From 6a1fe4532a27576f707f51cec102b0c51fb0a0b9 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Mon, 28 Sep 2020 13:57:04 +0200 Subject: [PATCH 001/162] add sample shibboleth conf --- auth/shibboleth-conf/shibboleth2.xml | 37 ++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 auth/shibboleth-conf/shibboleth2.xml diff --git a/auth/shibboleth-conf/shibboleth2.xml b/auth/shibboleth-conf/shibboleth2.xml new file mode 100644 index 00000000..342e057e --- /dev/null +++ b/auth/shibboleth-conf/shibboleth2.xml @@ -0,0 +1,37 @@ + + + + + +SAML2 + +SAML2 Local + + + + + + + + + + + + + + + + \ No newline at end of file -- GitLab From cdd1801bf29be506d819686520604c6cad126a1c Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Mon, 28 Sep 2020 14:10:17 +0200 Subject: [PATCH 002/162] add WIP auth folder structure --- auth/Dockerfile | 5 + auth/etc-httpd/conf.d/sp.conf | 15 +++ auth/index.html | 10 ++ auth/shibboleth-conf/attribute-map.xml | 5 + auth/shibboleth-conf/idp-metadata.xml | 122 +++++++++++++++++++++++++ auth/shibboleth-conf/shibd.logger | 76 +++++++++++++++ 6 files changed, 233 insertions(+) create mode 100644 auth/Dockerfile create mode 100644 auth/etc-httpd/conf.d/sp.conf create mode 100644 auth/index.html create mode 100644 auth/shibboleth-conf/attribute-map.xml create mode 100644 auth/shibboleth-conf/idp-metadata.xml create mode 100644 auth/shibboleth-conf/shibd.logger diff --git a/auth/Dockerfile b/auth/Dockerfile new file mode 100644 index 00000000..896601fb --- /dev/null +++ b/auth/Dockerfile @@ -0,0 +1,5 @@ +FROM unicon/shibboleth-sp:3.0.4 + +COPY shibboleth-conf /etc/shibboleth/ +COPY index.html /var/www/html/ +COPY etc-httpd/ /etc/httpd/ diff --git a/auth/etc-httpd/conf.d/sp.conf b/auth/etc-httpd/conf.d/sp.conf new file mode 100644 index 00000000..92bbe24a --- /dev/null +++ b/auth/etc-httpd/conf.d/sp.conf @@ -0,0 +1,15 @@ +ServerName idptestbed + + + ServerName https://idptestbed:443 + UseCanonicalName On + + DocumentRoot "/var/www/html" + + + AuthType shibboleth + ShibRequestSetting requireSession 1 + require shib-session + + + \ No newline at end of file diff --git a/auth/index.html b/auth/index.html new file mode 100644 index 00000000..7d20ce72 --- /dev/null +++ b/auth/index.html @@ -0,0 +1,10 @@ + + + + + APACHE TEST + + +

TESTING APACHE

+ + diff --git a/auth/shibboleth-conf/attribute-map.xml b/auth/shibboleth-conf/attribute-map.xml new file mode 100644 index 00000000..e9e9797a --- /dev/null +++ b/auth/shibboleth-conf/attribute-map.xml @@ -0,0 +1,5 @@ + + + + + diff --git a/auth/shibboleth-conf/idp-metadata.xml b/auth/shibboleth-conf/idp-metadata.xml new file mode 100644 index 00000000..caa418c0 --- /dev/null +++ b/auth/shibboleth-conf/idp-metadata.xml @@ -0,0 +1,122 @@ + + + + + + + + + samltest.id + + + + SAMLtest IdP + A free and basic IdP for testing SAML deployments + https://samltest.id/saml/logo.png + + + + + + + +MIIDETCCAfmgAwIBAgIUZRpDhkNKl5eWtJqk0Bu1BgTTargwDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwHhcNMTgwODI0MjExNDEwWhcNMzgw +ODI0MjExNDEwWjAWMRQwEgYDVQQDDAtzYW1sdGVzdC5pZDCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAJrh9/PcDsiv3UeL8Iv9rf4WfLPxuOm9W6aCntEA +8l6c1LQ1Zyrz+Xa/40ZgP29ENf3oKKbPCzDcc6zooHMji2fBmgXp6Li3fQUzu7yd ++nIC2teejijVtrNLjn1WUTwmqjLtuzrKC/ePoZyIRjpoUxyEMJopAd4dJmAcCq/K +k2eYX9GYRlqvIjLFoGNgy2R4dWwAKwljyh6pdnPUgyO/WjRDrqUBRFrLQJorR2kD +c4seZUbmpZZfp4MjmWMDgyGM1ZnR0XvNLtYeWAyt0KkSvFoOMjZUeVK/4xR74F8e +8ToPqLmZEg9ZUx+4z2KjVK00LpdRkH9Uxhh03RQ0FabHW6UCAwEAAaNXMFUwHQYD +VR0OBBYEFJDbe6uSmYQScxpVJhmt7PsCG4IeMDQGA1UdEQQtMCuCC3NhbWx0ZXN0 +LmlkhhxodHRwczovL3NhbWx0ZXN0LmlkL3NhbWwvaWRwMA0GCSqGSIb3DQEBCwUA +A4IBAQBNcF3zkw/g51q26uxgyuy4gQwnSr01Mhvix3Dj/Gak4tc4XwvxUdLQq+jC +cxr2Pie96klWhY/v/JiHDU2FJo9/VWxmc/YOk83whvNd7mWaNMUsX3xGv6AlZtCO +L3JhCpHjiN+kBcMgS5jrtGgV1Lz3/1zpGxykdvS0B4sPnFOcaCwHe2B9SOCWbDAN +JXpTjz1DmJO4ImyWPJpN1xsYKtm67Pefxmn0ax0uE2uuzq25h0xbTkqIQgJzyoE/ +DPkBFK1vDkMfAW11dQ0BXatEnW7Gtkc0lh2/PIbHWj4AzxYMyBf5Gy6HSVOftwjC +voQR2qr2xJBixsg+MIORKtmKHLfU + + + + + + + + + +MIIDEjCCAfqgAwIBAgIVAMECQ1tjghafm5OxWDh9hwZfxthWMA0GCSqGSIb3DQEB +CwUAMBYxFDASBgNVBAMMC3NhbWx0ZXN0LmlkMB4XDTE4MDgyNDIxMTQwOVoXDTM4 +MDgyNDIxMTQwOVowFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC0Z4QX1NFKs71ufbQwoQoW7qkNAJRIANGA4iM0 +ThYghul3pC+FwrGv37aTxWXfA1UG9njKbbDreiDAZKngCgyjxj0uJ4lArgkr4AOE +jj5zXA81uGHARfUBctvQcsZpBIxDOvUUImAl+3NqLgMGF2fktxMG7kX3GEVNc1kl +bN3dfYsaw5dUrw25DheL9np7G/+28GwHPvLb4aptOiONbCaVvh9UMHEA9F7c0zfF +/cL5fOpdVa54wTI0u12CsFKt78h6lEGG5jUs/qX9clZncJM7EFkN3imPPy+0HC8n +spXiH/MZW8o2cqWRkrw3MzBZW3Ojk5nQj40V6NUbjb7kfejzAgMBAAGjVzBVMB0G +A1UdDgQWBBQT6Y9J3Tw/hOGc8PNV7JEE4k2ZNTA0BgNVHREELTArggtzYW1sdGVz +dC5pZIYcaHR0cHM6Ly9zYW1sdGVzdC5pZC9zYW1sL2lkcDANBgkqhkiG9w0BAQsF +AAOCAQEASk3guKfTkVhEaIVvxEPNR2w3vWt3fwmwJCccW98XXLWgNbu3YaMb2RSn +7Th4p3h+mfyk2don6au7Uyzc1Jd39RNv80TG5iQoxfCgphy1FYmmdaSfO8wvDtHT +TNiLArAxOYtzfYbzb5QrNNH/gQEN8RJaEf/g/1GTw9x/103dSMK0RXtl+fRs2nbl +D1JJKSQ3AdhxK/weP3aUPtLxVVJ9wMOQOfcy02l+hHMb6uAjsPOpOVKqi3M8XmcU +ZOpx4swtgGdeoSpeRyrtMvRwdcciNBp9UZome44qZAYH1iqrpmmjsfI9pJItsgWu +3kXPjhSfj1AJGR1l9JGvJrHki1iHTA== + + + + + + + + + +MIIDEjCCAfqgAwIBAgIVAPVbodo8Su7/BaHXUHykx0Pi5CFaMA0GCSqGSIb3DQEB +CwUAMBYxFDASBgNVBAMMC3NhbWx0ZXN0LmlkMB4XDTE4MDgyNDIxMTQwOVoXDTM4 +MDgyNDIxMTQwOVowFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCQb+1a7uDdTTBBFfwOUun3IQ9nEuKM98SmJDWa +MwM877elswKUTIBVh5gB2RIXAPZt7J/KGqypmgw9UNXFnoslpeZbA9fcAqqu28Z4 +sSb2YSajV1ZgEYPUKvXwQEmLWN6aDhkn8HnEZNrmeXihTFdyr7wjsLj0JpQ+VUlc +4/J+hNuU7rGYZ1rKY8AA34qDVd4DiJ+DXW2PESfOu8lJSOteEaNtbmnvH8KlwkDs +1NvPTsI0W/m4SK0UdXo6LLaV8saIpJfnkVC/FwpBolBrRC/Em64UlBsRZm2T89ca +uzDee2yPUvbBd5kLErw+sC7i4xXa2rGmsQLYcBPhsRwnmBmlAgMBAAGjVzBVMB0G +A1UdDgQWBBRZ3exEu6rCwRe5C7f5QrPcAKRPUjA0BgNVHREELTArggtzYW1sdGVz +dC5pZIYcaHR0cHM6Ly9zYW1sdGVzdC5pZC9zYW1sL2lkcDANBgkqhkiG9w0BAQsF +AAOCAQEABZDFRNtcbvIRmblnZItoWCFhVUlq81ceSQddLYs8DqK340//hWNAbYdj +WcP85HhIZnrw6NGCO4bUipxZXhiqTA/A9d1BUll0vYB8qckYDEdPDduYCOYemKkD +dmnHMQWs9Y6zWiYuNKEJ9mf3+1N8knN/PK0TYVjVjXAf2CnOETDbLtlj6Nqb8La3 +sQkYmU+aUdopbjd5JFFwbZRaj6KiHXHtnIRgu8sUXNPrgipUgZUOVhP0C0N5OfE4 +JW8ZBrKgQC/6vJ2rSa9TlzI6JAa5Ww7gMXMP9M+cJUNQklcq+SBnTK8G+uBHgPKR +zBDsMIEzRtQZm4GIoHJae4zmnCekkQ== + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/auth/shibboleth-conf/shibd.logger b/auth/shibboleth-conf/shibd.logger new file mode 100644 index 00000000..e9526645 --- /dev/null +++ b/auth/shibboleth-conf/shibd.logger @@ -0,0 +1,76 @@ +# set overall behavior +log4j.rootCategory=INFO, shibd_log, warn_log + +# fairly verbose for DEBUG, so generally leave at INFO +log4j.category.XMLTooling.XMLObject=INFO +log4j.category.XMLTooling.KeyInfoResolver=INFO +log4j.category.Shibboleth.IPRange=INFO +log4j.category.Shibboleth.PropertySet=INFO + +# raise for low-level tracing of SOAP client HTTP/SSL behavior +log4j.category.XMLTooling.libcurl=INFO + +# useful categories to tune independently: +# +# tracing of SAML messages and security policies +#log4j.category.OpenSAML.MessageDecoder=DEBUG +#log4j.category.OpenSAML.MessageEncoder=DEBUG +#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG +#log4j.category.XMLTooling.SOAPClient=DEBUG +# interprocess message remoting +#log4j.category.Shibboleth.Listener=DEBUG +# mapping of requests to applicationId +#log4j.category.Shibboleth.RequestMapper=DEBUG +# high level session cache operations +#log4j.category.Shibboleth.SessionCache=DEBUG +# persistent storage and caching +#log4j.category.XMLTooling.StorageService=DEBUG + +# logs XML being signed or verified if set to DEBUG +log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log +log4j.additivity.XMLTooling.Signature.Debugger=false +log4j.ownAppenders.XMLTooling.Signature.Debugger=true + +# the tran log blocks the "default" appender(s) at runtime +# Level should be left at INFO for this category +log4j.category.Shibboleth-TRANSACTION=INFO, tran_log +log4j.additivity.Shibboleth-TRANSACTION=false +log4j.ownAppenders.Shibboleth-TRANSACTION=true + +# uncomment to suppress particular event types +#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN +#log4j.category.Shibboleth-TRANSACTION.Login=WARN +#log4j.category.Shibboleth-TRANSACTION.Logout=WARN + +# define the appenders + +log4j.appender.shibd_log=org.apache.log4j.RollingFileAppender +log4j.appender.shibd_log.fileName=/dev/stdout +log4j.appender.shibd_log.maxFileSize=0 +log4j.appender.shibd_log.maxBackupIndex=0 +log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout +log4j.appender.shibd_log.layout.ConversionPattern=sp-shibd %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +#log4j.appender.warn_log=org.apache.log4j.RollingFileAppender +#log4j.appender.warn_log.fileName=/var/log/shibboleth/shibd_warn.log +#log4j.appender.warn_log.maxFileSize=0 +#log4j.appender.warn_log.maxBackupIndex=0 +#log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout +#log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n +#log4j.appender.warn_log.threshold=WARN + +log4j.appender.tran_log=org.apache.log4j.RollingFileAppender +log4j.appender.tran_log.fileName=/dev/stdout +log4j.appender.tran_log.maxFileSize=0 +log4j.appender.tran_log.maxBackupIndex=0 +log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout +log4j.appender.tran_log.layout.ConversionPattern=sp-transaction %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +log4j.appender.sig_log=org.apache.log4j.FileAppender +log4j.appender.sig_log.fileName=/dev/stdout +log4j.appender.sig_log.maxFileSize=0 +log4j.appender.sig_log.maxBackupIndex=0 +log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout +log4j.appender.sig_log.layout.ConversionPattern=sp-signature %m + + -- GitLab From d37d1818f35d4fef86e6d746f3a8a5f2e37aabc6 Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Mon, 28 Sep 2020 16:21:57 +0200 Subject: [PATCH 003/162] Adding auth forwarding in preparation of shibboleth auth --- docker-compose.dem.ops.yml | 12 ++++++++++++ docker-compose.emg.ops.yml | 12 ++++++++++++ docker-compose.vhr18.ops.yml | 16 ++++++++++++++-- 3 files changed, 38 insertions(+), 2 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index b1f09109..345ea97b 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -32,6 +32,10 @@ services: - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-renderer.loadbalancer.sticky=false" - "traefik.http.services.dem-renderer.loadbalancer.server.port=80" @@ -74,6 +78,10 @@ services: - "traefik.http.routers.dem-cache_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-cache_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-cache.loadbalancer.sticky=false" - "traefik.http.services.dem-cache.loadbalancer.server.port=80" @@ -114,6 +122,10 @@ services: - "traefik.http.routers.dem-client-redirect.rule=Host(`dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`)" - "traefik.http.routers.dem-client-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-client-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-client.loadbalancer.sticky=false" - "traefik.http.services.dem-client.loadbalancer.server.port=80" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index fcc054e6..34a0dc82 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -32,6 +32,10 @@ services: - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" @@ -74,6 +78,10 @@ services: - "traefik.http.routers.emg-cache_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-cache.loadbalancer.sticky=false" - "traefik.http.services.emg-cache.loadbalancer.server.port=80" @@ -114,6 +122,10 @@ services: - "traefik.http.routers.emg-client-redirect.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-client-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-client.loadbalancer.sticky=false" - "traefik.http.services.emg-client.loadbalancer.server.port=80" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index e8665d49..068238d2 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -33,6 +33,10 @@ services: - "traefik.http.routers.vhr18-renderer_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-renderer.loadbalancer.sticky=false" - "traefik.http.services.vhr18-renderer.loadbalancer.server.port=80" @@ -74,6 +78,10 @@ services: - "traefik.http.routers.vhr18-cache_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache_referer-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-cache.loadbalancer.sticky=false" - "traefik.http.services.vhr18-cache.loadbalancer.server.port=80" @@ -97,7 +105,7 @@ services: replicas: 0 placement: constraints: - - node.labels.type == internal + - node.labels.type == internal client: configs: - source: client-ops @@ -114,6 +122,10 @@ services: - "traefik.http.routers.vhr18-client-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`)" - "traefik.http.routers.vhr18-client-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-client-redirect.entrypoints=http" + # Auth forwarding + - "traefik.frontend.auth.forward.address=http://auth/auth" + - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User + - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-client.loadbalancer.sticky=false" - "traefik.http.services.vhr18-client.loadbalancer.server.port=80" @@ -122,7 +134,7 @@ services: - "traefik.enable=true" placement: constraints: - - node.labels.type == external + - node.labels.type == external networks: - extnet preprocessor: -- GitLab From 3f73c73529e8bbcdc552b1f7a0e53d255459465b Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Mon, 28 Sep 2020 18:04:30 +0200 Subject: [PATCH 004/162] Fixing auth forwarding using correct labels Setup of middleware in traefik-dynamic.yml --- docker-compose.dem.ops.yml | 18 +++--------------- docker-compose.emg.ops.yml | 18 +++--------------- docker-compose.vhr18.ops.yml | 18 +++--------------- traefik-dynamic.yml | 4 ++++ 4 files changed, 13 insertions(+), 45 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index 345ea97b..57d7b33e 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -14,7 +14,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.dem-renderer.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer.middlewares=auth@file,compress@file,cors@file" + - "traefik.http.routers.dem-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.dem-renderer.tls=true" - "traefik.http.routers.dem-renderer.tls.certresolver=default" - "traefik.http.routers.dem-renderer.entrypoints=https" @@ -32,10 +32,6 @@ services: - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-renderer.loadbalancer.sticky=false" - "traefik.http.services.dem-renderer.loadbalancer.server.port=80" @@ -60,7 +56,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.dem-cache.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.dem-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" + - "traefik.http.routers.dem-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.dem-cache.tls=true" - "traefik.http.routers.dem-cache.tls.certresolver=default" - "traefik.http.routers.dem-cache.entrypoints=https" @@ -78,10 +74,6 @@ services: - "traefik.http.routers.dem-cache_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-cache_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-cache.loadbalancer.sticky=false" - "traefik.http.services.dem-cache.loadbalancer.server.port=80" @@ -114,7 +106,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.dem-client.rule=Host(`dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`)" - - "traefik.http.routers.dem-client.middlewares=auth@file,compress@file" + - "traefik.http.routers.dem-client.middlewares=auth@file,compress@file,shibAuth@file" - "traefik.http.routers.dem-client.tls=true" - "traefik.http.routers.dem-client.tls.certresolver=default" - "traefik.http.routers.dem-client.entrypoints=https" @@ -122,10 +114,6 @@ services: - "traefik.http.routers.dem-client-redirect.rule=Host(`dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`)" - "traefik.http.routers.dem-client-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-client-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.dem-client.loadbalancer.sticky=false" - "traefik.http.services.dem-client.loadbalancer.server.port=80" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 34a0dc82..46852d3f 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -14,7 +14,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.emg-renderer.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer.middlewares=auth@file,compress@file,cors@file" + - "traefik.http.routers.emg-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.emg-renderer.tls=true" - "traefik.http.routers.emg-renderer.tls.certresolver=default" - "traefik.http.routers.emg-renderer.entrypoints=https" @@ -32,10 +32,6 @@ services: - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" @@ -60,7 +56,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.emg-cache.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.emg-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" + - "traefik.http.routers.emg-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.emg-cache.tls=true" - "traefik.http.routers.emg-cache.tls.certresolver=default" - "traefik.http.routers.emg-cache.entrypoints=https" @@ -78,10 +74,6 @@ services: - "traefik.http.routers.emg-cache_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-cache.loadbalancer.sticky=false" - "traefik.http.services.emg-cache.loadbalancer.server.port=80" @@ -114,7 +106,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.emg-client.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client.middlewares=auth@file,compress@file" + - "traefik.http.routers.emg-client.middlewares=auth@file,compress@file,shibAuth@file" - "traefik.http.routers.emg-client.tls=true" - "traefik.http.routers.emg-client.tls.certresolver=default" - "traefik.http.routers.emg-client.entrypoints=https" @@ -122,10 +114,6 @@ services: - "traefik.http.routers.emg-client-redirect.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-client-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.emg-client.loadbalancer.sticky=false" - "traefik.http.services.emg-client.loadbalancer.server.port=80" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index 068238d2..76a5948b 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -15,7 +15,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-renderer.middlewares=auth@file,compress@file,cors@file" + - "traefik.http.routers.vhr18-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.vhr18-renderer.tls=true" - "traefik.http.routers.vhr18-renderer.tls.certresolver=default" - "traefik.http.routers.vhr18-renderer.entrypoints=https" @@ -33,10 +33,6 @@ services: - "traefik.http.routers.vhr18-renderer_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-renderer.loadbalancer.sticky=false" - "traefik.http.services.vhr18-renderer.loadbalancer.server.port=80" @@ -60,7 +56,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.vhr18-cache.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.vhr18-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" + - "traefik.http.routers.vhr18-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" - "traefik.http.routers.vhr18-cache.tls=true" - "traefik.http.routers.vhr18-cache.tls.certresolver=default" - "traefik.http.routers.vhr18-cache.entrypoints=https" @@ -78,10 +74,6 @@ services: - "traefik.http.routers.vhr18-cache_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache_referer-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-cache.loadbalancer.sticky=false" - "traefik.http.services.vhr18-cache.loadbalancer.server.port=80" @@ -114,7 +106,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.vhr18-client.rule=Host(`vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`)" - - "traefik.http.routers.vhr18-client.middlewares=auth@file,compress@file" + - "traefik.http.routers.vhr18-client.middlewares=auth@file,compress@file,shibAuth@file" - "traefik.http.routers.vhr18-client.tls=true" - "traefik.http.routers.vhr18-client.tls.certresolver=default" - "traefik.http.routers.vhr18-client.entrypoints=https" @@ -122,10 +114,6 @@ services: - "traefik.http.routers.vhr18-client-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`)" - "traefik.http.routers.vhr18-client-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-client-redirect.entrypoints=http" - # Auth forwarding - - "traefik.frontend.auth.forward.address=http://auth/auth" - - traefik.frontend.auth.forward.authResponseHeaders=X-Forwarded-User - - traefik.frontend.auth.forward.trustForwardHeader=true # general - "traefik.http.services.vhr18-client.loadbalancer.sticky=false" - "traefik.http.services.vhr18-client.loadbalancer.server.port=80" diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 87f49816..0291f929 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -20,6 +20,10 @@ http: realm: "PRISM View Server (PVS)" users: - "***REMOVED***" + shibAuth: + forwardAuth: + address: http://auth/auth + trustForwardHeader: true compress: compress: {} redirect: -- GitLab From 762e143b7077b58f171cdc465843b5c465636ff7 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 11:08:10 +0200 Subject: [PATCH 005/162] rename folders --- auth/Dockerfile | 5 - auth/shibboleth-conf/shibboleth2.xml | 37 ------ shibauth/Dockerfile | 39 ++++++ {auth/etc-httpd => shibauth}/conf.d/sp.conf | 4 + {auth => shibauth}/index.html | 0 .../shibboleth-conf/attribute-map.xml | 0 .../shibboleth-conf/idp-metadata.xml | 0 shibauth/shibboleth-conf/shibboleth2.xml | 125 ++++++++++++++++++ .../shibboleth-conf/shibd.logger | 0 9 files changed, 168 insertions(+), 42 deletions(-) delete mode 100644 auth/Dockerfile delete mode 100644 auth/shibboleth-conf/shibboleth2.xml create mode 100644 shibauth/Dockerfile rename {auth/etc-httpd => shibauth}/conf.d/sp.conf (73%) rename {auth => shibauth}/index.html (100%) rename {auth => shibauth}/shibboleth-conf/attribute-map.xml (100%) rename {auth => shibauth}/shibboleth-conf/idp-metadata.xml (100%) create mode 100644 shibauth/shibboleth-conf/shibboleth2.xml rename {auth => shibauth}/shibboleth-conf/shibd.logger (100%) diff --git a/auth/Dockerfile b/auth/Dockerfile deleted file mode 100644 index 896601fb..00000000 --- a/auth/Dockerfile +++ /dev/null @@ -1,5 +0,0 @@ -FROM unicon/shibboleth-sp:3.0.4 - -COPY shibboleth-conf /etc/shibboleth/ -COPY index.html /var/www/html/ -COPY etc-httpd/ /etc/httpd/ diff --git a/auth/shibboleth-conf/shibboleth2.xml b/auth/shibboleth-conf/shibboleth2.xml deleted file mode 100644 index 342e057e..00000000 --- a/auth/shibboleth-conf/shibboleth2.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - -SAML2 - -SAML2 Local - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/shibauth/Dockerfile b/shibauth/Dockerfile new file mode 100644 index 00000000..a1c6d766 --- /dev/null +++ b/shibauth/Dockerfile @@ -0,0 +1,39 @@ +#------------------------------------------------------------------------------ +# +# Project: prism view server +# Authors: Stephan Meissl +# +#------------------------------------------------------------------------------ +# Copyright (C) 2020 EOX IT Services GmbH +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to +# deal in the Software without restriction, including without limitation the +# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or +# sell copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies of this Software or works derived from this Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS +# IN THE SOFTWARE. +#----------------------------------------------------------------------------- + +FROM unicon/shibboleth-sp:3.0.4 + +MAINTAINER EOX +LABEL name="prism view server cache" \ + vendor="EOX IT Services GmbH " \ + license="MIT Copyright (C) 2019 EOX IT Services GmbH " \ + type="prism view server shibauth" \ + version="0.0.1" + +COPY shibboleth-conf /etc/shibboleth/ +COPY index.html /var/www/html/ +COPY conf.d /etc/httpd/etc-httpd/ diff --git a/auth/etc-httpd/conf.d/sp.conf b/shibauth/conf.d/sp.conf similarity index 73% rename from auth/etc-httpd/conf.d/sp.conf rename to shibauth/conf.d/sp.conf index 92bbe24a..091f85e9 100644 --- a/auth/etc-httpd/conf.d/sp.conf +++ b/shibauth/conf.d/sp.conf @@ -5,6 +5,10 @@ ServerName idptestbed UseCanonicalName On DocumentRoot "/var/www/html" + + Satisfy Any + Allow from all + AuthType shibboleth diff --git a/auth/index.html b/shibauth/index.html similarity index 100% rename from auth/index.html rename to shibauth/index.html diff --git a/auth/shibboleth-conf/attribute-map.xml b/shibauth/shibboleth-conf/attribute-map.xml similarity index 100% rename from auth/shibboleth-conf/attribute-map.xml rename to shibauth/shibboleth-conf/attribute-map.xml diff --git a/auth/shibboleth-conf/idp-metadata.xml b/shibauth/shibboleth-conf/idp-metadata.xml similarity index 100% rename from auth/shibboleth-conf/idp-metadata.xml rename to shibauth/shibboleth-conf/idp-metadata.xml diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml new file mode 100644 index 00000000..f890b39c --- /dev/null +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -0,0 +1,125 @@ + + + + + + + + + + + + + + + SAML2 SAML1 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/auth/shibboleth-conf/shibd.logger b/shibauth/shibboleth-conf/shibd.logger similarity index 100% rename from auth/shibboleth-conf/shibd.logger rename to shibauth/shibboleth-conf/shibd.logger -- GitLab From 70c6543feef529e295dd0698f9c8dda0343bac5e Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 13:25:29 +0200 Subject: [PATCH 006/162] add shib testing stack for now --- docker-compose.test.ops.