No OneTemporary
Actions

Size

6 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/roles/paas-docker/containers/openfire.sls b/roles/paas-docker/containers/openfire.sls
	index e0d6c48..6e56906 100644
	--- a/roles/paas-docker/containers/openfire.sls
	+++ b/roles/paas-docker/containers/openfire.sls
	@@ -1,52 +1,62 @@
	# -------------------------------------------------------------
	# Salt — Provision Docker engine
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	# Project: Nasqueron
	# Created: 2018-06-18
	# License: Trivial work, not eligible to copyright
	# -------------------------------------------------------------

	{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}
	{% set containers = pillar['docker_containers'][grains['id']] %}

	{% for instance, container in containers['openfire'].items() %}

	# -------------------------------------------------------------
	# Storage directory
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	/srv/{{ instance }}:
	file.directory:
	- user: 999
	- group: 999
	- makedirs: True

	{% if has_selinux %}
	selinux_context_openfire_data:
	selinux.fcontext_policy_present:
	- name: /srv/{{ instance }}
	- sel_type: container_file_t

	selinux_context_openfire_data_applied:
	selinux.fcontext_policy_applied:
	- name: /srv/{{ instance }}
	{% endif %}

	# -------------------------------------------------------------
	# Container
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	{{ instance }}:
	docker_container.running:
	- detach: True
	- interactive: True
	- image: nasqueron/openfire
	- binds: /srv/{{ instance }}:/var/lib/openfire
	- hostname: {{ container['host'] }}
	- ports: {{ pillar['xmpp_ports'] }}
	- port_bindings:
	{% for port in pillar['xmpp_ports'] %}
	- {{ container['ip'] }}:{{ port }}:{{ port }}
	{% endfor %}

	+# -------------------------------------------------------------
	+# Certificate propagation
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+
	+/srv/letsencrypt/etc/renewal/{{ container['host'] }}.conf:
	+ file.append:
	+ - text:
	+ - "# Propagate certificates to Openfire container"
	+ - post-hook = openfire propagate-certificate {{ instance }} {{ container['host'] }}
	+
	{% endfor %}
	diff --git a/roles/paas-docker/wrappers/files/openfire.sh b/roles/paas-docker/wrappers/files/openfire.sh
	new file mode 100644
	index 0000000..30cf859
	--- /dev/null
	+++ b/roles/paas-docker/wrappers/files/openfire.sh
	@@ -0,0 +1,86 @@
	+#!/bin/sh
	+
	+# -------------------------------------------------------------
	+# PaaS Docker
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+# Project: Nasqueron
	+# Created: 2019-01-01
	+# License: Trivial work, not eligible to copyright
	+# Source file: roles/paas-docker/wrappers/files/openfire.sh
	+# -------------------------------------------------------------
	+#
	+# <auto-generated>
	+# This file is managed by our rOPS SaltStack repository.
	+#
	+# Changes to this file may cause incorrect behavior
	+# and will be lost if the state is redeployed.
	+# </auto-generated>
	+
	+# -------------------------------------------------------------
	+# Helper methods
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+
	+getcommandname() {
	+ basename "$0"
	+}
	+
	+usage() {
	+ echo "Usage: $(getcommandname) <command>"
	+ exit 1
	+}
	+
	+unknown_command() {
	+ echo "$(getcommandname): $COMMAND: unknown command"
	+ usage
	+}
	+
	+# -------------------------------------------------------------
	+# Commands
	+#
	+# :: propagate-certificate: copy a certificate into a Java keystore file
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+
	+propagate_certificate() {
	+ DOMAIN=$1
	+ SOURCE=/srv/letsencrypt/etc/live/$DOMAIN
	+ TARGET=/srv/$INSTANCE/conf/security/tmp
	+
	+ # Per Openfire src/java/org/jivesoftware/multiplexer/net/SSLConfig.java
	+ # This is used as a blank password.
	+ PASS=changeit
	+
	+ if [ -z "$DOMAIN" ]; then
	+ echo "Please append the FQDN of the certificate to propagate (CN, not alt name)" >&2
	+ exit 2
	+ fi
	+
	+ mkdir -p "$TARGET"
	+ openssl pkcs12 -export -out "$TARGET/cert-to-import.p12" -in "$SOURCE/fullchain.pem" -inkey "$SOURCE/privkey.pem" -name "$DOMAIN" -password "pass:$PASS"
	+ docker exec "$INSTANCE" keytool -importkeystore -deststorepass "$PASS" -srcstorepass "$PASS" -destkeystore /var/lib/openfire/conf/security/keystore -srckeystore "/var/lib/$INSTANCE/conf/security/tmp/cert-to-import.p12" -srcstoretype PKCS12 -deststoretype pkcs12
	+ rm -R "$TARGET"
	+}
	+
	+# -------------------------------------------------------------
	+# Check arguments
	+#
	+# $1: instance name
	+# $2: command
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+
	+if [ $# -lt 2 ]; then
	+ usage
	+fi
	+
	+COMMAND=$1
	+INSTANCE=$2
	+shift 2
	+
	+# -------------------------------------------------------------
	+# Run command
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+
	+if [ "$COMMAND" = "propagate-certificate" ]; then
	+ propagate_certificate "$1"
	+else
	+ unknown_command
	+fi
	diff --git a/roles/paas-docker/wrappers/init.sls b/roles/paas-docker/wrappers/init.sls
	index 1f64ede..3cf809f 100644
	--- a/roles/paas-docker/wrappers/init.sls
	+++ b/roles/paas-docker/wrappers/init.sls
	@@ -1,27 +1,27 @@
	# -------------------------------------------------------------
	# Salt — Provision Docker engine
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	# Project: Nasqueron
	# Created: 2018-03-15
	# License: Trivial work, not eligible to copyright
	# -------------------------------------------------------------

	{% from "map.jinja" import dirs with context %}

	# -------------------------------------------------------------
	# Wrapper binaries
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	-{% for command in ['certbot', 'phpbb', 'mysql', 'sentry'] %}
	+{% for command in ['certbot', 'phpbb', 'mysql', 'sentry', 'openfire'] %}
	{{ dirs.bin }}/{{ command }}:
	file.managed:
	- source: salt://roles/paas-docker/wrappers/files/{{ command }}.sh
	- mode: 755
	{% endfor %}

	{% for command in ['pad-delete'] %}
	{{ dirs.bin }}/{{ command }}:
	file.managed:
	- source: salt://roles/paas-docker/wrappers/files/{{ command }}.py
	- mode: 755
	{% endfor %}

File Metadata

Mime Type: text/x-diff
Expires: Mon, Nov 25, 14:25 (1 d, 5 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2260362
Default Alt Text: (6 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions