribute = "${attr.cpu.arch}"
@ -8,36 +9,38 @@ job "webcap" {
  }

  group "main" {
-    task "flask" {
+    count = 1
+
+    network {
+      port "web_port" { to = 8080 }
+    }
+
+    task "server" {
      driver = "docker"
      config {
-        image = "superboum/amd64_webcap:v7"
-        port_map {
-          web_port = 3000
-        }
+        image = "superboum/amd64_bagage:v8"
+        readonly_rootfs = true
+        ports = [ "web_port" ]
      }
+
      env {
-        FLASK_APP = "/usr/local/bin/webcap"
+        BAGAGE_LDAP_ENDPOINT = "bottin2.service.2.cluster.deuxfleurs.fr:389"
      }

      resources {
-        cpu = 1000
-        memory = 2000
-        network {
-          port "web_port" {}
-        }
+        memory = 500
      }

      service {
+        name = "bagage"
        tags = [
-          "webcap",
+          "bagage",
          "traefik.enable=true",
          "traefik.frontend.entryPoints=https,http",
-          "traefik.frontend.rule=Host:webcap.deuxfleurs.fr;PathPrefix:/"
+          "traefik.frontend.rule=Host:bagage.deuxfleurs.fr",
        ]
        port = "web_port"
        address_mode = "host"
-        name = "webcap"
        check {
          type = "tcp"
          port = "web_port"
--- a/app/core/deploy/core.hcl
+++ b/app/core/deploy/core.hcl
@ -0,0 +1,51 @@
+job "core" {
+	datacenters = ["dc1"]
+		type = "system"
+		priority = 90
+
+		constraint {
+			attribute = "${attr.cpu.arch}"
+			value     = "amd64"
+		}
+
+	update {
+		max_parallel     = 1
+		stagger = "1m"
+	}
+
+	group "network" {
+		task "diplonat" {
+			driver = "docker"
+
+				config {
+					image = "darkgallium/amd64_diplonat:v3"
+					network_mode = "host"
+					readonly_rootfs = true
+					privileged = true
+				}
+
+			restart {
+				interval = "30m"
+				attempts = 2
+				delay    = "15s"
+				mode     = "delay"
+			}
+
+			template {
+				data = <<EOH
+DIPLONAT_PRIVATE_IP={{ env "attr.unique.network.ip-address" }}
+DIPLONAT_REFRESH_TIME=60
+DIPLONAT_EXPIRATION_TIME=300
+DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
+RUST_LOG=debug
+EOH
+				destination = "secrets/env"
+				env = true
+			}
+
+			resources {
+				memory = 40
+			}
+		}
+	}
+}
--- a/consul/configuration/directory/bottin/config.json
+++ b/consul/configuration/directory/bottin/config.json
@ -1,6 +1,6 @@
 {
  "suffix": "dc=deuxfleurs,dc=fr",
-  "bind": "0.0.0.0:1389",
+  "bind": "0.0.0.0:389",
  "consul_host": "http://consul.service.2.cluster.deuxfleurs.fr:8500",
  "log_level": "debug",
  "acl": [
--- a/consul/configuration/directory/guichet/config.json.tpl
+++ b/consul/configuration/directory/guichet/config.json.tpl
@ -12,19 +12,23 @@
  "invitation_name_attr": "cn",
  "invited_mail_format": "{}@deuxfleurs.fr",
  "invited_auto_groups": [
-    "cn=email,ou=groups,dc=deuxfleurs,dc=fr",
-    "cn=seafile,ou=groups,dc=deuxfleurs,dc=fr",
-    "cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr"
+    "cn=email,ou=groups,dc=deuxfleurs,dc=fr"
  ],

  "web_address": "https://guichet.deuxfleurs.fr",
-  "mail_from": "coucou@deuxfleurs.fr",
+  "mail_from": "deuxfleurs-bienvenue@adnab.me",
  "smtp_server": "adnab.me:25",
  "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
  "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",

  "admin_account": "cn=admin,dc=deuxfleurs,dc=fr",
  "group_can_admin": "cn=admin,ou=groups,dc=deuxfleurs,dc=fr",
-  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr"
+  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr",
+
+  "s3_endpoint": "garage.deuxfleurs.fr",
+  "s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}",
+  "s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}",
+  "s3_region": "garage",
+  "s3_bucket": "bottin-pictures"
 }

--- a/app/directory/deploy/directory.hcl
+++ b/app/directory/deploy/directory.hcl
@ -1,6 +1,7 @@
-job "directory2" {
+job "directory" {
  datacenters = ["dc1"]
  type = "service"
+  priority = 90

  constraint {
    attribute = "${attr.cpu.arch}"
@ -9,14 +10,21 @@ job "directory2" {

  group "bottin" {
    count = 1
+
+    network {
+      port "ldap_port" {
+        static = 389
+        to = 389
+      }
+    }
+
    task "bottin" {
      driver = "docker"
      config {
-        image = "lxpz/bottin_amd64:14"
+        image = "superboum/bottin_amd64:22"
+        network_mode = "host"
        readonly_rootfs = true
-        port_map {
-          ldap_port = 1389
-        }
+        ports = [ "ldap_port" ]
        volumes = [
          "secrets/config.json:/config.json"
        ]
@ -24,15 +32,10 @@ job "directory2" {

      resources {
        memory = 100
-        network {
-          port "ldap_port" {
-            static = "389"
-          }
-        }
      }

      template {
-        data = "{{ key \"configuration/directory/bottin/config.json\" }}"
+        data = file("../config/bottin/config.json")
        destination = "secrets/config.json"
      }

@ -58,34 +61,29 @@ job "directory2" {

  group "guichet" {
    count = 1
+
+    network {
+      port "web_port" { to = 9991 }
+    }
+
    task "guichet" {
      driver = "docker"
      config {
-        image = "lxpz/guichet_amd64:10"
+        image = "superboum/guichet_amd64:15"
        readonly_rootfs = true
-        port_map {
-          web_port = 9991
-        }
+        ports = [ "web_port" ]
        volumes = [
          "secrets/config.json:/config.json"
        ]
      }