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 docker-compose.test.ops.yml diff --git a/docker-compose.test.ops.yml b/docker-compose.test.ops.yml new file mode 100644 index 00000000..69f4143b --- /dev/null +++ b/docker-compose.test.ops.yml @@ -0,0 +1,34 @@ +version: "3.6" +services: + shibauth: + image: testing-shibboleth + deploy: + placement: + constraints: [node.role == manager] + deploy: + labels: + # router for basic auth based access (https) + - "traefik.http.routers.emg-renderer.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file" + - "traefik.http.routers.emg-renderer.tls=true" + - "traefik.http.routers.emg-renderer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + # general + - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" + - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" + - "traefik.docker.network=shib-extnet" + - "traefik.docker.lbswarm=true" + - "traefik.enable=true" + replicas: 1 + placement: + constraints: [node.role == manager] + networks: + - extnet +networks: + extnet: + name: shib-extnet + external: true -- GitLab From 5f1e9b004a836f5092d41dbb2168c0dc1a4593cf Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Tue, 29 Sep 2020 16:35:47 +0200 Subject: [PATCH 007/162] Using {{slug}}-secure for shibboleth authed routes --- docker-compose.dem.ops.yml | 52 +++++++++++++++++++++++++++++++++++- docker-compose.emg.ops.yml | 50 ++++++++++++++++++++++++++++++++++ docker-compose.vhr18.ops.yml | 52 +++++++++++++++++++++++++++++++++++- 3 files changed, 152 insertions(+), 2 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index 57d7b33e..a1f677ea 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -14,7 +14,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.dem-renderer.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-renderer.middlewares=auth@file,compress@file,cors@file" - "traefik.http.routers.dem-renderer.tls=true" - "traefik.http.routers.dem-renderer.tls.certresolver=default" - "traefik.http.routers.dem-renderer.entrypoints=https" @@ -32,6 +32,26 @@ services: - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-renderer.tls=true" + - "traefik.http.routers.dem-renderer.tls.certresolver=default" + - "traefik.http.routers.dem-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.dem-renderer_referer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.dem-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.dem-renderer_referer.tls=true" + - "traefik.http.routers.dem-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.dem-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.dem-renderer.loadbalancer.sticky=false" - "traefik.http.services.dem-renderer.loadbalancer.server.port=80" @@ -74,6 +94,26 @@ services: - "traefik.http.routers.dem-cache_referer-redirect.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem.pdas.prism.eox.at|dem.pass.copernicus.eu)/?`)" - "traefik.http.routers.dem-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-cache_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-renderer.tls=true" + - "traefik.http.routers.dem-renderer.tls.certresolver=default" + - "traefik.http.routers.dem-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.dem-renderer_referer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.dem-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.dem-renderer_referer.tls=true" + - "traefik.http.routers.dem-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.dem-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.dem-cache.loadbalancer.sticky=false" - "traefik.http.services.dem-cache.loadbalancer.server.port=80" @@ -114,6 +154,16 @@ services: - "traefik.http.routers.dem-client-redirect.rule=Host(`dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`)" - "traefik.http.routers.dem-client-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-client-redirect.entrypoints=http" + # router for basic auth based access (https) + - "traefik.http.routers.dem-client.rule=Host(`dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`)" + - "traefik.http.routers.dem-client.middlewares=shibAuth@file,compress@file" + - "traefik.http.routers.dem-client.tls=true" + - "traefik.http.routers.dem-client.tls.certresolver=default" + - "traefik.http.routers.dem-client.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.dem-client-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`)" + - "traefik.http.routers.dem-client-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-client-redirect.entrypoints=http" # general - "traefik.http.services.dem-client.loadbalancer.sticky=false" - "traefik.http.services.dem-client.loadbalancer.server.port=80" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 46852d3f..5d00a095 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -32,6 +32,26 @@ services: - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-renderer.tls=true" + - "traefik.http.routers.emg-renderer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.emg-renderer_referer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.emg-renderer_referer.tls=true" + - "traefik.http.routers.emg-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" @@ -74,6 +94,26 @@ services: - "traefik.http.routers.emg-cache_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-renderer.tls=true" + - "traefik.http.routers.emg-renderer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.emg-renderer_referer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.emg-renderer_referer.tls=true" + - "traefik.http.routers.emg-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.emg-cache.loadbalancer.sticky=false" - "traefik.http.services.emg-cache.loadbalancer.server.port=80" @@ -114,6 +154,16 @@ services: - "traefik.http.routers.emg-client-redirect.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-client-redirect.entrypoints=http" + # router for basic auth based access (https) + - "traefik.http.routers.emg-client.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client.middlewares=shibAuth@file,compress@file" + - "traefik.http.routers.emg-client.tls=true" + - "traefik.http.routers.emg-client.tls.certresolver=default" + - "traefik.http.routers.emg-client.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.emg-client-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-client-redirect.entrypoints=http" # general - "traefik.http.services.emg-client.loadbalancer.sticky=false" - "traefik.http.services.emg-client.loadbalancer.server.port=80" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index 76a5948b..ee885d69 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -33,6 +33,26 @@ services: - "traefik.http.routers.vhr18-renderer_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-renderer.tls=true" + - "traefik.http.routers.vhr18-renderer.tls.certresolver=default" + - "traefik.http.routers.vhr18-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.vhr18-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.vhr18-renderer_referer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.vhr18-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.vhr18-renderer_referer.tls=true" + - "traefik.http.routers.vhr18-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.vhr18-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.vhr18-renderer_referer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-renderer.loadbalancer.sticky=false" - "traefik.http.services.vhr18-renderer.loadbalancer.server.port=80" @@ -74,6 +94,26 @@ services: - "traefik.http.routers.vhr18-cache_referer-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18.pdas.prism.eox.at|vhr18.pass.copernicus.eu)/?`)" - "traefik.http.routers.vhr18-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache_referer-redirect.entrypoints=http" + # router for shibboleth based auth based access (https) + - "traefik.http.routers.vhr18-cache-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-cache-renderer.tls=true" + - "traefik.http.routers.vhr18-cache-renderer.tls.certresolver=default" + - "traefik.http.routers.vhr18-cache-renderer.entrypoints=https" + # router for shibboleth shibboleth auth based access (http) + - "traefik.http.routers.vhr18-cache-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-cache-renderer-redirect.entrypoints=http" + # router for referrer shibboleth based access (https) + - "traefik.http.routers.vhr18-cache-renderer_referer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.vhr18-cache-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.vhr18-cache-renderer_referer.tls=true" + - "traefik.http.routers.vhr18-cache-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.vhr18-cache-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" + - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-cache.loadbalancer.sticky=false" - "traefik.http.services.vhr18-cache.loadbalancer.server.port=80" @@ -106,7 +146,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.vhr18-client.rule=Host(`vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`)" - - "traefik.http.routers.vhr18-client.middlewares=auth@file,compress@file,shibAuth@file" + - "traefik.http.routers.vhr18-client.middlewares=auth@file,compress@file" - "traefik.http.routers.vhr18-client.tls=true" - "traefik.http.routers.vhr18-client.tls.certresolver=default" - "traefik.http.routers.vhr18-client.entrypoints=https" @@ -114,6 +154,16 @@ services: - "traefik.http.routers.vhr18-client-redirect.rule=Host(`vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`)" - "traefik.http.routers.vhr18-client-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-client-redirect.entrypoints=http" + # router for basic auth based access (https) + - "traefik.http.routers.vhr18-client.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`)" + - "traefik.http.routers.vhr18-client.middlewares=shibAuth@file,compress@file" + - "traefik.http.routers.vhr18-client.tls=true" + - "traefik.http.routers.vhr18-client.tls.certresolver=default" + - "traefik.http.routers.vhr18-client.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.vhr18-client-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`)" + - "traefik.http.routers.vhr18-client-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-client-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-client.loadbalancer.sticky=false" - "traefik.http.services.vhr18-client.loadbalancer.server.port=80" -- GitLab From 9a613a3ed1e598d1f360e37da4d04c66f4e5a961 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 16:42:03 +0200 Subject: [PATCH 008/162] save temp --- shibauth/Dockerfile | 3 +- .../sp.conf => etc-httpd/conf.d/shib.conf} | 4 +- shibauth/shibboleth-conf/idp-metadata.xml | 24 --- shibauth/shibboleth-conf/shibboleth2.xml | 104 +------------ shibauth/shibboleth-conf/sp-metadata.xml | 141 ++++++++++++++++++ 5 files changed, 150 insertions(+), 126 deletions(-) rename shibauth/{conf.d/sp.conf => etc-httpd/conf.d/shib.conf} (78%) create mode 100644 shibauth/shibboleth-conf/sp-metadata.xml diff --git a/shibauth/Dockerfile b/shibauth/Dockerfile index a1c6d766..986fbddc 100644 --- a/shibauth/Dockerfile +++ b/shibauth/Dockerfile @@ -35,5 +35,6 @@ LABEL name="prism view server cache" \ version="0.0.1" COPY shibboleth-conf /etc/shibboleth/ +COPY etc-httpd/ /etc/httpd/ COPY index.html /var/www/html/ -COPY conf.d /etc/httpd/etc-httpd/ + diff --git a/shibauth/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/shib.conf similarity index 78% rename from shibauth/conf.d/sp.conf rename to shibauth/etc-httpd/conf.d/shib.conf index 091f85e9..58a46d86 100644 --- a/shibauth/conf.d/sp.conf +++ b/shibauth/etc-httpd/conf.d/shib.conf @@ -1,7 +1,7 @@ -ServerName idptestbed +ServerName shib-testing - ServerName https://idptestbed:443 + ServerName http://shib.pdas.prism.eox.at UseCanonicalName On DocumentRoot "/var/www/html" diff --git a/shibauth/shibboleth-conf/idp-metadata.xml b/shibauth/shibboleth-conf/idp-metadata.xml index caa418c0..6a91356a 100644 --- a/shibauth/shibboleth-conf/idp-metadata.xml +++ b/shibauth/shibboleth-conf/idp-metadata.xml @@ -1,18 +1,8 @@ - - - - samltest.id - - SAMLtest IdP A free and basic IdP for testing SAML deployments @@ -44,7 +34,6 @@ voQR2qr2xJBixsg+MIORKtmKHLfU - @@ -70,7 +59,6 @@ ZOpx4swtgGdeoSpeRyrtMvRwdcciNBp9UZome44qZAYH1iqrpmmjsfI9pJItsgWu - @@ -96,27 +84,15 @@ zBDsMIEzRtQZm4GIoHJae4zmnCekkQ== - - - - - - - - - - \ No newline at end of file diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index f890b39c..2769ec5f 100644 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -4,122 +4,28 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180"> - - - - - - - - - - - SAML2 SAML1 - - SAML2 Local - - - - - - - + - - - - - - - - - - - - + - - - - - - - - - - - - + - - - - \ No newline at end of file diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml new file mode 100644 index 00000000..bfa4da80 --- /dev/null +++ b/shibauth/shibboleth-conf/sp-metadata.xml @@ -0,0 +1,141 @@ + + + + + + + +MIIHijCCBnKgAwIBAgIQPWbuJob/1pRBDBHQrAelKDANBgkqhkiG9w0BAQsFADB4 +MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMg +U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJjAkBgNVBAMTHVN0YXJ0 +Q29tIENsYXNzIDMgT1YgU2VydmVyIENBMB4XDTE2MDUzMDIwMjAwNFoXDTE5MDUz +MDIwMjAwNFowZDELMAkGA1UEBhMCQVQxDTALBgNVBAgMBFdpZW4xDTALBgNVBAcM +BFdpZW4xHTAbBgNVBAoMFEVPWCBJVCBTZXJ2aWNlcyBHbWJIMRgwFgYDVQQDDA9l +c2EubWFwcy5lb3guYXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCX +GBReYwFVvkSrourZRd4zBBlo9apZHXxt+kk4bNbk1n70YNeFUaxJpwFQqkfwghrg +9tctD2B9HLDZl+LMnO6IXAzXkn8OHzt9vf4lVLDYOSHcC/oAt4aQjr98Anl1q822 +/FJ6csFtFAmEIg8P6NHByHlwaSM1yxcrc7ZgR+xph0/sQijh4jxOlcNfCGRy0VBt +lJE0rLSAmIN/LUX/hf1P4psbPlXNLl1U3Du6sh+pkgWV5gsKJBxAYJvptlahn9Ud +b6FBFngM/Z9rk/M4R692z5WWLwfxFScEw3/FfF9aH5ztCAM1u3L5QjqANcdbVl86 +x2kUXZh9A7EjUhnI25xu4aEVJBHTcq46rZQw88lW/+Xxavon03dHuaHhrZXMF5mD +rIGvumSlB1XzCz2lOQG4zrUnXtKw6rm7fr20Zn5KQEgiUD+d2Hs8lvkWmP0qKiP+ +EWdJrAfprv85tKqQMxldnrOK9FwH9TQh4TmhYlp+6vvsfZMZB4uDMlvKBtlI+7Yh +O61HKIDSsEqq6tdy312ENOjZVZsPsNkZCdOm6irTTymB9Id1LJ+3jv+lakPzluW/ +rTeq2S0UMMvByRsTGiI3ettxgOwo/jWAJiMTWb26ldpxHqyvOIX7b40Wvk+KRx9T +Vgx4kkuS5ycNi0YgUBs98imh8GXvBEufvpZCtcd5OQIDAQABo4IDIjCCAx4wDgYD +VR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAJBgNV +HRMEAjAAMB0GA1UdDgQWBBRX3j8T9Ti5uurAxnFHSb/P6Q4Z9jAfBgNVHSMEGDAW +gBSxPxySe5KwWiWzOPucB6QmUDLjUTBvBggrBgEFBQcBAQRjMGEwJAYIKwYBBQUH +MAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5BggrBgEFBQcwAoYtaHR0cDov +L2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLnNlcnZlcjMuY3J0MDgGA1UdHwQx +MC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1zZXJ2ZXIzLmNy +bDB4BgNVHREEcTBvgg9lc2EubWFwcy5lb3guYXSCFXRpbGVzLmVzYS5tYXBzLmVv +eC5hdIIXKi50aWxlcy5lc2EubWFwcy5lb3guYXSCE29zbS5lc2EubWFwcy5lb3gu +YXSCF3N0YWdpbmcuZXNhLm1hcHMuZW94LmF0MCMGA1UdEgQcMBqGGGh0dHA6Ly93 +d3cuc3RhcnRzc2wuY29tLzBRBgNVHSAESjBIMAgGBmeBDAECAjA8BgsrBgEEAYG1 +NwECBTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9s +aWN5MIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHYAaPaY+B9kgr46jO65KB1M/HFR +XWeT1ETRCmesu09P+8QAAAFVA3EKawAABAMARzBFAiAQMFKOGTFIZzbVuZ8R2C+u +4QgL0vnSOBT3ylGgjAf+AQIhAOHkMTkhr0APu8jaCkos4c9k8vrn5DWq0k8WXT12 +ip4fAHUA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/csAAAFVA3EMcwAA +BAMARjBEAiASftiRTzUpe+IDonZidGHzHKlKwPZoaOE2zqsH1AW9jgIgM7Jmphm1 +rGkakcVooaUudEfCTN/fTJ7cs3kPiljWmkgwDQYJKoZIhvcNAQELBQADggEBAIp2 +QqqJ6+TRRr7cBeiMw+4MrQhbaf+Y0bAsPOF9KOnQ9JMavEki08JRLYLVSraqDW1+ +mrlk+mbvh9mEFkTIvwW5wt/S5tgbRE/fmDBTElRwLPVlvbwRNKNg/54lXhwgETM8 +oTOfxC+dK7bg+EFj3r71d7wf/qhPCBYmN9yk2z4tby1nYI6c+8xXVxnrKGIOOb/X +MAB1eHNvjMHHmhlSV33Z6nqrTzeUEDS5R6X1v3lCtP/058o6NDdLmJ/hTy/So5eB +8NwcilckyoYeI64QXg61KmH+9+scQ2bddWtuDJvnNo0NH1XPOuxl9HpaxBSzIflK +2Wfpr7x/2VCKeO7Mfpo= + + + + + + + + + + + + + + + + + + + + + + + + + + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + eox + EOX IT Services GmbH + http://eox.at + + -- GitLab From 46e407024f768335a05fafbf61a5738acfd02198 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 16:43:24 +0200 Subject: [PATCH 009/162] save temp --- shibauth/etc-httpd/conf.d/shib.conf | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf index 58a46d86..2c7d35d2 100644 --- a/shibauth/etc-httpd/conf.d/shib.conf +++ b/shibauth/etc-httpd/conf.d/shib.conf @@ -1,19 +1,6 @@ -ServerName shib-testing - - - ServerName http://shib.pdas.prism.eox.at - UseCanonicalName On - - DocumentRoot "/var/www/html" - - Satisfy Any - Allow from all - - - - AuthType shibboleth - ShibRequestSetting requireSession 1 - require shib-session - - - \ No newline at end of file +ServerName shib.pdas.prism.eox.at +LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so + + SetHandler shib + +DocumentRoot "/var/www/html" \ No newline at end of file -- GitLab From e558d513682d3bd40ae303bacd819e25f23d0fc5 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 17:36:25 +0200 Subject: [PATCH 010/162] rename test routers, fix syntax compose --- docker-compose.test.ops.yml | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/docker-compose.test.ops.yml b/docker-compose.test.ops.yml index 69f4143b..df6bd812 100644 --- a/docker-compose.test.ops.yml +++ b/docker-compose.test.ops.yml @@ -2,24 +2,21 @@ version: "3.6" services: shibauth: image: testing-shibboleth - deploy: - placement: - constraints: [node.role == manager] deploy: labels: # router for basic auth based access (https) - - "traefik.http.routers.emg-renderer.rule=Host(`shib.pdas.prism.eox.at`)" - - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file" - - "traefik.http.routers.emg-renderer.tls=true" - - "traefik.http.routers.emg-renderer.tls.certresolver=default" - - "traefik.http.routers.emg-renderer.entrypoints=https" + - "traefik.http.routers.shibauth.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth.middlewares=compress@file,cors@file" + - "traefik.http.routers.shibauth.tls=true" + - "traefik.http.routers.shibauth.tls.certresolver=default" + - "traefik.http.routers.shibauth.entrypoints=https" # router for basic auth based access (http) - - "traefik.http.routers.emg-renderer-redirect.rule=Host(`shib.pdas.prism.eox.at`)" - - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + - "traefik.http.routers.shibauth-redirect.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth-redirect.middlewares=redirect@file" + - "traefik.http.routers.shibauth-redirect.entrypoints=http" # general - - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" + - "traefik.http.services.shibauth.loadbalancer.sticky=false" + - "traefik.http.services.shibauth.loadbalancer.server.port=80" - "traefik.docker.network=shib-extnet" - "traefik.docker.lbswarm=true" - "traefik.enable=true" -- GitLab From a66a83f8630637692970a5e0bf8bc07a9a666c47 Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Tue, 29 Sep 2020 17:51:08 +0200 Subject: [PATCH 011/162] Removing traefik rules for referrer based auth in URLs using shibboleth --- docker-compose.dem.ops.yml | 20 -------------------- docker-compose.emg.ops.yml | 20 -------------------- docker-compose.vhr18.ops.yml | 20 -------------------- 3 files changed, 60 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index a1f677ea..907564ca 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -42,16 +42,6 @@ services: - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.dem-renderer_referer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.dem-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.dem-renderer_referer.tls=true" - - "traefik.http.routers.dem-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.dem-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.dem-renderer.loadbalancer.sticky=false" - "traefik.http.services.dem-renderer.loadbalancer.server.port=80" @@ -104,16 +94,6 @@ services: - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.dem-renderer_referer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.dem-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.dem-renderer_referer.tls=true" - - "traefik.http.routers.dem-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.dem-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.dem-renderer_referer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|dem-secure.pdas.prism.eox.at|dem-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.dem-cache.loadbalancer.sticky=false" - "traefik.http.services.dem-cache.loadbalancer.server.port=80" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 5d00a095..86fb801d 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -42,16 +42,6 @@ services: - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.emg-renderer_referer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.emg-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.emg-renderer_referer.tls=true" - - "traefik.http.routers.emg-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.emg-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" @@ -104,16 +94,6 @@ services: - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.emg-renderer_referer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.emg-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.emg-renderer_referer.tls=true" - - "traefik.http.routers.emg-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.emg-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg-secure.pdas.prism.eox.at|emg-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.emg-cache.loadbalancer.sticky=false" - "traefik.http.services.emg-cache.loadbalancer.server.port=80" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index ee885d69..4529ff57 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -43,16 +43,6 @@ services: - "traefik.http.routers.vhr18-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.vhr18-renderer_referer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.vhr18-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.vhr18-renderer_referer.tls=true" - - "traefik.http.routers.vhr18-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.vhr18-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.vhr18-renderer_referer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-renderer.loadbalancer.sticky=false" - "traefik.http.services.vhr18-renderer.loadbalancer.server.port=80" @@ -104,16 +94,6 @@ services: - "traefik.http.routers.vhr18-cache-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-cache-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache-renderer-redirect.entrypoints=http" - # router for referrer shibboleth based access (https) - - "traefik.http.routers.vhr18-cache-renderer_referer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.vhr18-cache-renderer_referer.middlewares=compress@file,cors@file" - - "traefik.http.routers.vhr18-cache-renderer_referer.tls=true" - - "traefik.http.routers.vhr18-cache-renderer_referer.tls.certresolver=default" - - "traefik.http.routers.vhr18-cache-renderer_referer.entrypoints=https" - # router for referrer based access (http) - - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|vhr18-secure.pdas.prism.eox.at|vhr18-secure.pass.copernicus.eu)/?