Skip to content

Commit 546fdd4

Browse files
baszoetekouwbaszoetekouw
authored
Merge pull request #603 from OpenConext/release/625
AA Release 625
2 parents 567c1cc + fd8f37b commit 546fdd4

14 files changed

Lines changed: 184 additions & 88 deletions

File tree

‎.ansible-lint‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
profile: "production"
3+
offline: false

‎environments/template/group_vars/template.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,7 @@ relp_remote:
2828

2929
php_display_errors: 1
3030

31-
attribute_aggregation_gui_version: "3.0.6"
32-
attribute_aggregation_server_version: "3.0.6"
31+
attribute_aggregation_version: "3.0.6"
3332
oidc_playground_client_version: "3.0.0"
3433
oidc_playground_server_version: "3.0.0"
3534
engine_version: "6.15.0"

‎provision.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@
115115
- { role: teams, tags: ["teams"] }
116116
- { role: pdp, tags: ["pdp"] }
117117
- { role: voot, tags: ["voot"] }
118-
- { role: attribute-aggregation, tags: ["aa", "attribute-aggregation"] }
118+
- { role: attribute_aggregation, tags: ["aa", "attribute-aggregation"] }
119119
- { role: oidc-playground, tags: ["oidc-playground"] }
120120
- { role: myconext, tags: ["myconext"] }
121121
- { role: manage, tags: ["manage"] }

‎roles/attribute-aggregation/handlers/main.yml‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎roles/attribute-aggregation/tasks/main.yml‎

Lines changed: 0 additions & 74 deletions
This file was deleted.

roles/attribute-aggregation/defaults/main.yml renamed to roles/attribute_aggregation/defaults/main.yml

File renamed without changes.

‎roles/attribute_aggregation/handlers/main.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
- name: "Restart attribute-aggregationserver"
2+
community.docker.docker_container:
3+
name: aaserver
4+
state: started
5+
restart: true
6+
# avoid restarting it creates unexpected data loss according to docker_container_module notes
7+
comparisons:
8+
'*': ignore
9+
when: "aa_servercontainer is success and aa_servercontainer is not changed"
10+
11+
- name: "Restart attribute-aggregationlink"
12+
community.docker.docker_container:
13+
name: aalink
14+
state: started
15+
restart: true
16+
# avoid restarting it creates unexpected data loss according to docker_container_module notes
17+
comparisons:
18+
'*': ignore
19+
when: "aa_linkcontainer is success and aa_linkcontainer is not changed"

