Merge remote-tracking branch 'origin/main' into fix/mariadb+docker

Author: baszoetekouw

environments/template/group_vars/mongo_servers.yml

@@ -1,5 +1,5 @@
 ---
-replica_set_name: my_mongo_cluster
+mongo_replica_set_name: my_mongo_cluster
 
 mongo_cluster_members:
   - host: "mongo3.example.com:{{ mongo_port }}" # arbiter first or change mongo_arbiter_index

environments/template/group_vars/template.yml

@@ -42,8 +42,7 @@ teams_gui_version: "9.1.3"
 teams_server_version: "9.1.3"
 voot_version: "6.2.0"
 myconext_version: "8.1.12-1"
-dashboard_server_version: "12.3.4"
-dashboard_gui_version: "12.3.4"
+dashboard_version: "13.0.11"
 invite_server_version: "0.0.2-SNAPSHOT"
 invite_client_version: "0.0.2-SNAPSHOT"
 invite_welcome_version: "0.0.2-SNAPSHOT"
@@ -157,15 +156,15 @@ voot:
     - { name: "voot", level: "DEBUG" }
   externalGroupProviders:
     - {
-        type: "teams",
-        url: "https://teams.{{ base_domain }}/api/voot",
-        credentials: {
-         username: "{{ teams.voot_api_user }}",
-         secret: "{{ external_group_provider_secrets.teams }}"
-        },
-        schacHomeOrganization: "{{ base_domain}}",
-        name: "SURFteams",
-        timeoutMillis: 15000
+          type: "invite",
+          url: "https://invite.{{ base_domain }}/api/external/v1/voot",
+          credentials: {
+              username: "{{ invite.vootuser }}",
+              secret: "{{ invite.vootsecret }}"
+          },
+          schacHomeOrganization: "N/A",
+          name: "Invite",
+          timeoutMillis: 3000
       }
 
 oidc_playground:
@@ -339,6 +338,7 @@ manage:
   features: push, validation, push_preview, orphans, find_my_data, edugain, auto_refresh
   environment: template
   super_user_team_names: "urn:collab:group:test.surfteams.nl:nl:surfnet:diensten:surfconext_tpm_core"
+  sram_rp_entity_id: "sbs.test.sram.surf.nl"
   apiUsers:
     - {
         name: "dashboard",

environments/template/secrets/secret_example.yml

@@ -13,7 +13,7 @@ mongo_passwords:
    oidcng: secret
    myconext: secret
 
-mongo_admin_password: secret
+mongo_admin_password: secret # this works for first time install, if you change it later you will have to do it manually
 mongo_ca_passphrase: secret
 
 engine_api_metadata_push_password: secret

roles/dashboard/tasks/main.yml

@@ -25,7 +25,7 @@
     name: dashboardserver
     env:
       TZ: "{{ timezone }}"
-    image: ghcr.io/openconext/openconext-dashboard/dashboard-server:{{ dashboard_server_version }}
+    image: ghcr.io/openconext/openconext-dashboard/dashboard-server:{{ dashboard_version }}
     pull: true
     restart_policy: "{{ dashboard_server_restart_policy }}"
     restart_retries: "{{ dashboard_server_restart_retries }}" # Only for restart policy on-failure
@@ -61,7 +61,7 @@
 - name: Create the gui container
   community.docker.docker_container:
     name: dashboardgui
-    image: ghcr.io/openconext/openconext-dashboard/dashboard-gui:{{ dashboard_gui_version }}
+    image: ghcr.io/openconext/openconext-dashboard/dashboard-gui:{{ dashboard_version }}
     pull: true
     restart_policy: "always"
     state: started

roles/dashboard/templates/serverapplication.yml.j2

@@ -80,6 +80,7 @@ dashboard.feature.consent={{ dashboard.feature_consent }}
 # Valid choices are 'MOCK', 'PDP' or 'MANAGE', 'MOCK' is for local development
 dashboard.feature.pdpSource={{ dashboard.pdp_source }}
 dashboard.feature.statistics=true
+dashboard.feature.statisticsDown={{ dashboard.feature_statsdown }}
 dashboard.feature.mail={{ dashboard.feature_mail }}
 dashboard.feature.oidc={{ dashboard.feature_oidc }}
 dashboard.feature.stepup={{ dashboard.feature_stepup }}

roles/docker/defaults/main.yml

@@ -8,5 +8,6 @@ docker_apt_gpg_key_checksum: "sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807c
 docker_apt_filename: "docker"
 docker_install_traefik: true
 docker_traefik_ldaps: false
+docker_traefik_version: 3.6.10
 docker_traefik_ports:
   - 0.0.0.0:443:443

roles/docker/tasks/main.yml

@@ -82,7 +82,7 @@
 - name: Create the Traefik loadbalancer
   community.docker.docker_container:
     name: loadbalancer
-    image: traefik:latest
+    image: traefik:{{ docker_traefik_version }}
     published_ports: "{{ docker_traefik_ports }}"
     pull: true
     restart_policy: "always"

roles/haproxy/tasks/main.yml

@@ -16,7 +16,7 @@
 - name: Install haproxy and socat
   ansible.builtin.apt:
     name:
-      - "haproxy=3.0.*"
+      - "haproxy"
       - "socat"
       - "git"
     state: "present"
@@ -88,17 +88,6 @@
     group: haproxy
     mode: "0770"
 
-- name: Create combined key and certificate file for HAproxy
-  ansible.builtin.copy:
-    content: >
-      {{ item.key_content }}{{ lookup('file', '{{ inventory_dir }}/files/certs/{{ item.crt_name }}') }}
-    dest: "/etc/haproxy/certs/{{ item.name }}_haproxy.pem"
-    mode: "0600"
-  with_items: "{{ haproxy_sni_ip.certs }}"
-  when: haproxy_sni_ip.certs is defined
-  notify:
-    - "reload haproxy"
-
 - name: Create backend CA directory
   ansible.builtin.file:
     path: "{{ tls_backend_ca | dirname }}"

roles/haproxy/templates/certlist.lst.j2

@@ -3,11 +3,6 @@
 /etc/haproxy/certs/{{ host }}.pem [ocsp-update on]
 {% endfor %}
 {% endif %}
-{% if haproxy_sni_ip.certs is defined %}
-{% for cert in haproxy_sni_ip.certs %}
-/etc/haproxy/certs/{{ cert.name }}_haproxy.pem [ocsp-update on]
-{% endfor %}
-{% endif %}
 {% if haproxy_extra_certs is defined %}
 {% for cert in haproxy_extra_certs %}
 {{ cert }} [ocsp-update on]