`)" - - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.middlewares=redirect@file" - - "traefik.http.routers.vhr18-cache-renderer_referer-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-cache.loadbalancer.sticky=false" - "traefik.http.services.vhr18-cache.loadbalancer.server.port=80" -- GitLab From 0a384d51582e2e1134abe3b8887a7c3c37a433d0 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Tue, 29 Sep 2020 20:49:09 +0200 Subject: [PATCH 012/162] update metadata to testing saml provider, still not working though --- shibauth/Dockerfile | 1 - shibauth/etc-httpd/conf.d/shib.conf | 6 ------ shibauth/etc-httpd/conf.d/sp.conf | 19 +++++++++++++++++++ shibauth/shibboleth-conf/shibboleth2.xml | 2 +- 4 files changed, 20 insertions(+), 8 deletions(-) delete mode 100644 shibauth/etc-httpd/conf.d/shib.conf create mode 100644 shibauth/etc-httpd/conf.d/sp.conf diff --git a/shibauth/Dockerfile b/shibauth/Dockerfile index 986fbddc..3f278c26 100644 --- a/shibauth/Dockerfile +++ b/shibauth/Dockerfile @@ -37,4 +37,3 @@ LABEL name="prism view server cache" \ COPY shibboleth-conf /etc/shibboleth/ COPY etc-httpd/ /etc/httpd/ COPY index.html /var/www/html/ - diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf deleted file mode 100644 index 2c7d35d2..00000000 --- a/shibauth/etc-httpd/conf.d/shib.conf +++ /dev/null @@ -1,6 +0,0 @@ -ServerName shib.pdas.prism.eox.at -LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so - - SetHandler shib - -DocumentRoot "/var/www/html" \ No newline at end of file diff --git a/shibauth/etc-httpd/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/sp.conf new file mode 100644 index 00000000..9de6cc7a --- /dev/null +++ b/shibauth/etc-httpd/conf.d/sp.conf @@ -0,0 +1,19 @@ +ServerName shib.pdas.prism.eox.at + + + ServerName https://shib.pdas.prism.eox.at:443 + UseCanonicalName On + + DocumentRoot "/var/www/html" + + + AuthType shibboleth + ShibRequestSetting requireSession 1 + require shib-session + + + + Satisfy Any + Allow from all + + \ No newline at end of file diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index 2769ec5f..8a916cfb 100644 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -8,7 +8,7 @@ REMOTE_USER="eppn uid persistent-id targeted-id"> - + SAML2 SAML1 SAML2 Local -- GitLab From c87648a08842d594521d683479306ddca04774fe Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 12:19:58 +0200 Subject: [PATCH 013/162] use http internally for handler, overwrite shib.conf completely, do not validate metadata --- shibauth/etc-httpd/conf.d/shib.conf | 13 +++++++++++++ shibauth/etc-httpd/conf.d/sp.conf | 19 ------------------- shibauth/shibboleth-conf/shibboleth2.xml | 10 +++++----- 3 files changed, 18 insertions(+), 24 deletions(-) create mode 100644 shibauth/etc-httpd/conf.d/shib.conf delete mode 100644 shibauth/etc-httpd/conf.d/sp.conf diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf new file mode 100644 index 00000000..758f387c --- /dev/null +++ b/shibauth/etc-httpd/conf.d/shib.conf @@ -0,0 +1,13 @@ +ServerName shib.pdas.prism.eox.at +LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so +ShibCompatValidUser Off +UseCanonicalName On + + SetHandler shib + + + + AuthType shibboleth + ShibRequestSetting requireSession 1 + require shib-session + diff --git a/shibauth/etc-httpd/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/sp.conf deleted file mode 100644 index 9de6cc7a..00000000 --- a/shibauth/etc-httpd/conf.d/sp.conf +++ /dev/null @@ -1,19 +0,0 @@ -ServerName shib.pdas.prism.eox.at - - - ServerName https://shib.pdas.prism.eox.at:443 - UseCanonicalName On - - DocumentRoot "/var/www/html" - - - AuthType shibboleth - ShibRequestSetting requireSession 1 - require shib-session - - - - Satisfy Any - Allow from all - - \ No newline at end of file diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index 8a916cfb..7bd47635 100644 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -4,22 +4,22 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180"> - + checkAddress="false" handlerSSL="false" cookieProps="http"> - SAML2 SAML1 + SAML2 SAML2 Local - + - + -- GitLab From 26454276a31a90d2641b17e9d3a7ea1ef3183e4e Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 13:17:58 +0200 Subject: [PATCH 014/162] update config forwardauth url, remove not necessary files, add shibauth to base compose --- docker-compose.base.ops.yml | 28 +++++ shibauth/shibboleth-conf/shibd.logger | 76 ------------ shibauth/shibboleth-conf/sp-metadata.xml | 141 ----------------------- traefik-dynamic.yml | 2 +- 4 files changed, 29 insertions(+), 218 deletions(-) delete mode 100644 shibauth/shibboleth-conf/shibd.logger delete mode 100644 shibauth/shibboleth-conf/sp-metadata.xml diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index f29bcc7c..1aecaffa 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -28,6 +28,32 @@ services: - emg-extnet - dem-extnet - logging-extnet + - shibauth-extnet + shibauth: + image: testing-shibboleth + deploy: + # labels: + # # router for basic auth based access (https) + # - "traefik.http.routers.shibauth.rule=Host(`shib.pdas.prism.eox.at`)" + # - "traefik.http.routers.shibauth.middlewares=compress@file,cors@file" + # - "traefik.http.routers.shibauth.tls=true" + # - "traefik.http.routers.shibauth.tls.certresolver=default" + # - "traefik.http.routers.shibauth.entrypoints=https" + # # router for basic auth based access (http) + # - "traefik.http.routers.shibauth-redirect.rule=Host(`shib.pdas.prism.eox.at`)" + # - "traefik.http.routers.shibauth-redirect.middlewares=redirect@file" + # - "traefik.http.routers.shibauth-redirect.entrypoints=http" + # # general + # - "traefik.http.services.shibauth.loadbalancer.sticky=false" + # - "traefik.http.services.shibauth.loadbalancer.server.port=80" + # - "traefik.docker.network=shib-extnet" + # - "traefik.docker.lbswarm=true" + # - "traefik.enable=true" + replicas: 1 + placement: + constraints: [node.role == manager] + networks: + - shibauth-extnet volumes: traefik-data: networks: @@ -39,3 +65,5 @@ networks: name: dem-extnet logging-extnet: name: logging-extnet + shibauth-extnet: + name: shibauth-extnet diff --git a/shibauth/shibboleth-conf/shibd.logger b/shibauth/shibboleth-conf/shibd.logger deleted file mode 100644 index e9526645..00000000 --- a/shibauth/shibboleth-conf/shibd.logger +++ /dev/null @@ -1,76 +0,0 @@ -# set overall behavior -log4j.rootCategory=INFO, shibd_log, warn_log - -# fairly verbose for DEBUG, so generally leave at INFO -log4j.category.XMLTooling.XMLObject=INFO -log4j.category.XMLTooling.KeyInfoResolver=INFO -log4j.category.Shibboleth.IPRange=INFO -log4j.category.Shibboleth.PropertySet=INFO - -# raise for low-level tracing of SOAP client HTTP/SSL behavior -log4j.category.XMLTooling.libcurl=INFO - -# useful categories to tune independently: -# -# tracing of SAML messages and security policies -#log4j.category.OpenSAML.MessageDecoder=DEBUG -#log4j.category.OpenSAML.MessageEncoder=DEBUG -#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG -#log4j.category.XMLTooling.SOAPClient=DEBUG -# interprocess message remoting -#log4j.category.Shibboleth.Listener=DEBUG -# mapping of requests to applicationId -#log4j.category.Shibboleth.RequestMapper=DEBUG -# high level session cache operations -#log4j.category.Shibboleth.SessionCache=DEBUG -# persistent storage and caching -#log4j.category.XMLTooling.StorageService=DEBUG - -# logs XML being signed or verified if set to DEBUG -log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log -log4j.additivity.XMLTooling.Signature.Debugger=false -log4j.ownAppenders.XMLTooling.Signature.Debugger=true - -# the tran log blocks the "default" appender(s) at runtime -# Level should be left at INFO for this category -log4j.category.Shibboleth-TRANSACTION=INFO, tran_log -log4j.additivity.Shibboleth-TRANSACTION=false -log4j.ownAppenders.Shibboleth-TRANSACTION=true - -# uncomment to suppress particular event types -#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN -#log4j.category.Shibboleth-TRANSACTION.Login=WARN -#log4j.category.Shibboleth-TRANSACTION.Logout=WARN - -# define the appenders - -log4j.appender.shibd_log=org.apache.log4j.RollingFileAppender -log4j.appender.shibd_log.fileName=/dev/stdout -log4j.appender.shibd_log.maxFileSize=0 -log4j.appender.shibd_log.maxBackupIndex=0 -log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout -log4j.appender.shibd_log.layout.ConversionPattern=sp-shibd %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n - -#log4j.appender.warn_log=org.apache.log4j.RollingFileAppender -#log4j.appender.warn_log.fileName=/var/log/shibboleth/shibd_warn.log -#log4j.appender.warn_log.maxFileSize=0 -#log4j.appender.warn_log.maxBackupIndex=0 -#log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout -#log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n -#log4j.appender.warn_log.threshold=WARN - -log4j.appender.tran_log=org.apache.log4j.RollingFileAppender -log4j.appender.tran_log.fileName=/dev/stdout -log4j.appender.tran_log.maxFileSize=0 -log4j.appender.tran_log.maxBackupIndex=0 -log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout -log4j.appender.tran_log.layout.ConversionPattern=sp-transaction %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n - -log4j.appender.sig_log=org.apache.log4j.FileAppender -log4j.appender.sig_log.fileName=/dev/stdout -log4j.appender.sig_log.maxFileSize=0 -log4j.appender.sig_log.maxBackupIndex=0 -log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout -log4j.appender.sig_log.layout.ConversionPattern=sp-signature %m - - diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml deleted file mode 100644 index bfa4da80..00000000 --- a/shibauth/shibboleth-conf/sp-metadata.xml +++ /dev/null @@ -1,141 +0,0 @@ - - - - - - - -MIIHijCCBnKgAwIBAgIQPWbuJob/1pRBDBHQrAelKDANBgkqhkiG9w0BAQsFADB4 -MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMg -U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJjAkBgNVBAMTHVN0YXJ0 -Q29tIENsYXNzIDMgT1YgU2VydmVyIENBMB4XDTE2MDUzMDIwMjAwNFoXDTE5MDUz -MDIwMjAwNFowZDELMAkGA1UEBhMCQVQxDTALBgNVBAgMBFdpZW4xDTALBgNVBAcM -BFdpZW4xHTAbBgNVBAoMFEVPWCBJVCBTZXJ2aWNlcyBHbWJIMRgwFgYDVQQDDA9l -c2EubWFwcy5lb3guYXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCX -GBReYwFVvkSrourZRd4zBBlo9apZHXxt+kk4bNbk1n70YNeFUaxJpwFQqkfwghrg -9tctD2B9HLDZl+LMnO6IXAzXkn8OHzt9vf4lVLDYOSHcC/oAt4aQjr98Anl1q822 -/FJ6csFtFAmEIg8P6NHByHlwaSM1yxcrc7ZgR+xph0/sQijh4jxOlcNfCGRy0VBt -lJE0rLSAmIN/LUX/hf1P4psbPlXNLl1U3Du6sh+pkgWV5gsKJBxAYJvptlahn9Ud -b6FBFngM/Z9rk/M4R692z5WWLwfxFScEw3/FfF9aH5ztCAM1u3L5QjqANcdbVl86 -x2kUXZh9A7EjUhnI25xu4aEVJBHTcq46rZQw88lW/+Xxavon03dHuaHhrZXMF5mD -rIGvumSlB1XzCz2lOQG4zrUnXtKw6rm7fr20Zn5KQEgiUD+d2Hs8lvkWmP0qKiP+ -EWdJrAfprv85tKqQMxldnrOK9FwH9TQh4TmhYlp+6vvsfZMZB4uDMlvKBtlI+7Yh -O61HKIDSsEqq6tdy312ENOjZVZsPsNkZCdOm6irTTymB9Id1LJ+3jv+lakPzluW/ -rTeq2S0UMMvByRsTGiI3ettxgOwo/jWAJiMTWb26ldpxHqyvOIX7b40Wvk+KRx9T -Vgx4kkuS5ycNi0YgUBs98imh8GXvBEufvpZCtcd5OQIDAQABo4IDIjCCAx4wDgYD -VR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAJBgNV -HRMEAjAAMB0GA1UdDgQWBBRX3j8T9Ti5uurAxnFHSb/P6Q4Z9jAfBgNVHSMEGDAW -gBSxPxySe5KwWiWzOPucB6QmUDLjUTBvBggrBgEFBQcBAQRjMGEwJAYIKwYBBQUH -MAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5BggrBgEFBQcwAoYtaHR0cDov -L2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLnNlcnZlcjMuY3J0MDgGA1UdHwQx -MC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1zZXJ2ZXIzLmNy -bDB4BgNVHREEcTBvgg9lc2EubWFwcy5lb3guYXSCFXRpbGVzLmVzYS5tYXBzLmVv -eC5hdIIXKi50aWxlcy5lc2EubWFwcy5lb3guYXSCE29zbS5lc2EubWFwcy5lb3gu -YXSCF3N0YWdpbmcuZXNhLm1hcHMuZW94LmF0MCMGA1UdEgQcMBqGGGh0dHA6Ly93 -d3cuc3RhcnRzc2wuY29tLzBRBgNVHSAESjBIMAgGBmeBDAECAjA8BgsrBgEEAYG1 -NwECBTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9s -aWN5MIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHYAaPaY+B9kgr46jO65KB1M/HFR -XWeT1ETRCmesu09P+8QAAAFVA3EKawAABAMARzBFAiAQMFKOGTFIZzbVuZ8R2C+u -4QgL0vnSOBT3ylGgjAf+AQIhAOHkMTkhr0APu8jaCkos4c9k8vrn5DWq0k8WXT12 -ip4fAHUA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/csAAAFVA3EMcwAA -BAMARjBEAiASftiRTzUpe+IDonZidGHzHKlKwPZoaOE2zqsH1AW9jgIgM7Jmphm1 -rGkakcVooaUudEfCTN/fTJ7cs3kPiljWmkgwDQYJKoZIhvcNAQELBQADggEBAIp2 -QqqJ6+TRRr7cBeiMw+4MrQhbaf+Y0bAsPOF9KOnQ9JMavEki08JRLYLVSraqDW1+ -mrlk+mbvh9mEFkTIvwW5wt/S5tgbRE/fmDBTElRwLPVlvbwRNKNg/54lXhwgETM8 -oTOfxC+dK7bg+EFj3r71d7wf/qhPCBYmN9yk2z4tby1nYI6c+8xXVxnrKGIOOb/X -MAB1eHNvjMHHmhlSV33Z6nqrTzeUEDS5R6X1v3lCtP/058o6NDdLmJ/hTy/So5eB -8NwcilckyoYeI64QXg61KmH+9+scQ2bddWtuDJvnNo0NH1XPOuxl9HpaxBSzIflK -2Wfpr7x/2VCKeO7Mfpo= - - - - - - - - - - - - - - - - - - - - - - - - - - - urn:oasis:names:tc:SAML:2.0:nameid-format:transient - - - - - eox - EOX IT Services GmbH - http://eox.at - - diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 0291f929..495ef4eb 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -22,7 +22,7 @@ http: - "***REMOVED***" shibAuth: forwardAuth: - address: http://auth/auth + address: http://shibauth/secure trustForwardHeader: true compress: compress: {} -- GitLab From 1dc82314529cc31453679294e7e4254d57565470 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 13:26:38 +0200 Subject: [PATCH 015/162] update pass copernicus shib urls for traefik --- docker-compose.dem.ops.yml | 4 ++-- docker-compose.emg.ops.yml | 8 ++++---- docker-compose.vhr18.ops.yml | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index 907564ca..1f14e215 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -33,13 +33,13 @@ services: - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.dem-renderer.middlewares=compress@file,cors@file,shibAuth@file" - "traefik.http.routers.dem-renderer.tls=true" - "traefik.http.routers.dem-renderer.tls.certresolver=default" - "traefik.http.routers.dem-renderer.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" # general diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 86fb801d..019e638a 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -33,13 +33,13 @@ services: - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" - "traefik.http.routers.emg-renderer.tls=true" - "traefik.http.routers.emg-renderer.tls.certresolver=default" - "traefik.http.routers.emg-renderer.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" # general @@ -85,13 +85,13 @@ services: - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" - "traefik.http.routers.emg-renderer.tls=true" - "traefik.http.routers.emg-renderer.tls.certresolver=default" - "traefik.http.routers.emg-renderer.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" # general diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index 4529ff57..22c58ea4 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -34,13 +34,13 @@ services: - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-renderer.middlewares=compress@file,cors@file,shibAuth@file" - "traefik.http.routers.vhr18-renderer.tls=true" - "traefik.http.routers.vhr18-renderer.tls.certresolver=default" - "traefik.http.routers.vhr18-renderer.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.vhr18-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer-redirect.entrypoints=http" # general @@ -85,13 +85,13 @@ services: - "traefik.http.routers.vhr18-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.vhr18-cache-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-cache-renderer.middlewares=compress@file,cors@file,shibAuth@file" - "traefik.http.routers.vhr18-cache-renderer.tls=true" - "traefik.http.routers.vhr18-cache-renderer.tls.certresolver=default" - "traefik.http.routers.vhr18-cache-renderer.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.vhr18-cache-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - "traefik.http.routers.vhr18-cache-renderer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache-renderer-redirect.entrypoints=http" # general -- GitLab From 5d892ea5202811afbe7600e7d1901b3b08359e8d Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 13:29:20 +0200 Subject: [PATCH 016/162] rename shibextnet --- docker-compose.base.ops.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index 1aecaffa..a7b647cb 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -53,7 +53,7 @@ services: placement: constraints: [node.role == manager] networks: - - shibauth-extnet + - shib-extnet volumes: traefik-data: networks: @@ -65,5 +65,5 @@ networks: name: dem-extnet logging-extnet: name: logging-extnet - shibauth-extnet: - name: shibauth-extnet + shib-extnet: + name: shib-extnet -- GitLab From ba5d76ee29773ea09df31dc72a28642ba0093cb9 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 14:52:09 +0200 Subject: [PATCH 017/162] fix traefik labels to be unique --- docker-compose.dem.ops.yml | 32 ++++++++++++++++---------------- docker-compose.emg.ops.yml | 32 ++++++++++++++++---------------- docker-compose.vhr18.ops.yml | 32 ++++++++++++++++---------------- 3 files changed, 48 insertions(+), 48 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index 1f14e215..46c6a135 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -33,15 +33,15 @@ services: - "traefik.http.routers.dem-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.dem-renderer.tls=true" - - "traefik.http.routers.dem-renderer.tls.certresolver=default" - - "traefik.http.routers.dem-renderer.entrypoints=https" + - "traefik.http.routers.dem-renderer-shib.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-renderer-shib.tls=true" + - "traefik.http.routers.dem-renderer-shib.tls.certresolver=default" + - "traefik.http.routers.dem-renderer-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" + - "traefik.http.routers.dem-renderer-shib-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem-secure.pass.copernicus.eu`, `a.dem-secure.pass.copernicus.eu`, `b.dem-secure.pass.copernicus.eu`, `c.dem-secure.pass.copernicus.eu`, `d.dem-secure.pass.copernicus.eu`, `e.dem-secure.pass.copernicus.eu`, `f.dem-secure.pass.copernicus.eu`, `g.dem-secure.pass.copernicus.eu`, `h.dem-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-renderer-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-renderer-shib-redirect.entrypoints=http" # general - "traefik.http.services.dem-renderer.loadbalancer.sticky=false" - "traefik.http.services.dem-renderer.loadbalancer.server.port=80" @@ -85,15 +85,15 @@ services: - "traefik.http.routers.dem-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.dem-cache_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.dem-renderer.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.dem-renderer.tls=true" - - "traefik.http.routers.dem-renderer.tls.certresolver=default" - - "traefik.http.routers.dem-renderer.entrypoints=https" + - "traefik.http.routers.dem-cache-shib.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-cache-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-cache-shib.tls=true" + - "traefik.http.routers.dem-cache-shib.tls.certresolver=default" + - "traefik.http.routers.dem-cache-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.dem-renderer-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.dem-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.dem-renderer-redirect.entrypoints=http" + - "traefik.http.routers.dem-cache-shib-redirect.rule=Host(`dem-secure.pdas.prism.eox.at`, `a.dem-secure.pdas.prism.eox.at`, `b.dem-secure.pdas.prism.eox.at`, `c.dem-secure.pdas.prism.eox.at`, `d.dem-secure.pdas.prism.eox.at`, `e.dem-secure.pdas.prism.eox.at`, `f.dem-secure.pdas.prism.eox.at`, `g.dem-secure.pdas.prism.eox.at`, `h.dem-secure.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.dem-cache-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.dem-cache-shib-redirect.entrypoints=http" # general - "traefik.http.services.dem-cache.loadbalancer.sticky=false" - "traefik.http.services.dem-cache.loadbalancer.server.port=80" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 019e638a..9054dbe2 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -33,15 +33,15 @@ services: - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.emg-renderer.tls=true" - - "traefik.http.routers.emg-renderer.tls.certresolver=default" - - "traefik.http.routers.emg-renderer.entrypoints=https" + - "traefik.http.routers.emg-renderer-shib.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-renderer-shib.tls=true" + - "traefik.http.routers.emg-renderer-shib.tls.certresolver=default" + - "traefik.http.routers.emg-renderer-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + - "traefik.http.routers.emg-renderer-shib-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer-shib-redirect.entrypoints=http" # general - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" @@ -85,15 +85,15 @@ services: - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.emg-renderer.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.emg-renderer.tls=true" - - "traefik.http.routers.emg-renderer.tls.certresolver=default" - - "traefik.http.routers.emg-renderer.entrypoints=https" + - "traefik.http.routers.emg-cache-shib.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-cache-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-cache-shib.tls=true" + - "traefik.http.routers.emg-cache-shib.tls.certresolver=default" + - "traefik.http.routers.emg-cache-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + - "traefik.http.routers.emg-cache-shib-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `a.emg-secure.pdas.prism.eox.at`, `b.emg-secure.pdas.prism.eox.at`, `c.emg-secure.pdas.prism.eox.at`, `d.emg-secure.pdas.prism.eox.at`, `e.emg-secure.pdas.prism.eox.at`, `f.emg-secure.pdas.prism.eox.at`, `g.emg-secure.pdas.prism.eox.at`, `h.emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`, `a.emg-secure.pass.copernicus.eu`, `b.emg-secure.pass.copernicus.eu`, `c.emg-secure.pass.copernicus.eu`, `d.emg-secure.pass.copernicus.eu`, `e.emg-secure.pass.copernicus.eu`, `f.emg-secure.pass.copernicus.eu`, `g.emg-secure.pass.copernicus.eu`, `h.emg-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-cache-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-cache-shib-redirect.entrypoints=http" # general - "traefik.http.services.emg-cache.loadbalancer.sticky=false" - "traefik.http.services.emg-cache.loadbalancer.server.port=80" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index 22c58ea4..443001b6 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -34,15 +34,15 @@ services: - "traefik.http.routers.vhr18-renderer_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-renderer_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.vhr18-renderer.tls=true" - - "traefik.http.routers.vhr18-renderer.tls.certresolver=default" - - "traefik.http.routers.vhr18-renderer.entrypoints=https" + - "traefik.http.routers.vhr18-renderer-shib.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-renderer-shib.tls=true" + - "traefik.http.routers.vhr18-renderer-shib.tls.certresolver=default" + - "traefik.http.routers.vhr18-renderer-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.vhr18-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.vhr18-renderer-redirect.entrypoints=http" + - "traefik.http.routers.vhr18-renderer-shib-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-renderer-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-renderer-shib-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-renderer.loadbalancer.sticky=false" - "traefik.http.services.vhr18-renderer.loadbalancer.server.port=80" @@ -85,15 +85,15 @@ services: - "traefik.http.routers.vhr18-cache_referer-redirect.middlewares=redirect@file" - "traefik.http.routers.vhr18-cache_referer-redirect.entrypoints=http" # router for shibboleth based auth based access (https) - - "traefik.http.routers.vhr18-cache-renderer.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-cache-renderer.middlewares=compress@file,cors@file,shibAuth@file" - - "traefik.http.routers.vhr18-cache-renderer.tls=true" - - "traefik.http.routers.vhr18-cache-renderer.tls.certresolver=default" - - "traefik.http.routers.vhr18-cache-renderer.entrypoints=https" + - "traefik.http.routers.vhr18-cache-renderer-shib.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer-shib.middlewares=compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-cache-renderer-shib.tls=true" + - "traefik.http.routers.vhr18-cache-renderer-shib.tls.certresolver=default" + - "traefik.http.routers.vhr18-cache-renderer-shib.entrypoints=https" # router for shibboleth shibboleth auth based access (http) - - "traefik.http.routers.vhr18-cache-renderer-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-cache-renderer-redirect.middlewares=redirect@file" - - "traefik.http.routers.vhr18-cache-renderer-redirect.entrypoints=http" + - "traefik.http.routers.vhr18-cache-renderer-shib-redirect.rule=Host(`vhr18-secure.pdas.prism.eox.at`, `a.vhr18-secure.pdas.prism.eox.at`, `b.vhr18-secure.pdas.prism.eox.at`, `c.vhr18-secure.pdas.prism.eox.at`, `d.vhr18-secure.pdas.prism.eox.at`, `e.vhr18-secure.pdas.prism.eox.at`, `f.vhr18-secure.pdas.prism.eox.at`, `g.vhr18-secure.pdas.prism.eox.at`, `h.vhr18-secure.pdas.prism.eox.at`, `vhr18-secure.pass.copernicus.eu`, `a.vhr18-secure.pass.copernicus.eu`, `b.vhr18-secure.pass.copernicus.eu`, `c.vhr18-secure.pass.copernicus.eu`, `d.vhr18-secure.pass.copernicus.eu`, `e.vhr18-secure.pass.copernicus.eu`, `f.vhr18-secure.pass.copernicus.eu`, `g.vhr18-secure.pass.copernicus.eu`, `h.vhr18-secure.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.vhr18-cache-renderer-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.vhr18-cache-renderer-shib-redirect.entrypoints=http" # general - "traefik.http.services.vhr18-cache.loadbalancer.sticky=false" - "traefik.http.services.vhr18-cache.loadbalancer.server.port=80" -- GitLab From 4f6d22d4e00ae6d3f26c99ee0a11f094a2f51d41 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 14:54:27 +0200 Subject: [PATCH 018/162] fix typo --- docker-compose.base.ops.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index a7b647cb..bf6103e8 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -28,7 +28,7 @@ services: - emg-extnet - dem-extnet - logging-extnet - - shibauth-extnet + - shib-extnet shibauth: image: testing-shibboleth deploy: -- GitLab From 658e2e48d081f1c659ad57470d9800c8be5f3f69 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 15:22:38 +0200 Subject: [PATCH 019/162] intnet shib network --- docker-compose.base.ops.yml | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index bf6103e8..dbf099ee 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -28,32 +28,14 @@ services: - emg-extnet - dem-extnet - logging-extnet - - shib-extnet shibauth: image: testing-shibboleth deploy: - # labels: - # # router for basic auth based access (https) - # - "traefik.http.routers.shibauth.rule=Host(`shib.pdas.prism.eox.at`)" - # - "traefik.http.routers.shibauth.middlewares=compress@file,cors@file" - # - "traefik.http.routers.shibauth.tls=true" - # - "traefik.http.routers.shibauth.tls.certresolver=default" - # - "traefik.http.routers.shibauth.entrypoints=https" - # # router for basic auth based access (http) - # - "traefik.http.routers.shibauth-redirect.rule=Host(`shib.pdas.prism.eox.at`)" - # - "traefik.http.routers.shibauth-redirect.middlewares=redirect@file" - # - "traefik.http.routers.shibauth-redirect.entrypoints=http" - # # general - # - "traefik.http.services.shibauth.loadbalancer.sticky=false" - # - "traefik.http.services.shibauth.loadbalancer.server.port=80" - # - "traefik.docker.network=shib-extnet" - # - "traefik.docker.lbswarm=true" - # - "traefik.enable=true" replicas: 1 placement: constraints: [node.role == manager] networks: - - shib-extnet + - intnet volumes: traefik-data: networks: @@ -65,5 +47,4 @@ networks: name: dem-extnet logging-extnet: name: logging-extnet - shib-extnet: - name: shib-extnet + intnet: -- GitLab From 3fa843b0f64beca18fa7f9823c0975975a2e21bf Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 15:38:20 +0200 Subject: [PATCH 020/162] correct typo intnet traefik service --- docker-compose.base.ops.