Merge branch 'release/678' into release/test2

Author: baszoetekouw

roles/spdashboard/defaults/main.yml

@@ -1,41 +1,55 @@
 ---
-front_controller: app.php
-develop_spd: False
-spdashboard_fpm_user: spdashboard
-spdashboard_domain: spdashboard.{{ base_domain }}
-spdashboard_data_dir: /opt/openconext/spdashboard
-spdashboard_document_root: "{{ spdashboard_data_dir }}/current/web"
-spdashboard_branch: master
-spdashboard_branch_dir: /opt/openconext/builds/spdashboard
+spdashboard_domain: "spdashboard.{{ base_domain }}"
+spdashboard_db_name: "spdashboard"
+
+spdashboard_app_secret: "CHANGE_ME"
+
+spdashboard_support_email: "{{ support_email }}"
+
+spdashboard_show_global_notice: false
+spdashboard_global_notice_date: "01-01-2020"
+
+# these are really not used in any regular configuration, safe to keep them on default
 spdashboard_saml_sp_publickey: "%kernel.project_dir%/vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_publickey.cer"
 spdashboard_saml_sp_privatekey: "%kernel.project_dir%/vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_privatekey.pem"
 spdashboard_saml_metadata_publickey: "%kernel.project_dir%/vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_publickey.cer"
 spdashboard_saml_metadata_privatekey: "%kernel.project_dir%/vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_privatekey.pem"
+
 spdashboard_saml_remote_idp_host: "https://engine.{{ base_domain }}"
-spdashboard_support_email: "{{ support_email }}"
-spdashboard_manage_prod_host: "https://manage-prod.{{ base_domain }}"
-spdashboard_manage_test_publication_status: testaccepted
-spdashboard_manage_prod_publication_status: prodaccepted
-spdashboard_manage_test_oidcng_enabled: true
-spdashboard_manage_prod_oidcng_enabled: true
-spdashboard_nodejs_rpm_url: "https://rpm.nodesource.com/pub_11.x/el/7/x86_64/nodesource-release-el7-1.noarch.rpm"
-spdashboard_jira_host: https://jira-test.surfnet.nl
-spdashboard_jira_username: username
-spdashboard_jira_password: password
-spdashboard_jira_issue_priority: Medium
-spdashboard_jira_issue_type: spd-delete-production-entity
-spdashboard_jira_issue_type_publication_request: spd-request-production-entity
-spdashboard_jira_entityid_fieldname: customfield_12914
-spdashboard_jira_manageid_fieldname: customfield_13401
+spdashboard_saml_remote_idp_entity_id: "https://engine.{{ base_domain }}/authentication/idp/metadata"
+spdashboard_saml_remote_idp_sso_url: "https://engine.{{ base_domain }}/authentication/idp/single-sign-on/key:20230503"
+
+spdashboard_invite_host: "https://invite.{{ base_domain }}"
+spdashboard_invite_landing_url: "https://invite.{{ base_domain }}"
+
+spdashboard_surf_autorization_attribute: "urn:mace:dir:attribute-def:eduPersonEntitlement"
+spdashboard_surf_autorization_attribute_svc_value: "urn:mace:undefined"
+spdashboard_adminteams: []
+
+spdashboard_manage_prod_host: "https://manage.{{ base_domain }}"
+spdashboard_manage_prod_publication_status: "prodaccepted"
+
+spdashboard_manage_test_host: "https://manage.test.{{ base_domain }}"
+spdashboard_manage_test_publication_status: "testaccepted"
+
+spdashboard_jira_host: "https://jira.invalid"
+spdashboard_jira_project_key: "CXT"
+spdashboard_jira_issue_priority: "Medium"
+spdashboard_jira_issue_type: "spd-delete-production-entity"
+spdashboard_jira_issue_type_publication_request: "spd-request-production-entity"
+spdashboard_jira_issue_type_change_request: "spd-request-change-request-prod"
+spdashboard_jira_issue_type_invite: "spd-idp-invite-request"
+
+spdashboard_jira_entityid_fieldname: "customfield_12914"
+spdashboard_jira_reporter_fieldname: "customfield_13009"
+spdashboard_jira_manageid_fieldname: "customfield_13401"
 spdashboard_jira_manageid_field_label: "SURFconext Manage ID"
-spdashboard_jira_project_key: CXT
-spdashboard_test_mode_enabled: false
-spdashboard_test_mode_path: '../var/issues.json'
-spdashboard_playground_uri_test: https://authz-playground.dev.support.surfconext.nl/redirect
-spdashboard_playground_uri_prod: https://authz-playground.dev.support.surfconext.nl/redirect
-spdashboard_oidcng_playground_uri_test: https://oidc-playground.dev.support.surfconext.nl/redirect
-spdashboard_oidcng_playground_uri_prod: https://oidc-playground.dev.support.surfconext.nl/redirect
-spdashboard_show_global_notice: False
-spdashboard_global_notice_date: "01-01-2020"
-spdashboard_docker_networks: 
-  - name: loadbalancer
+
+spdashboard_playground_uri_prod: "https://oidc-playground.{{ basedomain }}/redirect"
+spdashboard_playground_uri_test: "https://oidc-playground.test.{{ basedomain }}/redirect"
+
+spdashboard_oidcng_playground_uri_test: "https://oidc-playground.dev.support.surfconext.nl/redirect"
+spdashboard_oidcng_playground_uri_prod: "https://oidc-playground.dev.support.surfconext.nl/redirect"
+
+spdashboard_docker_networks:
+  - name: "loadbalancer"

