adrien/infrastructure
1
0
Fork 0
forked from Deuxfleurs/infrastructure
Code Issues Pull requests Releases Wiki Activity

Document secrets and add stub utility to manage them

Browse source
This commit is contained in:
Alex 2021-01-16 17:37:34 +01:00
parent c74dc92feb
commit d4d0b100ad
79 changed files with 81 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
app/.gitignore vendored
View file

@ -1,11 +0,0 @@
# Blacklist everything cleverly
*/secrets/*
!*/secrets/*/
# Whitelist some patterns
!*.sample
!*.gen
!*.sh
!.gitignore
# Whitelist specific files

0
app/email/config/dkim/smtp.private.sample
View file

0
app/email/config/dkim/smtp.txt.sample
View file

1
app/email/secrets/email/dkim/smtp.private Normal file
View file

@ -0,0 +1 @@
RSA_PRIVATE_KEY dkim

0
app/email/secrets/email/dkim/smtp.private.sample
View file

1
app/email/secrets/email/dovecot/dovecot.crt Normal file
View file

@ -0,0 +1 @@
SSL_CERT dovecot deuxfleurs.fr

0
app/email/secrets/email/dovecot/dovecot.crt.sample
View file

1
app/email/secrets/email/dovecot/dovecot.key Normal file
View file

@ -0,0 +1 @@
SSL_KEY dovecot

0
app/email/secrets/email/dovecot/dovecot.key.sample
View file

1
app/email/secrets/email/dovecot/ldap_binddn Normal file
View file

@ -0,0 +1 @@
SERVICE_DN dovecot Dovecot IMAP server

0
app/email/secrets/email/dovecot/ldap_binddn.sample
View file

1
app/email/secrets/email/dovecot/ldap_bindpwd Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD dovecot

0
app/email/secrets/email/dovecot/ldap_bindpwd.sample
View file

1
app/email/secrets/email/postfix/postfix.crt Normal file
View file

@ -0,0 +1 @@
SSL_CERT postfix deuxfleurs.fr

0
app/email/secrets/email/postfix/postfix.crt.sample
View file

1
app/email/secrets/email/postfix/postfix.key Normal file
View file

@ -0,0 +1 @@
SSL_KEY postfix

0
app/email/secrets/email/postfix/postfix.key.sample
View file

1
app/email/secrets/email/sogo/ldap_binddn Normal file
View file

@ -0,0 +1 @@
SERVICE_DN sogo SoGo email frontend

0
app/email/secrets/email/sogo/ldap_binddn.sample
View file

1
app/email/secrets/email/sogo/ldap_bindpw Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD sogo

0
app/email/secrets/email/sogo/ldap_bindpw.sample
View file

1
app/email/secrets/email/sogo/postgre_auth Normal file
View file

@ -0,0 +1 @@
USER SoGo postgres auth (format: sogo:<password>) (TODO: replace this with two separate files and change template)

0
app/email/secrets/email/sogo/postgre_auth.sample
View file

1
app/im/secrets/chat/coturn/static-auth Normal file
View file

@ -0,0 +1 @@
USER cotorn static-auth (what is this?)

0
app/im/secrets/chat/coturn/static-auth.sample
View file

1
app/im/secrets/chat/fb2mx/as_token Normal file
View file

@ -0,0 +1 @@
USER fb2mx API server token

0
app/im/secrets/chat/fb2mx/as_token.sample
View file

1
app/im/secrets/chat/fb2mx/db_url Normal file
View file

@ -0,0 +1 @@
USER fb2mx database URL, format: postgres://username:password@hostname/dbname

1
app/im/secrets/chat/fb2mx/db_url.sample
View file

@ -1 +0,0 @@
postgres://username:password@hostname/dbname

1
app/im/secrets/chat/fb2mx/hs_token Normal file
View file

@ -0,0 +1 @@
USER fb2mx homeserver token

0
app/im/secrets/chat/fb2mx/hs_token.sample
View file

1
app/im/secrets/chat/synapse/homeserver.tls.crt Normal file
View file

@ -0,0 +1 @@
SSL_CERT synapse im.deuxfleurs.fr

0
app/im/secrets/chat/synapse/homeserver.tls.crt.sample
View file

1
app/im/secrets/chat/synapse/homeserver.tls.dh Normal file
View file

@ -0,0 +1 @@
USER_LONG DH parameters for matrix ssl key? how does this work?

0
app/im/secrets/chat/synapse/homeserver.tls.dh.sample
View file

1
app/im/secrets/chat/synapse/homeserver.tls.key Normal file
View file

@ -0,0 +1 @@
SSL_KEY synapse im.deuxfleurs.fr

0
app/im/secrets/chat/synapse/homeserver.tls.key.sample
View file

1
app/im/secrets/chat/synapse/ldap_binddn Normal file
View file

@ -0,0 +1 @@
SERVICE_DN matrix Matrix chat server

0
app/im/secrets/chat/synapse/ldap_binddn.sample
View file

1
app/im/secrets/chat/synapse/ldap_bindpw Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD matrix

0
app/im/secrets/chat/synapse/ldap_bindpw.sample
View file

1
app/im/secrets/chat/synapse/postgres_db Normal file
View file

@ -0,0 +1 @@
CONST synapse

0
app/im/secrets/chat/synapse/postgres_db.sample
View file

1
app/im/secrets/chat/synapse/postgres_pwd Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD matrix

0
app/im/secrets/chat/synapse/postgres_pwd.sample
View file

1
app/im/secrets/chat/synapse/postgres_user Normal file
View file

@ -0,0 +1 @@
CONST matrix

0
app/im/secrets/chat/synapse/postgres_user.sample
View file

1
app/im/secrets/chat/synapse/registration_shared_secret Normal file
View file

@ -0,0 +1 @@
USER Shared secret for homeserver registrations (?)