-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/directory/guichet/config.json.tpl?raw"
-        destination = "secrets/config.json.tpl"
-        mode = "file"
-      }
      template {
-        source = "secrets/config.json.tpl"
+        data = file("../config/guichet/config.json.tpl")
        destination = "secrets/config.json"
      }

      resources {
        memory = 200
-        network {
-          port "web_port" {}
-        }
      }

      service {
--- a/app/directory/secrets/directory/guichet/s3_access_key
+++ b/app/directory/secrets/directory/guichet/s3_access_key
@ -0,0 +1 @@
+USER Garage access key for Guichet profile pictures
--- a/app/directory/secrets/directory/guichet/s3_secret_key
+++ b/app/directory/secrets/directory/guichet/s3_secret_key
@ -0,0 +1 @@
+USER Garage secret key for Guichet profile pictures
--- a/app/directory/secrets/directory/guichet/smtp_pass
+++ b/app/directory/secrets/directory/guichet/smtp_pass
@ -0,0 +1 @@
+USER SMTP password
--- a/app/directory/secrets/directory/guichet/smtp_user
+++ b/app/directory/secrets/directory/guichet/smtp_user
@ -0,0 +1 @@
+USER SMTP username
--- a/app/docker-compose.yml
+++ b/app/docker-compose.yml
@ -0,0 +1,109 @@
+version: '3.4'
+services:
+
+  # Instant Messaging
+  riot:
+    build:
+      context: ./im/build/riotweb
+      args:
+        # https://github.com/vector-im/riot-web/releases
+        VERSION: 1.8.4
+    image: superboum/amd64_riotweb:v24
+
+  synapse:
+    build: 
+      context: ./im/build/matrix-synapse
+      args:
+        # https://github.com/matrix-org/synapse/releases
+        VERSION: 1.42.0
+        # https://github.com/matrix-org/synapse-s3-storage-provider/commits/main
+        S3_VERSION: 3c3fafd6a2624f05fd396d9e003501bf8bef7b2e
+    image: superboum/amd64_synapse:v47
+
+  # Email
+  sogo:
+    build:
+      context: ./email/build/sogo
+      args:
+        # fake for now
+        VERSION: 5.0.0
+    image: superboum/amd64_sogo:v7
+
+  alps:
+    build:
+      context: ./email/build/alps
+      args:
+        VERSION: 9bafa64b9d
+    image: superboum/amd64_alps:v1
+
+  dovecot:
+    build:
+      context: ./email/build/dovecot
+    image: superboum/amd64_dovecot:v6
+
+  # VoIP
+  jitsi-meet:
+    build:
+      context: ./jitsi/build/jitsi-meet
+      args:
+        # https://github.com/jitsi/jitsi-meet
+        MEET_TAG: jitsi-meet_5463
+    image: superboum/amd64_jitsi_meet:v4
+
+  jitsi-conference-focus:
+    build:
+      context: ./jitsi/build/jitsi-conference-focus
+      args:
+        # https://github.com/jitsi/jicofo
+        JICOFO_TAG: jitsi-meet_5463
+    image: superboum/amd64_jitsi_conference_focus:v7
+
+  jitsi-videobridge:
+    build:
+      context: ./jitsi/build/jitsi-videobridge
+      args:
+        # https://github.com/jitsi/jitsi-videobridge
+        # note: JVB is not tagged with non-stable tags
+        JVB_TAG: stable/jitsi-meet_5390
+    image: superboum/amd64_jitsi_videobridge:v17
+
+  jitsi-xmpp:
+    build:
+      context: ./jitsi/build/jitsi-xmpp
+      args:
+        MEET_TAG: jitsi-meet_5463
+        PROSODY_VERSION: 0.11.7-1~buster4
+    image: superboum/amd64_jitsi_xmpp:v9
+
+  plume:
+    build:
+      context: ./plume/build/plume
+      args:
+        VERSION: 8c372aa6fcd05083601903d83b0fcb4915585a95
+    image: superboum/plume:v4
+
+  postfix:
+    build:
+      context: ./email/build/postfix
+      args:
+        # https://packages.debian.org/fr/buster/postfix
+        VERSION: 3.4.14-0+deb10u1
+    image: superboum/amd64_postfix:v3
+
+  postgres:
+    build:
+      args:
+        # https://github.com/sorintlab/stolon/releases
+        STOLON_VERSION: 057389f7e484ee1d5c1e1a7020256020e7413c87
+      context: ./postgres/build/postgres
+    image: superboum/amd64_postgres:v9
+
+  backup-consul:
+    build:
+      context: ./backup/build/backup-consul
+    image: lxpz/backup_consul:12
+
+  backup-matrix:
+    build:
+      context: ./backup/build/backup-matrix
+    image: superboum/backup_matrix:4
--- a/app/drone-ci/deploy/drone.hcl
+++ b/app/drone-ci/deploy/drone.hcl
@ -0,0 +1,125 @@
+job "drone-ci" {
+  datacenters = ["dc1"]
+  type = "service"
+
+  group "server" {
+    count = 1
+
+    network {
+      port "web_port" {
+		  to = 80
+	  }
+    }
+
+    task "drone_server" {
+      driver = "docker"
+      config {
+        image = "drone/drone:2.0.4"
+        ports = [ "web_port" ]
+      }
+
+	  template {
+		  data = <<EOH
+DRONE_GITEA_SERVER=https://git.deuxfleurs.fr
+DRONE_GITEA_CLIENT_ID={{ key "secrets/drone-ci/oauth_client_id" }}
+DRONE_GITEA_CLIENT_SECRET={{ key "secrets/drone-ci/oauth_client_secret" }}
+DRONE_RPC_SECRET={{ key "secrets/drone-ci/rpc_secret" }}
+DRONE_SERVER_HOST=drone.deuxfleurs.fr
+DRONE_SERVER_PROTO=https
+DRONE_DATABASE_SECRET={{ key "secrets/drone-ci/db_enc_secret" }}
+DRONE_COOKIE_SECRET={{ key "secrets/drone-ci/cookie_secret" }}
+AWS_ACCESS_KEY_ID={{ key "secrets/drone-ci/s3_ak" }}
+AWS_SECRET_ACCESS_KEY={{ key "secrets/drone-ci/s3_sk" }}
+AWS_DEFAULT_REGION=garage
+AWS_REGION=garage
+DRONE_S3_BUCKET={{ key "secrets/drone-ci/s3_bucket" }}
+DRONE_S3_ENDPOINT=https://garage.deuxfleurs.fr
+DRONE_S3_PATH_STYLE=true
+DRONE_DATABASE_DRIVER=postgres
+DRONE_DATABASE_DATASOURCE=postgres://{{ key "secrets/drone-ci/db_user" }}:{{ key "secrets/drone-ci/db_pass" }}@psql-proxy.service.2.cluster.deuxfleurs.fr:5432/drone?sslmode=disable
+DRONE_USER_CREATE=username:lx-admin,admin:true
+DRONE_LOGS_TEXT=true
+DRONE_LOGS_PRETTY=true
+DRONE_LOGS_DEBUG=true
+DOCKER_API_VERSION=1.39
+EOH
+		destination = "secrets/env"
+		env = true
+	  }
+
+      resources {
+        cpu = 100
+        memory = 100
+      }
+
+      service {
+        name = "drone"
+        tags = [
+          "drone",
+          "traefik.enable=true",
+          "traefik.frontend.entryPoints=https,http",
+          "traefik.frontend.rule=Host:drone.deuxfleurs.fr",
+        ]
+        port = "web_port"
+        address_mode = "host"
+        check {
+          type = "http"
+          protocol = "http"
+          port = "web_port"
+          path = "/"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "600s"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+
+/*
+  group "runner" {
+    count = 3
+
+	constraint {
+	  operator  = "distinct_hosts"
+	  value     = "true"
+	}
+
+    task "drone_runner" {
+      driver = "docker"
+      config {
+		network_mode = "host"
+
+        #image = "drone/drone-runner-nomad:latest"
+        image = "drone/drone-runner-docker:1.6.3"
+
+        volumes = [
+          "/var/run/docker.sock:/var/run/docker.sock"
+        ]
+      }
+
+	  template {
+		  data = <<EOH
+DRONE_RPC_SECRET={{ key "secrets/drone-ci/rpc_secret" }}
+DRONE_RPC_HOST=drone.deuxfleurs.fr
+DRONE_RPC_PROTO=https
+DRONE_RUNNER_NAME={{ env "node.unique.name" }}
+DRONE_DEBUG=true
+NOMAD_ADDR=http://nomad-client.service.2.cluster.deuxfleurs.fr:4646
+DOCKER_API_VERSION=1.39
+EOH
+		destination = "secrets/env"
+		env = true
+	  }
+
+      resources {
+        memory = 40
+        cpu = 50
+      }
+	}
+  }
+  */
+}
--- a/app/drone-ci/secrets/drone-ci/cookie_secret
+++ b/app/drone-ci/secrets/drone-ci/cookie_secret
@ -0,0 +1 @@
+CMD openssl rand -hex 16
--- a/app/drone-ci/secrets/drone-ci/db_enc_secret
+++ b/app/drone-ci/secrets/drone-ci/db_enc_secret
@ -0,0 +1 @@
+CMD_ONCE openssl rand -hex 16
--- a/app/drone-ci/secrets/drone-ci/db_pass
+++ b/app/drone-ci/secrets/drone-ci/db_pass
@ -0,0 +1 @@
+SERVICE_PASSWORD drone
--- a/app/drone-ci/secrets/drone-ci/db_user
+++ b/app/drone-ci/secrets/drone-ci/db_user
@ -0,0 +1 @@
+CONST drone
--- a/app/drone-ci/secrets/drone-ci/oauth_client_id
+++ b/app/drone-ci/secrets/drone-ci/oauth_client_id
@ -0,0 +1 @@
+USER OAuth client ID (on Gitea)
--- a/app/drone-ci/secrets/drone-ci/oauth_client_secret
+++ b/app/drone-ci/secrets/drone-ci/oauth_client_secret
@ -0,0 +1 @@
+USER OAuth client secret (for gitea)
--- a/app/drone-ci/secrets/drone-ci/rpc_secret
+++ b/app/drone-ci/secrets/drone-ci/rpc_secret
@ -0,0 +1 @@
+CMD openssl rand -hex 16
--- a/app/drone-ci/secrets/drone-ci/s3_ak
+++ b/app/drone-ci/secrets/drone-ci/s3_ak
@ -0,0 +1 @@
+USER S3 (garage) access key for Drone
--- a/app/drone-ci/secrets/drone-ci/s3_bucket
+++ b/app/drone-ci/secrets/drone-ci/s3_bucket
@ -0,0 +1 @@
+CONST drone
--- a/app/drone-ci/secrets/drone-ci/s3_sk
+++ b/app/drone-ci/secrets/drone-ci/s3_sk
@ -0,0 +1 @@
+USER S3 (garage) secret key for Drone
--- a/app/dummy/secrets/dummy/test_cmd
+++ b/app/dummy/secrets/dummy/test_cmd
@ -0,0 +1 @@
+CMD head -c 10 /dev/urandom | base64
--- a/app/dummy/secrets/dummy/test_const
+++ b/app/dummy/secrets/dummy/test_const
@ -0,0 +1 @@
+CONST this is a constant
--- a/app/dummy/secrets/dummy/test_const_long
+++ b/app/dummy/secrets/dummy/test_const_long
@ -0,0 +1,5 @@
+CONST_LONG
+this is a 
+constant
+on several
+lines
--- a/app/dummy/secrets/dummy/test_service_dn
+++ b/app/dummy/secrets/dummy/test_service_dn
@ -0,0 +1 @@
+SERVICE_DN dummy Dummy service for testing secretmgr.py
--- a/app/dummy/secrets/dummy/test_service_password
+++ b/app/dummy/secrets/dummy/test_service_password
@ -0,0 +1 @@
+SERVICE_PASSWORD dummy
--- a/app/dummy/secrets/dummy/test_user
+++ b/app/dummy/secrets/dummy/test_user
@ -0,0 +1 @@
+USER Test user value
--- a/app/email/build/alps/Dockerfile
+++ b/app/email/build/alps/Dockerfile
@ -0,0 +1,19 @@
+FROM golang:1.15.6-buster as builder
+
+ARG VERSION
+
+ENV CGO_ENABLED=0 GOOS=linux GOARCH=amd64
+WORKDIR /tmp/alps
+
+RUN git init && \
+    git remote add origin https://git.deuxfleurs.fr/Deuxfleurs/alps.git && \
+    git fetch --depth 1 origin ${VERSION} && \
+    git checkout FETCH_HEAD
+
+RUN go build -a -o /usr/local/bin/alps ./cmd/alps
+
+FROM scratch
+COPY --from=builder /usr/local/bin/alps /alps
+COPY --from=builder /tmp/alps/themes /themes
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+ENTRYPOINT ["/alps"]
--- a/app/email/build/dovecot/.gitignore
+++ b/app/email/build/dovecot/.gitignore
--- a/app/email/build/dovecot/Dockerfile
+++ b/app/email/build/dovecot/Dockerfile
@ -1,4 +1,4 @@
-FROM amd64/debian:stretch
+FROM amd64/debian:bullseye

 RUN apt-get update && \
    apt-get install -y \
@ -11,7 +11,6 @@ RUN apt-get update && \
      dovecot-lmtpd && \
    rm -rf /etc/dovecot/*
 RUN useradd mailstore
-COPY ./conf/* /etc/dovecot/
 COPY entrypoint.sh /usr/local/bin/entrypoint

 ENTRYPOINT ["/usr/local/bin/entrypoint"]
--- a/app/email/build/dovecot/README.md
+++ b/app/email/build/dovecot/README.md
--- a/app/email/build/dovecot/entrypoint.sh
+++ b/app/email/build/dovecot/entrypoint.sh
--- a/app/email/build/dovecot/legacy/all_before.sieve
+++ b/app/email/build/dovecot/legacy/all_before.sieve
@ -0,0 +1,5 @@
+require ["fileinto", "mailbox"];
+if header :contains "X-Spam-Flag" "YES" {
+    fileinto :create "Junk";
+}
+
--- a/app/email/build/dovecot/legacy/dovecot-ldap.sample.conf
+++ b/app/email/build/dovecot/legacy/dovecot-ldap.sample.conf
@ -0,0 +1,8 @@
+hosts = ldap.example.com
+dn = cn=admin,dc=example,dc=com
+dnpass = s3cr3t
+base = dc=example,dc=com
+scope = subtree
+user_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=example,dc=com)))
+pass_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=example,dc=com)))
+user_attrs = mail=/var/mail/%{ldap:mail}
--- a/app/email/build/dovecot/legacy/report-ham.sieve
+++ b/app/email/build/dovecot/legacy/report-ham.sieve
@ -0,0 +1,17 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables", "vnd.dovecot.debug"];
+
+if environment :matches "imap.mailbox" "*" {
+  set "mailbox" "${1}";
+}
+
+if string "${mailbox}" "Trash" {
+  stop;
+}
+
+if environment :matches "imap.user" "*" {
+  set "username" "${1}";
+}
+
+pipe :copy "sa-learn" [ "--ham", "-u", "debian-spamd" ];
+debug_log "ham reported by ${username}";
+
--- a/app/email/build/dovecot/legacy/report-spam.sieve
+++ b/app/email/build/dovecot/legacy/report-spam.sieve
@ -0,0 +1,9 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables", "vnd.dovecot.debug"];
+
+if environment :matches "imap.user" "*" {
+  set "username" "${1}";
+}
+
+pipe :copy "sa-learn" [ "--spam", "-u", "debian-spamd"];
+debug_log "spam reported by ${username}";
+
--- a/app/email/build/opendkim/Dockerfile
+++ b/app/email/build/opendkim/Dockerfile
--- a/app/email/build/opendkim/README.md
+++ b/app/email/build/opendkim/README.md
--- a/app/email/build/opendkim/opendkim.conf
+++ b/app/email/build/opendkim/opendkim.conf
--- a/app/email/build/postfix/Dockerfile
+++ b/app/email/build/postfix/Dockerfile
@ -1,8 +1,10 @@
 FROM amd64/debian:buster

+ARG VERSION
+
 RUN apt-get update && \
    apt-get install -y \
-      postfix \
+      postfix=$VERSION \
      postfix-ldap

 COPY entrypoint.sh /usr/local/bin/entrypoint
--- a/app/email/build/postfix/README.md
+++ b/app/email/build/postfix/README.md
--- a/app/email/build/postfix/entrypoint.sh
+++ b/app/email/build/postfix/entrypoint.sh
@ -26,5 +26,6 @@ for file in $(ls /etc/postfix-conf); do
 done

 echo ${MAILNAME} > /etc/mailname
+postmap /etc/postfix/transport

 exec "$@"
--- a/app/email/build/sogo/Dockerfile
+++ b/app/email/build/sogo/Dockerfile
@ -1,6 +1,6 @@
 #FROM amd64/debian:stretch as builder

-FROM amd64/debian:stretch
+FROM amd64/debian:buster

 RUN mkdir ~/.gnupg && echo "disable-ipv6" >> ~/.gnupg/dirmngr.conf

@ -8,7 +8,7 @@ RUN apt-get update && \
    apt-get install -y apt-transport-https gnupg2 sudo nginx && \
    rm -rf /etc/nginx/sites-enabled/* && \
    apt-key adv --keyserver keys.gnupg.net --recv-key 0x810273C4 && \
-    echo "deb https://packages.inverse.ca/SOGo/nightly/4/debian stretch stretch" > /etc/apt/sources.list.d/sogo.list && \
+    echo "deb http://packages.inverse.ca/SOGo/nightly/5/debian/ buster buster" > /etc/apt/sources.list.d/sogo.list && \
    apt-get update && \
    apt-get install -y sogo sogo-activesync sope4.9-gdl1-postgresql postgresql-client

--- a/app/email/build/sogo/README.md
+++ b/app/email/build/sogo/README.md
--- a/app/email/build/sogo/entrypoint
+++ b/app/email/build/sogo/entrypoint
--- a/app/email/build/sogo/sogo.nginx.conf
+++ b/app/email/build/sogo/sogo.nginx.conf
@ -0,0 +1,83 @@
+server {
+  listen 8080;
+  server_name default_server; 
+  root /usr/lib/GNUstep/SOGo/WebServerResources/; 
+
+  ## requirement to create new calendars in Thunderbird ##
+  proxy_http_version 1.1;
+
+  # Message size limit
+  client_max_body_size 50m;
+  client_body_buffer_size 128k;
+
+  location = / {
+    rewrite ^ '/SOGo'; 
+    allow all; 
+  }
+
+  location = /principals/ {
+    rewrite ^ '/SOGo/dav'; 
+    allow all; 
+  }
+
+  location ^~/SOGo {
+    proxy_pass 'http://127.0.0.1:20000'; 
+    proxy_redirect 'http://127.0.0.1:20000' default; 
+    # forward user's IP address 
+    proxy_set_header X-Real-IP $remote_addr; 
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
+    proxy_set_header Host $host; 
+    proxy_set_header x-webobjects-server-protocol HTTP/1.0; 
+    proxy_set_header x-webobjects-remote-host 127.0.0.1; 
+    proxy_set_header x-webobjects-server-name $server_name; 
+    proxy_set_header x-webobjects-server-url $scheme://$host; 
+    proxy_set_header x-webobjects-server-port $server_port; 
+    proxy_connect_timeout 90;
+    proxy_send_timeout 90;
+    proxy_read_timeout 90;
+    proxy_buffer_size 4k;
+    proxy_buffers 4 32k;
+    proxy_busy_buffers_size 64k;
+    proxy_temp_file_write_size 64k;
+    break;
+  }
+
+  location /SOGo.woa/WebServerResources/ {
+    alias /usr/lib/GNUstep/SOGo/WebServerResources/;
+    allow all;
+    expires max;
+  }
+
+  location /SOGo/WebServerResources/ {
+    alias /usr/lib/GNUstep/SOGo/WebServerResources/; 
+    allow all;
+    expires max;
+  }
+
+  location (^/SOGo/so/ControlPanel/Products/([^/]*)/Resources/(.*)$) {
+    alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
+    expires max;
+  }
+
+  location (^/SOGo/so/ControlPanel/Products/[^/]*UI/Resources/.*\.(jpg|png|gif|css|js)$) {
+    alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
+    expires max;
+  }
+
+  location ^~ /Microsoft-Server-ActiveSync {
+    access_log /var/log/nginx/activesync.log;
+    error_log  /var/log/nginx/activesync-error.log;
+      
+    proxy_connect_timeout 75;
+    proxy_send_timeout 3600;
+    proxy_read_timeout 3600;
+    proxy_buffers 64 256k;
+      
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      
+    proxy_pass http://127.0.0.1:20000/SOGo/Microsoft-Server-ActiveSync;
+    proxy_redirect http://127.0.0.1:20000/SOGo/Microsoft-Server-ActiveSync /;
+  }
+}
--- a/consul/configuration/email/dkim/keytable
+++ b/consul/configuration/email/dkim/keytable
--- a/consul/configuration/email/dkim/signingtable
+++ b/consul/configuration/email/dkim/signingtable
--- a/consul/configuration/email/dkim/trusted
+++ b/consul/configuration/email/dkim/trusted
--- a/consul/configuration/email/dovecot/certs.gen
+++ b/consul/configuration/email/dovecot/certs.gen
--- a/consul/configuration/email/dovecot/dovecot-ldap.conf.tpl
+++ b/consul/configuration/email/dovecot/dovecot-ldap.conf.tpl
@ -5,4 +5,8 @@ base = dc=deuxfleurs,dc=fr
 scope = subtree
 user_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
 pass_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
-user_attrs = mail=/var/mail/%{ldap:mail}
+user_attrs = \
+  =user=%{ldap:cn}, \
+  =mail=maildir:/var/mail/%{ldap:cn}, \
+  =uid=1000, \
+  =gid=1000 
--- a/app/email/config/dovecot/dovecot.conf
+++ b/app/email/config/dovecot/dovecot.conf
@ -0,0 +1,87 @@
+auth_mechanisms = plain login
+auth_username_format = %u
+log_timestamp = "%Y-%m-%d %H:%M:%S "
+mail_location = maildir:/var/mail/%u
+mail_privileged_group = mail
+
+log_path = /dev/stderr
+info_log_path = /dev/stdout
+debug_log_path = /dev/stdout
+
+protocols = imap sieve lmtp
+
+ssl_cert = < /etc/ssl/certs/dovecot.crt
+ssl_key = < /etc/ssl/private/dovecot.key
+
+service auth {
+ inet_listener {
+   port = 1337
+ }
+}
+
+
+
+service lmtp {
+  inet_listener lmtp {
+    address = 0.0.0.0
+    port = 24
+  }
+}
+
+# https://doc.dovecot.org/configuration_manual/authentication/ldap_authentication/
+passdb {
+  args = /etc/dovecot/dovecot-ldap.conf
+  driver = ldap
+}
+userdb {
+  driver = prefetch
+}
+userdb {
+  args = /etc/dovecot/dovecot-ldap.conf
+  driver = ldap
+}
+
+
+service imap-login {
+  service_count = 0 # performance mode. set to 1 for secure mode
+  process_min_avail = 1
+  inet_listener imap {
+    port = 143
+  }
+  inet_listener imaps {
+    port = 993
+  }
+}
+
+protocol imap {
+  mail_plugins = $mail_plugins imap_sieve
+}
+
+protocol lda {
+  auth_socket_path = /var/run/dovecot/auth-master
+  info_log_path = /var/log/dovecot-deliver.log
+  log_path = /var/log/dovecot-deliver-errors.log
+  postmaster_address = postmaster@deuxfleurs.fr
+  mail_plugins = $mail_plugins sieve
+}
+
+plugin {
+  sieve = file:~/sieve;active=~/dovecot.sieve
+  sieve_before = /etc/dovecot/all_before.sieve
+
+  # antispam learn
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +vnd.dovecot.debug
+  sieve_pipe_bin_dir = /usr/bin
+
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY FLAG APPEND
+  imapsieve_mailbox1_before = file:/etc/dovecot/report-spam.sieve
+
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Spam
+  imapsieve_mailbox2_causes = COPY APPEND
+  imapsieve_mailbox2_before = file:/etc/dovecot/report-ham.sieve
+
+}
+
--- a/consul/configuration/email/postfix/certs.gen
+++ b/consul/configuration/email/postfix/certs.gen
--- a/consul/configuration/email/postfix/dynamicmaps.cf
+++ b/consul/configuration/email/postfix/dynamicmaps.cf
--- a/consul/configuration/email/postfix/header_checks
+++ b/consul/configuration/email/postfix/header_checks
--- a/consul/configuration/email/postfix/ldap-account.cf.tpl
+++ b/consul/configuration/email/postfix/ldap-account.cf.tpl
--- a/consul/configuration/email/postfix/ldap-alias.cf.tpl
+++ b/consul/configuration/email/postfix/ldap-alias.cf.tpl
--- a/consul/configuration/email/postfix/ldap-virtual-domains.cf.tpl
+++ b/consul/configuration/email/postfix/ldap-virtual-domains.cf.tpl
--- a/consul/configuration/email/postfix/main.cf
+++ b/consul/configuration/email/postfix/main.cf
--- a/consul/configuration/email/postfix/master.cf
+++ b/consul/configuration/email/postfix/master.cf
--- a/consul/configuration/email/postfix/transport
+++ b/consul/configuration/email/postfix/transport
--- a/consul/configuration/email/postfix/transport.db
+++ b/consul/configuration/email/postfix/transport.db
--- a/consul/configuration/email/sogo/sogo.conf.tpl
+++ b/consul/configuration/email/sogo/sogo.conf.tpl
@ -1,6 +1,7 @@
 {
  WONoDetach = NO;
-  WOWorkersCount = 10;
+  WOWorkersCount = 3;
+	SxVMemLimit = 300;
  WOPort = "127.0.0.1:20000";
  SOGoProfileURL = "postgresql://{{ key "secrets/email/sogo/postgre_auth" | trimSpace }}@psql-proxy.service.2.cluster.deuxfleurs.fr:5432/sogo/sogo_user_profile";
  OCSFolderInfoURL = "postgresql://{{ key "secrets/email/sogo/postgre_auth" | trimSpace }}@psql-proxy.service.2.cluster.deuxfleurs.fr:5432/sogo/sogo_folder_info";
@ -23,7 +24,7 @@
  SOGoSentFolderName = Sent;
  SOGoTrashFolderName = Trash;
  SOGoDraftsFolderName = Drafts;
-  SOGoIMAPServer = "imaps://dovecot-imaps.service.2.cluster.deuxfleurs.fr:993/";
+  SOGoIMAPServer = "imaps://dovecot-imaps.service.2.cluster.deuxfleurs.fr:993/?tlsVerifyMode=none";
  SOGoSieveServer = "sieve://sieve.service.2.cluster.deuxfleurs.fr:4190/?tls=YES";
  SOGoIMAPAclConformsToIMAPExt = YES;
  SOGoVacationEnabled = NO;
--- a/app/email/deploy/email.hcl
+++ b/app/email/deploy/email.hcl
@ -1,27 +1,43 @@
 job "email" {
  datacenters = ["dc1"]
  type = "service"
+  priority = 65