roles/spdashboard/tasks/main.yml

@@ -1,31 +1,30 @@
 ---
-- name: Create directory to keep configfile
-  file:
-    dest: "/opt/openconext/spdashboard"
-    state: directory
-    owner: root
-    group: root
-    mode: 0770
+- name: "Create directory to keep configfile"
+  ansible.builtin.file:
+    path: "/opt/openconext/spdashboard"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0750"
 
-- name: Place the configfile
-  template:
-    src: env.j2
-    dest: /opt/openconext/spdashboard/env
-    owner: root
-    group: root
-    mode: 0644
+- name: "Place the configfile"
+  ansible.builtin.template:
+    src: "env.j2"
+    dest: "/opt/openconext/spdashboard/env"
+    owner: "root"
+    mode: "0644"
 
-- name: Add the MariaDB docker network to the list of networks when MariaDB runs in Docker
+- name: "Add the MariaDB docker network to the list of networks when MariaDB runs in Docker"
   ansible.builtin.set_fact:
     spdashboard_docker_networks:
-      - name: loadbalancer
-      - name: openconext_mariadb
-  when: mariadb_in_docker | default(false) | bool
+      - name: "loadbalancer"
+      - name: "openconext_mariadb"
+  when: "mariadb_in_docker | default(false) | bool"
 
-- name: Create the container
-  docker_container:
-    name: spdashboard
-    image: ghcr.io/surfnet/sp-dashboard/spdashboard:{{ spdashboard_version }}
+- name: "Create the container"
+  community.docker.docker_container:
+    name: "spdashboard"
+    image: "ghcr.io/surfnet/sp-dashboard/spdashboard:{{ spdashboard_version }}"
     env_file: "/opt/openconext/spdashboard/env"
     pull: true
     restart_policy: "always"
@@ -36,8 +35,8 @@
       traefik.enable: "true"
       traefik.port: "8080"
     healthcheck:
-      test: ["CMD", "curl", "--fail", "http://localhost"]
-      interval: 10s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
+      test: ["CMD", "curl", "--fail", "http://localhost/health"]
+      interval: "10s"
+      timeout: "10s"
+      retries: "3"
+      start_period: "10s"