‎roles/attribute_aggregation/tasks/main.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
- name: Create directory to keep configfile
3+
ansible.builtin.file:
4+
dest: "/opt/openconext/attribute-aggregation"
5+
state: "directory"
6+
owner: "root"
7+
group: "root"
8+
mode: "0770"
9+
10+
- name: Place the server application configfiles
11+
ansible.builtin.template:
12+
src: "{{ item }}.j2"
13+
dest: "/opt/openconext/attribute-aggregation/{{ item }}"
14+
owner: "root"
15+
group: "root"
16+
mode: "0644"
17+
with_items:
18+
- "serverapplication.yml"
19+
- "logback.xml"
20+
- "attributeAuthorities.yml"
21+
- "serviceProviderConfig.json"
22+
notify:
23+
- "Restart attribute-aggregationserver"
24+
25+
- name: Place the link application configfiles
26+
ansible.builtin.template:
27+
src: "{{ item }}.j2"
28+
dest: "/opt/openconext/attribute-aggregation/{{ item }}"
29+
owner: "root"
30+
group: "root"
31+
mode: "0644"
32+
with_items:
33+
- "apachelink.conf"
34+
notify:
35+
- "Restart attribute-aggregationlink"
36+
37+
- name: Add the MariaDB docker network to the list of networks when MariaDB runs in Docker
38+
ansible.builtin.set_fact:
39+
aa_docker_networks:
40+
- name: "loadbalancer"
41+
- name: "openconext_mariadb"
42+
when: "mariadb_in_docker | default(false) | bool"
43+
44+
- name: Create and start the server container
45+
community.docker.docker_container:
46+
name: "aaserver"
47+
image: "ghcr.io/openconext/openconext-attribute-aggregation/aa-server:{{ attribute_aggregation_version }}"
48+
pull: true
49+
restart_policy: "always"
50+
state: "started"
51+
networks: "{{ aa_docker_networks }}"
52+
mounts:
53+
- source: "/opt/openconext/attribute-aggregation/serverapplication.yml"
54+
target: "/application.yml"
55+
read_only: true
56+
type: "bind"
57+
- source: "/opt/openconext/attribute-aggregation/logback.xml"
58+
target: "/logback.xml"
59+
read_only: true
60+
type: "bind"
61+
- source: "/opt/openconext/attribute-aggregation/attributeAuthorities.yml"
62+
target: "/attributeAuthorities.yml"
63+
read_only: true
64+
type: "bind"
65+
- source: "/opt/openconext/attribute-aggregation/serviceProviderConfig.json"
66+
target: "/serviceProviderConfig.json"
67+
read_only: true
68+
type: "bind"
69+
command: "-Xmx128m --spring.config.location=./"
70+
etc_hosts:
71+
host.docker.internal: "host-gateway"
72+
labels:
73+
traefik.http.routers.aaserver.rule: "Host(`aa.{{ base_domain }}`)"
74+
traefik.http.routers.aaserver.tls: "true"
75+
traefik.enable: "true"
76+
healthcheck:
77+
test:
78+
[
79+
"CMD",
80+
"wget",
81+
"-no-verbose",
82+
"--tries=1",
83+
"--spider",
84+
"http://localhost:8080/internal/health",
85+
]
86+
interval: "10s"
87+
timeout: "10s"
88+
retries: 3
89+
start_period: "10s"
90+
notify: "Restart attribute-aggregationserver"
91+
register: "aa_servercontainer"
92+
93+
- name: Create the gui link container
94+
community.docker.docker_container:
95+
name: "aalink"
96+
image: "ghcr.io/openconext/openconext-basecontainers/apache2-shibboleth:latest"
97+
pull: true
98+
restart_policy: "always"
99+
state: "started"
100+
networks: "{{ aa_docker_networks }}"
101+
mounts:
102+
- source: "/opt/openconext/attribute-aggregation/apachelink.conf"
103+
target: "/etc/apache2/sites-enabled/000-default.conf"
104+
read_only: true
105+
type: "bind"
106+
- source: "/etc/localtime"
107+
target: "/etc/localtime"
108+
read_only: true
109+
type: "bind"
110+
- source: "/opt/openconext/common/favicon.ico"
111+
target: "/var/www/favicon.ico"
112+
read_only: true
113+
type: "bind"
114+
etc_hosts:
115+
host.docker.internal: "host-gateway"
116+
labels:
117+
traefik.http.routers.aalink.rule: "Host(`link.{{ base_domain }}`)"
118+
traefik.http.routers.aalink.tls: "true"
119+
traefik.enable: "true"
120+
healthcheck:
121+
test: ["CMD", "curl", "--fail", "http://localhost/internal/health"]
122+
interval: "10s"
123+
timeout: "10s"
124+
retries: 3
125+
start_period: "10s"
126+
hostname: "attribute-link"
127+
env:
128+
HTTPD_CSP: "{{ httpd_csp.lenient_with_static_img }}"
129+
HTTPD_SERVERNAME: "link.{{ base_domain }}"
130+
OPENCONEXT_INSTANCENAME: "{{ instance_name }}"
131+
OPENCONEXT_ENGINE_LOGOUT_URL: "https://engine.{{ base_domain }}/logout"
132+
OPENCONEXT_HELP_EMAIL: "{{ support_email }}"
133+
SHIB_ENTITYID: "https://link.{{ base_domain }}/shibboleth"
134+
SHIB_REMOTE_ENTITYID: "https://engine.{{ base_domain }}/authentication/idp/metadata"
135+
SHIB_REMOTE_METADATA: "{{ shibboleth_metadata_sources.engine }}"
136+
register: "aa_linkcontainer"
137+
138+
- name: Remove obsolete pdp containers
139+
community.docker.docker_container:
140+
name: "{{ item }}"
141+
state: "absent"
142+
loop:
143+
- "aagui"

roles/attribute-aggregation/templates/apachelink.conf.j2 renamed to roles/attribute_aggregation/templates/apachelink.conf.j2

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ Redirect /orcid https://link.{{ base_domain }}/aa/api/client/information.html
1212
ProxyPass /Shibboleth.sso !
1313

1414
ProxyPass /redirect http://aaserver:8080/aa/api/redirect
15-
ProxyPass /internal/health http://aaserver:8080/aa/api/internal/health
16-
ProxyPass /internal/info http://aaserver:8080/aa/api/internal/info
15+
ProxyPass /internal/health http://aaserver:8080/internal/health
16+
ProxyPass /internal/info http://aaserver:8080/internal/info
1717

1818
ProxyPass /aa/api http://aaserver:8080/aa/api
1919
ProxyPassReverse /aa/api http://aaserver:8080/aa/api
@@ -22,3 +22,18 @@ ProxyPassReverse /aa/api/client http://aaserver:8080/aa/api/client
2222
Header always set X-Frame-Options "DENY"
2323
Header always set Referrer-Policy "strict-origin-when-cross-origin"
2424
Header always set X-Content-Type-Options "nosniff"
25+
26+
<Location />
27+
AuthType shibboleth
28+
ShibUseHeaders On
29+
ShibRequireSession On
30+
Require valid-user
31+
</Location>
32+
33+
<Location ~ "/internal/(health|info)">
34+
Require all granted
35+
</Location>
36+
37+
<Location ~ "/aa/api/internal/">
38+
Require all denied
39+
</Location>

roles/attribute-aggregation/templates/attributeAuthorities.yml.j2 renamed to roles/attribute_aggregation/templates/attributeAuthorities.yml.j2

File renamed without changes.

0 commit comments

Comments
 (0)