  group "dovecot" {
    count = 1
+
+    network {
+      port "zauthentication_port" {
+        static = 1337
+        to = 1337
+      }
+      port "imaps_port" {
+        static = 993
+        to = 993
+      }
+      port "imap_port" {
+        static = 143
+        to = 143
+      }
+      port "lmtp_port" {
+        static = 24
+        to = 24
+      }
+    }
+
    task "server" {
      driver = "docker"

      config {
-        image = "superboum/amd64_dovecot:v2"
+        image = "superboum/amd64_dovecot:v6"
        readonly_rootfs = false
-        port_map {
-          auth_port = 1337
-          imaps_port = 993
-          imap_port = 143
-          lmtp_port = 24
-        }
+        ports = [ "zauthentication_port", "imaps_port", "imap_port", "lmtp_port" ]
        command = "dovecot"
        args = [ "-F" ]
        volumes = [
          "secrets/ssl/certs:/etc/ssl/certs",
          "secrets/ssl/private:/etc/ssl/private",
-	  "secrets/conf/dovecot-ldap.conf:/etc/dovecot/dovecot-ldap.conf",
+          "secrets/conf/:/etc/dovecot/",
          "/mnt/glusterfs/email/mail:/var/mail/",
        ]
      }
@ -33,47 +49,11 @@ job "email" {
      resources {
        cpu = 100
        memory = 200
-        network {
-          mbits = 1
-          port "auth_port" {
-            static = "1337"
-          }
-          port "imap_port" {
-            static = "143"
-          }
-          port "imaps_port" {
-            static = "993"
-          }
-          port "lmtp_port" {
-            static = "24"
-          }
-        }
-      }
-
-      service {
-        name = "dovecot-auth"
-        port = "auth_port"
-        address_mode = "host"
-        tags = [
-          "dovecot",
-        ]
-        check {
-          type = "tcp"
-          port = "auth_port"
-          interval = "60s"
-          timeout = "5s"
-          check_restart {
-            limit = 3
-            grace = "90s"
-            ignore_warnings = false
-          }
-        }
      }

      service {
        name = "dovecot-imap"
        port = "imap_port"
-        address_mode = "host"
        tags = [
          "dovecot"
        ]
@ -93,7 +73,6 @@ job "email" {
      service {
        name = "dovecot-imaps"
        port = "imaps_port"
-        address_mode = "host"
        tags = [
          "dovecot",
          "(diplonat (tcp_port 993))"
@ -115,7 +94,6 @@ job "email" {
      service {
        name = "dovecot-lmtp"
        port = "lmtp_port"
-        address_mode = "host"
        tags = [
          "dovecot",
        ]
@ -133,24 +111,44 @@ job "email" {
        }
      }

-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/email/dovecot/dovecot-ldap.conf.tpl?raw"
-        destination = "secrets/conf/dovecot-ldap.conf.tpl"
-        mode = "file"
-      }
-      template {
-        source = "secrets/conf/dovecot-ldap.conf.tpl"
-        destination = "secrets/conf/dovecot-ldap.conf"
-        perms = "400"
+      service {
+        name = "dovecot-auth"
+        port = "zauthentication_port"
+        tags = [
+          "dovecot",
+        ]
+        check {
+          type = "tcp"
+          port = "zauthentication_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "90s"
+            ignore_warnings = false
+          }
+        }
      }

      template {
-        data = "{{ key \"configuration/email/dovecot/dovecot.crt\" }}"
+        data = file("../config/dovecot/dovecot-ldap.conf.tpl")
+        destination = "secrets/conf/dovecot-ldap.conf"
+        perms = "400"
+      }
+      template {
+        data = file("../config/dovecot/dovecot.conf")
+        destination = "secrets/conf/dovecot.conf"
+        perms = "400"
+      }
+
+      # ----- secrets ------
+      template {
+        data = "{{ key \"secrets/email/dovecot/dovecot.crt\" }}"
        destination = "secrets/ssl/certs/dovecot.crt"
        perms = "400"
      }
      template {
-        data = "{{ key \"configuration/email/dovecot/dovecot.key\" }}"
+        data = "{{ key \"secrets/email/dovecot/dovecot.key\" }}"
        destination = "secrets/ssl/private/dovecot.key"
        perms = "400"
      }
@ -159,15 +157,20 @@ job "email" {

  group "opendkim" {
    count = 1
+
+    network {
+      port "dkim_port" {
+        static = 8999
+        to = 8999
+      }
+    }
+
    task "server" {
      driver = "docker"
-
      config {
        image = "superboum/amd64_opendkim:v1"
        readonly_rootfs = false
-        port_map {
-          dkim_port = 8999
-        }
+        ports = [ "dkim_port" ]
        command = "opendkim"
        args = [ "-f", "-v", "-x", "/etc/opendkim.conf" ]
        volumes = [
@ -179,12 +182,6 @@ job "email" {
      resources {
        cpu = 100
        memory = 50
-        network {
-          mbits = 1
-          port "dkim_port" {
-            static = "8999"
-          }
-        }
      }

      service {
@ -208,72 +205,69 @@ job "email" {
      }

      template {
-        data = "{{ key \"configuration/email/dkim/keytable\" }}"
+        data = file("../config/dkim/keytable")
        destination = "secrets/dkim/keytable"
      }
      template {
-        data = "{{ key \"configuration/email/dkim/signingtable\" }}"
+        data = file("../config/dkim/signingtable")
        destination = "secrets/dkim/signingtable"
      }
      template {
-        data = "{{ key \"configuration/email/dkim/smtp.private\" }}"
+        data = file("../config/dkim/trusted")
+        destination = "secrets/dkim/trusted"
+      }
+
+      # --- secrets ---
+      template {
+        data = "{{ key \"secrets/email/dkim/smtp.private\" }}"
        destination = "secrets/dkim/smtp.private"
        perms = "600"
      }
-      template {
-        data = "{{ key \"configuration/email/dkim/smtp.txt\" }}"
-        destination = "secrets/dkim/smtp.txt"
-      }
-      template {
-        data = "{{ key \"configuration/email/dkim/trusted\" }}"
-        destination = "secrets/dkim/trusted"
-      }
    }
  }

  group "postfix" {
    count = 1
+
+    network {
+      port "smtp_port" {
+        static = 25
+        to = 25
+      }
+      port "smtps_port" {
+        static = 465
+        to = 465
+      }
+      port "submission_port" {
+        static = 587
+        to = 587
+      }
+    }
+
    task "server" {
      driver = "docker"
-
      config {
-        image = "superboum/amd64_postfix:v1"
+        image = "superboum/amd64_postfix:v3"
        readonly_rootfs = false
-        port_map {
-          smtp_port = 25
-          smtps_port = 465
-          submission_port = 587
-        }
+        ports = [ "smtp_port", "smtps_port", "submission_port" ]
        command = "postfix"
        args = [ "start-fg" ]
        volumes = [
          "secrets/ssl/certs:/etc/ssl/certs",
          "secrets/ssl/private:/etc/ssl/private",
-	  "secrets/postfix:/etc/postfix-conf",
+          "secrets/postfix:/etc/postfix-conf",
          "/dev/log:/dev/log"
        ]
      }

      env {
        TLSINFO = "/C=FR/ST=Bretagne/L=Rennes/O=Deuxfleurs/CN=smtp.deuxfleurs.fr"
-        MAILNAME = "smtp.deuxfleurs.fr",
+        MAILNAME = "smtp.deuxfleurs.fr"
      }

      resources {
        cpu = 100
        memory = 200
-        network {
-          mbits = 1
-          port "smtp_port" {
-            static = "25"
-          }
-          port "smtps_port" {
-            static = "465"
-          }
-          port "submission_port" {
-            static = "587"
-          }
-        }
      }

      service {
@ -339,109 +333,140 @@ job "email" {
        }
      }

-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/email/postfix/ldap-account.cf.tpl?raw"
-        destination = "secrets/postfix/ldap-account.cf.tpl"
-        mode = "file"
-      }
      template {
-        source = "secrets/postfix/ldap-account.cf.tpl"
+        data = file("../config/postfix/ldap-account.cf.tpl")
        destination = "secrets/postfix/ldap-account.cf"
      }

-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/email/postfix/ldap-alias.cf.tpl?raw"
-        destination = "secrets/postfix/ldap-alias.cf.tpl"
-        mode = "file"
-      }
      template {
-        source = "secrets/postfix/ldap-alias.cf.tpl"
+        data = file("../config/postfix/ldap-alias.cf.tpl")
        destination = "secrets/postfix/ldap-alias.cf"
      }

-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/email/postfix/ldap-virtual-domains.cf.tpl?raw"
-        destination = "secrets/postfix/ldap-virtual-domains.cf.tpl"
-        mode = "file"
-      }
      template {
-        source = "secrets/postfix/ldap-virtual-domains.cf.tpl"
+        data = file("../config/postfix/ldap-virtual-domains.cf.tpl")
        destination = "secrets/postfix/ldap-virtual-domains.cf"
      }
-
+ 
+      template {
+        data = file("../config/postfix/dynamicmaps.cf")
+        destination = "secrets/postfix/dynamicmaps.cf"
+      }