roles/spdashboard/templates/env.j2

@@ -1,77 +1,82 @@
 APP_ENV=prod
-APP_SECRET={{ spdashboard_symfony_secret }}
-DATABASE_URL=mysql://spdrw:{{ mysql_passwords.spdashboard }}@{{ mariadb_host }}/{{ spdashboard_db_name | default('spdashboard') }}
-MAILER_DSN=null://null
+# TODO/wip: maak alleen indirecte referentie naar de secrets.  Dus niet vanuit de config files direct secrets, maar die via een variabele hier laten lopen).
+APP_SECRET={{ spdashboard_app_secret }}
+DATABASE_URL=mysql://spdrw:{{ mysql_passwords.spdashboard }}@{{ mariadb_host }}/{{ spdashboard_db_name }}
+
 locale=en
-mailer_transport=smtp
-mailer_host=127.0.0.1
-mailer_user=null
-mailer_password=null
+
+MAILER_DSN=smtp://{{ smtp_server }}:25
 mail_from={{ noreply_email }}
 mail_no_reply={{ noreply_email}}
 mail_receiver={{ spdashboard_support_email }}
-secret=ThisTokenIsNotSoSecretChangeIt
+
 session_max_absolute_lifetime=32400
 session_max_relative_lifetime=14400
-logout_redirect_url=https://engine.{{ spdashboard_base_domain }}/logout
-administrator_teams={% for team in spdashboard.adminteams %}{{ team }}{% if not loop.last %},{% endif %}{% endfor %}
 