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index dbf099ee..d16ac8c4 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -28,6 +28,7 @@ services: - emg-extnet - dem-extnet - logging-extnet + - intnet shibauth: image: testing-shibboleth deploy: -- GitLab From de7a16c83e521c3a0a85d6a4eaf5c0231c62216b Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 30 Sep 2020 16:04:01 +0200 Subject: [PATCH 021/162] latest progress --- docker-compose.base.ops.yml | 29 ++++++++++++++++++++++++++--- traefik-dynamic.yml | 2 +- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index d16ac8c4..7ac26701 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -28,15 +28,37 @@ services: - emg-extnet - dem-extnet - logging-extnet - - intnet + - shib-extnet shibauth: image: testing-shibboleth deploy: replicas: 1 placement: constraints: [node.role == manager] + labels: + # router for basic auth based access (https) + - "traefik.http.routers.shibauth.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth.middlewares=compress@file,cors@file" + - "traefik.http.routers.shibauth.tls=true" + - "traefik.http.routers.shibauth.tls.certresolver=default" + - "traefik.http.routers.shibauth.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.shibauth-redirect.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth-redirect.middlewares=redirect@file" + - "traefik.http.routers.shibauth-redirect.entrypoints=http" + # general + - "traefik.http.services.shibauth.loadbalancer.sticky=false" + - "traefik.http.services.shibauth.loadbalancer.server.port=80" + - "traefik.docker.network=shib-extnet" + - "traefik.docker.lbswarm=true" + - "traefik.enable=true" + # labels: + # - "traefik.enable=true" + # - "traefik.frontend.rule=Host:shib.pdas.prism.eox.at" + # - "traefik.port=80" + # - "traefik.frontend.passHostHeader=true" networks: - - intnet + - shib-extnet volumes: traefik-data: networks: @@ -48,4 +70,5 @@ networks: name: dem-extnet logging-extnet: name: logging-extnet - intnet: + shib-extnet: + name: shib-extnet diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 495ef4eb..9b51a489 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -22,7 +22,7 @@ http: - "***REMOVED***" shibAuth: forwardAuth: - address: http://shibauth/secure + address: http://shib.pdas.prism.eox.at/secure trustForwardHeader: true compress: compress: {} -- GitLab From 15a9e1176d6c116752706bbc3ab35508b8fb4322 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Mon, 5 Oct 2020 09:36:06 +0200 Subject: [PATCH 022/162] t --- docker-compose.base.ops.yml | 2 +- shibauth/Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index 7ac26701..807af599 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -51,7 +51,7 @@ services: - "traefik.http.services.shibauth.loadbalancer.server.port=80" - "traefik.docker.network=shib-extnet" - "traefik.docker.lbswarm=true" - - "traefik.enable=true" + - "traefik.enable=true" # labels: # - "traefik.enable=true" # - "traefik.frontend.rule=Host:shib.pdas.prism.eox.at" diff --git a/shibauth/Dockerfile b/shibauth/Dockerfile index 3f278c26..88efe7cb 100644 --- a/shibauth/Dockerfile +++ b/shibauth/Dockerfile @@ -33,7 +33,7 @@ LABEL name="prism view server cache" \ license="MIT Copyright (C) 2019 EOX IT Services GmbH " \ type="prism view server shibauth" \ version="0.0.1" - +RUN mkdir -p /var/www/secure COPY shibboleth-conf /etc/shibboleth/ COPY etc-httpd/ /etc/httpd/ -COPY index.html /var/www/html/ +COPY index.html /var/www/html/secure -- GitLab From 837253323372dd260e76ba4ee408855d62a7a03d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 13:47:43 +0200 Subject: [PATCH 023/162] initial renderer service --- chart/.helmignore | 23 ++++++ chart/Chart.yaml | 18 +++++ chart/README.md | 1 + chart/templates/_helpers.tpl | 63 ++++++++++++++++ chart/templates/init-db-configmap.yaml | 7 ++ chart/templates/renderer-deployment.yaml | 93 +++++++++++++++++++++++ chart/values-init-db.yaml | 80 ++++++++++++++++++++ chart/values.yaml | 96 ++++++++++++++++++++++++ 8 files changed, 381 insertions(+) create mode 100644 chart/.helmignore create mode 100644 chart/Chart.yaml create mode 100644 chart/README.md create mode 100644 chart/templates/_helpers.tpl create mode 100644 chart/templates/init-db-configmap.yaml create mode 100644 chart/templates/renderer-deployment.yaml create mode 100644 chart/values-init-db.yaml create mode 100644 chart/values.yaml diff --git a/chart/.helmignore b/chart/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/chart/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/chart/Chart.yaml b/chart/Chart.yaml new file mode 100644 index 00000000..a91297c6 --- /dev/null +++ b/chart/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v2 +name: vs +description: A Helm chart for Kubernetes of the View Server (VS) + +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0-beta.1 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. +appVersion: 1.0.0-beta.1 + +maintainers: + - name: EOX IT Services GmbH + url: https://eox.at diff --git a/chart/README.md b/chart/README.md new file mode 100644 index 00000000..9ef273a0 --- /dev/null +++ b/chart/README.md @@ -0,0 +1 @@ +Chart for the View Server (VS) bundling all services diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl new file mode 100644 index 00000000..64cea4aa --- /dev/null +++ b/chart/templates/_helpers.tpl @@ -0,0 +1,63 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "vs.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 53 chars leaving space for 10 additional chars because some +Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "vs.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 53 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 53 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 53 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "vs.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "vs.labels" -}} +helm.sh/chart: {{ include "vs.chart" . }} +{{ include "vs.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "vs.selectorLabels" -}} +app.kubernetes.io/name: {{ include "vs.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "vs.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "vs.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/chart/templates/init-db-configmap.yaml b/chart/templates/init-db-configmap.yaml new file mode 100644 index 00000000..c012c5c6 --- /dev/null +++ b/chart/templates/init-db-configmap.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +data: + init-db.sh: | + {{- .Values.initDb }} +kind: ConfigMap +metadata: + name: {{ include "vs.fullname" . }}-init-db diff --git a/chart/templates/renderer-deployment.yaml b/chart/templates/renderer-deployment.yaml new file mode 100644 index 00000000..d8a8f83a --- /dev/null +++ b/chart/templates/renderer-deployment.yaml @@ -0,0 +1,93 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "vs.fullname" . }}-renderer + labels: + {{- include "vs.labels" . | nindent 4 }} + app.kubernetes.io/service: renderer +spec: +{{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.renderer.replicaCount }} +{{- end }} + selector: + matchLabels: + {{- include "vs.selectorLabels" . | nindent 6 }} + app.kubernetes.io/service: renderer + strategy: + rollingUpdate: + maxUnavailable: 0 + type: RollingUpdate + template: + metadata: + annotations: + prometheus.io/scrape: "false" + labels: + {{- include "vs.selectorLabels" . | nindent 8 }} + app.kubernetes.io/service: renderer + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }}-renderer + image: "registry.gitlab.eox.at/esa/prism/vs/pvs_core:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.renderer.resources | nindent 12 }} + args: + - /run-httpd.sh + env: + {{- range $key, $value := .Values.config.general }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- range $key, $value := .Values.config.database }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- range $key, $value := .Values.config.django }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- range $key, $value := .Values.config.objectStorage.data }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + - name: INIT_SCRIPTS + value: /configure.sh /init-db.sh /initialized.sh + - name: INSTALL_DIR + value: /var/www/pvs/dev/ + - name: INSTANCE_ID + value: prism-view-server_renderer + - name: STARTUP_SCRIPTS + value: /wait-initialized.sh + - name: WAIT_SERVICES + value: {{ .Values.config.database.DB_HOST }}:{{ .Values.config.database.DB_PORT }} + volumeMounts: + - mountPath: /init-db.sh + name: init-db + subPath: init-db.sh + {{- with .Values.renderer.affinity | default .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - configMap: + items: + - key: vhr18_init-db.sh + path: init-db.sh + name: init-db + name: {{ include "vs.fullname" . }}-init-db diff --git a/chart/values-init-db.yaml b/chart/values-init-db.yaml new file mode 100644 index 00000000..23118ada --- /dev/null +++ b/chart/values-init-db.yaml @@ -0,0 +1,80 @@ +initDb: | + # Check if collection exits in database and initialize database only if not + if python3 manage.py id check "${COLLECTION}"; then + echo "Initialize database" + + python3 manage.py coveragetype import /rgbnir_definition.json --traceback + + if [ "${COLLECTION}" == "VHR_IMAGE_2018" ]; then + echo "Initializing collection '${COLLECTION}'." + + # PL00 + python3 manage.py producttype create "${COLLECTION}"_Product_PL00 --traceback \ + --coverage-type "RGBNir" + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 --traceback \ + --red "red" \ + --green "green" \ + --blue "blue" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "TRUE_COLOR" --traceback \ + --red "red" \ + --green "green" \ + --blue "blue" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "FALSE_COLOR" --traceback \ + --red "nir" \ + --green "red" \ + --blue "green" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "NDVI" --traceback \ + --grey "(nir-red)/(nir+red)" --grey-range -1 1 + + + python3 manage.py collectiontype create "${COLLECTION}"_Collection --traceback \ + --coverage-type "RGBNir" \ + --product-type "${COLLECTION}"_Product_PL00 + + # Create collections for all products + python3 manage.py collection create "${COLLECTION}" --type "${COLLECTION}"_Collection --traceback + + # Register mask type + python3 manage.py masktype create --validity "${COLLECTION}"_Product_PL00 validity + + else + echo "Provided collection '${COLLECTION}' not valid." + fi + + python3 manage.py storageauth create auth-cloud-ovh "${OS_AUTH_URL_SHORT}" \ + --type keystone \ + -p auth-version "${ST_AUTH_VERSION}" \ + -p identity-api-version="${ST_AUTH_VERSION}" \ + -p username "${OS_USERNAME}" \ + -p password "${OS_PASSWORD}" \ + -p tenant-name "${OS_TENANT_NAME}" \ + -p tenant-id "${OS_TENANT_ID}" \ + -p region-name "${OS_REGION_NAME}" + + python3 manage.py storage create \ + ${UPLOAD_CONTAINER} ${UPLOAD_CONTAINER} \ + --type swift \ + --storage-auth auth-cloud-ovh + + + else + echo "Using existing database" + fi diff --git a/chart/values.yaml b/chart/values.yaml new file mode 100644 index 00000000..75b000cd --- /dev/null +++ b/chart/values.yaml @@ -0,0 +1,96 @@ +config: + general: + COLLECTION: COLLECTION + CPL_VSIL_CURL_ALLOWED_EXTENSIONS: .TIF,.tif,.xml + GDAL_DISABLE_READDIR_ON_OPEN: "TRUE" + COLLECT_STATIC: "false" + database: + DB_HOST: database + DB_NAME: dbname + DB_PORT: "5432" + DB_PW: dbpw + DB_USER: dbuser + POSTGRES_DB: dbname + POSTGRES_PASSWORD: dbpw + POSTGRES_USER: dbuser + django: + DJANGO_MAIL: office@eox.at + DJANGO_PASSWORD: djangopw + DJANGO_USER: djangouser + objectStorage: + download: + OS_AUTH_URL_DOWNLOAD: https://auth.cloud.ovh.net/ + OS_PASSWORD_DOWNLOAD: ospw + OS_REGION_NAME_DOWNLOAD: SERCO-DIAS1 + OS_TENANT_ID_DOWNLOAD: tenantid + OS_TENANT_NAME_DOWNLOAD: "tenantname" + OS_USERNAME_DOWNLOAD: osuser + ST_AUTH_VERSION_DOWNLOAD: "3" + data: + OS_AUTH_URL: https://auth.cloud.ovh.net/v3/ + OS_AUTH_URL_SHORT: https://auth.cloud.ovh.net/ + OS_PASSWORD: ospw + OS_REGION_NAME: SERCO-DIAS1 + OS_TENANT_ID: tenantid + OS_TENANT_NAME: "tenantname" + OS_USER_DOMAIN_NAME: default + OS_USERNAME: osuser + ST_AUTH_VERSION: "3" + cache: + S3_BUCKET: s3bucket + S3_ID: s3id + S3_SECRET: s3secret + S3_REGION: eu-central-1 + preprocessing: + UPLOAD_CONTAINER: container + ENFORCE_FOUR_BANDS: "True" + SPLIT_PARTS_CHECK: "False" + redis: + REDIS_HOST: redis + REDIS_PORT: "6379" + REDIS_PREPROCESS_QUEUE_KEY: preprocess_queue + REDIS_QUEUE_KEY: seed_queue + REDIS_REGISTER_QUEUE_KEY: register_queue + REDIS_REGISTERED_SET_KEY: registered_set + REDIS_SEED_QUEUE_KEY: seed_queue + REDIS_SET_KEY: registered_set + +renderer: + replicaCount: 1 + resources: + limits: + cpu: 1.5 + memory: 6Gi + requests: + cpu: 0.5 + memory: 2Gi + affinity: {} + +replicaCount: 1 + +image: + repository: registry.gitlab.eox.at/esa/prism/vs + pullPolicy: IfNotPresent + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +service: + type: ClusterIP + port: 80 + +ingress: + enabled: false + annotations: + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" + nginx.ingress.kubernetes.io/proxy-read-timeout: "600" + nginx.ingress.kubernetes.io/enable-cors: "true" + hosts: + - host: chart-example.local + paths: [] + tls: [] + +affinity: {} -- GitLab From f85f092ff6219d2cc9256ad02ca18818316359e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:05:44 +0200 Subject: [PATCH 024/162] add postgres chart dependency --- chart/Chart.yaml | 6 ++++++ chart/values.yaml | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/chart/Chart.yaml b/chart/Chart.yaml index a91297c6..2f4a7b4e 100644 --- a/chart/Chart.yaml +++ b/chart/Chart.yaml @@ -16,3 +16,9 @@ appVersion: 1.0.0-beta.1 maintainers: - name: EOX IT Services GmbH url: https://eox.at + +dependencies: + - name: "postgresql" + version: "9.7.2" + repository: "https://charts.bitnami.com/bitnami" + alias: database diff --git a/chart/values.yaml b/chart/values.yaml index 75b000cd..b411b1e0 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -55,6 +55,15 @@ config: REDIS_SEED_QUEUE_KEY: seed_queue REDIS_SET_KEY: registered_set +database: + persistence: + enabled: true + existingClaim: eoepca-rm-db-pvc + postgresqlUsername: dbuser + postgresqlPassword: dbpw + postgresqlDatabase: dbname + postgresqlPostgresPassword: dbpgpw + renderer: replicaCount: 1 resources: -- GitLab From cfe694ef1137e29efddff76f5dc09ac23462b220 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:25:13 +0200 Subject: [PATCH 025/162] adding initial ingress and service --- chart/templates/ingress.yaml | 54 ++++++++++++++++++++++++ chart/templates/renderer-deployment.yaml | 2 +- chart/templates/renderer-service.yaml | 17 ++++++++ chart/values.yaml | 9 ++-- 4 files changed, 77 insertions(+), 5 deletions(-) create mode 100644 chart/templates/ingress.yaml create mode 100644 chart/templates/renderer-service.yaml diff --git a/chart/templates/ingress.yaml b/chart/templates/ingress.yaml new file mode 100644 index 00000000..05de097d --- /dev/null +++ b/chart/templates/ingress.yaml @@ -0,0 +1,54 @@ +{{- $fullName := include "vs.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "vs.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + nginx.ingress.kubernetes.io/rewrite-target: /$1 + {{- end }} +spec: + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + - path: /(ows.*) + backend: + serviceName: renderer + servicePort: http + - path: /(opensearch.*) + backend: + serviceName: renderer + servicePort: http + - path: /(admin.*) + backend: + serviceName: renderer + servicePort: http + # - path: /cache/(.*) + # backend: + # serviceName: cache + # servicePort: http + # - path: /(.*) + # backend: + # serviceName: client + # servicePort: http + {{- end }} diff --git a/chart/templates/renderer-deployment.yaml b/chart/templates/renderer-deployment.yaml index d8a8f83a..59e9666d 100644 --- a/chart/templates/renderer-deployment.yaml +++ b/chart/templates/renderer-deployment.yaml @@ -87,7 +87,7 @@ spec: volumes: - configMap: items: - - key: vhr18_init-db.sh + - key: init-db.sh path: init-db.sh name: init-db name: {{ include "vs.fullname" . }}-init-db diff --git a/chart/templates/renderer-service.yaml b/chart/templates/renderer-service.yaml new file mode 100644 index 00000000..93be22e3 --- /dev/null +++ b/chart/templates/renderer-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "vs.fullname" . }}-renderer + labels: + {{- include "vs.labels" . | nindent 4 }} + app.kubernetes.io/service: renderer +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "vs.selectorLabels" . | nindent 4 }} + app.kubernetes.io/service: renderer diff --git a/chart/values.yaml b/chart/values.yaml index b411b1e0..b748774f 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -91,15 +91,16 @@ service: port: 80 ingress: - enabled: false annotations: kubernetes.io/ingress.class: nginx kubernetes.io/tls-acme: "true" nginx.ingress.kubernetes.io/proxy-read-timeout: "600" nginx.ingress.kubernetes.io/enable-cors: "true" hosts: - - host: chart-example.local - paths: [] - tls: [] + - host: vs.local + tls: + - hosts: + - vs.local + secretName: vs-secret affinity: {} -- GitLab From fa4515ce7dd97c9d990aa8da9134588c989bf31a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:31:11 +0200 Subject: [PATCH 026/162] adding dependency --- chart/Chart.lock | 6 ++++++ chart/charts/postgresql-9.7.2.tgz | Bin 0 -> 47550 bytes 2 files changed, 6 insertions(+) create mode 100644 chart/Chart.lock create mode 100644 chart/charts/postgresql-9.7.2.tgz diff --git a/chart/Chart.lock b/chart/Chart.lock new file mode 100644 index 00000000..737d729e --- /dev/null +++ b/chart/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 9.7.2 +digest: sha256:a59e13b07f7f8f203ada856c39d69e9a4d2f4810e1265d9b80d8fe661331979e +generated: "2020-10-07T14:27:02.464388398+02:00" diff --git a/chart/charts/postgresql-9.7.2.tgz b/chart/charts/postgresql-9.7.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..6189f2c85ae6627787637a101759f2ce6acefca7 GIT binary patch literal 47550 zcmV)uK$gEBiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvJciT9UI12CI`V{q3dNy{iCEI!J(X-k8Ikr3TY1`3SPI~9* z>1#tIBw<1kYyh;Qj&nczJ$NHQiliu6cI+AA%ycXgC=`l?LZMKoiYOOjhWQ`C_WlGh z(Vd}b@NeraJ3Bi&uV21Y|L*MUcroYYqPAcneSnbodYKi4Mbo>JA0qn=W9ALNvxx z917qwF7UJku<_yS;O)s^6RwGv$o6;|O%Nv>XbAX=z#%6?5)d&16#DWZ7bx@*^LfXk z(f&yK3l+1=gwvb+1b8-?T6XFR*6 z%;&vU2b`|bAFWP8u~rB4JBFixc#5E{4tPNXx}2?Zh{W(pdfA`V3wnlNq>e zc71)_O&X-72N-d@1tAp}!~_Wt6T;z|1Od=1%oy?I zb3E603rOe%u}{J=_&CC$k3)}Oz9ogxh>T-~eGn94uG^0_DvA?j$NMp3a#cWAhy-XD zBsEHq?dd0HcucrpdSy^g`f(5pu*a~F18Qj~a=}aazXxBxwVnWELG)lcvwxqWDNbuR zAbaX5K*y>43!dq>Nh>ZWLu0%jAkHP&f%Cg1M{6Xovv8UL8eu2vFg!{Z9w|(<;8ZfT zXsOy3Xw0|em=!2FWR?ugv?WwMjVLEVt^EZn9)Lh&yW)3zJR~UW?Cx~f^A|0ECr@Ay zVULVvfKux8X+XT0etm#PC=LXdU;F7^aE)gCDUgvFpg?0F9G(V9U@o3+0S-6@j)kgz zG&-fC&oIZKc&foAWaw>ge~yQkg;-$TC3M@T9^Z~RW}R_Ne7vnX;M-3khC5Ll1SA}H z^fLuXvOt1r58SSFPah(!tpqdRc8DP$#?TDtXpR-Sh8p@8Ok*x!s5G2d!SEPH0{cKh z#qe^~qLxPA%Q#gV{hBhK2hUM7*{^1 zVq7~M^(6$0vHWN=8pAb>10MqN8Ot{uW2uxe1SA|$HdPvlRLTN6)`W&50U~B0hqrr! z_iARI?wuTgkB9MiECmD!VM;>cFW_7e%dL&MGx@ku9vYX`0#^k9Sn zj@5J<2qwD~R0GgZ)V`&(k(TmJndm7NJ}EC4 z*)!D2t^B<}-mG2XtW)L~cFf8hji2pl1(~zD)VX`PlZ<#y_AHVfd*8170kk>?^^Ykv=pUIi)DJ+Q3VM7vfM*@@7L_t8WvA=1S zy1&sFrf3G&NJ|*40}{Rrt>0L5LpjbN3H7=oke3IV{mdWeEVsxEPogl0U%C3lqVbAmAig|lX)8|}+?jQ}?5LP`i zy%jFFQXEPRf{rvRGK~Bg;4g#=DG>|=Fi^WvyHhXp>{D{dCtL#MN(9O|CN(-Q-&C(F zgobKLYqQWiqnTy723k%J5o)yC0&y5W}ZnJL_AW)O0}xFD&4+%!hz8MD{(c* zP)k-h!+*p?ZabBUa?qFX*bsRI03G96A)RBz46@cmtOb9BIKQUMH&5+PDLn#oh0ioV z-hMue7L0rgN&uze^n zn<*;)wfkzD#i1Zm+|j(&xkf>EBBsHUcOUmVzwRA(jt@T_9w(A7#c*FC*n_8ZG%{PU zpBbHMts0(8%iySB} zCF$nU0j1e3R z_wC%sk6D6(4W&rL5oYSAR3k}%$Cyi%JvIZDx^J(1tt;`uWP3M4(C^ho5M7{7|B_RMUKs7h(~3A+O% zv#cmFI3TPCMW#TBg~DvlZYJdh!uO5krsyLm^Y71;0sexfQGk1z0R%&b;g$L!w{M#H zfBx`6KLD*n^q@UNtgVTZwn_ei-+ouvB)W=J_C{oUf+D*W(i~`zlSuI_v`>if{S#wc zF*{{zh9bfr0%Bu+M?`l&{E_NykBxa27X)6+1)ZujTCERq1(9o?!yJO4kRwmM4(Rya z(ESw!l2!7&YSmA@J~@LiIzzUCV{g(^+$Ww$_MT{pgMD>$Aoo5J*w;3nAcp<7@o0n@ zZ}*`6a%bn{ZTp*IOtWnwS6He#GaAeF9imvsznN<%lUP6;s%`KDE6KvQaR$3I6tbu{f`f1Zwe+$uoBSb)?5RK*KrS)E{IPb_G) zfFwT_Q$jxM`Zaat_1hbBqpir$uzP7$O zfFwqFQXU#&Ns{*L7Eo_~zg8VlcYrrAahgr$~4WjY;A;+8ymk#sF^-F!j zDxs?PFX!{es3menv*p|nTTil}6AXF_5GoT>$qU&u2hFUh+S!M@Tp)!$p&??*K5Z(P z87lV%NPtqBU`VN`^VKbg{1-Rk35SBs)Y(KwBh~dYlCEWu9cVcEfOa~&kWVi(@GhV9 z;KrQX!ju2AJtW~apV$Z3n^0&UP~dcm#e{_8Zo7!4H3nPytur|0an2E6YumN@gblfn zNPbO?${aWjIgtc+kLWgY_{ooOP1$Ea0aZtG4nja#35I#p&CVdB3gwiZWJ{;`+U_}| zMEruiSQvML9K)Fh$_SVI%I;+LVxI`GtJUg@o&-Zesf@MM-#u+DIHqGOA*F0k2Pt-| zAJFl8^DJYFQ*CG%Vl_v&UGDX2&&(H33os^jSey|GVMM@*vJlbP9W)`)v{=; zskC7hX}Ks#0nM@4Ob*3$ont!gLA&h?1PK(-aTd~iqkUbi2W>hUIn4ung|!()Q!yEe z{&_;e6U;dpW8MSI7&WIU=l0}Pwv^omB*YLgJR)BzhY`^6F$r;B)y$4Ws(F9X5Ia@R z%_CJ&F|X29Wk*usfq)DdVnpqVoK2Um)z_7dZJi#pqp>2phIN9zkZC*xL4{n|ov)bz zc7ndRjF4&Sa*^Fg*p_NWWkFfXOA7CpOo>3&VTuWxPQcie?BLdo=X9VG~~|s9OA}<3c%~#teB_IV03MkV*{na*dGO&bK3~ z|FiwXLM1fp&{0Re&`YuN;+^cTj~Su8q45i)qX|Ar_KxNI167wx39d z9f^-bICWC881@YIeX}D&;S7*37iY!pj{CYfke;HMQi{wmPZtj57}fMs_6h4&(@iY& zjt4w^{pL74)Ny`*uJ8umltNGbBSkBX1q5=jGR#6l;FBp#@su(x z``*sLDiT^BRIrj`SzmiIM3i$f3})8EkepZ>!x2{+wdx5jw|#uI%_q}K$t{qn&EyW0n|nw^a+i{bKjkrb5*MbWkn_npSfEG$5b9 zdii2=O9In#%2U36Lv_3ZIHd7-B9*PII({R# z{a$jzt@am*OM;m%YL`SKy~Ii_XH2DrNJelu@3)c+ig378E5c=>@5)ZK4@nluqLYKZ z_RN!-iY6Br-(k?s!%v>T(a4^%Ze<*e^`YZ`x{vNxQvezJB5hVBLGv zJeMQX8zc!!?$h-d?}l=_(i3S@ZW&ECVH^Zo5YoA>lt&a0uFnoQ7F*y=DCOECA%T_l zidh$6V;nt`Uuo~x!B%qf2efSk;N35WTk;kByLMO-$os4{DN9Mc*cR}|Ug|ZcuO;~f zHQS6SJ8gp3}W!&1#fiHkDttK)EW zFs*ljJ{gTLOT4D@F6=y+k_t>8iAmuZm4gS5hlxqYy7Q&8UrPo-6I_TK_?3Hz#ZzZK z8e-^wQZ!3W?d<}bV8-L2#_Q=*g+|U{zul3WN4<`nP#+ry#txie4+{{X`?x;TkKm#m!>cOLWgOs(e~Ms@K*L*%`x$UW+rANQ|wzXWcb@yai}9k}`I- z1%d{~Si!f91)fkw#LSb#PwY9`%uMBk;AE`6@{(#-M)ls-V3hxrR5-Vv$p3O2D6U&C zWINUl3jGcW1?ku)>+MIbR)VWu9HMrHSfGwMVYpR?vM2j-IuXNo8YNyiEl_&NIo>#{s>L0r`BI@tWS28F$E7()xpmdlV2s?iA_LUN#iBvQv z%SZ0Q&kf6_2i-pHBt~KT&bqn7Fy^x%{gOU64!Aw|?Ws?nZo$)}?bF{AJ*A*mbv&+@ zq;$VCKgm8h-ugTPPrp(A7?#rYfE9tsLI6&D>>-vIGb8FdM9er0s3*4m94%)wX2x|q zOgz3Fa;EQdulhya^QMB_N~T?b)17>i?MHtiLv^*|gxzQ6Qj-$q2J!TBd~k2P6>jPE zLW9h81>-%eclc(9sRe0nr<>i#7s%CtTnBPuRjmz;RBfc{eM;3rd39qhbd-omeb-}7 zO6tc8g=C4`(lcT`GSG$9h`@D-KqZ@QApz}88f9upy(L_Ws`_TeJ%Z-!DUDGl@Ux@Am`hIfoAq-kqC`sI%6 z)UB2R?!t#Kn88sfw`?2)lcGrO;6dBOjcLtv6Gg$St8Y&k z!+~nDrEIKnjyVS{9%XWWsG*rtSta!xCvr1Xvu{i1D$Dq&D(jJCkVK=Sp}|6O$d+4I zI}v$Oif0ec7@aEfv?h}Vvyn#@d@Q%!)>)j1&D0Pb1oZmwi?;k))>Kf)2=Eul;zV7G zQ&;!6T@NJk%HkA`9dpaqZ-!)sE`6#Ff{*~jaB>gO{lHIodM_~DIjbg9B)o~Wc*>nF zBS;$^XowA1MQwG5pHg3chAm}|U>JFt1P5=85$$a(v|9z4V!j2}*!V-KI>xI(e=wrF zqo_SC)~L1KI@WDPO~DZ3nRz%8YefVwBKK-2s$;%T77Y0CS@pRL}_cM43fV zz!k#w3kB+c0{dNOH8{+y1m)i{5!j02W_?ZtHKWQ2nkk9%J^sN_vND^^Pg0x2nr5xfM)LTq*_7TBg29l)AiW$qFYg8$6>LKtJ|El9rzodZ z5%uCYL%oC%bfYuue&w{$S$2@7l{&UR9?YME3d8PpHIkLg`cmlHsOmZjf{i1hkA$Cc z-3y5(>PiV#7D^9uU`V%^AT0>BczLR9fx6y6LD*MKd1@b49a@KV+0wXWDRGgwS}Bm2 z2{Ixc5=xnLf7*)^+CZT|?x(Mnr<+mGWUHUe&(iw8;90)SFL+kmY_F^*WyCfIcz(fp zm%4+hud+QD94A6~IJ0_;vDr@nxdT?ENX(K_fIc{<=$U<>y~wEqe-EY_ zO1g!!emzn!nt%nM@wRR)fOCT7^d$rhGf4 zbjPlhPqY}bpIYDj%lP0$nZYejZHLxRlTZ`qN-2?=+CO40?0`A2IFK4jq(_H*6bU`w z1l4}C%Ec#%>TrTSW8jjzwOcwD3=yMfDNt4)w!Zf1oU~k&Mu?F0d-j*qEl_|ZFTRh* z*ttY`jK*mtrAx3LMB@v`h5aHxLZ- zdo!HL_L2@iXlDNQtu1R$Xv{YFW;cg_Je?xBNpyg@=qwM|1TqM4vcq37Vv8MkCy}8^ z?3SJGPuZ|h&z`-S3xbjhz64Dulzb?Z10^(F2Poq)Xl6&Xn7d{)#yrG9@}(~9mwF;W zhT~3%ukB3hToKek_J+7r6|{Lqb$F7lj1ui=eBmc|AN3=EKVmGoqdho0KHNVCzw0Aq zc!IrwBKsEX?+p&&*Y}5~5`gh6?oJR-fL$c_fH#unTkv%M!|Cba{`u2QIL|e95V_#w zPp8=?93Br2VFwOR4zeBXJx1<8+H z`NI1I2j#WYJV#~$ZAktOEJ=GQ*ndwY1?&b`dYpth@qT727?4$?7}b@OiTi=>xHvd#72`Sw{+;yJYM~7lGWSN!BWo7z zzq>g6-~NZQ^TV@?gQLOT+vCHFgTtTqJ|3T6oE)B?9qkV+ne6RWsin1BIjCxjV|*YA zqOGh!#LP!BfrISnJLlHS!Ku~{wXt6cArk7{ ztvMQ0-ilCj)7Aa@HL(YD6N|Qd!LPioy&|q}2y0)yZRO18ob9x}e(eAmLHCo6knL=@ ztcx#v`?ds5YHeH|F>|1k#S4e3bBm)~CpV;$x`F>l5S|ZJlOosN+=LCv3hL$q_rQh@ z=A0c_%<*9+AWR#&o0|%ya|&Z~k0QC@DHrv$Z>fryuc;L}=zkcTzdJh|TBmMU zaj)yo&0^k5)}`cZtZnZUwi7y9Q?t5P_w8Fo;GKRrIJ`LO=fs?HD6Bb$v%-rAJmtUb z{NCjPiI{hh?=z{hsAuNKxAx{73jGgf=Q$)+>7GZ}Q>>@@vyM;S+R1H%nqPj?Y8zx! zyewOxEURw>M_#vUi1DfTU$JF}_qq%oCE14~cB{@Yi z5a=@o1S5P6Qxe7k^Wy8VM}6z4Vsle;Th@T~tMZpIp@~GSXLb*sW>)GeuOL8% z46*y{b$6$`)7^bQAGy8?liLaw5a|j9#76>aY-G#MTy^a++Py|BB;lBMnZD|Ej>aiB zX{9)6`-3I^Ck>y_@Q^XeIP~7k0lrG=@a|QfD#>T$ZP@UMC!o#Ep0e<(JG{0jdr)TY zHvF(zJ}?zjhIiv=%#e@M4!d|7iCNO^RcL10c50PE``^U`2N7nx zE24Fz0;{(FJ%9cD2+#o^)$VFzs6(q5>!k{r9AR&>nlh;bvjcM0lYGvf zq)ustS`?FOjs5Y18dmR3{g2|{nW!8ZN=8>mam_qk8o`K>P>i7c7vA}cT(UCIbid26 zN%`N8k$dzN!vZE+{j>g%C;+^>Ev_VImjas(hoFfBr_)GsQTxB%>~>#tcDCR@ zce}4UJ8kIhqeus*C75?50~#pZcSKmkB)qmsp-V%)eYHEp0`0al`-xmn|IgALq;ZY9 zpMO$*1Xs3;Qlgp}s85}e@Q^0`At0_prJ1>+YbkqKHDy)BcBx2lr-uI9j^jpo*2zsz z`#;*yzNpE1WqcyJ1he_{j>-kQY5>O0oXkwFokE`-Cf{uq|94-VkGy8b$oa2g(#@{Q@iRUxj{&%f`^+ZBEUTw z;jPv%7GQw?Rq?{J?(Pow6!Y+@u$=)BTfiw?