      template {
-        data = "{{ key \"configuration/email/postfix/postfix.crt\" }}"
+        data = file("../config/postfix/header_checks")
+        destination = "secrets/postfix/header_checks"
+      }
+
+      template {
+        data = file("../config/postfix/main.cf")
+        destination = "secrets/postfix/main.cf"
+      }
+
+      template {
+        data = file("../config/postfix/master.cf")
+        destination = "secrets/postfix/master.cf"
+      }
+
+      template {
+        data = file("../config/postfix/transport")
+        destination = "secrets/postfix/transport"
+      }
+
+      # --- secrets ---
+      template {
+        data = "{{ key \"secrets/email/postfix/postfix.crt\" }}"
        destination = "secrets/ssl/certs/postfix.crt"
        perms = "400"
      }
+
      template {
-        data = "{{ key \"configuration/email/postfix/postfix.key\" }}"
+        data = "{{ key \"secrets/email/postfix/postfix.key\" }}"
        destination = "secrets/ssl/private/postfix.key"
        perms = "400"
      }
-      template {
-        data = "{{ key \"configuration/email/postfix/dynamicmaps.cf\" }}"
-        destination = "secrets/postfix/dynamicmaps.cf"
-      }
-      template {
-        data = "{{ key \"configuration/email/postfix/header_checks\" }}"
-        destination = "secrets/postfix/header_checks"
-      }
-      template {
-        data = "{{ key \"configuration/email/postfix/main.cf\" }}"
-        destination = "secrets/postfix/main.cf"
-      }
-      template {
-        data = "{{ key \"configuration/email/postfix/master.cf\" }}"
-        destination = "secrets/postfix/master.cf"
-      }
-      template {
-        data = "{{ key \"configuration/email/postfix/transport\" }}"
-        destination = "secrets/postfix/transport"
-      }
-      template {
-        data = "{{ key \"configuration/email/postfix/transport.db\" }}"
-        destination = "secrets/postfix/transport.db"
-      }
    }
  }

+  group "alps" {
+    count = 1
+
+    network {
+      port "alps_web_port" { to = 1323 }
+    }
+
+    task "main" {
+      driver = "docker"
+      config {
+        image = "lxpz/alps_amd64:v2"
+        readonly_rootfs = true
+        ports = [ "alps_web_port" ]
+        args = [
+			"-skiptlsverification",
+			"-theme",
+			"alps",
+			"imaps://imap.deuxfleurs.fr:993",
+			"smtps://smtp.deuxfleurs.fr:465"
+		]
+      }
+      
+      resources {
+        cpu = 100
+        memory = 100
+      }
+      
+      service {
+        name = "alps"
+        port = "alps_web_port"
+        address_mode = "host"
+        tags = [
+          "alps",
+          "traefik.enable=true",
+          "traefik.frontend.entryPoints=https,http",
+          "traefik.frontend.rule=Host:alps.deuxfleurs.fr"
+        ]
+        check {
+          type = "tcp"
+          port = "alps_web_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "5m"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+  }
+
+
  group "sogo" {
    count = 1
-    task "bundle" {
-    
-      driver = "docker"

+    network {
+      port "sogo_web_port" { to = 8080 }
+    }
+
+    task "bundle" {
+      driver = "docker"
      config {
-        image = "superboum/amd64_sogo:v6"
+        image = "superboum/amd64_sogo:v7"
        readonly_rootfs = false
-        port_map {
-          sogo_web_port = 8080
-        }
+        ports = [ "sogo_web_port" ]
        volumes = [
-	  "secrets/sogo.conf:/etc/sogo/sogo.conf",
+	        "secrets/sogo.conf:/etc/sogo/sogo.conf",
        ]
      }

-      /* Workaround as there is no consul source and no way to template recursively... */
-      artifact {
-        source = "http://127.0.0.1:8500/v1/kv/configuration/email/sogo/sogo.conf.tpl?raw"
-        destination = "secrets/tpl/sogo.conf.tpl"
-        mode = "file"
-      }
      template {
-        source = "secrets/tpl/sogo.conf.tpl"
+        data = file("../config/sogo/sogo.conf.tpl")
        destination = "secrets/sogo.conf"
      }

      resources {
        cpu = 200
        memory = 1000
-        network {
-          mbits = 1
-          port "sogo_web_port" {}
-        }
      }
      
      service {
--- a/app/email/secrets/email/dkim/smtp.private
+++ b/app/email/secrets/email/dkim/smtp.private
@ -0,0 +1 @@
+RSA_PRIVATE_KEY dkim
--- a/app/email/secrets/email/dovecot/dovecot.crt
+++ b/app/email/secrets/email/dovecot/dovecot.crt
@ -0,0 +1 @@
+SSL_CERT dovecot deuxfleurs.fr
--- a/app/email/secrets/email/dovecot/dovecot.key
+++ b/app/email/secrets/email/dovecot/dovecot.key
@ -0,0 +1 @@
+SSL_KEY dovecot
--- a/app/email/secrets/email/dovecot/ldap_binddn
+++ b/app/email/secrets/email/dovecot/ldap_binddn
@ -0,0 +1 @@
+SERVICE_DN dovecot Dovecot IMAP server
--- a/app/email/secrets/email/dovecot/ldap_bindpwd
+++ b/app/email/secrets/email/dovecot/ldap_bindpwd
@ -0,0 +1 @@
+SERVICE_PASSWORD dovecot
--- a/app/email/secrets/email/postfix/postfix.crt
+++ b/app/email/secrets/email/postfix/postfix.crt
@ -0,0 +1 @@
+SSL_CERT postfix deuxfleurs.fr
--- a/app/email/secrets/email/postfix/postfix.key
+++ b/app/email/secrets/email/postfix/postfix.key
@ -0,0 +1 @@
+SSL_KEY postfix
--- a/app/email/secrets/email/sogo/ldap_binddn
+++ b/app/email/secrets/email/sogo/ldap_binddn
@ -0,0 +1 @@
+SERVICE_DN sogo SoGo email frontend
--- a/app/email/secrets/email/sogo/ldap_bindpw
+++ b/app/email/secrets/email/sogo/ldap_bindpw
@ -0,0 +1 @@
+SERVICE_PASSWORD sogo
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`USER_LONG Private ed25519 key of the container doing the backup`
				`@ -0,0 +1 @@`
				`USER Public ed25519 key of the container doing the backup (this key must be in authorized_keys on the backup target host)`
				`@ -0,0 +1 @@`
				`USER Directory where to store backups on target host`
				`@ -0,0 +1 @@`
				`USER SSH fingerprint of the target machine (format: copy here the corresponding line from your known_hosts file)`
				`@ -0,0 +1 @@`
				`USER SSH port number to connect to the target host`
				`@ -0,0 +1 @@`
				`USER SSH username to log in as on the target host`
				`@ -0,0 +1 @@`
				`USER Garage access key for Guichet profile pictures`
				`@ -0,0 +1 @@`
				`USER Garage secret key for Guichet profile pictures`
				`@ -0,0 +1 @@`
				`SERVICE_DN dummy Dummy service for testing secretmgr.py`