+global_site_notice_show={{ spdashboard_show_global_notice }}
+global_site_notice_date={{ spdashboard_global_notice_date }}
+global_site_notice_allowed_tags=<a><u><i><br><wbr><strong><em><blink><marquee><p><ul><ol><dl><li><dd><dt><div><span><blockquote><hr><h2></h2><h3><h4><h5><h6>
+
+# where to redirect the user on logout
+logout_redirect_url=https://{{ spdashboard_saml_remote_idp_host }}/logout
+
+# SAML-keys for SP; note: in normal OpenConext usecases,
+# these are not necessary and default to insecure keys from the SP-dashboard repo
 saml_sp_publickey={{ spdashboard_saml_sp_publickey }}
 saml_sp_privatekey={{ spdashboard_saml_sp_privatekey }}
 saml_metadata_publickey={{ spdashboard_saml_metadata_publickey }}
 saml_metadata_privatekey={{ spdashboard_saml_metadata_privatekey }}
+
+# SAML-metadata for IdP
 saml_remote_idp_entity_id={{ spdashboard_saml_remote_idp_entity_id }}
 saml_remote_idp_sso_url={{ spdashboard_saml_remote_idp_sso_url }}
 saml_remote_idp_certificate={{ spdashboard_saml_remote_idp_certificate }}
 saml_remote_idp_host={{ spdashboard_saml_remote_idp_host }}
-manage_test_host=https://manage.{{ base_domain }}
-manage_test_username=sp-dashboard
-manage_test_password={{ manage_sp_dashboard_secret }}
+
+# Invite instance; needs to correspond to saml_remote_idp_*
+invite_host={{ spdashboard_invite_host }}
+invite_api_username={{ spdashboard_invite_api_username }}
+invite_api_password={{ spdashboard_invite_api_password }}
+invite_landing_url={{ spdashboard_invite_landing_url }}}
+
+# authorization: Invite roles and suepradmin teams
+authorization_attribute_name={{ spdashboard_surf_autorization_attribute }}
+surfconext_representative_authorization={{ spdashboard_surf_autorization_attribute_svc_value }}
+administrator_teams={% for team in spdashboard_adminteams %}{{ team }}{% if not loop.last %},{% endif %}{% endfor %}
+
+# where to publish test instances
+manage_test_host={{ spdashboard_manage_test_host }}
+manage_test_username={{ spdashboard_manage_test_user }}
+manage_test_password={{ spdashboard_manage_test_password }}
 manage_test_publication_status={{ spdashboard_manage_test_publication_status }}
-manage_test_oidcng_enabled={{ spdashboard_manage_test_oidcng_enabled }}
+manage_test_oidcng_enabled=true
+
+# where to public prod instances
 manage_prod_host={{ spdashboard_manage_prod_host }}
-manage_prod_username=sp-dashboard
-manage_prod_password={{ manage_prod_sp_dashboard_secret }}
+manage_prod_username={{ spdashboard_manage_prod_user}}
+manage_prod_password={{ spdashboard_manage_prod_password }}
 manage_prod_publication_status={{ spdashboard_manage_prod_publication_status }}
-manage_prod_oidcng_enabled={{ spdashboard_manage_prod_oidcng_enabled }}
+manage_prod_oidcng_enabled=true
+
+# manage guid van SP Dashboard
+spdashboard_manage_id={{ spdashboard_manage_id }}
+
 jira_host={{ spdashboard_jira_host }}
 jira_personal_access_token={{ spdashboard_jira_apikey }}
-jira_password={{ spdashboard_jira_password }}
+jira_issue_project_key={{ spdashboard_jira_project_key }}
 jira_issue_priority={{ spdashboard_jira_issue_priority }}
 jira_issue_type={{ spdashboard_jira_issue_type }}
 jira_issue_type_publication_request={{ spdashboard_jira_issue_type_publication_request }}
-jira_issue_type_entity_change_request={{ spdashboard_jira_entity_change_request }}
+jira_issue_type_entity_change_request={{ spdashboard_jira_issue_type_change_request }}
 jira_issue_type_idp_invite={{ spdashboard_jira_issue_type_invite }}
+
 jira_issue_entityid_fieldname={{ spdashboard_jira_entityid_fieldname }}
+jira_issue_reporter_fieldname={{ spdashboard_jira_reporter_fieldname }}
 jira_issue_manageid_fieldname={{ spdashboard_jira_manageid_fieldname }}
 jira_issue_manageid_field_label={{ spdashboard_jira_manageid_field_label }}
-jira_issue_reporter_fieldname={{ spdashboard_jira_reporter_fieldname }}
-jira_issue_project_key={{ spdashboard_jira_project_key }}
-jira_enable_test_mode={{ spdashboard_test_mode_enabled }}
-jira_test_mode_storage_path={{ spdashboard_test_mode_path }}
+
 playground_uri_test={{ spdashboard_playground_uri_test }}
 playground_uri_prod={{ spdashboard_playground_uri_prod }}
-global_site_notice_show={{ spdashboard_show_global_notice }}
-global_site_notice_date={{ spdashboard_global_notice_date }}
-global_site_notice_allowed_tags=<a><u><i><br><wbr><strong><em><blink><marquee><p><ul><ol><dl><li><dd><dt><div><span><blockquote><hr><h2></h2><h3><h4><h5><h6>
 
-acs_location_route_name=dashboard_saml_consume_assertion
-metadata_url_timeout=30
+metadata_url_timeout=3
 test_idp_entity_ids=[{{ spdashboard_test_idps }}]
-authorization_attribute_name={{ spdashboard_surf_autorization_attribute }}
-surfconext_representative_authorization={{ spdashboard_surf_autorization_attribute_svc_value }}
-
-## Teams test instance
-teams_host={{ spdashboard_teams_host }}
-teams_username={{ spdashboard_teams_api_user }}
-teams_password={{ spdashboard_teams_api_password }}
-team_prefix_default_stem_name={{ spdashboard_teams_default_stem }}
-team_prefix_group_name_context={{ spdashboard_teams_group_name_context }}
-
-spdashboard_manage_id={{ spdashboard_manage_id }}
-
-## Invite instance
-invite_host={{ spdashboard_invite_host }}
-invite_api_username={{ spdashboard_invite_api_username }}
-invite_api_password={{ spdashboard_invite_api_password }}
-invite_landing_url={{ spdashboard_invite_landing_url }}}