<0J+%nMQ#L?I*=68Fdt22XsulZfh^# z)Ls*MD%7n31e}E9K(W3R;sN?|X1$S(Yo*F#6&e?n^qV=N%_JyI&I1cxcC$%JO;uYx zWzX%u@Sft(s@D0Bt3F)E={}K!)tzLSYB5xI4!b?v3VJP(>n5vkgI}guHmc^5{nIfS z6f97N)CKJd&PAP(uhc$6$3lBTVUv8Hb$f8zG8FoIK{P?9@f3DD zq+RLQD-4sBWT?Y)wP@mgswL^;G*y`~m*qFrXdz|t2(GxgFtK1QarMf|VH*p)3Z`0X z$Zms$!?pJPC{ufhq1sy!Nj9abVJFV!%gzYL>b=yANZKuy<(aDG^JN}losFJR;8U$# z=VwjQDVy+gQ5piWl8*BMBkL;qB`udy{mWr2+zga8ZMFx^_Tam34~lo%_Ihv49k;2z za6%>~vUYMkF8v@GAWO~7e9O`qnRKu7n3wh4Ow49te!q$NF7E@Y4|S`JcCHs{Ej1&X zmJ$kw)rJib1@(cLliVVeBUiJSjJf_6Kre-{@a((3aAdI>#dQ+CCe{hdv#3>nngW+^ z=L_HjT+#Z7^1K3dR=d^&SwznKtw>OJx zrP*@Yn+1ElY#zPj{d{i51zf)RWH$FZ$)CC(o4#!s4$UTBE9T7N9Z6hkS5Dp<_&HS@o%NV%FxK8slhQZgb+8gw1 z>I~|tu8wA=w}nm!l9G*MQH?U|Pqh4~3L7pQPZmZw!pp;|Ikd$T&+oDt>VGfl7mDm$ zBnf+8X~CI?8_Ho{x6pF112=ZM7fS5ZVBR&i_3#($K{UP~T!Nh$hx3x1MRFzd2L6bt zu-@lwe<)wPDQW0*s@>3&n}?R(B1lpcWu9fD?J0+U9>|AfU5SA24oQuO@| zIwRPoktj&rvn{64b~n-6un)h(&5dbNP(53<-bTgMXtF7=DosgF9-l|7xKyYcol3K% zJN`L~qLf+q59PpC(QGr*E^nlo&mQ*o_TSs>xxUhgS{F`%8MSgWmTM}FsP4gG8X3ME za3!(IAk0&2HM&((Z&?~HIbN5Xr6jJhC@)LuTNC;I*|PSyDhYQ>KVv7C*8;P;Q?Z_p z@qg}icV8^!`kT-W+9-;wfAO;_=j^0r9oK7#8VRt@z(r@iB&gT3>k52wAq zhw8w}Hn~w>yaqR!n|vmcFqeydKN&Z4;AjN$D|KTQ05KluVuDpjBJgSWRG9U9f=y~%U|oD>61>q)75m_tvdlldn^Mk=$8zku121Q@KkZsebCa2igN2+E)G)|q9PTCEo)Ozm#4GhAJoPg>cxjSHLcyU{ezyv~)V{765WWEQnXt4t%+ z19p>REI()`kH+1Ndw*}4kGz-t%=K}quw5;O?%8ooRL_nJk0})bX(Eo>4y6E6(Iorc z7wsQtDUAP+cmZ^0XnOky5Y_P?cAo9LdXUQ^xe+k@xLE%~clzI{GeAC%#Gmv}c08XDL{_q*kwrtK5$4Ocds}^__Yf6HF z8{i@Oj6Hp8<&B$5rRdl(UF{Z6k_x)H^_HU9yi=1VR|-&*s;WiO&5OB_*}uNG)N0DQ zO5ysSb2;qXQXg2b{_j42_By-%Kihr&qFMj%r8xWXG6g_>{jR_LWBKBK==iqg7Vtv1 z*UdXzzKh*u|Ap6a<+i)+%B8B}Xy@dcYyOFXPgt(Ub=<2e|8m-3l^$66dG%*i+ToCd zh|LZXz0#<05fYOv_(5mVO!c_0UsWm?{T{x3Q{U+a+dUTM#SIK!y}+U8_~4dkbc+?* zI(+(VDMh!F)pRplYv2g_H#7|te^h{ZxJy`}{I?lk*K`iBNdJ5Nawn(%y?*_2w~_z% zQ3}rE?Ujza)4P41$pE}ok?q`yGh*alOH5lTX$sqGfNJt-q8VXR`9X>$Y1#L$od5jF zTgL`)q5k(QKmT97eEqVS|MyXH(<49k%VzgL2OL{n9ZM6I-+qeclJ?h|@x|TU%QUy0 zmrQ3H%*`2A9vqLbCxdVJflTH(CpBbYgKX-g&C<$lPM@Q`k=U7MmBMr)!&62 z2f%26d!QqdKX4VVvJ}eyY}E2wuK`U6LX0XU+nSGue%5^Jw?e}?KVdfTjprv-tSr>!DbKID#d0idq1pv z-h7Dy;t`P~P2(27>@~9_)mn=Fyp~@ZbYg+neU|Mer+TbPv{e{u_r?5;MZI+Lz$54b9FrHEY9`RcIJxbyFKYt72F6}?NFJI;D|2w-c8vD<^l>8;# z^ny`t>z55uP<2bDo9YXFDP(j-qcb!M{;~@`BUdEAW9;`}gaR&QroNw&?2Mjz*4Fma zKGD$+lb^{QWub5J><5TUleg+F-~nN2bw>YzJ%N4sWJ0+xdS8lxe0bE~&pzlM9i$If z9PaUt9GlgJ#Zu@$J&CzElW$IGct)whkmF+##$Ph^RGqzWrryVq35$S&cZ|jnF9xa6 zSH}{`;?RL9345^HN>{fpJ$Uu<<@1*l)&-7XFzl@5Qs`{P$kU3ikh$JI*9`l$Z*qG$evD5{|nbWtb{yxSbdf z`xzjsFAH;rbR}4ZPX6MSqj?twky_VUQwK5R`$Vn{DA4+I+S)l@L)lkyHl#3;V- zn-eXd{kv9CF{d%}uzH){nh|WPU12scwV z$ar$>c^-{J(Xz)9s^=vC_ku9wkh%!)47jeF|1h`ba&w3$JF{jPx#vzr(5oxud6g7zplvFZd)HB^hb;nr_TaQTt!A_6UFb3 zg1SjA*o5Nk%}vOKP3YJ^J2op<{)lHT52uq|xLfGBKj*!bcDAsOTA)j^3Og3aOs`Iz z#TXQ)QLZ&mJBLccGG-o1#rnebu$jkMR>>k;-gq%?ivu8)$bYqnBeRI#vHgGN)yv(y z{r~yP=KlY^6xS`ZM2Aa)?q#lU6)1XD3q(fAbQg--Oa3L7n#Z(I+`T$nHUG^K&Rx&{ zXU|^0oIC&9ZS24IQdT(sGu&}vxMQ{Rzd;5_vFf;J*I6{3OOUKS{#&Z;n$HRAj-dFQ zu+Bw-QV1ouJj#>B#9s!7zPkLG92Q1J_Wby^R4HcG3%kB9U#xi z6w_FwjWdtyAXEY;gH?fBYT_6=e^gLx$jM%{Sf`tEVyB{gis!>N+<)$})>M?w|uxWl(4=YS;A1R~*@1!{R&VhoT^xhER6D zKOYrw#rucf@%CZKxKR;`wVaUb+H2OD(`7D#PB8KV%(?QPRLsXS>zK=t3ePiB>uy(> zqN@saIHoU$fitHj^|qn11eseFOEd9L?%fI()shb!QUAD_w~L&hiUAeer_D`-S{*1I z#&A!8GQ_YCXf`xKKJL?^ zyFCSMv!tr0Gn)B38j+BQne#o&lk%>UHmi3lXn0e+rC7}ZFjv){C zF(c~20S$c@m#S(RSyL0>Lb@0SoP8~lv-WAlzu5|U+eD{Cl!1VDlA_?o(y~wvEJm%! zwC7^xzCT^>LGVH>ofNs6LsXc!qmYPwovIQuo;9YZwOrkbE51)U|W=HWfL;@0rm2wqGYMI9l5qSH}{luEMMPBa`$GI zy9A6Bvid$yX8Kj-|JBvA2OYM|>9EEhE?diSlPj>9q>Y@*i;M43f=wNqy(-y(?I8)b z`6TzW<9*3JxhcrHSduhxZnEau;6Gpk1RV%Q!ZB=AkTox$lDj&vxe09)3)-IV#hcLU z5H5)io%ph+{(T2G;Kf2EzJ)e)M$azY@982xl~SOuV}TW*U!2=gcj-X%>?|9Uj^Nw3 zo~sVz>X{oqI@Rw=h~~e)EYr_EVI~dlBADB9UP0BdyQ-ZD$*uw-ZPr9u1@ln#jodnFz%PtR5#3xj= zGmitx#ea-w9I93O@84z80(?Pi%*{;doGqNcwddv>VP#YEKHso}Rr6cKIq6t7s(F#;jH*y5*2ADeAlkkey6(6c7%T8d zq-P-@$Mvcvyei>PJ=l8ol%hSavDZa;3rbPlytVCC$V7}#HK}aw^R)ils|-6XY(Ce& zH@AaceATnistSvDt2Otgu3>R*E1KFC3#fO$d(gQPhmy6ha8fOn_hs;^tx~lx$Kh3e z=d8c@+oSW-y_2JhgTuEU-{oebIt(!%mxYMUOn4?}t4Is&+&A;_Fdi3M4$}Vm9|q^| z&JG9vbA0jX!|}(H!;6EXv*Lc+H3W8hQ78QmXXh8EA5Y#MR`jwUj8?l!h}K$462#se z?49qGl6l_8_y7rXKv)@7OXPf>4i{&K{o|v3mB0Ps2~ z%OV7S&O~FgMdS7ho|&sn`BE*{b?eh2$!^PMJnJoT_Fjo6_m4jg&JWKn_WJ#c)4h|D zk5Y0%iK681>~dGq*~y;j>-~qpd4-T$X5}mIWTD6@_5arbr+P9d58`DnC1lLr6_*`~ z(26-e{6e@O;W)jbvbpA|n*Oogc{+FdV#P^1hu;I9p>t!dyERz6V_5pLuK8=;@*_Ti zZ+8oc`aj1Pho^gQj}I@-j|YoYxf$kdXos|2xF4*yBG=eKI@p~b4=(y=hd&>lT?`J- zJ{_K2>>u^tAD*p@Y{c+LYRl{jvwadxF1ZjzpdU) zvEi!VQ{>Xk*CfH-ikR({kf6Tt!ObaO6WO!l6|p@#UJliI6YluKJEc_AQeaT*6VVOm z_&w!94Z1$F%8vFwoSq);OGUAK#?1A#pN11&vb%$$!Adthn)KEosO zr6!ukN2iBMtQ`GseH@)$mfKpDp?yxK_)i+vrS19A$>IP1!|4({lXS2Ke53K6{P&oS zYoObIxA*bj=v<;*6I%!T?e?wN-Y@p|&i7WqVjl?;Cc4;pzFs$$>CtI z_wKMR|LZ{3CnP+Q>x6zqLt0ACoB&br>$$pC-e(I6gW# zD&IHO?|n^!I~dAc-tt5HI5<3$3)O9gR^0cR26pa6zhE4pfLvjIGN!#d;0eUbeSA5WJV%6ymW5_RLr5S`&Ey~00} zK$v5!1%v6od;fOt;_UF`!>2>3P@h-r!fN%o%xH3X1za437j@EpawsJSB>m+QU=+|# zeuofq-e+`Jasr#FlEoH(NnPnv>gZ+80;d5=%pe+H z5Y902XVCdrW^OFDzbiiye<)wPDQV~+p}o)M9DiK1K;`}vI1l8*vaT}wY+3m;o-L@G zY?f2bYeQ!OyU$*Cce*>>UE@DkpK}~WF7eP>1KDpyMfuI{kdkfJA8$>RoELB=8TJ7V z(5&dvKz7C!)XoEpO79fCB7Y({>_dCcys|bj z5{}{gcmOVJAUthxJ;9->K{zDt#d$M>ZK)l<7JPw{Vc4v9J@{IOaJBTc5?w9nDnqj= z_DMYL!3myHHp`Ne{E5{GMh|x1k(zw&M&~Th>GJVAwS#_9y`lkS6~9$!mtS*uzVf0) zikF2y$#fn^J`#8!7!r6q(^Q{Jm7lHTWXexXo%j!EpJ5#ayIs{Vp&6q=K*I4yRiy`E z90V;WTsbpwo(nYah2Kecd6njKJh$A=+DM;JKfmN_bP5NSHpwEV1KJgx z85A&gdYL1$Z~i03Jij&Nf--v{rEs4^{wzESD=~x`aOze~doFw3*JT3aEsFnk_xWF5 zy?(ZnkN^7Wbrb*Xe#*T>b}IusMO;%)b#uhaJv zTTXwN#}QmE!L?9xFf5h{GB>Z-EfKb=1p30rbIbSl$Rp4h+SCX^SEOSXwO%QgVC*kLlceeaYdtBjHYur%`iz5kFJSF*Tkc1;?X$<@g^SK zq7IsPbWJ?Ev^4SPns{_gJh~z&sNLfBa~L#H?V6}|4vc@3@qj6=<7IZiP5ekc_Ij=*vrV2m5D7{qsR`pL-$J z4%Sli~SELCr9TML1)WS5YF{o zQw5VkD}#ago{LoyxBD=j4pIz~REW0>!+Vz@Ppdz36E(Dn8k#M488vi{5KAvicfS}l zp-JyBG-=hzVO0#1Il3IYEoGa{81WQA|9v|%W z7aKh0!>I;7ik1xinrX5aL5Z1(`?_%5Q=qwu>slAG+_2Px8&zyfO7Y%*e^_I^)_8jp zT)aN#i6??Ov6>VDr6GOWyDRM*60+3`oT&*{88EYybRU1N-2;zDEA;SoZ*X{Va9Xbm zDIE?@YlA*IJ*W?wg#J8eD+{&uHI2kn&~UQ)=6Wdz72d=wZ(^1=G0U5nB=cYzx{h^a=hKjW)idgVXnpv;X)* zeSi0BkpFBKOdmsV?K-@AfAR9&`TzH4 zo25j=LiBQ>T~nknH-EJh-2zS=dz*OUH>Uny&ac&xJ=*?`_ynZEL-Q`qu0E?jpdw--SM z2@gTI_8#-rMM#y3OJP2e!aEXz3vtIJSi*b$%K82jo zZbIsuMJH822bP7-ZuG-U-tgr_mgZ^R(rPba6;&k*FY3t170k)&0!9WI_nzQm=?Y6( z?>P>uQBzzh_zB~0Obq>eSqWX$Zdv7S;_U~4HYsCYX2fW4jl~4N2gJKDA>Ole3D@l`BgCmPj)&8G8E{0 zoJqR*4~wiB(^@lQ^fy?*WI2itt!i<<64rK-S*+ur2&f(VZLDs3JQ~q|?>CysevQ0S z+J22x>Sj$Tnn`PsBmq2zdmaxQb+T<7=s`E!B)iPPyQYm=2?vz~dCpo69Bsd@`l#R? zXaH&Do%P6cZi2!@?88FZHb*;cRPZ$2;uc^1m@%zi$JE7lxrPU|q_5XTuiqd4WyLnM0sgDvQm-2DC zD9#sj+)lH2K9tV@=xQEJFSBY>!t#0&J8p$35(&*1F$YW~LB9(7u{+@`u_q(_Q(i1- zm68rh)^eWcrzsyMN^T&&NY`sF)y#37gkArba!vHn6lcLGb(A%Rp!y-;KHJ!&G~M7P zKWV-P(PCMV2xJG82#GeiJ!ppwwn=3Wq|N&+7ySU8lnoQ{BuA>E9fvdNUR!Q3-lefx zia%IWQ@SUxCNp{4&Q#%7#W?k2&_4#EGQhO>=e6EAb7szCLJ!R%J)~cCyDq{LFSQ#w z?{=7L+PUxLnJ&VY+rl-@VvXV@&f*nvh3mIgW)4O=;!yb6iQgtPLWwb+Qt0yf2*{`1 z@!{1(_Sf^rqHW>#rnCo$4;h##F{GfNpU-7EOSI%pl06*q9bX~S(dH5=XD$)~PwWC1 zBwwH4k9~gxK?i>55$#@kf3UXx@tjSMSfQRrFd?3$uXtQ8OYWyfi?8q1i~l(OKjBrS zBTz)r1qFmQY+Mi_FhK>eZGl;Mw#%LQuOHt1?v>oXjI=-13%Ab@zKz$JL$dw zes`7j+~BMtTgRLrhltB>^%J#)OL3dTZyRs*G$o4XBi}8LV0^@4=99Z8JMk^;$c5j% zf6QGX;{G+)jGXWjjA!eWaNd7k*kA7))Nwy9Z;Bs&_}zZ2-fu3qy?$RjMlDZ$^u*nP z$q>!*UQK$K#Eb- z5&2K21dW{!$hqXjwmyT76Y8Be59Hhx5LV!8%Z8H_7?dfeW(BJ(zmF9!RTL<~Sg>jG zErHv*wh=@#SVbMd@*XH-vAywt~_a>A9)ahEj=-#hfuCbE?)li@exRO+qUuFPA z9V%FOA%TkgYKk)2bmZQun2bd#_I(P2KLvNyX|TFpTL9j^^IzlMXIB3d0zb$J zj4+G>+8|cfx4yD@&QRJdnuNmJbjSw52JC?BDOslY{mZ+t5?ui}={noW$E8`>c~~B_ zek9?^OUt}=am7Jp^V}&^wgOo!#Um0r?BQKbE|3V=3#%8hzbkk2oGRHw2*T0ANa?UX zukS#R94BnvO}z9QRy>~!d0WZ08lNSQ4hx(KA*A;0l7(x?C=f6-8YtG_B^uY#^Dxsu z8jkhY5o~Mcy7+v_Qndm2jhx=1g)cFN(6PB`_WkedB!DN0U*N9mC}6q1M! zi#D}Q$R3&1mj-oKGm6q;7B~!T!6FkVu~!K*?BnXi0}f(-*Ao$8EL<|JOiLUc{7|of`5z zUw3ZKLPQu324O%$;Cuc{86n*144LeLOg2NYL^yQVn6hIe^e@_73jnowlkJ>uzFb=X zXq6q61ijsOA^jb|(pRJ2=e(p*N3+>inZUm7a-`E@v$q)9p^yY7XP0R=aEg8c`zfaa z0a9u|m~<5;-JxEKga^eOwtFX0!Qm#tBpuz?& zK5hRP*6TpRd->!#9?y+HfKaCLjpimY?#82FC;OYHALOTS8xcBvZIsF!7@Dn!V?XGW z)XTBmi4M>sc5fiRbEdJ~?Hxl*&!tJdQl;`;`NWka@FO->CHW-U_h}LD4k_H@J{wQi zvJ#b3I|-b@Au)w!c71@-bJ)MGU#HdWDo?5=Lmj+xS+j~bAf?+?eDFWygFF!z@UCg->8I+EzD$?6bhSXUi@o@%oY#uc*_i}d59X5Swoq*S| z^b4ZTuVhpV^&uIL$b-cy^Y=+UETxL8+vq*)9Oy;yKB$Wm*ynymdWY94A()@_>EBnawgsYnyA5JI0mGy zhc{()BI}_uR54v?+lBXZd&^i;?_GQ$ES9&1wN1Q(iUY|9$7J7G0V=6{)dcJv3Vb@? zrQs6jP%b_PF}=`%IfH`cXXAp0Krsm_AWinJ!RGIrnRq%$d%1uv|6osU)E%@BZsO1$ zcKBP*xFxJPF}&$}tVMg!5NF+rbIy7wnA}tshw!vEVlBl;P^zvNVa5_ zJDmBl69r(;PKUMgmMiRuZyT^s<5CdK9tm#4!CmG>!(rd%1bg-GB5A@#4gMNptB|IvuNlK81xhgj zTY&m+WIIDlLM`6e08Oh<)$dvNa1%P*XCUz_rJQ29u>Ktn7-A;EmLLQ0T505kgu=bdsh4D9pt4&GAOK>*qKAwS_XRza~ zwtQsic1u_|fdAvN$4^*@kvSUt>$BziE5?ge$uC-hi1GdNdE2jNN^2weaQtm04B)D2 z_U#8M?jz7W!+5L&ix5Mbcu}~_0$$d^EG664)4=x>0dwVy{#-^97kcX)o&oQ8a1*05 zz=IRIqCBCgOyH@VM+jK^?!wu`?1 ze#!{h3jP;A?42uDT13=v_5;?wqCA*Wq&NAk71rxNy&^mMfTx|r&@}CaC@S<95K%=& zCtrOQ5@5no0TKL&fC@hbCpY(L*t zd!T$%U$+!9yf7RfG+~w_dw`m1CHr7oRx_%y^L@3*n-M53Mgkd&%jl8RS6(4U)qaz( zuZUL$&wE#^aAL^cD7dcyg%X>kdX=Ay+nPO1pN-f?#z6H{etu-_sl!AixSZ`;){Z(D zqn{x#Z2O5l!`yemUC!smOS}aZE*p28o)d{;elmbcVhoxaEtZ}U94%?mrqhm}!GG+j za>oiyq=ZJv4?CJc9c6%Sr@pXv`2)@y4P97CF*!M9>Nje?fUt?n{NJUPTqsD|Z=o?0 zEZoPU4uXz2VT}7_9cqv?AL>MulZULkb97(z0#c2(+=SpzN`gI3A43mOHv^VhYxbxW zPvC0Li1y|T)4@&cM0B^%jv|7JHmp1uZYFf5gVr+BFr)L8T|nT3?P4&Xj1zru9v_hq0o)TY2nZQJ|@rrcy*k5I> z_IL%-yWcD%vVt>&6I2)uZ`%CT4A6Jd|JS$nasLyXh@SMYkc=;P9=A z$(h|aDV1A4Ur#}v&d>2Wd4U*SO^;Y6G{=MT?VmOv^Spr#rceJW6(_0TRygc2!UARL zb=%*<^Qkaep?B|J#xqxsZ=!nh<9x=ji|0nvDs~FteL!Wj7fZu~1vF7=R-HWlGGY48 zG!Q&t_YfA~1dcqEku04m7nyrAVHeaGho>l-k3Z97`WOs=sV|Q}Ua4>DAX(DW_&}fz z)@_?{=8f|I5)Q>0TWz!xP!E(?4(wG6f{&9cEgNtMPG6%24~`P+2n$P(|H>4v~fgWe|@>e@uRESMg89vipCz#QsXz?_YaY6yB=rDH|PTkvKGm>;f zC2Kfh^T}THZsUBuiqXd&Pq#rwgP#eh9mcsnIGD!bIRHX=wT?^9%sXA+5SbCh_bTH> zIx!Ei(yvW#3MfGb*SK^LvmU;uxLkJ*ClPZED0_zZspWeeaa?oM=^Jb+vWoyi#r(Sf zGZ=_ytems1bb!8!1#IRW(zw>jNK{+iJiswTc+w;HpJ7PHF8oSz=@^xWftCN$=f)5Zv8Z-K$G9Wb7X8*V!1=@*gR(Jfw?_%k2>$KZCC3b zn>BQLo7@CuF1cd%F97^tl_GB+0XjfTgRqI+`k{5)6Zm7cw?l@Usz;0gx5GMdNM&n~ zXWdHrCYTTWXvrWTe>YwgZIGI@K{5jcmU;&WZ-Ehd^_s-A$6-+Z4`k@D+BJa7c#S>} z_5uT$81w?h1h*_AGiM(r>v3YzRdEj#lJOIC48-N+aKoSc95~2RsYiuoI{AR0*~P1tvX5kX(%XSBw+kUIZ391M2@6S|8+hIe=# zF_L;lg%Nl>q^5dtYY1m!I~d1JPZN>MJKk}e)nh={O85OwEimv8a4+hiX)ximZ{#wz z@NZ=25kL0mNB;?&)lxBQ!ZHb|Ueb#MXy7^5h6AtJdop z;2Z)sa#5ZQ^hWdB(-HU&6htQ2`d&PUcJk3wn*G`2Yc<=QxnNDcv)b(W{s#GKl`HH; z&1Mbw+Y+8&M^GT=l*g~R;bp8&UczTXe^4l7ZlqZUJ*LDvw_#~W`VdB7@rsX{Q&)+O z5OhO83p=M|!>%o0qIR3!uu#NH2P>CofbZx3WPmC)VC{&s;YTTVaf(5Z5z?gE}<0ddcaaa&@^BJ$(@;`jAj!d&cupo>ZPRb~EKE{*q4wz@TAl8yQD1WgY(G|yW z^!ef$sAYqZZx_PHl%ptq3=&%);Ht=2`{M13Zx5PzjGFMynK6Hg1i43InlZaLX6ykO z>yW{HDVCKBc{YUlHuqyHpXnqy?i3F$TdnZj&^~7qewlZSK#vawqxPaQ(~QuLx!9Kt zwR|PiKez!a(DFyEeoylrrC}aCGXm8>_d*OkTi7F07Rq$-bj}m8D*2_|y8U8T8qhn& zW$pC+Wm1~r;C$t`rjH(1;+@vu`@|&K{sbygGSnvX{-2x{D9n7aUYZZAu(@E#x*b)- zLN-0mLc<^KD^V)g@y($FZFDBpkR^qW{3gPMba+BdstF54Abr-you|r(z{MB`(Wk$T zqRbV`35(LOA~cCW6gcFr@6EsIm@i0yVxDbJHx0AtN<-KumU(A~HZ!4VnRh!AYnTiN z9_ja}XKCB_i5HEf6#-Stj5GUm|3yXEVqdkcMRMRIEp(OBp!$LL)`>daU2GD)Ta;JJJ#5|{WK~4 zxp8jz8=I>>Tamno&lckhfYQn|cYg?^OzVv``@U>kYc&jcJUqSJsY~Q=62ILrZ$xp)@yKLF+yuZ66S1<~5*?+4f~D?JK=K!Cc%QL+E4)BlZK>^E z>7p>FOU@iGHTZ3;F7Efbk{k~FJx{lz_=U2MEaMCx{65c8gWS{Z;0OV=PCYa4)oZsg z#)Qyn(?s3O85Y|i!GzXosajqP?g}i3=TwXr56FL>&#rW53|hnv7ME^eO=+oQp7)dOYbu6m6HmTAB7G?}15TLm z(ztE-iFk$68Egy-_kF`u?gYNKmN_FBREJ8&yDG!n5&b1p5@G@M){@3u$E{EpN5Hj5 zoe7bjM|fdr+9rnhX_tTX1C8nOl$N@P3G&z$upJ zH5+)_3WY!B`DhS(DnGVvO>8k7;70sgmF8o~iA#TOvtmCj{NGe+O@~f+{dXVx37kv5 z$831JL*TVJP#UWZk3}c;&Jds-4`R&*{JY9Fv+mY5$w0M^OnDBE`4Ahy_Ms#Ves?Eai5&=K-N`O;crd%bQqH%uRB$Of3e^uVS5vGg2f zwl~FbNSxLrl7g8oD_J&8xW#m^%V!$=272*tHg~>Am0IVO6nb0df?l>vAMe1h5t_Gx-S@`I!Ui5S$LSrSgP3=@AKSHQny2Xq5LoAodu zxrtV<_+sFHtH)*-uW=9&wpyu=ivz~ z<&g#mQ(2QtiY3cF?uP8;mGJy=1noFCB@`@4A1;XYOYYD(sf((b2^gLV{k%=Vb@%81 znzIOzg|B{(Y^}Ss*pSBTyND2sxRVh#h+KK)#>wmE^M!5P+wkXIl^H{o@gFi0T|)isH75p+D;S@|WO&WB zpiXje9_*P2IyDESY4QR83I#i55IJy#9D^uYgmf~hAsj#j{LwCut>Z)fO~L=XUxX*g zZ(uPT#*>Gg#EVg6?Hddau#o^P?s7(SzkT$QHm@k5 z=On{M6A9}cPJ?Rj`yDw6zfB#L;#gxnyhg~T0Ti%(w(3uDLb^AP_5K~7*n_`03CAK> zLC4F>g-LC-?-9egjs6a0zxdo{ac<7@U^jILb)lc}tk%1hxfe);EBQ4V$OYZVl!bKm z$IB|=>z?P?&As@alo@6laYeSFJ)=-^lq}|j)CrirnNCeeeeGLYuCqO@v`1aRjjymL zwk(SfdT|CNHf>sPm%8Kon&OSN*A)eJu~=?OAYiLCb()t0>*($E=nw83zZPDUy`;~G zti7g+@H~K_5F0UDB9w%jK{UEgWh6QjIce?%p{Dq;_O)$!U?LA$H(8?;4P#@fqA*^( zMFr3Fe1%T`5%~0kc)tdZ3&?|#e^p6mYGyVb$sJZ|Ezw)>o$~lDe5}-p=Ss}pV8@u_ zEyNe#Dt*bk#23*X%9Mu=_4n_8 zBQg+}(RNk5wQa`}FscuFL)bJT3^al+7a_<(uf`uKiW#@X8b$caROj+PzGj~UN&7~W zRDKqS$MCI{JhHD8R#qh(TX|fe`@mpdlEfYTzDU+I8~V*nq1Fc8c9h+7cdVy*4D;rV zbFMQ~#CH9G&i6ddr9Nv$aIRxNxeQ31PQ=S97l@UeMMoX7|Mb?KfnST9gLYC&k=ip3 z)Y0+#`BnsjZTZo;)f=|mJgk{IYFnwgBppf;KV7LN!t$$8jcAXU@Q|vkOqnx!mDEu;%XX4dPVK8h4t^KnQe6qo`7y57 z)$-D-PwHIK%NbkFu~DSlcmExNoYkD-HDjrsT~k&%Bfj31N0_1ed)mEYer`zYOi zl#o++DZz=+vWelQ))v1K#&ecoB&n8P|67%KajmQ3lO27TrIxi^KD|+Ac(bDD4x$MBLia?@?yT_prvLfupneiYjV*gEP;CDpOiIo`h zxYohfUncQsS-3O*{D7Y6%0tw^CJ3TBr#^8?FL9O{j2GY~f#_-MWeX!;=D`L1PHG5O z96Qo(tj;*(e|~iaEQZ#5o3Uag1(!JYqe*8;IQX^RK3ikbB9V0c_Erj6HUoH+jt1@Tf*`;x!EiyMPd^+>5 z)^q11Suxwc$q)&2?hg8b=wDk#4HbU*#74B=4O<+y&>fGs7S`7b#_F^fa~?jJ--wPf zkCT>1+QxHaI*`_S9XKyJMtQz3)&*wJX;%mcmlGLCT zv|&Q`sIXwPraJFMinib}3O>q6pN)nL*B$5|;wdBz*9OhD3I_usJ&43KilJMGzJ<4N zKmCy@CNq^#8m$JQtpx)T%^Kaf`_xM?4VEQ^ja`>%?FDe3|QXRWCsB;!zwQt%q{}wKz z_tUAjlJDwQbQR;G#_t2m<0wfB#E9fZ&H-@QqZsHTUP<%u;veXo1nGr51?AWvPv`1S zKhii+LS~~wA(Bl2;TqM+W|NM}sUmo!hi;2UN>OV!8_P$&b<+MR=HB|>OwvxF9rL6N z_hbIW6=vA~Xu@fKvK@5N=dFZLiEyRJQRlkJ^7E!5|BeZApf*a7&THZ!MMZ9C<3%5e z%X3a+9kO4kdeTs*wVjrmorD{sB>GC%tDmb=^LNOW_Y{pWs<<3)JxV#(h@XtJx_;7) zNY$^poD4J4We91ME}*(Vjj^wjbfsOxHQIRQ0nO#Z7IQ8_@*oi!LMpqi2M5qD9PKfo zP#uTUo}|blkW!hxYqa8vo;@8~3;o7eW+M2P$%7YQhW;H#BF|8!q7z91*9Db2AG`^X=Ob| zbr1x(JyuTDN-4pwqSk!b7>GlsCHF!JQWY=|vI_j+Gw3B@>yC7aG8S45z2z3_3&nh@ zrz75e!)~$-az0hhlc+#6b`kTTSs4mdulLbBUy4)Kd6~x3G6I zG!Ga`c*U?S*E>E#>Ca<+le^WUH6V^!9HB|2*ZC2&=HAP_E|uF@SDpjUtPN5q)n{;N zXx^N+(8&vK8->d-8XXHWY@UtijZY&~FKS_xT53hbSJHGj4i>B2v)O18I!AT?p#RnL z`F)C8B%7#0X$Xp>0rMziqh^o}hP*Qg=0d*Kgmp*BRu>uYYUz}OAt`1z0vg$arkWrn zGZgb3_$yQXM=HiH=;j$~o;oepo0j!MfKHhVM=1@r(v68^$Q3PB&k?cvcDz?@< z%A{37w{kD6$9SMjktrmpbiux#Y_fj9?hQsARH*dW{rZDJ5jdZVM- zWEn}Maxsrj7$diaf=tU`4L4`NTVOooYHSVGEObYD-jtf2*~8P(L-xC?SO#@W1j>p5=`JIeC6iv8g13`v_NT; z$n=Chm8O(c$yCb~HEH*6CF99i#TrS$2pqFz3BOiyuWR6j`}R&SYR{JXqnvN3q7qL#q7Y}QCLf*)45NkB|zVL&S|rZ{1X!h&1^ zZ2tEEGi#6phBSg#&WLb=oO3x37HGL7I&SHi^w2XlTW(cCp%e>~WI&XKxldug1_nt+ zay+uwZI+LI>^t{aE`I@^g5JwK;b&gD~{~HPQdXTTMuTD5_lo=sX9+9w^MMfJ_;>kFh&#mHS ztxJxXhSK4-*?HL>DIc3qVx$M#$5inhOQeu5M zJvFISzHN_nW?Ojc|Iw?QahV=INSV;@eUT#D8;Lh35Zw+x8^pb)`*^R*XCR1?k?KrC ziqV)1Nv`3pNyhuRdA|^FT<)6tMyEQCIJdTJsg$y;lEMa1OlrexbRV(J=enpMd`}6# zgXT6n4VGRJg|PV(NG*cyU|;^>h#~)n{dlrjv%(kyF{-jWxrh6_G79Kdm@?@;j_@aB zQe~@ke7Lv}=%!K4KesmQbVde>v=+g>#?eVPjkl5$hn7w%betyv;4EbUBt~{*XuaF^ zR8DGMI6aLP4;%dXoz|E9o(&x>vP$d)R62Z^qEdybNvhISsakLWg<`SQ9LocElC*do znf?!EsrU_Rc~{wWG^uip^*F&sRDwT@uTe3KX<0>*!)Wu$|Kc&5BSEnC|B}cY zsjFr!2I2K0*~xQFwSW!A!s)og%5_Ufl!z9yR1gc@q@Rvepw!!mR3;l%LaeQYF86|Z zdLfG_(Lya=#XC2V4-z1HVH3V6;-iIpzS&JQlcG=rfEqtWCWlwVLVV5JAQ=r8eLd~$ zRls(6^#*vHffKQRIP;_1&DiWT)BldHIaTTBi0|yUDYek(YM{d)F!q?cv6QdE0iE+@DFQ{xG*8Uan<7BNg|btc(#Lyxy?rES$CIPUvq$(q*x6^ zeU?1FEwmYm93lxyE#Bi&OzVx>+&ckv;f@rC7D3xJL-N4;dfo(BIQwSOB`}h`M9I60 z1l)>bNZjfN1+sV)&aiVVwM`Ezpx9VSCZUe6ygDI82*NUH)bHAJ#N@}g=-XP<5@~!n zqu5ySO$F*kVTmI6OW8B{hcw=z^L-^WCevUPj35b!TNZPeyvmiKaAPn16bYbYiT@|X zpp+>}M^>Ypz=GX4dX~GDd4@}g;sq=tcqr?lk>foh_TP2h8kWEZan7}`t&lvLk*E_- zz?v-!mju59MMDh6`Sc*_Mp@u(rH${f{Q{99|Gv4nC}!v+B> ziVPGZ!m3Lat+Lc^7;CG%G(*rN_k*$q{kT!sm~S?PTR_^?5H*uKQDBe>Rsi`#AXLh6 zs-Ub2^k+>`4e$I?hlY;&jDfhqmZD5d;^VD3=y;%daNY-7e?c=Vi`QHvgHzEDa0>AR zH2`ihQ%3nW$K)vY7ah$-jaGhhI-4L2WR3}-jE=kXT}e|QZQk(Ea%py6raH4UEoS6w zG*RYi0q2`&(Ci`kJ62PXr9cBV_5?VF%9V7Jl`WeL^e2MMffX#7Zz0BZ1uyI zHuA4emcA>b+yog=d$2=|DjTWJveCku`OJLTFqDir238Ewa6 zw+Ov~r~v3L{ouhngLv!lQcmy!W#7AHH>xc#|6I9jhZ-=LKeL3-VOgn+?UDaVdpqt` zH1sFootW3iIXZk*QQ6ZP@|fH!&*B(9LJ|*gUseolbf=v2Z;SVnE&55oxR9lD_kaO*AlAb#Psq!wq2D)^+porqgs9;-JdsoV}MdMH99&Cn{ z7f7r!L(^a#SVj8~iOn@p6=Dk{6$jDbL*VqCR%r+k326_EU!+L5=*SEb%q0H=B(Ay8 zEWCqrY}T`zLZ=(SH(CuFF?+qGYu9s<*~JEY#H+*jXNx(-@NTUEgmZ;rLLsSxr9c}u zHRe?cXWVRd;Mk`}i?4p@lnz8b!1sE)cX5KGw#YzmKFREQhNN6PX>q zD%@T__KKdLjXzRR7l-Qa&mIm>4{sY=!Z2sN8twdk^KkQZ{YcN{ z=jZF>c^J#@MwDI+zQa=SYZ8W}Vf=fF5WQ!+Rq*DidPL7f>0%_0j|PL{d2CtL9BG`_ zXsJ7=Gl3?gZTCo%&v%OfQyq~&kd{0%s+q^9whc1u4(@8)8q+P0uxkqFHDW)&R@-Z^ z6rq82Ny3Raf{W7l3tH0bDHQ}adA0L5(K3t1gOb%!3%P@p^MG0Ul}KC;dYGfcLIcL0 zrZL&kWyL?_UuE!67Zaf=%v@yp3MMzv1f^!AL+j2mmxhK>VRfh>{NcUIfn5-L<|8p(pS2>7Uzyxa1#cu&>lu~W446s#&<*~+jDN!GKG0M6 zPZW$V`U5ib1u*0iyg%Y$0LCU4^8{};Jza%O(Gl^9R?-Ys@Rt%~E?Mrb+&q9pn&xW9 zeC$Rm<+f3^U|<=ov6%m4EPGUWOBE=@oK}$lD9$Ry2?&XM_Ui$5ig{!YOYP4gK5CNR z0>KWJ=SQl#e-fD3T*=SSusDYq?d8-^8F|@MIuz4aT-Lq>3u$5S?;k9r;fqtE7x>}R zTte%!=dG)vu-MpMe`6Q38pjM=L z>gm7T!_&$%QQrONAf7@RqET-mmOt25X=DXIaf9Ha$n2~}ZZKZ=S{`}3=$dPPe*8F5 za4?K7HvhEAm`fCvr$y6-#(EJ!hMQ#qbzyWK{HLoRX)b{}g|L_ZbK6g4!kFM1^w!JdDd$-#lFvdRe~`A+JiBqeDTb;b%GZ;Wwha@Hvuk08{bILuQU z1-kq<4W>PYPP@&}UnXuAU3TdubLKii(6;hylZIq9eeS}!=&Zj;U@jwVc%QxxzpcCi z%rY7oOwq9i?`5RpKIPW0d06?-YP02fFQFA!rT|0si_Vy1!xICT6lFD^9dC_pzV6O< z&rwOsrCsyt4Bub(ueZC0V-7h=KpC^G4xY}BHu2HzIA5O5R$4!99)5~id3qHu1mdp_ zt?rgz4!WMUkNU+%`S?~&#C+uZoy^=srIP#hqEDDBGCe3%qrBj3M*(=Ez4x+Vsqq#vJm?@`S*Vz2tGP=&bY z@V>x7GLZH}qCK67rsgR57Kz_r3K{=VGAe1y{~%o`$UhBO>rNJDvogie3@3?6Vnw$| z`|$qy*t>ZN{;+rVbamWdJGK>SG?2+`YP2L7@*LTZe|S(ktFJo$y0J(cZF?jZBd`vo z#}m|TvVh=$)7+p-H&a|Iiw6jgod{1C)ETq2Ti7;mxQ&+F)@_MYbZExPH$ZcHn0vC+ z@za+D&zp7i)>1_(%k5dy90V=Mb?+`{!;#5aR_UkyS}=9#(*PBx+}E!C!d%~);CR;i zJo0T_x8Z+U@3`z5d5mzvu8lIi`kGT; zKIx`1a_-EELaJE&t&*4Dy;$40Ot1EKP9&K_kx7;VO4*`o!{i$z=AgJV4p61EkE`Qd~s^M59~xq7?nrGCqLq*LG6YI!PnE07I# z@YM5Ntr^+~kOu|a%OoO8Y-mUR04j7_kEn{%I0UrX;jd3b*<6N(a$u?mkrFlc47c+; z47o%k^Z0!x#p!8=)_Q)uQ3SrhqC!Ngz4Qoy8jGp7Q<9w;0SY!4(|*xpJ8hAJ)6w_K%Yd3pAmix4a7{Wt7ST zkCEAc_7}{Uf5xBQ1ZZ(6t>~QLqEJmWU;$$?cbqGs8&bJNKO5)!6Z_Pv*sq8#FutvD z-wXwG)YbO02SI^RfSNU0=8bG?h?J&(#HjMGdnn$;{dN}tzvl^T`YgCRNu!MgLw(h{ z=icpS!YK(t?&8XMN|3`4(%bcfes0FnIrc5~%T!l(=dP!`B@c(ejJTX9gwvfNFEe$+ z91EA_?dLHnYB+<G0XE`>-zKIgB8z)*4DG?Gw$F&T-E7w%r89yJtU z4IcMA{Oc*%TF@A|5f@uG{=bAglpDK!uY4?uU_zBgp%Eh>07{_ljhH!Y3Fhrf&P5^z z1b1z1?WUDsLadfE(OngKqt)sekMCWb>ZlJ5+LoB^+Z>LtSR;=KYG(1rC$(-ejdj*L zY_C!^N4!bvrMZV@hk?JRq$x=;=?(}58bIklf@G2Dhk)|p?5Um=98hl48jlcy97`As zti;`-8ksIgtNse-D*D4crh%{#S zbb?S1`R?JAe=G>{5)r3)$BJB0;j$_(XWCr`FJ}_8e~-pdRQdE>4si** zaxMg#Wj{?yz017s5-|l7J5x64xXgXPo+xDvJ#Kx`ia;BXNBzorHijgoQ{!^*(%jx6 z8S-bE%KMkXu99m4H3!re`O2DzL+BfVJbsy6x!$kDBAz8j7DR$c`jR&0Z-%C-38tOC zAP8bRuAT%!1O~*J_M&jKBHavS#<73mIz{rL4=0Okaq{$t@~Vr{fEGpb+C^e*_uf8P z%^1`+E{AxgS*{@`9{Wxwja9#sD{vtns6Ck_=6FvawB0CM~YzED`Cj@etLg2<%CN`Ry{8?_{f z&?$#plPIFp5vy3NuzoSOv3M8)_K_l(ub=T`fk=P|&GU~vquw1>)?z)2W3{56xCa@D zraP>{Vp!hfh6}5I^`Sth23j4ZV&^_H%TJ@|;k1qP3*3yDc86?IV7R8*uJc7P+oQ5* z)1236eP)a7m!(Kj;nKTIEu4EUzbC%cbK#V5Xt34deId7!r^%0-p)RXThEZ-?#{=fYo;BpfjApYdv zh!8_TE=r`$U!t6{8U;cnE}S&@u>U5Pq*{>T{CB}kv3KkrIf00pF5;#p9~LJ}-HDSo z3n{X~^O}?RND!rfI&H`Vj$H}}2FZXqbf0Vf3R`sePXXx2qvpIHR*a^oT3Gi#hnPc| z$>-yUcYRTeRh_2N$J}5{nQ13&X6T?e&Su z!!;Cp-G$6=?D)95yggp_&@RB}AnZ~zv5R5G?fr7@Xb9?&LDMeYn5b{)aHg}h_OzVj z<#aU7ggTl+p0R^m=mxqOep>Q?c34t{fzkJw*3Ar z&4YUoP26a{M^`XBz$RIY{hLd*vz{y{TReX-%QNHje+3UX@W;3Xb@AhP?1n=3*VN!E zeaib^jwfi#?P-U?@IFYvvi;xQdsyE8yNV}R@Bc6HSXT#i?pMNT|Jh?(KcD|`_CH2v zyf`^LesSVY!u#uE>G{9AS2_P5w)fWi|BF0FBAF7C^dX(O_oi{!5@}5cX_L((!_b^M zD%XT2>!bdgdS>>&4nlmNWMJ9;fAnyM|KDw|<^M18tQZgbQ-fd!WinGA3fpg7La5zx zbZZ{}jMEr`ZOX~Gz~Y&kKW z+5hvSGvApeEZhGN+ZFxaZfCdsaJ~P(#Pjd^4XTa9%E6aKTEt#P8eqb8)0CO`;2{Z% zBnx;kG7us&*S;p#)-86$9k&B_4E{U{G5$c1PrSV442+kfPD8X+Gs znRSUA)7|}p?xTn8N00Y*pX`Tw?anX^I|q-4bQlgOeRR+c+3q7c*nc=^4~KgPgZ<9l z{^KWfpYHB=_S=tk2ag}`H>|gNmo(9r?1{Jg@Us1++dk;-J@nfTpLE&>k00&*PjfAY ztn$p;|M#T&hi9q$|8Re1{~zqH_y3o8%KN{F+-xa8X-mKN-@~h0l7&BelIv&gkmndZ5}Y`sqlJU*;+qRL;xg00iEPMv%xIw|q~oM2dRO3omwfox z*f25fO%q)*nVP>}(g`a{I8AoptsbC+#SrQmSTq&TnuioEyQ+n3isA zkdzGzlDl$tLN#X$=np)dnVPQ4MTOI=u|y>#qoXeAbo?iN+tblEJ8duBd)OdkV}tZ; zHpNPg0Q~G`r`g1$0h@#mi=2yuOR|ZW zV>p@ASQ8rOn8*Ok@WPqUlYV7h3*&d%&Eq8^EHZF|ud&YKkfi*IX3R5--7>S?fcaX) zRWBAHu9*&+=B7DQiw3roV2FtZqXOI{G3%O}Dhi!q5YXf_gCL)hJUi_D2s`uT;fqre zvO$hnKzIyMaYHt6V6n&{QJ40hW7*nJ&3hvD22_qc+pd{7yf9arYAf}!RNI~=G|f0H zkELdgBG3396rKrNK=~$=$JXxJ7;&qD+iJUQ5Z7O!Tj^1?xnghFSk(an8f@s)a&B%G zH!}Ff#%u_^u1Ti~X1-uXsZ}%D!>|<14W08dK`u<7y{-=Br@EhQeD)IAWD?PQV;$+K zCq4x(XxcM?NVV{L3B9>@igTYdN26nz?l@^w?nZO&PIW#%-LW&Cp*_o}4-$?Nh7%LI zk?7csSjYtaWh8*q*d}c}_*P>2L6c_>$km)MlGvE`uy@>GZV`zRoA_nSVkZVBxM612 z<;w6lL`SUzS3+lwm@XNO%Y*SX8vJ9!?u;@)RQ*tG_X)VPC?xz}5ctDpltt5i*(H4* z5-;y};os-vh6H&=ys$}{#2fDRv3VR2c)sb8MpM=5Fpt3L!N&e{BV`1E&U3BfcdAkF zP?9YL$hL8s)d~K#^-=e4kwfTE>m6tUUfw?Hr;c(l;4z*%YB1PIBEp%)E=BW1_qB!b zJ~jGQn$ZN!l10+S0Flt7O$C5n1YsVrRA=;UDmL(4)1P7HZWFD$*oc!n%6Jkn&-R1d z-bT@}+DUl+oQrUF`+V~5H-Ldx?0p9P*FdYBlb@KFuwBw=w>vPtqxqZs^Ney{JlMM7 zI!kQ_i~vO!v%?@zC+4S*w0N(**F1_%Yrw)g-CON}tH@!I+|fk;cal8ffOV_j(W{?C6t@_soy^Uh9QpPX63SB&ro2G}J{ z5jU~RAB^8$k#VJ8nrvSOg$~iNZpUUrDJo!SCmnq(iqLz_g^RNg8ogg#o^+K&QG^iw zXBoz3@Nqur6)hDj(7}c-oM;(GI!~LO>EuE%- z3X{q7t@BRrl_KYmqV$fRAcjFwoP=XophyrpOzU&ie(P_~Y_i*D;n3OP>|OtcNqFl~ z&p2aw!0UpMK`JvZ&115qB*0i??7y}f8*b=c{g(;h+pW$S9MZOcjmQ(0!cWI>j1Qp% zNJLzI?zw8a4=)=th!^jfwJ1#%NYKoBbPGqm$`maf_)|x`Q4>&kW;HDCA@f*C46F*9 zSIDJzi!adB3pf@^L0=#@F4*pX$$%63N_93b2S8&(t-BfL4?L=&^G-C8FNOGvfNByf z%>dQJocRocETf{1Yu+Vwia-c*u7+@EL`fw+grU~k)Fxt3#YO$1U=$Noj${Dw($45#AcPS?B;VxS%zM06^*_L`>h=!I6TXgS#^ zp?DS!2u(-wGXdRQ_*3ZZFooD(CDnvBqk+WuCf{2n8h)12Skk~mkojW6{e?yfRjRmJ zG9q&)qgjTES)CIJ9=3SMgUm{vbi$$|xHwRfk812gQ;uoM!e{w#$WqztlIDK9{o+~k zBOqpdPX8p&>W!207=+-lwis*`ah+zMxGdz6%oKlH;fsJLszUF`o&OB@tYPB}91o>o zfChO+6c+#m-x}X{i1IgEYY9jm)I&lW@s1DzjFc0k^iv;G<1A9m> z8`Bt0BI8F`G^9pU1?7nbmI7(l2!J|fkzN>+Ja09HqO*F z0q=?gMi_(#^R}79ye&H_y{x#^=sDzfzt5@Dy5cgdB^c!(RQx^c9-0EaPNk|q`3G>c#|2t z9}Ah;*H8%FR0>R{HUz%ryJ{K`fK|8GrnCQ=WOlam9g08aa zrito`&$mr3QM!g1Y!BPP>)FZlt$O*wi&`a+R6$f(Yh>XU4# zbBm%ckY?N@kt~)R%<7%{!0pQT)S5$HL>dXW|8oXJL^@}L)uC%a1jcPHPDtqZAxjpB zIFvSxmZH=cK^nB?iYkp#8Zfw%TS+f#^;Bx~>M)e8MBsl~8>Uq*VowY`i0}?L>3n#u z`a5SS7hw-a*Cl(XK%R{Qu4+diO={_To56QJdB`*CSaElLL^Z=> z#V0r5?=C8G&cw(ZUW#nP4VTfvL}K)#epgbGLY*SAso}(I@K96vs3&Ryix zLs1;~e?-ijqL=y=6a)eVVub2QZ9fw6K}u5&0;?krW2tj2bY{wQNi!J%*s-k_^gW;C z6OxIHMx{` z^5LUn?o@?{3j{^DZNPaEE4JYtfnr()IoliP0Tj@QoMD}w+XIk>q!=tFkytYS74DuP zM4#u}S=8J?2a(7_PfN|IH{>b1rcu<|NSVx19%P1fcQ~#KRHjpA&Ba4WM98buEO(2it#s+y-gp5X}!{n96 zOW6=@8FcL2sZlZ5`)aK?lEC6ZPo&=p*;Px9CzulZ;Ngot-jaYBKsE-Q^&8z8#K^66 zbki&lo^VsE(A6>bTMs)2+a`1&H0TU@expSp_fOsA-ogIE?H$z^?y10pT!bKqvB*bb zb)uK0A2d9RA{GHl&r(Uoj9zi%s2im)BYKDR3$u&a{aLFO zJ1H(nAM+W{4$Up=PRYy|FCG8eef3XW zUYjE|y=GmNX46Exx0V3LxCi#Rnjv!Gsx2j_;~npo;|;y7WH{YToJY|PiN#D;nDdQG zygQIA+abYN2{c_Cp+pB`Cn+Rl+oZF z9@j;R*SZURC8ZQLa}yfV5esX;ueRG!MEOM9r#Zkse|==F?+mkMTh#d^ZE9%rZy$&} z4h?$g1fgJmRZqEhh!hw?*GWL>1UN2|SNRv(CRL=wKN?f_fHk*xFb#9cUP7c*lc=;j zO4y5PETG

u^lq2`gpehg%k=WWX-%mb8g=YwxI>akz=0-Wypjb3s)1raxbxD zVag|BM$TVj%yM&UZw_EPGMNu>TuQ=FAS#>dH$5ex;5qg}giM<+dgOx9@RyWl>{Sd0 zndJXrUGn%juVF3}dX{q)q7_O3E+@SrIxl3>MEiF>&0cD)rle4`J{1udi8)E9S{pbh zPvWSw9914^*Ychh0xVj8#(37+4B45(3p|TUE+kr4-8IIVAuEE*@3@iWceDnci6 zKmosq#sF$&p*Do%BUt5IvRx(CyM@hw^_5~cTN~=XQpZ-m-JsO7|jWh0TDq3X#jj+dm2O%iLB(;%hn0h*mQ^VC0`QNa~3!Gy$y`JQFR z6A_-dB@z)H&KA-`DxF}Oq8H-AERMc*Ox>-<1Fn$q3z##Qfv(nAT{Gnth~yy)XlfNs zi3lxauH3i78&h8YEbiQ=B2Ts5b!^S0iE&VJzgIq;*O{K{0!k7qx*|?@>PxvF^;iZH z1UAyy)gD1W3-!R^vLAI{uDe*RMC|02C`@lrK-K~p(xHl=SeAop$Wjk;RFtR^kk&O( zS`(!&Oq5Qnm5SrKV?M#wcL)Lyl2cb2nWY4w@a#?13>g^Yayk(2i}%_mpiACthGKJv zY}&e;zm>>WrPn2N5O>)9&{VgrHA%e>k_xo$6DX>2Yr)7@)_B2HaKf6IMBP>4)!s#v zg|IpaxG)1T=}?^XP04gBKj$ z1WB%bwkLR@6^11RBxZQhLaWYbY@0`CgKDUCkO{N~P~(m!0tj1UUath8mu|75VV}H; zqbWI!l>{Y8mMYSw1ZsjebK1~77T2?C5q&vlWiH+JM1(AY=_E-s_0g3{%kfZU2jjja zB6O7NI)yH_rf=eaiaIvkda7ECD)wqxG8qMBjzSPi%S5b4p)h2poEkBTpt&R~Uzns~ z0@`8(6E?F|9V`i%l7fxxcA9M$df_M%*C+2$5o=HrTH!;&-YXR6;G+h9bkdwJYVe={ zibsz2rFy6v2G~3w`G_I4PY3^ViZ6 zY=F2v?+Zem3b08|!2~KSl|6Z%sNHBhVzGipKD=YoF4Wu6$$k_=avJaGQ0ZOr#x(ca z$KuSJJ3gaQD99yRzoLQ?In#(=u~=<3OsPmi4!@FA4A@F)gjIc&Oh=yW#KTTn8%||- z1G+d<{#?DP)5hueZO1I4Q`blWP7v2{qNCpFi$eQyzd^{5@+eQ)ETXVW4nWZZ z$n3oBG#Yl$w;Rs>=NSz|zJLqIGqZdEIXFe&!&wP>77?)01#?%qsB}@Dq^<>5wP(HA zYspNbyE%Bg$|AVxT>kmmVjJXQzU4Tr5PXcfM&oPFJ|>PUWl0M z6QyS75a&+2Bvu-yN}&5)GQn1mEmGf%DTktqI(PuVaU07B(rN1>SJQ@bJA;cHPxApY z*B76B34zsCx`mkQ4y>C^6B+?y5-UdS z_grRX!jhzUq!^S0XGcStWVqcjfmW>ae*3c7{$nP^kcQ(XSS%V zhl%wPwDNYX;}u4(HixRfK`{o+V5;gXIDCi5{PAN`l^%;c-ICjWW&HVMLY0i@H0BQH z_6_Tx0ui$U{vD&In2CFqgxWYNZU1pOgwyWs!AwAsN+2Y%4ogxEOL7cE(=|uZMq+w* zEGBc;smPg(S!7r0ty!rJ)nq(^h{d`s?}}588h35QDWG-+I($(ajB41)=xt~{5%Cov zf8Kbo7+tbg-IDwjv~%^qn=!Xvafk|`0V7YS@~F^K24YZG~;cS zI#9EFJD6rn&g`Vrn>$YAlg^7}FgkapVo}tU%E7o)P9}dGrMm zbiE8+FGbIjqvuG{gv?6zU&+}1?8u+^%*227G3~McyA<&~^|2)W^TUIO)%dUboz6P` z^A~wOGze*ahil&KlBT{(QLFE1Oc3d)g@0}|cT{mDPph(G@H-1Ke3zt3Ov^Zv%`W)> zNZ*`|kzv0%tw;!p2(93Io<;EC5Tc>vlBLDRp-3l9XWxF@sdi=j=Wf-Nt+c$O;`XYp z2L~ird=@P5UhxE_H}gkX8R@JssA{TI*cp52eahmHrO-vhLkFxlBzX6N$IUM3)P14v zn{Zs!eET`(nQHerZ`zL^8}7dbepXSl3iRx(ZP2C*Tiq6N_#{MmU>TYJuO zRR+DNE%=7_iZkyQBfz3{UB0$uV7`C>Kp-q8v)O_rL}<_Z4A`*Se)xD!0fQ1R9F!mh zBG}SFlK+XYI6D9No&eFFSHJ*bQh`IG?(cb<#_AMS**109?QEq&KXJ@5$|Jd)Txo`B z-WC`L5iuIiAzAwR!0C7{xhmkWC&@g?|_qvkGaHxDM&HHFZug@I7Hkt$)nm$1Xj&KIMa z{K5b$2+G_$j1`c+JfnvC|HscPC%E~aA%RB=%~V>Ts=uEM5KH*~PJ91RHUC5BV4eTz zi#!!2dq6Wb0!8v^JWQ#~(mVkBOq%f5CJ)S2r$LkCbtTi2tFAgE=xseEKeA{-0GB|U z0HKME2QEgu;sF`3?3%IID6ff5CDR}}P6Slf(GJnJ3aHOuN_Zw&H1r!R9`TrU$w*{L z)EJ9Ny&B7C$2F>FDPtyFmi>f@Z+M{QVVZE0+JxddMt6!xjD)nY3MMpt=O^)~@s3TE zECK1XbZZ_NvnXL{!z;qNdt{i$V6N2g%*-1mraahqdW20VkGhVH=>Ks>(jZ!Krt?NL zN|}4CU7NQY5W0-M3w9^lsO0ndv(a_^-19S+{@+91fAcKO|Fu`m|8?-Nv(EqdMV^ff zQlWg9s)I}GM6c-V(P``Gm}Ejk(u7D0n3PQV4XxjQjVgI;!~Hnx z$EHov{NdHBrk1W{lWavwCTu=CylATb{!epzn|L2THefg(K6u(@X;}}d3fd5+EIfw9 z#68T5z~j;BC>Hkh2?T1>q24{mK+%|o)mir917^J+J`n#Mo05-(aPQjq+LzkY*O3L) zY*LVoef;RQ0d~V5z+|OTg~g$HdCmA}oOMa3VLo`Xi#DcdIB(HbS~Jza=Up@GK~*tl z&+1F&dU;*4bYdN}ztVMEuu`9}NOpZdTS1z*3qH$g;X>h@_>izah!3H0bf0?O@O3q6 z;5!XMHl|Xmh#R+Q6>F4Q)$m>bdmwFz2o3yO;M$k*+pk9=!U~-W#3T_hi!-|x+J2x( zzFQggPP1kz-`R#q_o~bl|rQk~$^n0Y%23X4G=2sL2$T@6Xv9Ofi9S&swA)HjsPa-pA?X`? zWgd?r=0lT~$AoV`0c)AiZ0u*kH=}B|74r$sJob;5;1|{$au$V9Mdwg!x0~CA3{xFp z=W~s)bBhsn>60^= zCM~*Wb94IOB22{4DNWE4(B`3l!*&M}dc$oMq8`u4wTL$}l8sYwji~BFzj~C!Gmapo z{>~|88`8qm+{1YpNDH363M#3P<#)kjka}mK;7Tks4r}VqhyFtviM>YM6GP zlIE}R`C+g3%d3my9yz(Vcy$3$jBr1iR7c>jYCTWw{&hAvbJN`a!^&9LrxtZfUC&P7 z2K*zw4!LLj;Iqp4uVc7=w)1~)f3JG}?;Wh=zc2FKP5wjEN%Z(7T7xum{Ajd+f0|^A z;AsOtFNDaN#D9(FqdEVwF~icNIf}%9M&?MFM~%xp*mK%A`GRX^_bKshpT7Cz7B4atN##|rt($9a^rL-wt1!HmeL{${7}bWRPI0@smJhcY++AzS~D zUC=g`+OEzYrngkS)$4zZ!Rt?9&Frvr6c$iKF2D=N=emL&mIIlKAf280-*&eP^f86- z_bRwl8kKXJJMY!%!|*<^krZ`g6+50fNpQ}d&TzdIM)RxAWMH63+ z5my&ff$zG`Y=1mfBMLMPac|D*%j;AS-e6j;(bK_JYmZC3Q#66lM65OAzD!u)n}E*l z^&@7lxeCf9mch1kfBC84y)CHL#BR-ylhCU++POXa`z!-rM+zuVbc)Bi8=+=Bj} zyiatZDa`BU;~(EY0J99PGiLeA0vbrKIW2 zUNYezk1)+Nx(wNjyxNO}P>DJH2Ge5bc!n*TfId)W#VSw9RHcdF-{zL>1|ovdfRX0+ zP11bZy!)i61stTRC4b~J;zQ0t#iYYz{l+g0TZi(Q>O+lOk^u{-I)|i~Fyfr#03y&T zONem?p|vrSIRx?D(x5ti34x-Ne5;P9ZNG6kG}=I&e8>dcbYRajn?MNQ4nYLf;Pq%1 z!@P*t=8DuBPs~S)E2hlc0xQAYz3BWd)*6A8@zoip1qZfLK057KOK)#Iz$zA&TEl*C zgKTS+?EibuD(An{@%-+}0W3NH_c~So-`)29!P@`hi#)eD|DUs%rRrQke9$DkxWkd&=slG5#Eqy2d z9Y$g`b@ha$iBsvgMv@V~VzJ>TAT2Z6T-qa#%Z$;`hVIiRiHMm`zUT2!e43x~h8ZIc z5vDu?E%%DGm@PW_!5ASo0UwfUhM5B(E-Q_y^OovBaqYXx_o~Ngecemd%Q3T`O_E_7 znpH;@hJ2m#*nlzu%^b@!CcRa*p)lvwycBW}H2^9#{gebWGw1gF!VZt-VIGVs;#Ql5 z0oK}c=kmE~5 zwky}Uh9uAC`2Mx|YqME(ZCSA{5coMGn>(BJA@KD*tI+=}i8L#Aw-aCq{cj(%tMY%R zv$u}_^+ldr(f>GPsU%eAd8wpX()i*p5Jn0_(jhwSfq+33YmWkWH6!HDI|XLDs8Db< zy;Erei)!Efs^evrMCOYTB1@(wB~n>b+0u1xNGASGC((9&?XSo-WtIJ(XZ%ylKbG=; z2M=fbKX&)m`~QnPx7h#Z;P=I23<_v+o{m^XsL@6M_AjCUh)P-#9%<_ABd8TC~O7!vvT@ne(RkO7tK;34t6kOd-S z+cmnQXE~2TlMe(h=uoXf@dj||x>aC+i)I#LGWCq(Ky&#@RGM-uE#V8O+meVwxB#jC z0FMyG?doYeHS#23=@FIehncEir#WL6S?!~w6PedqVG22~#1?@s#3$SH3?j7$$lK=p zR=(`XunPTmU7GH43M{7oyPf@m{VMy7bNW zf73MilbrLM-a7Z&+X6?s8lS(ii=7E;Qgy8>!KQ8sHSTrgWvKer!7S_5(p9y)8Ff4| z`5tG~?mL9}qpqUu@{h=RyEUORbFS6hEx8(ST@Dj?)%PpONMCD&Et!dwg{6+|xgtHi zSTF#64lL^*iOVtRa4pRM%-Jt-Iq^lzWeKhrksX@0=<^)$r7ir-XCA@{wSky**6vz z;ty)wm;uWb+?#6Yn(PCes8p`mUH&$q{yjODxUzDcREZbI!mD26F}oPff)|9yu^i zx0vnH3PEa_5q)Y8cm9Fk4XQ|#71P{VFG4nJmbs{E^rmvWGj~M-M8nL!@MNr{b-i(-1_WSq~7A{YEH8n+jT=l zJCz-0I=T=ddx2F=Sul~EcdDmCWIs!m)*bJDfeOy)jukys(K+Ym45t`xA)n8FTR3_P zsJife^Pm=+l{f!q_U_iQUzF_9HVuc z$tZk_!>S&(4m(}3Dyvb4J53l}N7bIN)S%w^tF@$4Z(aVzGGASR@zjb zwZn9?#S?8c3|R?E%g?p@f!d<;tyV(%;%D39 zv+OW`&m&G#n}SP;U?B^5$P~c`TC5G!8PS$tdYFq2v)L`1OXeH%wNmDUcWmm3p=Z7= zInmMcFK^E|YYd{4-tDYi4iTOy3%f<75jOhe_3 zTf0!!bpNV3v;Ew)DhYD6%i*?EtN74ud;+PS2YTaiF~jZMas}paj7A2r(grdEi^YvU zgY#c`MxTXt)a3nNfqnqLI=e9!pe=E?STe)Xm96#aD$SOR=VJEE5mevf{nL?>qT^14 zq%53#!$@2^pZlY2^A%Q0>0GtdB~9HgwX4&F-GSiMik9Cnw#=Q=5{#LH5lLl}yXdf} z+}9mYVHNwYYnsM99^Kglc&Yzad&d9k(cU`$>lb-$VgL0Dq5+`;k!L#Kdn%$x{hQIz zBC}tMLAv}U9W4m|dLcx%h|#TW&GnfA{g?GjXc|}ECUF9~ZtJ*|)#$A^BxNJ^{s$h1 zr0J!<{u+M&-Hja6-Ti}Z6GK-1a(MCb^yTv|xhQ5&LYA>W$=_QaKDhmmj~~10jVkl; zs9j+NjFE)*EQTxO|=N0FlDYMLw#F$xd85vG7nP}zU+mX>Y^mH$t>cw+PHXPrDua%swpIbh2>Ayc_(S$?V zwNLG1ng7@R?m;#G_uj#yHU0k*&jvZCS;kUy=D_vFu>XUcN08bhp}{+djojEEmt#e$ z@+1*yCW#!gC<4g{^X>6?v_n!B(Trbdd#K_)jl;$UiP;GC=vzt3hWx!&Sd#zR_Q|U_ zni3I1O*JHvu#`kRW`4sz?!E10B4v#Yas&uUULW;H$Wz(yM?7o6e{uK?fAF8Q1^+cK z#-o<{kNGLD;#SenfClgK1kOI$c;L(Hr18KX(07doel|%O5B|T#26;_WE^nJ`>a;8VU!DE^ zb^OOK^K6i3$QPL1aK;BIO{WAx-8CAA>;d|9yPXX!QI2DV;=(kR^&S ziUZEHtckI0u{{vQbg0KJY5VW}_eMI?%vccwMt9;eMfz{m8T2@ya@_cisNoaa@s#9A zNHbGGJ}9uBom2h;*A-m6BF~iV5%?j zIO7vm9-?BpeJ)ztWb4^a=NH>PIfhXZ^~?H1=9!qlh1}&?j|42u_>c!mpx#kl*mrwB+u^B zMB~O=! zys!m#jhCm=?U$B&_3XVfFzWk#JZx=HM;Au*Bbv=$JF~S{%$HlYY70jMsD+v5ZiQ5z zj!s|bxrY<3uGQP1`#qdnU*`Ed19j1Uac0QATCP(a4V}d@PuZ;LG#V9SNCr^BTr+r6 zWLc#;+CDiQl72P6VxMpcx9CMGOw}7^!lbdz+p2g@crO(P4AC@oen$#Cn_m$2PfQG2 zJ_q!Mgj`{(Y{;*I1H4Ud%lFM!!6)9PHwV4lRC|3F#*^gl9OL-_NZJr(cSzheXeYF_8`TLg(-l( zf{pbRYy@|eD=DaE*pK;Ht(HPz0sBE}hTvpsx<5o)I0Qfp%)|KQ@!}4A^q0hoA}>vU zW)5@H+z^pMHm`nN_K*H;@uIBpb40V%^S#Vlh}#VT=GHGYa8x95NupfZ3_7dh!V0LV z$?jJ`w7!DpE7%`j!Q&#Q8~(qnU{jv9MGRN8ATr%lyV^a-?l2DdIl=A_6!c-UT2&57iX812mCH}%&ek-Zv-*m8%fg;8DrWJf)-a?IrZP7zDW#;_uC zEb=HMI6ySNHvR7unR`+e4xVrv#eZ>|lc2DnzpELedNTRoC=$pb^7td*9Nz8Q4}vTM4k#CpTo};KK7dF{Ayo7{V5Z zUl$I_ces-JMs5+l;-h5lbBF7=ulmd=o^N81@VGmAN!Y)FP~4CeLQ4Lrs5NuAt`soV zk5`LM**A0y^yA>VPg6!jk&rJY0hJ)sPK%qM9mgIAFK$dMNJ7b2TpKd!kWQcU6fgVQ z4JZ5C)`kf$3-j0}OBS&lj-gPSx?$vWk@*3E$!SJXVC@yZBga&68F&w+*l7yaQ#PXJ zy)WYZgx&402G2j~S+#L(pHd6q0!U3@0R9)UrlO9bZKA%7akKWSz&%jE>7 zDQM;bN78ii)Y$CR}vBHfL#h#0Zo_%|H+`r3ZvPJ{aOIW~ZL^!O94909i zrDN`(8Z2zZQ+=z~Z4gLC)FqgTs6j|rU`W?o1)AbcfM~o5=aNJspcxArgs}H?l0>Xa zLa60)(P%hk?@PM6D7+Qb&M5Bf-ImSK5RZ8LzR}3&Xj!w^PDV#=GabKk;CH-`4LFUx zPTNZl_8N^OkD_xC@nGp#0ocPSq1gPnt!O>P;ZWKttb7#73V{rHVW z$OgFs)d4!s&p-f&3^b4rk{?@3WK=9uGx2L5C~!w~+2yphvwz;lmgh zNE!!BH#T71#)ic{7qK=<4i#mz*ic}ev&b97S!Ln^ys<%W>Uu=ltzm;W>eylf>39lD z;bh_rV0q$ZeRP4K;Mi!mxeS+~;PbJN7$dzHU`AexD4(!$O3WQ{Iy5NO^qM)F4Z_C38xC60s3x8E)}0B2FOoEOt8JO&&Bnb7 z+tduiJ2pivV4bOhle4;J5IBA@01wDTz(!9eJJb#04t9eO%d@INCOXGYY-&NNU)1!F$j1>Yc+hQ10#-Mzoa@oQytp~@=a8h>S?pNQ-S8wW)pCJvr=@$gcj8fzB60>t!ko@=3;)P zj)vWLI>DmT%<}At#%Rt70AH6u(ZR#|1d4Tl=-deq9TyOt`vFAfGXSDf4+!IB{8FHs oXfUQR81cVs9ezWh4%W~5SwHJ%{W#D69{>RV|Cvx^{s3$R05KO~M*si- literal 0 HcmV?d00001 -- GitLab From e8a045823630b55f67bdb7711f6739cdef7547a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:31:40 +0200 Subject: [PATCH 027/162] adding test --- chart/templates/tests/test-connection.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 chart/templates/tests/test-connection.yaml diff --git a/chart/templates/tests/test-connection.yaml b/chart/templates/tests/test-connection.yaml new file mode 100644 index 00000000..5ca4058f --- /dev/null +++ b/chart/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "vs.fullname" . }}-test-connection" + labels: + {{- include "vs.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test-success +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "vs.fullname" . }}-renderer:{{ .Values.service.port }}'] + restartPolicy: Never -- GitLab From c5b598170d00ae39f8194d3a28289e18d0975a8b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:32:47 +0200 Subject: [PATCH 028/162] fix --- chart/templates/renderer-deployment.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/chart/templates/renderer-deployment.yaml b/chart/templates/renderer-deployment.yaml index 59e9666d..aa45c6d8 100644 --- a/chart/templates/renderer-deployment.yaml +++ b/chart/templates/renderer-deployment.yaml @@ -6,9 +6,7 @@ metadata: {{- include "vs.labels" . | nindent 4 }} app.kubernetes.io/service: renderer spec: -{{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.renderer.replicaCount }} -{{- end }} selector: matchLabels: {{- include "vs.selectorLabels" . | nindent 6 }} -- GitLab From 1cbfc9630c1818801ea65a67f892e0c1d9645a6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 7 Oct 2020 14:38:39 +0200 Subject: [PATCH 029/162] fix init-db --- chart/templates/init-db-configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/templates/init-db-configmap.yaml b/chart/templates/init-db-configmap.yaml index c012c5c6..a0516d5b 100644 --- a/chart/templates/init-db-configmap.yaml +++ b/chart/templates/init-db-configmap.yaml @@ -1,7 +1,7 @@ apiVersion: v1 data: init-db.sh: | - {{- .Values.initDb }} + {{- .Values.initDb | nindent 4 }} kind: ConfigMap metadata: name: {{ include "vs.fullname" . }}-init-db -- GitLab From d32e91254ee91d20463accc9fe0809885c685f20 Mon Sep 17 00:00:00 2001 From: Bernhard Mallinger Date: Wed, 7 Oct 2020 14:54:28 +0200 Subject: [PATCH 030/162] Disable persistence in chart db --- chart/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index b748774f..04230e4f 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -57,8 +57,8 @@ config: database: persistence: - enabled: true - existingClaim: eoepca-rm-db-pvc + enabled: false + # existingClaim: eoepca-rm-db-pvc postgresqlUsername: dbuser postgresqlPassword: dbpw postgresqlDatabase: dbname -- GitLab From 93a878e640cd6f4130d093f64b38e1bf9c34815d Mon Sep 17 00:00:00 2001 From: Bernhard Mallinger Date: Wed, 7 Oct 2020 15:03:38 +0200 Subject: [PATCH 031/162] Fix volume name confusion --- chart/templates/renderer-deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/chart/templates/renderer-deployment.yaml b/chart/templates/renderer-deployment.yaml index aa45c6d8..36f65516 100644 --- a/chart/templates/renderer-deployment.yaml +++ b/chart/templates/renderer-deployment.yaml @@ -87,5 +87,5 @@ spec: items: - key: init-db.sh path: init-db.sh - name: init-db - name: {{ include "vs.fullname" . }}-init-db + name: {{ include "vs.fullname" . }}-init-db + name: init-db -- GitLab From 43096bc9e05af7028da071517cfbd36e99c4c2bc Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 7 Oct 2020 16:05:55 +0200 Subject: [PATCH 032/162] update client deploy labels --- docker-compose.emg.ops.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 9054dbe2..88c5411b 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -135,15 +135,15 @@ services: - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-client-redirect.entrypoints=http" # router for basic auth based access (https) - - "traefik.http.routers.emg-client.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client.middlewares=shibAuth@file,compress@file" - - "traefik.http.routers.emg-client.tls=true" - - "traefik.http.routers.emg-client.tls.certresolver=default" - - "traefik.http.routers.emg-client.entrypoints=https" + - "traefik.http.routers.emg-client-shib.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client-shib.middlewares=shibAuth@file,compress@file" + - "traefik.http.routers.emg-client-shib.tls=true" + - "traefik.http.routers.emg-client-shib.tls.certresolver=default" + - "traefik.http.routers.emg-client-shib.entrypoints=https" # router for basic auth based access (http) - - "traefik.http.routers.emg-client-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-client-redirect.entrypoints=http" + - "traefik.http.routers.emg-client-shib-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client-shib-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-client-shib-redirect.entrypoints=http" # general - "traefik.http.services.emg-client.loadbalancer.sticky=false" - "traefik.http.services.emg-client.loadbalancer.server.port=80" -- GitLab From 1233ece3dd7f9c08b7a60658b157c1452f4367cd Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 7 Oct 2020 16:06:05 +0200 Subject: [PATCH 033/162] fix shib internal url --- traefik-dynamic.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 9b51a489..495ef4eb 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -22,7 +22,7 @@ http: - "***REMOVED***" shibAuth: forwardAuth: - address: http://shib.pdas.prism.eox.at/secure + address: http://shibauth/secure trustForwardHeader: true compress: compress: {} -- GitLab From 87e4a8efcd7f235a4c61667b3e8d3d4bb5e4d160 Mon Sep 17 00:00:00 2001 From: Bernhard Mallinger Date: Wed, 7 Oct 2020 16:56:11 +0200 Subject: [PATCH 034/162] Enable postgis in chart --- chart/values.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/chart/values.yaml b/chart/values.yaml index 04230e4f..adfec900 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -63,6 +63,10 @@ database: postgresqlPassword: dbpw postgresqlDatabase: dbname postgresqlPostgresPassword: dbpgpw + initdbScripts: + enablePostgis.sh: | + echo "Enabling postgis" + PGPASSWORD="$POSTGRES_POSTGRES_PASSWORD" psql -U postgres -d "${POSTGRES_DB}" -c "CREATE EXTENSION postgis;" renderer: replicaCount: 1 -- GitLab From 14376141e3dd30c71ba1c55f357ddafb7bf42e3d Mon Sep 17 00:00:00 2001 From: Bernhard Mallinger Date: Wed, 7 Oct 2020 17:47:39 +0200 Subject: [PATCH 035/162] Fix service name in ingress --- chart/templates/ingress.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/chart/templates/ingress.yaml b/chart/templates/ingress.yaml index 05de097d..770ce776 100644 --- a/chart/templates/ingress.yaml +++ b/chart/templates/ingress.yaml @@ -33,15 +33,15 @@ spec: paths: - path: /(ows.*) backend: - serviceName: renderer + serviceName: {{ $fullName }}-renderer servicePort: http - path: /(opensearch.*) backend: - serviceName: renderer + serviceName: {{ $fullName }}-renderer servicePort: http - path: /(admin.*) backend: - serviceName: renderer + serviceName: {{ $fullName }}-renderer servicePort: http # - path: /cache/(.*) # backend: -- GitLab From 09fbdb4c171e1e2fae97c2bfaf7038a3ebca18a1 Mon Sep 17 00:00:00 2001 From: Bernhard Mallinger Date: Wed, 7 Oct 2020 18:15:14 +0200 Subject: [PATCH 036/162] Add client deployment to chart --- chart/files/index.html | 475 +++++++++++++++++++++++++ chart/templates/client-configmap.yaml | 6 + chart/templates/client-deployment.yaml | 62 ++++ chart/templates/client-service.yaml | 17 + chart/values.yaml | 11 + 5 files changed, 571 insertions(+) create mode 100644 chart/files/index.html create mode 100644 chart/templates/client-configmap.yaml create mode 100644 chart/templates/client-deployment.yaml create mode 100644 chart/templates/client-service.yaml diff --git a/chart/files/index.html b/chart/files/index.html new file mode 100644 index 00000000..23b59e21 --- /dev/null +++ b/chart/files/index.html @@ -0,0 +1,475 @@ + + + + + +PRISM View Server + + + + +

+
+ + + + diff --git a/chart/templates/client-configmap.yaml b/chart/templates/client-configmap.yaml new file mode 100644 index 00000000..4b130f7e --- /dev/null +++ b/chart/templates/client-configmap.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "vs.fullname" . }}-client +data: + {{ (.Files.Glob "files/index.html").AsConfig | nindent 2}} diff --git a/chart/templates/client-deployment.yaml b/chart/templates/client-deployment.yaml new file mode 100644 index 00000000..31e8ebd6 --- /dev/null +++ b/chart/templates/client-deployment.yaml @@ -0,0 +1,62 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: {{ include "vs.fullname" . }}-client + labels: + {{- include "vs.labels" . | nindent 4 }} + app.kubernetes.io/service: client +spec: + replicas: {{ .Values.client.replicaCount }} + selector: + matchLabels: + {{- include "vs.selectorLabels" . | nindent 6 }} + app.kubernetes.io/service: client + strategy: + rollingUpdate: + maxUnavailable: 0 + type: RollingUpdate + template: + metadata: + annotations: + prometheus.io/scrape: "false" + labels: + {{- include "vs.selectorLabels" . | nindent 8 }} + app.kubernetes.io/service: client + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }}-client + image: 'registry.gitlab.eox.at/esa/prism/vs/pvs_client:{{ .Values.image.tag | default .Chart.AppVersion }}' + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.client.resources | nindent 12 }} + volumeMounts: + - mountPath: /usr/share/nginx/html/index.html + name: client + subPath: index.html + {{- with .Values.client.affinity | default .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - configMap: + items: + - key: index.html + path: index.html + name: {{ include "vs.fullname" . }}-client + name: client diff --git a/chart/templates/client-service.yaml b/chart/templates/client-service.yaml new file mode 100644 index 00000000..587cba40 --- /dev/null +++ b/chart/templates/client-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "vs.fullname" . }}-client + labels: + {{- include "vs.labels" . | nindent 4 }} + app.kubernetes.io/service: client +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "vs.selectorLabels" . | nindent 4 }} + app.kubernetes.io/service: client diff --git a/chart/values.yaml b/chart/values.yaml index adfec900..a779f6ca 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -79,6 +79,17 @@ renderer: memory: 2Gi affinity: {} +client: + replicaCount: 1 + resources: + limits: + cpu: 0.5 + memory: 1Gi + requests: + cpu: 0.1 + memory: 0.1Gi + + replicaCount: 1 image: -- GitLab From 1e6900784570ebae24c2d33825cd5099ccc0a38e Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 09:18:54 +0200 Subject: [PATCH 037/162] fix traefik auth labels on basicauth access hosts --- docker-compose.dem.ops.yml | 4 ++-- docker-compose.emg.ops.yml | 6 +++--- docker-compose.vhr18.ops.yml | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docker-compose.dem.ops.yml b/docker-compose.dem.ops.yml index 46c6a135..af14f652 100644 --- a/docker-compose.dem.ops.yml +++ b/docker-compose.dem.ops.yml @@ -66,7 +66,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.dem-cache.rule=Host(`dem.pdas.prism.eox.at`, `a.dem.pdas.prism.eox.at`, `b.dem.pdas.prism.eox.at`, `c.dem.pdas.prism.eox.at`, `d.dem.pdas.prism.eox.at`, `e.dem.pdas.prism.eox.at`, `f.dem.pdas.prism.eox.at`, `g.dem.pdas.prism.eox.at`, `h.dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`, `a.dem.pass.copernicus.eu`, `b.dem.pass.copernicus.eu`, `c.dem.pass.copernicus.eu`, `d.dem.pass.copernicus.eu`, `e.dem.pass.copernicus.eu`, `f.dem.pass.copernicus.eu`, `g.dem.pass.copernicus.eu`, `h.dem.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.dem-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.dem-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" - "traefik.http.routers.dem-cache.tls=true" - "traefik.http.routers.dem-cache.tls.certresolver=default" - "traefik.http.routers.dem-cache.entrypoints=https" @@ -126,7 +126,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.dem-client.rule=Host(`dem.pdas.prism.eox.at`, `dem.pass.copernicus.eu`)" - - "traefik.http.routers.dem-client.middlewares=auth@file,compress@file,shibAuth@file" + - "traefik.http.routers.dem-client.middlewares=auth@file,compress@file" - "traefik.http.routers.dem-client.tls=true" - "traefik.http.routers.dem-client.tls.certresolver=default" - "traefik.http.routers.dem-client.entrypoints=https" diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 88c5411b..909dab1b 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -14,7 +14,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.emg-renderer.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.emg-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-renderer.middlewares=auth@file,compress@file,cors@file" - "traefik.http.routers.emg-renderer.tls=true" - "traefik.http.routers.emg-renderer.tls.certresolver=default" - "traefik.http.routers.emg-renderer.entrypoints=https" @@ -66,7 +66,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.emg-cache.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.emg-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.emg-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" - "traefik.http.routers.emg-cache.tls=true" - "traefik.http.routers.emg-cache.tls.certresolver=default" - "traefik.http.routers.emg-cache.entrypoints=https" @@ -126,7 +126,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.emg-client.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client.middlewares=auth@file,compress@file,shibAuth@file" + - "traefik.http.routers.emg-client.middlewares=auth@file,compress@file" - "traefik.http.routers.emg-client.tls=true" - "traefik.http.routers.emg-client.tls.certresolver=default" - "traefik.http.routers.emg-client.entrypoints=https" diff --git a/docker-compose.vhr18.ops.yml b/docker-compose.vhr18.ops.yml index 443001b6..75e0c25a 100644 --- a/docker-compose.vhr18.ops.yml +++ b/docker-compose.vhr18.ops.yml @@ -15,7 +15,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.vhr18-renderer.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" - - "traefik.http.routers.vhr18-renderer.middlewares=auth@file,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-renderer.middlewares=auth@file,compress@file,cors@file" - "traefik.http.routers.vhr18-renderer.tls=true" - "traefik.http.routers.vhr18-renderer.tls.certresolver=default" - "traefik.http.routers.vhr18-renderer.entrypoints=https" @@ -66,7 +66,7 @@ services: - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" # router for basic auth based access (https) - "traefik.http.routers.vhr18-cache.rule=Host(`vhr18.pdas.prism.eox.at`, `a.vhr18.pdas.prism.eox.at`, `b.vhr18.pdas.prism.eox.at`, `c.vhr18.pdas.prism.eox.at`, `d.vhr18.pdas.prism.eox.at`, `e.vhr18.pdas.prism.eox.at`, `f.vhr18.pdas.prism.eox.at`, `g.vhr18.pdas.prism.eox.at`, `h.vhr18.pdas.prism.eox.at`, `vhr18.pass.copernicus.eu`, `a.vhr18.pass.copernicus.eu`, `b.vhr18.pass.copernicus.eu`, `c.vhr18.pass.copernicus.eu`, `d.vhr18.pass.copernicus.eu`, `e.vhr18.pass.copernicus.eu`, `f.vhr18.pass.copernicus.eu`, `g.vhr18.pass.copernicus.eu`, `h.vhr18.pass.copernicus.eu`) && PathPrefix(`/cache`)" - - "traefik.http.routers.vhr18-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file,shibAuth@file" + - "traefik.http.routers.vhr18-cache.middlewares=auth@file,cache-stripprefix,compress@file,cors@file" - "traefik.http.routers.vhr18-cache.tls=true" - "traefik.http.routers.vhr18-cache.tls.certresolver=default" - "traefik.http.routers.vhr18-cache.entrypoints=https" -- GitLab From 59c28d0cd1e25de365ba6d04015628e788839afd Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 16:27:24 +0200 Subject: [PATCH 038/162] testing emg.pdas.prism.eox.at directly --- docker-compose.base.ops.yml | 5 ----- docker-compose.emg.ops.yml | 12 +----------- 2 files changed, 1 insertion(+), 16 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index 807af599..421d65ce 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -52,11 +52,6 @@ services: - "traefik.docker.network=shib-extnet" - "traefik.docker.lbswarm=true" - "traefik.enable=true" - # labels: - # - "traefik.enable=true" - # - "traefik.frontend.rule=Host:shib.pdas.prism.eox.at" - # - "traefik.port=80" - # - "traefik.frontend.passHostHeader=true" networks: - shib-extnet volumes: diff --git a/docker-compose.emg.ops.yml b/docker-compose.emg.ops.yml index 909dab1b..cd0cbafd 100644 --- a/docker-compose.emg.ops.yml +++ b/docker-compose.emg.ops.yml @@ -126,7 +126,7 @@ services: labels: # router for basic auth based access (https) - "traefik.http.routers.emg-client.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client.middlewares=auth@file,compress@file" + - "traefik.http.routers.emg-client.middlewares=shibAuth@file,compress@file" - "traefik.http.routers.emg-client.tls=true" - "traefik.http.routers.emg-client.tls.certresolver=default" - "traefik.http.routers.emg-client.entrypoints=https" @@ -134,16 +134,6 @@ services: - "traefik.http.routers.emg-client-redirect.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" - "traefik.http.routers.emg-client-redirect.entrypoints=http" - # router for basic auth based access (https) - - "traefik.http.routers.emg-client-shib.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client-shib.middlewares=shibAuth@file,compress@file" - - "traefik.http.routers.emg-client-shib.tls=true" - - "traefik.http.routers.emg-client-shib.tls.certresolver=default" - - "traefik.http.routers.emg-client-shib.entrypoints=https" - # router for basic auth based access (http) - - "traefik.http.routers.emg-client-shib-redirect.rule=Host(`emg-secure.pdas.prism.eox.at`, `emg-secure.pass.copernicus.eu`)" - - "traefik.http.routers.emg-client-shib-redirect.middlewares=redirect@file" - - "traefik.http.routers.emg-client-shib-redirect.entrypoints=http" # general - "traefik.http.services.emg-client.loadbalancer.sticky=false" - "traefik.http.services.emg-client.loadbalancer.server.port=80" -- GitLab From 9e879ebd007ec48af5e6396cefc54a9884fafa89 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 16:29:48 +0200 Subject: [PATCH 040/162] try https for shibAuth --- traefik-dynamic.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 495ef4eb..896eaef8 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -22,7 +22,7 @@ http: - "***REMOVED***" shibAuth: forwardAuth: - address: http://shibauth/secure + address: https://shibauth/secure trustForwardHeader: true compress: compress: {} -- GitLab From 24c8bffd85469a2f2f36b1af2e9a550a921c2b55 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 16:55:34 +0200 Subject: [PATCH 041/162] new test --- docker-compose.emg.ops_test.yml | 147 ++++++++++++++++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 docker-compose.emg.ops_test.yml diff --git a/docker-compose.emg.ops_test.yml b/docker-compose.emg.ops_test.yml new file mode 100644 index 00000000..7b66a1ea --- /dev/null +++ b/docker-compose.emg.ops_test.yml @@ -0,0 +1,147 @@ +version: "3.6" +services: + database: + volumes: + - type: tmpfs + target: /dev/shm + tmpfs: + size: 536870912 + renderer: + environment: + INSTALL_DIR: "/var/www/pvs/ops/" + INSTANCE_DIR: "/var/www/pvs/ops/pvs_instance/" + deploy: + labels: + # router for basic auth based access (https) + - "traefik.http.routers.emg-renderer.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer.middlewares=auth@file,compress@file,cors@file" + - "traefik.http.routers.emg-renderer.tls=true" + - "traefik.http.routers.emg-renderer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.emg-renderer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`)" + - "traefik.http.routers.emg-renderer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer-redirect.entrypoints=http" + # router for referrer based access (https) + - "traefik.http.routers.emg-renderer_referer.