0
app/im/secrets/chat/synapse/registration_shared_secret.sample
View file

1
app/jitsi/secrets/jitsi/auth.jitsi.deuxfleurs.fr.crt Normal file
View file

@ -0,0 +1 @@
SSL_CERT jitsi_auth autj.jitsi.deuxfleurs.fr

0
app/jitsi/secrets/jitsi/auth.jitsi.deuxfleurs.fr.crt.sample
View file

1
app/jitsi/secrets/jitsi/auth.jitsi.deuxfleurs.fr.key Normal file
View file

@ -0,0 +1 @@
SSL_KEY jitsi_auth autj.jitsi.deuxfleurs.fr

0
app/jitsi/secrets/jitsi/auth.jitsi.deuxfleurs.fr.key.sample
View file

1
app/jitsi/secrets/jitsi/jitsi.deuxfleurs.fr.crt Normal file
View file

@ -0,0 +1 @@
SSL_CERT jitsi jitsi.deuxfleurs.fr

0
app/jitsi/secrets/jitsi/jitsi.deuxfleurs.fr.crt.sample
View file

1
app/jitsi/secrets/jitsi/jitsi.deuxfleurs.fr.key Normal file
View file

@ -0,0 +1 @@
SSL_KEY jitsi

0
app/jitsi/secrets/jitsi/jitsi.deuxfleurs.fr.key.sample
View file

1
app/platoo/secrets/platoo/bddpw Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD platoo

0
app/platoo/secrets/platoo/bddpw.sample
View file

1
app/postgres/secrets/postgres/keeper/pg_repl_pwd Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD replicator

0
app/postgres/secrets/postgres/keeper/pg_repl_pwd.sample
View file

1
app/postgres/secrets/postgres/keeper/pg_repl_username Normal file
View file

@ -0,0 +1 @@
CONST replicator

0
app/postgres/secrets/postgres/keeper/pg_repl_username.sample
View file

1
app/postgres/secrets/postgres/keeper/pg_su_pwd Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD postgres

0
app/postgres/secrets/postgres/keeper/pg_su_pwd.sample
View file

0
app/seafile/config/conf/mykey.peer.sample
View file

1
app/seafile/secrets/mariadb/main/ldap_binddn Normal file
View file

@ -0,0 +1 @@
SERVICE_DN mysql MySQL/MariaDB database

0
app/seafile/secrets/mariadb/main/ldap_binddn.sample
View file

1
app/seafile/secrets/mariadb/main/ldap_bindpwd Normal file
View file

@ -0,0 +1 @@
SERVICE_PASSWORD mysql

0
app/seafile/secrets/mariadb/main/ldap_bindpwd.sample
View file

1
app/seafile/secrets/mariadb/main/mysql_pwd Normal file
View file

@ -0,0 +1 @@
USER mysql_pwd (what is this?)

0
app/seafile/secrets/mariadb/main/mysql_pwd.sample
View file

1
app/seafile/secrets/seafile/conf/mykey.peer Normal file
View file

@ -0,0 +1 @@
USER Seafile peer key

0
app/seafile/secrets/seafile/conf/mykey.peer.sample
View file

44
app/secrets.py Normal file
View file

@ -0,0 +1,44 @@
#!/usr/bin/env python3
"""
TODO: this will be a utility to handle secrets in the Consul database
for the various components of the Deuxfleurs infrastructure
Functionnalities:
- check that secrets are correctly configured
- help user fill in secrets
- create LDAP service users and fill in corresponding secrets
- maybe one day: manage SSL certificates and keys
It uses files placed in <module_name>/secrets/* to know what secrets
it should handle. These secret files contain directives for what to do
about these secrets.
Example directives:
USER <description>
(a secret that must be filled in by the user)
USER_LONG <description>
(the same, indicates that the secret fits on several lines)
CONST <constant value>
(the secret has a constant value set here)
CONST_LONG
<constant value, several lines>
(same)
SERVICE_DN <service name> <service description>
(the LDAP DN of a service user)
SERVICE_PASSWORD <service name>
(the LDAP password for the corresponding service user)
SSL_CERT <cert name> <list of domains>
(a SSL domain for the given domains)
SSL_KEY <cert name>
(the SSL key going with corresponding certificate)
"""

1
app/web_static/secrets/web/home_token Normal file
View file

@ -0,0 +1 @@
USER web home_token (what is this?)

0
app/web_static/secrets/web/home_token.sample
View file

1
app/web_static/secrets/web/quentin.dufour.io_token Normal file
View file

@ -0,0 +1 @@
USER web quentin.dufour.io token (what is this?)

0
app/web_static/secrets/web/quentin.dufour.io_token.sample
View file