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer.middlewares=compress@file,cors@file" + - "traefik.http.routers.emg-renderer_referer.tls=true" + - "traefik.http.routers.emg-renderer_referer.tls.certresolver=default" + - "traefik.http.routers.emg-renderer_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.emg-renderer_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/ows`, `/opensearch`, `/admin`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-renderer_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-renderer_referer-redirect.entrypoints=http" + # general + - "traefik.http.services.emg-renderer.loadbalancer.sticky=false" + - "traefik.http.services.emg-renderer.loadbalancer.server.port=80" + - "traefik.docker.network=emg-extnet" + - "traefik.docker.lbswarm=true" + - "traefik.enable=true" + replicas: 0 + resources: + limits: + memory: 8G + placement: + constraints: + - node.labels.type == external + networks: + - extnet + cache: + configs: + - source: mapcache-ops + target: /mapcache-template.xml + deploy: + labels: + - "traefik.http.middlewares.cache-stripprefix.stripprefix.prefixes=/cache" + # router for basic auth based access (https) + - "traefik.http.routers.emg-cache.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`)" + - "traefik.http.routers.emg-cache.middlewares=shibAuth@file,cache-stripprefix,compress@file,cors@file" + - "traefik.http.routers.emg-cache.tls=true" + - "traefik.http.routers.emg-cache.tls.certresolver=default" + - "traefik.http.routers.emg-cache.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.emg-cache-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`)" + - "traefik.http.routers.emg-cache-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-cache-redirect.entrypoints=http" + # router for referrer based access (https) + - "traefik.http.routers.emg-cache_referer.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-cache_referer.middlewares=cache-stripprefix,compress@file,cors@file" + - "traefik.http.routers.emg-cache_referer.tls=true" + - "traefik.http.routers.emg-cache_referer.tls.certresolver=default" + - "traefik.http.routers.emg-cache_referer.entrypoints=https" + # router for referrer based access (http) + - "traefik.http.routers.emg-cache_referer-redirect.rule=Host(`emg.pdas.prism.eox.at`, `a.emg.pdas.prism.eox.at`, `b.emg.pdas.prism.eox.at`, `c.emg.pdas.prism.eox.at`, `d.emg.pdas.prism.eox.at`, `e.emg.pdas.prism.eox.at`, `f.emg.pdas.prism.eox.at`, `g.emg.pdas.prism.eox.at`, `h.emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`, `a.emg.pass.copernicus.eu`, `b.emg.pass.copernicus.eu`, `c.emg.pass.copernicus.eu`, `d.emg.pass.copernicus.eu`, `e.emg.pass.copernicus.eu`, `f.emg.pass.copernicus.eu`, `g.emg.pass.copernicus.eu`, `h.emg.pass.copernicus.eu`) && PathPrefix(`/cache`) && HeadersRegexp(`Referer`, `(https?://)?(panda.copernicus.eu|panda.cdsv3.eu|panda-demo.ondaprism.eu|panda-demo.copernicus.eu|cdsportal-demo.copernicus.eu|ocqc-demo.copernicus.eu|emg.pdas.prism.eox.at|emg.pass.copernicus.eu)/?`)" + - "traefik.http.routers.emg-cache_referer-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-cache_referer-redirect.entrypoints=http" + # general + - "traefik.http.services.emg-cache.loadbalancer.sticky=false" + - "traefik.http.services.emg-cache.loadbalancer.server.port=80" + - "traefik.docker.network=emg-extnet" + - "traefik.docker.lbswarm=true" + - "traefik.enable=true" + replicas: 0 + resources: + limits: + memory: 8G + placement: + constraints: + - node.labels.type == external + networks: + - extnet + registrar: + environment: + INSTALL_DIR: "/var/www/pvs/ops/" + INSTANCE_DIR: "/var/www/pvs/ops/pvs_instance/" + deploy: + replicas: 0 + placement: + constraints: + - node.labels.type == internal + client: + configs: + - source: client-ops + target: /usr/share/nginx/html/index.html + deploy: + labels: + # router for basic auth based access (https) + - "traefik.http.routers.emg-client.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client.middlewares=shibAuth@file,compress@file" + - "traefik.http.routers.emg-client.tls=true" + - "traefik.http.routers.emg-client.tls.certresolver=default" + - "traefik.http.routers.emg-client.entrypoints=https" + # router for basic auth based access (http) + - "traefik.http.routers.emg-client-redirect.rule=Host(`emg.pdas.prism.eox.at`, `emg.pass.copernicus.eu`)" + - "traefik.http.routers.emg-client-redirect.middlewares=redirect@file" + - "traefik.http.routers.emg-client-redirect.entrypoints=http" + # general + - "traefik.http.services.emg-client.loadbalancer.sticky=false" + - "traefik.http.services.emg-client.loadbalancer.server.port=80" + - "traefik.docker.network=emg-extnet" + - "traefik.docker.lbswarm=true" + - "traefik.enable=true" + placement: + constraints: + - node.labels.type == external + networks: + - extnet + preprocessor: + volumes: + - type: bind + source: /var/vhr + target: /tmp + deploy: + replicas: 0 + placement: + constraints: + - node.labels.type == internal + sftp: + deploy: + replicas: 0 + ingestor: + deploy: + replicas: 0 +networks: + extnet: + name: emg-extnet + external: true -- GitLab From 5529378266fe47f3537a9e81e0ecb65db99ad955 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 20:53:45 +0200 Subject: [PATCH 042/162] add sp-metadata.xml --- shibauth/shibboleth-conf/sp-metadata.xml | 84 ++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 shibauth/shibboleth-conf/sp-metadata.xml diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml new file mode 100644 index 00000000..ef565636 --- /dev/null +++ b/shibauth/shibboleth-conf/sp-metadata.xml @@ -0,0 +1,84 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + https://https://shib.pdas.prism.eox.at/shibboleth + https://shib.pdas.prism.eox.at + + CN=https://shib.pdas.prism.eox.at + MIIEVDCCArygAwIBAgIJANYdDHsBg6ulMA0GCSqGSIb3DQEBCwUAMCkxJzAlBgNV +BAMTHmh0dHBzOi8vc2hpYi5wZGFzLnByaXNtLmVveC5hdDAeFw0yMDEwMDgxNDI2 +MjBaFw0zMDEwMDYxNDI2MjBaMCkxJzAlBgNVBAMTHmh0dHBzOi8vc2hpYi5wZGFz +LnByaXNtLmVveC5hdDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMKW +psgoJpT33XXQDzFiWXPkTW8deYIjaRN4iXuVpMa9/RpuQsSTTPCxwFXhp31lgsay +3DA3WNK5KVCx5ccnLbb5CiuZBrzFFttfzK1LIgf0rieGtpFj0cTEQwfFGM+3T/5p +cdTi/CyT7xUCGOn6rzU9NjIpQ7Z0DrIkN4vcRbljExMALZwrfg0E00JB/rg7nUga +Tc5rkM8DuqsvOe9IfRv9ZOe2sDimido13jzhE/Y/NTHtq8qleVxeT42P/hiZlJX4 +rioMtigG7nXmz0/6nfBR3y2tnViWURNF3DXy+7BAKIfTUU5Dy8diFpPVolEuoF3r +7hK+TMrOjOm+XZ/oyM2AlxiDGHtMMVkVs/m92jewUnyZoOYawCs0O/Eysri302Ve +e1S7oj67NRB2X/x98iejBYP76Y4ssJvKyYn96M+Va3B+SOfrdMLJwTUZxTQmFMmk +iJsyCM9b7ZNb745mClkcoTy22HtA0qtcnd/sZJ6ljOCe8RxA9fhFYu+5oO9SHQID +AQABo38wfTBcBgNVHREEVTBTgh5odHRwczovL3NoaWIucGRhcy5wcmlzbS5lb3gu +YXSGMWh0dHBzOi8vaHR0cHM6Ly9zaGliLnBkYXMucHJpc20uZW94LmF0L3NoaWJi +b2xldGgwHQYDVR0OBBYEFOj3ABr8n1Af0GDfg5+aYtGAFM3kMA0GCSqGSIb3DQEB +CwUAA4IBgQC9jN3ZLU6z6UCngdY16vlPdyMjIdko3/bstXlNWGvAwx0lPmPnV4b5 +ej+4l1vd3S3OAFYUKPJJG8rTInHt2tyYNIjytjIzYnonksdnS/iSlrd38q1FdWH8 +3ny1gyegunJutXqaFLHlBw77oNau8swXSegs/60pgYNNH+eMJbrToeAAM8zGqN1z +wXh4KWcwHmmH2ozJ468DYnv6I4/U9WydBoXNdQa3cKDv6/g4xfiyS4ByorVmNvOW +0C6OrCYwucS1CYxbmHk1E9ygIFEeKv1Z29leTIJxUHZXljfg7BDst2I2EfhyQ+fT +vB7rAipb+M2xckJJrCZJe5skBWsvP5ZcM3FA/GctWnc+5P/CO+2CZkdNFan7NBIx +focLOwyc7q3iCpqDxBY+EIkVlmSeg8mZdU9B9y0SkJxIcsePwSX8CSaFj5ndBY/T +aFiImaHsFzO4bZDEdaA0AdeJ5PalOTopbbVYO2FLMfvaXdu+GjDS6PGi/HrSX+P0 +FDXpx00p+0g= + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file -- GitLab From 85d24a59d1d4624e3cbda0fbd950c46a1b50f338 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Thu, 8 Oct 2020 23:53:11 +0200 Subject: [PATCH 043/162] https --- shibauth/shibboleth-conf/shibboleth2.xml | 4 ++-- shibauth/shibboleth-conf/sp-metadata.xml | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index 7bd47635..568b8f4d 100644 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -7,9 +7,9 @@ + checkAddress="false" handlerSSL="true" cookieProps="https"> - SAML2 + SAML2 SAML2 Local diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml index ef565636..25280b3d 100644 --- a/shibauth/shibboleth-conf/sp-metadata.xml +++ b/shibauth/shibboleth-conf/sp-metadata.xml @@ -25,7 +25,7 @@ and do *NOT* provide it in real time to your partners. - + @@ -70,15 +70,15 @@ FDXpx00p+0g= - - - - - - - - - + + + + + + + + + \ No newline at end of file -- GitLab From c79249027b5b11bbf04edfb6f810294fadc8e228 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Fri, 9 Oct 2020 00:00:34 +0200 Subject: [PATCH 044/162] test --- shibauth/etc-httpd/conf.d/shib.conf | 6 ------ shibauth/etc-httpd/conf.d/sp.conf | 13 +++++++++++++ 2 files changed, 13 insertions(+), 6 deletions(-) create mode 100644 shibauth/etc-httpd/conf.d/sp.conf diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf index 758f387c..191c4328 100644 --- a/shibauth/etc-httpd/conf.d/shib.conf +++ b/shibauth/etc-httpd/conf.d/shib.conf @@ -5,9 +5,3 @@ UseCanonicalName On SetHandler shib - - - AuthType shibboleth - ShibRequestSetting requireSession 1 - require shib-session - diff --git a/shibauth/etc-httpd/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/sp.conf new file mode 100644 index 00000000..9749dc2b --- /dev/null +++ b/shibauth/etc-httpd/conf.d/sp.conf @@ -0,0 +1,13 @@ +ServerName shib.pdas.prism.eox.at + + + ServerName https://shib.pdas.prism.eox.at:443 + UseCanonicalName On + + DocumentRoot "/var/www/html" + + AuthType shibboleth + ShibRequestSetting requireSession 1 + require shib-session + + \ No newline at end of file -- GitLab From 884634f171f18b0dd24f96bb536a81e1d437d8e0 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Fri, 9 Oct 2020 00:15:04 +0200 Subject: [PATCH 045/162] change modes for debugging --- shibauth/Dockerfile | 0 shibauth/etc-httpd/conf.d/shib.conf | 0 shibauth/etc-httpd/conf.d/sp.conf | 0 shibauth/index.html | 0 shibauth/shibboleth-conf/attribute-map.xml | 0 shibauth/shibboleth-conf/idp-metadata.xml | 0 shibauth/shibboleth-conf/shibboleth2.xml | 0 shibauth/shibboleth-conf/sp-metadata.xml | 0 8 files changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 shibauth/Dockerfile mode change 100644 => 100755 shibauth/etc-httpd/conf.d/shib.conf mode change 100644 => 100755 shibauth/etc-httpd/conf.d/sp.conf mode change 100644 => 100755 shibauth/index.html mode change 100644 => 100755 shibauth/shibboleth-conf/attribute-map.xml mode change 100644 => 100755 shibauth/shibboleth-conf/idp-metadata.xml mode change 100644 => 100755 shibauth/shibboleth-conf/shibboleth2.xml mode change 100644 => 100755 shibauth/shibboleth-conf/sp-metadata.xml diff --git a/shibauth/Dockerfile b/shibauth/Dockerfile old mode 100644 new mode 100755 diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf old mode 100644 new mode 100755 diff --git a/shibauth/etc-httpd/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/sp.conf old mode 100644 new mode 100755 diff --git a/shibauth/index.html b/shibauth/index.html old mode 100644 new mode 100755 diff --git a/shibauth/shibboleth-conf/attribute-map.xml b/shibauth/shibboleth-conf/attribute-map.xml old mode 100644 new mode 100755 diff --git a/shibauth/shibboleth-conf/idp-metadata.xml b/shibauth/shibboleth-conf/idp-metadata.xml old mode 100644 new mode 100755 diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml old mode 100644 new mode 100755 diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml old mode 100644 new mode 100755 -- GitLab From 0871f92585164a318b506aac331b275aecb3d242 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Fri, 9 Oct 2020 18:35:50 +0200 Subject: [PATCH 046/162] updating current progress --- docker-compose.base.ops.yml | 6 +++--- shibauth/etc-httpd/conf.d/shib.conf | 2 +- shibauth/etc-httpd/conf.d/sp.conf | 5 ++--- traefik-dynamic.yml | 2 +- 4 files changed, 7 insertions(+), 8 deletions(-) diff --git a/docker-compose.base.ops.yml b/docker-compose.base.ops.yml index 421d65ce..56a2e14f 100644 --- a/docker-compose.base.ops.yml +++ b/docker-compose.base.ops.yml @@ -19,7 +19,7 @@ services: environment: HTTP_PROXY: "http://172.30.252.68:3128" HTTPS_PROXY: "http://172.30.252.68:3128" - NO_PROXY: "172.0.0.0/8,192.168.0.0/16,10.0.0.0/8" + NO_PROXY: "172.0.0.0/8,192.168.0.0/16,10.0.0.0/8,shibauth" deploy: placement: constraints: [node.role == manager] @@ -37,13 +37,13 @@ services: constraints: [node.role == manager] labels: # router for basic auth based access (https) - - "traefik.http.routers.shibauth.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth.rule=Host(`emg.pdas.prism.eox.at`) && PathPrefix(`/secure`, `/Shibboleth.sso`)" - "traefik.http.routers.shibauth.middlewares=compress@file,cors@file" - "traefik.http.routers.shibauth.tls=true" - "traefik.http.routers.shibauth.tls.certresolver=default" - "traefik.http.routers.shibauth.entrypoints=https" # router for basic auth based access (http) - - "traefik.http.routers.shibauth-redirect.rule=Host(`shib.pdas.prism.eox.at`)" + - "traefik.http.routers.shibauth-redirect.rule=Host(`emg.pdas.prism.eox.at`) && PathPrefix(`/secure`, `/Shibboleth.sso`)" - "traefik.http.routers.shibauth-redirect.middlewares=redirect@file" - "traefik.http.routers.shibauth-redirect.entrypoints=http" # general diff --git a/shibauth/etc-httpd/conf.d/shib.conf b/shibauth/etc-httpd/conf.d/shib.conf index 191c4328..635aa462 100755 --- a/shibauth/etc-httpd/conf.d/shib.conf +++ b/shibauth/etc-httpd/conf.d/shib.conf @@ -1,4 +1,4 @@ -ServerName shib.pdas.prism.eox.at +ServerName emg.pdas.prism.eox.at LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so ShibCompatValidUser Off UseCanonicalName On diff --git a/shibauth/etc-httpd/conf.d/sp.conf b/shibauth/etc-httpd/conf.d/sp.conf index 9749dc2b..edfa7e84 100755 --- a/shibauth/etc-httpd/conf.d/sp.conf +++ b/shibauth/etc-httpd/conf.d/sp.conf @@ -1,7 +1,5 @@ -ServerName shib.pdas.prism.eox.at - - ServerName https://shib.pdas.prism.eox.at:443 + ServerName https://emg.pdas.prism.eox.at:443 UseCanonicalName On DocumentRoot "/var/www/html" @@ -9,5 +7,6 @@ ServerName shib.pdas.prism.eox.at AuthType shibboleth ShibRequestSetting requireSession 1 require shib-session + RequestHeader set Referer X-Forwarded-Uri env=X-Forwarded-Uri \ No newline at end of file diff --git a/traefik-dynamic.yml b/traefik-dynamic.yml index 896eaef8..495ef4eb 100644 --- a/traefik-dynamic.yml +++ b/traefik-dynamic.yml @@ -22,7 +22,7 @@ http: - "***REMOVED***" shibAuth: forwardAuth: - address: https://shibauth/secure + address: http://shibauth/secure trustForwardHeader: true compress: compress: {} -- GitLab From 239272ffad54e29c9dc199dc43cead751e70bba0 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Fri, 9 Oct 2020 18:38:10 +0200 Subject: [PATCH 047/162] add debug loggers --- shibauth/shibboleth-conf/native.logger | 41 ++++++++++++++ shibauth/shibboleth-conf/shibd.logger | 75 ++++++++++++++++++++++++++ traefik.yml | 2 +- 3 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 shibauth/shibboleth-conf/native.logger create mode 100644 shibauth/shibboleth-conf/shibd.logger diff --git a/shibauth/shibboleth-conf/native.logger b/shibauth/shibboleth-conf/native.logger new file mode 100644 index 00000000..d360b124 --- /dev/null +++ b/shibauth/shibboleth-conf/native.logger @@ -0,0 +1,41 @@ +# set overall behavior +log4j.rootCategory=DEBUG, native_log + +# fairly verbose for DEBUG, so generally leave at WARN/INFO +log4j.category.XMLTooling.XMLObject=WARN +log4j.category.XMLTooling.KeyInfoResolver=WARN +log4j.category.Shibboleth.IPRange=WARN +log4j.category.Shibboleth.PropertySet=WARN + +# raise for low-level tracing of SOAP client HTTP/SSL behavior +log4j.category.XMLTooling.libcurl=WARN + +# useful categories to tune independently: +# +# tracing of SAML messages and security policies +#log4j.category.OpenSAML.MessageDecoder=DEBUG +#log4j.category.OpenSAML.MessageEncoder=DEBUG +#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG +# interprocess message remoting +#log4j.category.Shibboleth.Listener=DEBUG +# mapping of requests to applicationId +#log4j.category.Shibboleth.RequestMapper=DEBUG +# high level session cache operations +#log4j.category.Shibboleth.SessionCache=DEBUG +# persistent storage and caching +#log4j.category.XMLTooling.StorageService=DEBUG + +# define the appender + +log4j.appender.native_log=org.apache.log4j.RollingFileAppender +log4j.appender.native_log.fileName=/dev/stdout +log4j.appender.native_log.maxFileSize=0 +log4j.appender.native_log.maxBackupIndex=0 +log4j.appender.native_log.layout=org.apache.log4j.PatternLayout +log4j.appender.native_log.layout.ConversionPattern=sp-native %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +#log4j.appender.warn_log=org.apache.log4j.RollingFileAppender +#log4j.appender.warn_log.fileName=/var/log/shibboleth-www/native_warn.log +#log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout +#log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n +#log4j.appender.warn_log.threshold=WARN diff --git a/shibauth/shibboleth-conf/shibd.logger b/shibauth/shibboleth-conf/shibd.logger new file mode 100644 index 00000000..c12b4089 --- /dev/null +++ b/shibauth/shibboleth-conf/shibd.logger @@ -0,0 +1,75 @@ +# set overall behavior +log4j.rootCategory=DEBUG, shibd_log, warn_log + +# fairly verbose for DEBUG, so generally leave at INFO +log4j.category.XMLTooling.XMLObject=INFO +log4j.category.XMLTooling.KeyInfoResolver=INFO +log4j.category.Shibboleth.IPRange=INFO +log4j.category.Shibboleth.PropertySet=INFO + +# raise for low-level tracing of SOAP client HTTP/SSL behavior +log4j.category.XMLTooling.libcurl=INFO + +# useful categories to tune independently: +# +# tracing of SAML messages and security policies +#log4j.category.OpenSAML.MessageDecoder=DEBUG +#log4j.category.OpenSAML.MessageEncoder=DEBUG +#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG +#log4j.category.XMLTooling.SOAPClient=DEBUG +# interprocess message remoting +#log4j.category.Shibboleth.Listener=DEBUG +# mapping of requests to applicationId +#log4j.category.Shibboleth.RequestMapper=DEBUG +# high level session cache operations +#log4j.category.Shibboleth.SessionCache=DEBUG +# persistent storage and caching +#log4j.category.XMLTooling.StorageService=DEBUG + +# logs XML being signed or verified if set to DEBUG +log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log +log4j.additivity.XMLTooling.Signature.Debugger=false +log4j.ownAppenders.XMLTooling.Signature.Debugger=true + +# the tran log blocks the "default" appender(s) at runtime +# Level should be left at INFO for this category +log4j.category.Shibboleth-TRANSACTION=INFO, tran_log +log4j.additivity.Shibboleth-TRANSACTION=false +log4j.ownAppenders.Shibboleth-TRANSACTION=true + +# uncomment to suppress particular event types +#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN +#log4j.category.Shibboleth-TRANSACTION.Login=WARN +#log4j.category.Shibboleth-TRANSACTION.Logout=WARN + +# define the appenders + +log4j.appender.shibd_log=org.apache.log4j.RollingFileAppender +log4j.appender.shibd_log.fileName=/dev/stdout +log4j.appender.shibd_log.maxFileSize=0 +log4j.appender.shibd_log.maxBackupIndex=0 +log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout +log4j.appender.shibd_log.layout.ConversionPattern=sp-shibd %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +#log4j.appender.warn_log=org.apache.log4j.RollingFileAppender +#log4j.appender.warn_log.fileName=/var/log/shibboleth/shibd_warn.log +#log4j.appender.warn_log.maxFileSize=0 +#log4j.appender.warn_log.maxBackupIndex=0 +#log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout +#log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n +#log4j.appender.warn_log.threshold=WARN + +log4j.appender.tran_log=org.apache.log4j.RollingFileAppender +log4j.appender.tran_log.fileName=/dev/stdout +log4j.appender.tran_log.maxFileSize=0 +log4j.appender.tran_log.maxBackupIndex=0 +log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout +log4j.appender.tran_log.layout.ConversionPattern=sp-transaction %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +log4j.appender.sig_log=org.apache.log4j.FileAppender +log4j.appender.sig_log.fileName=/dev/stdout +log4j.appender.sig_log.maxFileSize=0 +log4j.appender.sig_log.maxBackupIndex=0 +log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout +log4j.appender.sig_log.layout.ConversionPattern=sp-signature %m + diff --git a/traefik.yml b/traefik.yml index 2986bbf2..4a4135d7 100644 --- a/traefik.yml +++ b/traefik.yml @@ -19,7 +19,7 @@ providers: api: dashboard: true log: - level: WARN + level: DEBUG accessLog: {} certificatesResolvers: default: -- GitLab From 33e32828e996ecea73f0b39eec70b391b1b1c71e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Tue, 13 Oct 2020 14:33:27 +0200 Subject: [PATCH 048/162] fix client ingress --- chart/templates/client-deployment.yaml | 2 +- chart/templates/ingress.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/chart/templates/client-deployment.yaml b/chart/templates/client-deployment.yaml index 31e8ebd6..ae66fa84 100644 --- a/chart/templates/client-deployment.yaml +++ b/chart/templates/client-deployment.yaml @@ -1,4 +1,4 @@ -apiVersion: extensions/v1beta1 +apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "vs.fullname" . }}-client diff --git a/chart/templates/ingress.yaml b/chart/templates/ingress.yaml index 770ce776..deb7100d 100644 --- a/chart/templates/ingress.yaml +++ b/chart/templates/ingress.yaml @@ -43,12 +43,12 @@ spec: backend: serviceName: {{ $fullName }}-renderer servicePort: http + - path: /(.*) + backend: + serviceName: {{ $fullName }}-client + servicePort: http # - path: /cache/(.*) # backend: - # serviceName: cache - # servicePort: http - # - path: /(.*) - # backend: - # serviceName: client + # serviceName: {{ $fullName }}-cache # servicePort: http {{- end }} -- GitLab From fd01235df8c84dbe106a0bf464e14ff190d58a66 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 14 Oct 2020 12:52:11 +0200 Subject: [PATCH 049/162] test change to esa sso --- .../shibboleth-conf/idp-metadata-esa-test.xml | 116 ++++++++++++++++++ ...metadata.xml => idp-metadata_samltest.xml} | 0 shibauth/shibboleth-conf/shibboleth2.xml | 4 +- 3 files changed, 118 insertions(+), 2 deletions(-) create mode 100644 shibauth/shibboleth-conf/idp-metadata-esa-test.xml rename shibauth/shibboleth-conf/{idp-metadata.xml => idp-metadata_samltest.xml} (100%) diff --git a/shibauth/shibboleth-conf/idp-metadata-esa-test.xml b/shibauth/shibboleth-conf/idp-metadata-esa-test.xml new file mode 100644 index 00000000..647078b2 --- /dev/null +++ b/shibauth/shibboleth-conf/idp-metadata-esa-test.xml @@ -0,0 +1,116 @@ + + + + + + esa.int + + + + + + +MIIEQjCCAyqgAwIBAgIJAJw83mLahxpQMA0GCSqGSIb3DQEBBQUAMHMxCzAJBgNV +BAYTAklUMQ4wDAYDVQQIEwVMYXppbzENMAsGA1UEBxMEUm9tZTEZMBcGA1UEChMQ +Q0RTVjMgQ29uc29ydGl1bTEOMAwGA1UECxMFU3BhY2UxGjAYBgNVBAMTEXVtc3Nv +aWRwLmNkc3YzLmV1MB4XDTE1MDQwMjE2Mzg1M1oXDTI1MDMzMDE2Mzg1M1owczEL +MAkGA1UEBhMCSVQxDjAMBgNVBAgTBUxhemlvMQ0wCwYDVQQHEwRSb21lMRkwFwYD +VQQKExBDRFNWMyBDb25zb3J0aXVtMQ4wDAYDVQQLEwVTcGFjZTEaMBgGA1UEAxMR +dW1zc29pZHAuY2RzdjMuZXUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQCrDTGZEQj7uMw347TnyMac0HnkLY046e/4V+boJBuQsP7Moxh6xHH2qcdS2UbW +xtSBOUuS/aAz92udzY8wBrKUUvvWKEnyh3v84+kfNYugBp4ZpW7pJbfUh9KjUvWh +G3LtZfyuRaCdyYF6TKh0K+96IRSpwe5wFXqRev7a6+8fDcTL73cFFBLjDaMFelIz +szskhsGalXAq5WP20aDog0eiEbf8oTa5NDPY1UZDnwDmF0lNDm4lsYGAv59h+8kU +ODGmmGVo5zrz7ujcU1sChc9iy9GlGEzekFAoEj6y9fbieyE4Wz6QW4nLeO1YZtjz +kvOi6yp2raNQSI4hwVEWNDK/AgMBAAGjgdgwgdUwHQYDVR0OBBYEFKXpmub0bNGS +gtwbyAUqu2kD1e8WMIGlBgNVHSMEgZ0wgZqAFKXpmub0bNGSgtwbyAUqu2kD1e8W +oXekdTBzMQswCQYDVQQGEwJJVDEOMAwGA1UECBMFTGF6aW8xDTALBgNVBAcTBFJv +bWUxGTAXBgNVBAoTEENEU1YzIENvbnNvcnRpdW0xDjAMBgNVBAsTBVNwYWNlMRow +GAYDVQQDExF1bXNzb2lkcC5jZHN2My5ldYIJAJw83mLahxpQMAwGA1UdEwQFMAMB +Af8wDQYJKoZIhvcNAQEFBQADggEBAGMnf0UOmtKB2VF/TsjG1Lz7fJ48sySGC9R6 +TLy3lbUplogZsIBdt/cc+DP6O6l2z16hDb9B0X9QjJjO1qvM4oQPjlm8dZGCnyFV +EsstRM9EgOdnFIh16+q6x+u6c2XhnnLDdRsjsP7p53dT+iShgjI448voZDE3DLcs +b2eQu+iN5rmNfvg6DdaP/+2cvkoMvKL5dF+YRk5KNLn2vHi3Fti6uIpWAfgiICHr +dadCFX5qVlnadZP9Av35lM4VaDz+5eOFvjl1G+7+yEyaoi/m6gjrgrOI4Mqc1zcu +DhMOi9NqX4P9LSI1seXUf0feKA5wB+ei7MgqSSpooJc2PEnFyRg= + + + + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + esa.int + + + + + + +MIIEQjCCAyqgAwIBAgIJAJw83mLahxpQMA0GCSqGSIb3DQEBBQUAMHMxCzAJBgNV +BAYTAklUMQ4wDAYDVQQIEwVMYXppbzENMAsGA1UEBxMEUm9tZTEZMBcGA1UEChMQ +Q0RTVjMgQ29uc29ydGl1bTEOMAwGA1UECxMFU3BhY2UxGjAYBgNVBAMTEXVtc3Nv +aWRwLmNkc3YzLmV1MB4XDTE1MDQwMjE2Mzg1M1oXDTI1MDMzMDE2Mzg1M1owczEL +MAkGA1UEBhMCSVQxDjAMBgNVBAgTBUxhemlvMQ0wCwYDVQQHEwRSb21lMRkwFwYD +VQQKExBDRFNWMyBDb25zb3J0aXVtMQ4wDAYDVQQLEwVTcGFjZTEaMBgGA1UEAxMR +dW1zc29pZHAuY2RzdjMuZXUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQCrDTGZEQj7uMw347TnyMac0HnkLY046e/4V+boJBuQsP7Moxh6xHH2qcdS2UbW +xtSBOUuS/aAz92udzY8wBrKUUvvWKEnyh3v84+kfNYugBp4ZpW7pJbfUh9KjUvWh +G3LtZfyuRaCdyYF6TKh0K+96IRSpwe5wFXqRev7a6+8fDcTL73cFFBLjDaMFelIz +szskhsGalXAq5WP20aDog0eiEbf8oTa5NDPY1UZDnwDmF0lNDm4lsYGAv59h+8kU +ODGmmGVo5zrz7ujcU1sChc9iy9GlGEzekFAoEj6y9fbieyE4Wz6QW4nLeO1YZtjz +kvOi6yp2raNQSI4hwVEWNDK/AgMBAAGjgdgwgdUwHQYDVR0OBBYEFKXpmub0bNGS +gtwbyAUqu2kD1e8WMIGlBgNVHSMEgZ0wgZqAFKXpmub0bNGSgtwbyAUqu2kD1e8W +oXekdTBzMQswCQYDVQQGEwJJVDEOMAwGA1UECBMFTGF6aW8xDTALBgNVBAcTBFJv +bWUxGTAXBgNVBAoTEENEU1YzIENvbnNvcnRpdW0xDjAMBgNVBAsTBVNwYWNlMRow +GAYDVQQDExF1bXNzb2lkcC5jZHN2My5ldYIJAJw83mLahxpQMAwGA1UdEwQFMAMB +Af8wDQYJKoZIhvcNAQEFBQADggEBAGMnf0UOmtKB2VF/TsjG1Lz7fJ48sySGC9R6 +TLy3lbUplogZsIBdt/cc+DP6O6l2z16hDb9B0X9QjJjO1qvM4oQPjlm8dZGCnyFV +EsstRM9EgOdnFIh16+q6x+u6c2XhnnLDdRsjsP7p53dT+iShgjI448voZDE3DLcs +b2eQu+iN5rmNfvg6DdaP/+2cvkoMvKL5dF+YRk5KNLn2vHi3Fti6uIpWAfgiICHr +dadCFX5qVlnadZP9Av35lM4VaDz+5eOFvjl1G+7+yEyaoi/m6gjrgrOI4Mqc1zcu +DhMOi9NqX4P9LSI1seXUf0feKA5wB+ei7MgqSSpooJc2PEnFyRg= + + + + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + diff --git a/shibauth/shibboleth-conf/idp-metadata.xml b/shibauth/shibboleth-conf/idp-metadata_samltest.xml similarity index 100% rename from shibauth/shibboleth-conf/idp-metadata.xml rename to shibauth/shibboleth-conf/idp-metadata_samltest.xml diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index 568b8f4d..424920c7 100755 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -8,7 +8,7 @@ REMOTE_USER="eppn uid persistent-id targeted-id"> - + SAML2 SAML2 Local @@ -19,7 +19,7 @@ - + -- GitLab From 289e44b31a7b7d27a348f56f593781269370a49a Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 14 Oct 2020 13:08:49 +0200 Subject: [PATCH 050/162] update certs with emg url as source --- shibauth/shibboleth-conf/shibboleth2.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shibauth/shibboleth-conf/shibboleth2.xml b/shibauth/shibboleth-conf/shibboleth2.xml index 424920c7..e3a18eaf 100755 --- a/shibauth/shibboleth-conf/shibboleth2.xml +++ b/shibauth/shibboleth-conf/shibboleth2.xml @@ -4,7 +4,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180"> - -- GitLab From 3c0266a6bcb2faf30b87987eb00f7542dc1eb398 Mon Sep 17 00:00:00 2001 From: Lubomir Bucek Date: Wed, 14 Oct 2020 13:32:38 +0200 Subject: [PATCH 051/162] fix --- shibauth/shibboleth-conf/sp-metadata.xml | 76 ++++++++++++------------ 1 file changed, 38 insertions(+), 38 deletions(-) mode change 100755 => 100644 shibauth/shibboleth-conf/sp-metadata.xml diff --git a/shibauth/shibboleth-conf/sp-metadata.xml b/shibauth/shibboleth-conf/sp-metadata.xml old mode 100755 new mode 100644 index 25280b3d..28a4e91f --- a/shibauth/shibboleth-conf/sp-metadata.xml +++ b/shibauth/shibboleth-conf/sp-metadata.xml @@ -2,7 +2,7 @@ This is example metadata only. Do *NOT* supply it as is without review, and do *NOT* provide it in real time to your partners. --> - + @@ -25,38 +25,38 @@ and do *NOT* provide it in real time to your partners. - + - https://https://shib.pdas.prism.eox.at/shibboleth - https://shib.pdas.prism.eox.at + https://emg.pdas.prism.eox.at + https://https://emg.pdas.prism.eox.at/shibboleth - CN=https://shib.pdas.prism.eox.at - MIIEVDCCArygAwIBAgIJANYdDHsBg6ulMA0GCSqGSIb3DQEBCwUAMCkxJzAlBgNV -BAMTHmh0dHBzOi8vc2hpYi5wZGFzLnByaXNtLmVveC5hdDAeFw0yMDEwMDgxNDI2 -MjBaFw0zMDEwMDYxNDI2MjBaMCkxJzAlBgNVBAMTHmh0dHBzOi8vc2hpYi5wZGFz -LnByaXNtLmVveC5hdDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMKW -psgoJpT33XXQDzFiWXPkTW8deYIjaRN4iXuVpMa9/RpuQsSTTPCxwFXhp31lgsay -3DA3WNK5KVCx5ccnLbb5CiuZBrzFFttfzK1LIgf0rieGtpFj0cTEQwfFGM+3T/5p -cdTi/CyT7xUCGOn6rzU9NjIpQ7Z0DrIkN4vcRbljExMALZwrfg0E00JB/rg7nUga -Tc5rkM8DuqsvOe9IfRv9ZOe2sDimido13jzhE/Y/NTHtq8qleVxeT42P/hiZlJX4 -rioMtigG7nXmz0/6nfBR3y2tnViWURNF3DXy+7BAKIfTUU5Dy8diFpPVolEuoF3r -7hK+TMrOjOm+XZ/oyM2AlxiDGHtMMVkVs/m92jewUnyZoOYawCs0O/Eysri302Ve -e1S7oj67NRB2X/x98iejBYP76Y4ssJvKyYn96M+Va3B+SOfrdMLJwTUZxTQmFMmk -iJsyCM9b7ZNb745mClkcoTy22HtA0qtcnd/sZJ6ljOCe8RxA9fhFYu+5oO9SHQID -AQABo38wfTBcBgNVHREEVTBTgh5odHRwczovL3NoaWIucGRhcy5wcmlzbS5lb3gu -YXSGMWh0dHBzOi8vaHR0cHM6Ly9zaGliLnBkYXMucHJpc20uZW94LmF0L3NoaWJi -b2xldGgwHQYDVR0OBBYEFOj3ABr8n1Af0GDfg5+aYtGAFM3kMA0GCSqGSIb3DQEB -CwUAA4IBgQC9jN3ZLU6z6UCngdY16vlPdyMjIdko3/bstXlNWGvAwx0lPmPnV4b5 -ej+4l1vd3S3OAFYUKPJJG8rTInHt2tyYNIjytjIzYnonksdnS/iSlrd38q1FdWH8 -3ny1gyegunJutXqaFLHlBw77oNau8swXSegs/60pgYNNH+eMJbrToeAAM8zGqN1z -wXh4KWcwHmmH2ozJ468DYnv6I4/U9WydBoXNdQa3cKDv6/g4xfiyS4ByorVmNvOW -0C6OrCYwucS1CYxbmHk1E9ygIFEeKv1Z29leTIJxUHZXljfg7BDst2I2EfhyQ+fT -vB7rAipb+M2xckJJrCZJe5skBWsvP5ZcM3FA/GctWnc+5P/CO+2CZkdNFan7NBIx -focLOwyc7q3iCpqDxBY+EIkVlmSeg8mZdU9B9y0SkJxIcsePwSX8CSaFj5ndBY/T -aFiImaHsFzO4bZDEdaA0AdeJ5PalOTopbbVYO2FLMfvaXdu+GjDS6PGi/HrSX+P0 -FDXpx00p+0g= + CN=https://emg.pdas.prism.eox.at + MIIEUDCCArigAwIBAgIJAJtainQ0t+tRMA0GCSqGSIb3DQEBCwUAMCgxJjAkBgNV +BAMTHWh0dHBzOi8vZW1nLnBkYXMucHJpc20uZW94LmF0MB4XDTIwMTAxNDExMjcy +MFoXDTMwMTAxMjExMjcyMFowKDEmMCQGA1UEAxMdaHR0cHM6Ly9lbWcucGRhcy5w +cmlzbS5lb3guYXQwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDKkqzn +QsDnXSa+BHA10ZVkvw/PBfJVsby1C+zazCo32GpIHv5P+RFZj3FoC+N+gYatqijZ +57flt93krtqO/l/RrEosxwpWCXc54qXcFrPrlfXFr51dOW/BH6z1wpW9z67Pkr2M +v8Jqgs0t/k8BFlZ2jmiAZGrG+G+DrCefiy9JuKwBSiVh7Tg5P31fZv0qliNKwo5k +EbkeUuVrAvuNFV9NPdl35aevYZ0Mxy5N+/AbaaZScfmRnlTsRdHXL/k5anIceqk3 +k+qA1cHEXXqD7WtfQN4GQh9Oxqng//PBcH/9oe2h5axrkcw8YCC22YXp/OST4isk +lL1noCuRYPluvVDFqrh6z9S94QFuO3PdUckl7S7Gsty6X0MSYPYpBFZgivalIena +2vLC3sn5AGLrm3xmp4Io/iD0UtpnHHypCRghr8GE/yiZKPtq8bEk5d/NWMRgT5Ef +t77vZByeDxgN0Pl5gf8WtN0yKSPauxS3llNy9UFfoQP9OGV3FjzOo3DGuTUCAwEA +AaN9MHswWgYDVR0RBFMwUYIdaHR0cHM6Ly9lbWcucGRhcy5wcmlzbS5lb3guYXSG +MGh0dHBzOi8vaHR0cHM6Ly9lbWcucGRhcy5wcmlzbS5lb3guYXQvc2hpYmJvbGV0 +aDAdBgNVHQ4EFgQUzMF2sJVjzVscd6vLPMLWx2gD4uEwDQYJKoZIhvcNAQELBQAD +ggGBAIFFdjkcQyTWx30mwuJON4Bfi0IjBXyQ7YnbvB36sk9ohaPBz4uU1wKl5In+ +c/usuBgHS9JsBm2JIwnLKko6dS8h79pMnY8rDZxBxAPHkTUwTvzMraWHNXhblO9U +Oqp2NJqy4hyV1OzDWM5yYHiTSZIOewDS8inUvoDwUSYgQr9fSKljUmeI0In9f6wf +vvHA4hQQHVGYMNPO+rvpw8XeWZ8e+HdSxSM1RcL1m29s42HdycXTsmh4ghex4u16 +XvHNMGojW6ih0Oja69PKCraaLTUHPRjxwqx1ipaNbK/1pT7DPnLXHNGIOFW2JE9e +XIi3xy/d+C2Z/Ejwt4Xd+FVA9mhhbLkss7YI+SMJi73e31//sBiKOXBT1yBv8l0n +xTJsPmg2dbWQvNuJ89UIH8yPffcxdbT0xohgOiek+hBxZj0UU1ZSV5q2/X9aPKGZ +PMQ/PFgQJvdjegNZPupgBspcNlvYsdtln9vvyXWoNsNioSa6Uvntb8KEHnnh035S +VorGcA== @@ -70,15 +70,15 @@ FDXpx00p+0g= - - - - - - - - - + + + + + + + + + \ No newline at end of file -- GitLab From d803c8ea8a08473c5ab851a196a283fd74db9c07 Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Tue, 20 Oct 2020 13:35:47 +0200 Subject: [PATCH 052/162] Initial implementation of modular registrar --- core/registrar/__init__.py | 0 core/registrar/backend.py | 138 ++++++++++++++++++++++ core/registrar/context.py | 13 +++ core/registrar/exceptions.py | 4 + core/registrar/registrar.py | 52 +++++++++ core/registrar/scheme.py | 99 ++++++++++++++++ core/registrar/source.py | 214 +++++++++++++++++++++++++++++++++++ core/registrar/utils.py | 0 core/registrar/xml.py | 37 ++++++ 9 files changed, 557 insertions(+) create mode 100644 core/registrar/__init__.py create mode 100644 core/registrar/backend.py create mode 100644 core/registrar/context.py create mode 100644 core/registrar/exceptions.py create mode 100644 core/registrar/registrar.py create mode 100644 core/registrar/scheme.py create mode 100644 core/registrar/source.py create mode 100644 core/registrar/utils.py create mode 100644 core/registrar/xml.py diff --git a/core/registrar/__init__.py b/core/registrar/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/core/registrar/backend.py b/core/registrar/backend.py new file mode 100644 index 00000000..b20c0396 --- /dev/null +++ b/core/registrar/backend.py @@ -0,0 +1,138 @@ +import os +import re +import sys +import logging + +import django +from django.db import transaction +from django.contrib.gis.geos import GEOSGeometry +from eoxserver.resources.coverages import models +from eoxserver.resources.coverages.registration.product import ProductRegistrator +from eoxserver.resources.coverages.registration.browse import BrowseRegistrator +from eoxserver.resources.coverages.registration.mask import MaskRegistrator +from eoxserver.resources.coverages.registration.registrators.gdal import GDALRegistrator + +from .exceptions import RegistrationError +from .context import Context +from .source import Source + + +logger = logging.getLogger(__name__) + +class RegistrationResult: + pass + + +class Backend: + def register_item(self, item: Context) -> RegistrationResult: + raise NotImplementedError + + +class EOxServerBackend(Backend): + def __init__(self, instance_base_path: str, instance_name: str, mapping: dict, simplify_footprint_tolerance: int=None): + self.mapping = mapping + self.simplify_footprint_tolerance = simplify_footprint_tolerance + path = os.path.join(instance_base_path, instance_name) + if path not in sys.path: + sys.path.append(path) + + os.environ.setdefault("DJANGO_SETTINGS_MODULE", f"{instance_name}.settings") # TODO: from config + django.setup() + + def exists(self, source: Source, item: Context): + return models.Product.objects.filter(identifier=item.itentifier).exists() + + def _get_storage_from_source(self, source: Source) -> list: + return [] + + @transaction.atomic + def register(self, source: Source, item: Context, replace: bool) -> RegistrationResult: + # get the mapping for this particular item + mapping = self.mapping.get(item.product_type, {}).get(item.level_name) + metadata_file = item.metadata_files[0] + + storage = self._get_storage_from_source(source) + + try: + models.ProductType.objects.get(name=item['product_type_name']) + except models.ProductType.DoesNotExist: + pass + + product, _ = ProductRegistrator().register( + metadata_locations=[storage + [metadata_file]], + type_name=item['product_type_name'], + replace=replace, + extended_metadata=True, + mask_locations=None, + package_path=None, + simplify_footprint_tolerance=self.simplify_footprint_tolerance, + overrides=item.metadata, + ) + if product.footprint.empty: + raise RegistrationError("No footprint was extracted. full product: %s" % product) + + # insert the product in the to be associated collections + for collection_id in mapping.get('collections', []): + collection = models.Collection.objects.get( + identifier=collection_id, + ) + models.collection_insert_eo_object(collection, product) + + # register coverages and link them to the product + for raster_identifier, coverage_type_name in mapping.get('coverages', {}).items(): + raster_item = item.raster_files.get(raster_identifier) + + report = GDALRegistrator().register( + data_locations=[storage + [raster_item]], + metadata_locations=[storage + [metadata_file]], + coverage_type_name=coverage_type_name, + overrides={ + "identifier": f'{product.identifier}__{raster_identifier}__coverage', + "footprint": None, + }, + replace=replace, + ) + logger.debug("Adding coverage to product") + models.product_add_coverage(product, report.coverage) + + # register browses + for raster_identifier, browse_type_name in mapping.get('browses', {}): + raster_item = item.raster_files.get(raster_identifier) + BrowseRegistrator().register( + product.identifier, + storage + [raster_item], + browse_type_name, + ) + + # register masks + for mask_identifier, mask_type_name in mapping.get('masks', {}): + mask_item = item.mask_files.get(mask_identifier) + MaskRegistrator().register( + product.identifier, + storage + [mask_item], + mask_type_name, + ) + + +BACKENDS = { + 'eoxserver': EOxServerBackend +} + +def get_backend(config: dict, path: str) -> Backend: + cfg_backends = config['backends'] + + for cfg_backend in cfg_backends: + if cfg_backend['filter']: + if re.match(cfg_backend['filter'], path): + break + else: + break + else: + # no source found + raise RegistrationError(f'Could not find a suitable backend for the path {path}') + + return BACKENDS[cfg_backend['type']]( + *cfg_backend.get('args', []), + **cfg_backend.get('kwargs', {}), + ) + diff --git a/core/registrar/context.py b/core/registrar/context.py new file mode 100644 index 00000000..81ded127 --- /dev/null +++ b/core/registrar/context.py @@ -0,0 +1,13 @@ +from dataclasses import dataclass, field + + +@dataclass +class Context: + identifier: str + product_type: str = None + product_level: str = None + metadata: dict = field(default_factory=dict) + raster_files: dict = field(default_factory=dict) + metadata_files: dict = field(default_factory=dict) + masks: dict = field(default_factory=dict) + mask_files: dict = field(default_factory=dict) diff --git a/core/registrar/exceptions.py b/core/registrar/exceptions.py new file mode 100644 index 00000000..81a2e41e --- /dev/null +++ b/core/registrar/exceptions.py @@ -0,0 +1,4 @@ + + +class RegistrationError(Exception): + pass diff --git a/core/registrar/registrar.py b/core/registrar/registrar.py new file mode 100644 index 00000000..53e2379e --- /dev/null +++ b/core/registrar/registrar.py @@ -0,0 +1,52 @@ +import re + +from .source import get_source +from .exceptions import RegistrationError + + + +def register(config, path): + # TODO: select registration scheme (config, path) + source = get_source(config, path) + scheme = select_registation_scheme(config, path) + context = scheme.get_context(source, path) + + for pre_handler in get_pre_handlers(config): + pre_handler(config, path, context) + + for backend in get_backends(config): + if backend.exists(source, context): + if config.replace: + backend.register(source, context, replace=True) + else: + raise RegistrationError(f'Object {context} is already registered') + else: + backend.register(source, context, replace=False) + + for post_handler in get_post_handlers(config): + post_handler(config, path, context) + + +def select_registation_scheme(config, path): + cfg_schemes = config['schemes'] + for cfg_scheme in cfg_schemes: + if cfg_scheme['filter']: + if re.match(cfg_scheme['filter'], path): + break + else: + break + else: + # no source found + raise RegistrationError(f'Could not find a suitable scheme for the path {path}') + + +def get_pre_handlers(config): + pass + + +def get_post_handlers(config): + pass + + +def get_backends(config): + pass diff --git a/core/registrar/scheme.py b/core/registrar/scheme.py new file mode 100644 index 00000000..d68a911a --- /dev/null +++ b/core/registrar/scheme.py @@ -0,0 +1,99 @@ +import re + +from os.path import join + +from .xml import read_xml, parse_metadata_schema, Parameter +from .context import Context +from .exceptions import RegistrationError + + +class RegistrationScheme: + def __init__(self, source, path): + self.source = source + self.path = path + + def get_context(self): + raise NotImplementedError + + + + +class Sentinel2RegistrationScheme(RegistrationScheme): + MTD_TL_SCHEMA = { + 'begin_time': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/PRODUCT_START_TIME/text()', False, parse_datetime), + 'end_time': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/PRODUCT_STOP_TIME/text()', False, parse_datetime), + 'identifier': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/PRODUCT_URI/text()'), + 'level': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/PROCESSING_LEVEL/text()'), + 'type': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/PRODUCT_TYPE/text()'), + 'generation_time': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/GENERATION_TIME/text()', False, parse_datetime), + 'cloud_cover': Parameter('/n1:Level-2A_User_Product/n1:Quality_Indicators_Info/Cloud_Coverage_Assessment'), + 'image_file_paths': Parameter('/n1:Level-2A_User_Product/n1:General_Info/Product_Info/Product_Organisation/Granule_List/Granule/IMAGE_FILE/text()', True), + 'mask_file_paths': Parameter('/n1:Level-2A_Tile_ID/n1:Quality_Indicators_Info/Pixel_Level_QI/MASK_FILENAME', True), + } + + S2_NAMESPACES = { + 'n1': "https://psd-14.sentinel2.eo.esa.int/PSD/User_Product_Level-2A.xsd" + } + + def get_context(self): + metadata_file = join(self.path, 'MTD_TL.xml') + mtd_tree = read_xml(self.source, metadata_file) + + # get MTD metadata + + metadata = parse_metadata_schema(mtd_tree, self.MTD_TL_SCHEMA, self.S2_NAMESPACES) + + band_re = re.compile(r'.*([A-Z0-9]{3})_([0-9]{2}m)$') + raster_files = { + band_re.match(image_file_path).groups()[0]: f'{join(self.path, image_file_path)}.jp2' + for image_file_path in metadata['image_file_paths'] + } + + mask_type_re = re.compile(r'.*/MSK_([A-Z]*)_([A-Z0-9]{3}).[a-z0-9]+$') + mask_files = { + mask_type_re.match(mask_file_path).groups[0]: mask_file_path + for mask_file_path in metadata['mask_file_paths'] + } + + return Context( + identifier=metadata['identifier'], + raster_files=raster_files, + mask_files=mask_files, + metadata_files=[metadata_file], + metadata={ + 'begin_time': metadata['begin_time'], + 'end_time': metadata['end_time'], + 'generation_time': metadata['generation_time'], + 'cloud_cover': metadata['cloud_cover'], + } + ) + + + +class GSCRegistrationScheme(RegistrationScheme): + pass + + +REGISTRATION_SCHEMES = { + 'gsc': GSCRegistrationScheme, + 'sentinel-2': Sentinel2RegistrationScheme, +} + +def get_scheme(config: dict, path: str) -> RegistrationScheme: + cfg_schemes = config['schemes'] + + for cfg_scheme in cfg_schemes: + if cfg_scheme['filter']: + if re.match(cfg_scheme['filter'], path): + break + else: + break + else: + # no source found + raise RegistrationError(f'Could not find a suitable scheme for the path {path}') + + return REGISTRATION_SCHEMES[cfg_scheme['type']]( + *cfg_scheme.get('args', []), + **cfg_scheme.get('kwargs', {}), + ) + diff --git a/core/registrar/source.py b/core/registrar/source.py new file mode 100644 index 00000000..2230ee2a --- /dev/null +++ b/core/registrar/source.py @@ -0,0 +1,214 @@ +import re +from os.path import normpath, join, isabs +import shutil +from glob import glob +from fnmatch import fnmatch + +import boto3 +from swiftclient.multithreading import OutputManager +from swiftclient.service import SwiftError, SwiftService + + +class RegistrationError(Exception): + pass + + +class Source: + def list_files(self, path, glob_pattern=None): + raise NotImplementedError + + def get_file(self, path, target_path): + raise NotImplementedError + + def get_vsi_env_and_path(self, path): + raise NotImplementedError + + +class SwiftSource(Source): + def __init__(self, username=None, password=None, tenant_name=None, + tenant_id=None, region_name=None, user_domain_id=None, + user_domain_name=None, auth_url=None, auth_version=None, + container=None): + self.username = username + self.password = password + self.tenant_name = tenant_name + self.tenant_id = tenant_id + self.region_name = region_name + self.user_domain_id = user_domain_id + self.user_domain_name = user_domain_name + self.auth_url = auth_url + self.auth_version = auth_version # TODO: assume 3 + self.container = container + + def get_service(self): + return SwiftService(options={ + "os_username": self.username, + "os_password": self.password, + "os_tenant_name": self.tenant_name, + "os_tenant_id": self.tenant_id, + "os_region_name": self.region_name, + "os_auth_url": self.auth_url, + "auth_version": self.auth_version, + "os_user_domain_id": self.user_domain_id, + "os_user_domain_name": self.user_domain_name, + }) + + def get_container_and_path(self, path: str): + container = self.container + if container is None: + parts = (path[1:] if path.startswith('/') else path).split('/') + container, path = parts[0], parts[1:].join('/') + + return container, path + + + def list_files(self, path, glob_pattern=None): + container, path = self.get_container_and_path(path) + + with self.get_service() as swift: + pages = swift.list( + container=container, + options={"prefix": path}, + ) + + filenames = [] + for page in pages: + if page["success"]: + # at least two files present -> pass validation + for item in page["listing"]: + if glob_pattern is None or fnmatch(item['name'], glob_pattern): + filenames.append(item['name']) + else: + raise page['error'] + + return filenames + + def get_file(self, path, target_path): + container, path = self.get_container_and_path(path) + + with self.get_service() as swift: + results = swift.download( + container, + [path], + options={ + 'out_file': target_path + } + ) + + for result in results: + if not result["success"]: + raise Exception('Failed to download %s' % path) + + def get_vsi_env_and_path(self, path): + container, path = self.get_container_and_path(path) + return { + 'OS_IDENTITY_API_VERSION': self.auth_version, + 'OS_AUTH_URL': self.auth_url, + 'OS_USERNAME': self.username, + 'OS_PASSWORD': self.password, + 'OS_USER_DOMAIN_NAME': self.user_domain_name, + # 'OS_PROJECT_NAME': self.tena, + # 'OS_PROJECT_DOMAIN_NAME': , + 'OS_REGION_NAME': self.region_name, + }, f'/vsiswift/{container}/{path}' + + +class S3Source(Source): + def __init__(self, bucket_name=None, secret_access_key=None, access_key_id=None, endpoint_url=None, **client_kwargs): + # see https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html#boto3.session.Session.client + # for client_kwargs + self.bucket_name = bucket_name + self.secret_access_key=secret_access_key + self.access_key_id=access_key_id + self.endpoint_url = endpoint_url + + self.client = boto3.client( + 's3', + aws_secret_access_key=secret_access_key, + aws_access_key_id=access_key_id, + endpoint_url=endpoint_url, + **client_kwargs, + ) + + def get_bucket_and_key(self, path: str): + container = self.bucket_name + if container is None: + parts = (path[1:] if path.startswith('/') else path).split('/') + container, path = parts[0], parts[1:].join('/') + + return container, path + + def list_files(self, path, glob_pattern=None): + bucket, key = self.get_bucket_and_key(path) + response = self.client.list_objects_v2( + Bucket=bucket, + Prefix=key, + ) + + return [ + item['Key'] + for item in response['Contents'] + if glob_pattern is None or fnmatch(item['Key'], glob_pattern) + ] + + def get_file(self, path, target_path): + bucket, key = self.get_bucket_and_key(path) + self.client.download_file(bucket, key, target_path) + + def get_vsi_env_and_path(self, path: str, streaming: bool=False): + bucket, key = self.get_bucket_and_key(path) + return { + 'AWS_SECRET_ACCESS_KEY': self.secret_access_key, + 'AWS_ACCESS_KEY_ID': self.access_key_id, + 'AWS_S3_ENDPOINT': self.endpoint_url, + }, f'/{"vsis3" if not streaming else "vsis3_streaming"}/{bucket}/{key}' + + +class LocalSource(Source): + def __init__(self, root_directory): + self.root_directory = root_directory + + def _join_path(self, path): + path = normpath(path) + if isabs(path): + path = path[1:] + + return join(self.root_directory, path) + + def list_files(self, path, glob_pattern=None): + if glob_pattern is not None: + return glob(join(self._join_path(path), glob_pattern)) + else: + return glob(join(self._join_path(path), '*')) + + def get_file(self, path, target_path): + shutil.copy(self._join_path(path), target_path) + + def get_vsi_env_and_path(self, path): + return {}, self._join_path(path) + + +SOURCE_TYPES = { + 'swift': SwiftSource, + 's3': S3Source, + 'local': LocalSource, +} + + +def get_source(config: dict, path: str) -> Source: + cfg_sources = config['sources'] + + for cfg_source in cfg_sources: + if cfg_source['filter']: + if re.match(cfg_source['filter'], path): + break + else: + break + else: + # no source found + raise RegistrationError(f'Could not find a suitable source for the path {path}') + + return SOURCE_TYPES[cfg_source['type']]( + *cfg_source.get('args', []), + **cfg_source.get('kwargs', {}) + ) diff --git a/core/registrar/utils.py b/core/registrar/utils.py new file mode 100644 index 00000000..e69de29b diff --git a/core/registrar/xml.py b/core/registrar/xml.py new file mode 100644 index 00000000..4a088b26 --- /dev/null +++ b/core/registrar/xml.py @@ -0,0 +1,37 @@ +from tempfile import NamedTemporaryFile +from dataclasses import dataclass, field +from typing import Union, Type, Optional, List, Callable, Any + +import lxml.etree + +from .source import Source + + +def read_xml(source: Source, path: str) -> lxml.etree._ElementTree: + with NamedTemporaryFile() as f: + source.get_file(path, f.name) + return lxml.etree.parse(f) + +@dataclass +class Parameter: + xpath: str + multi: bool = False + parser: Optional[Callable[[str], Any]] = None + namespaces: dict = field(default_factory=dict) + + +def parse_metadata_schema(tree: lxml.etree._ElementTree, schema: dict, namespaces: dict=None) -> dict: + out = {} + for key, param in schema.items(): + values = tree.xpath(param.xpath, namespaces=param.namespaces or namespaces) + if param.multi: + value = [ + param.parser(v) if param.parser else v + for v in values + ] + else: + value = param.parser(values[0]) if param.parser else values[0] + + out[key] = value + + return out -- GitLab From 882c1aef96f1e806ea7abae753e38ea2045a36f7 Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Tue, 20 Oct 2020 16:07:04 +0200 Subject: [PATCH 053/162] Adding CLI and daemon files Adding config schema --- core/registrar/cli.py | 80 +++++++++++++++++++++++++++++++ core/registrar/config-schema.yaml | 67 ++++++++++++++++++++++++++ core/registrar/config.py | 39 +++++++++++++++ core/registrar/daemon.py | 26 ++++++++++ core/registrar/registrar.py | 20 ++------ 5 files changed, 215 insertions(+), 17 deletions(-) create mode 100644 core/registrar/cli.py create mode 100644 core/registrar/config-schema.yaml create mode 100644 core/registrar/config.py create mode 100644 core/registrar/daemon.py diff --git a/core/registrar/cli.py b/core/registrar/cli.py new file mode 100644 index 00000000..2703bdf8 --- /dev/null +++ b/core/registrar/cli.py @@ -0,0 +1,80 @@ +from os.path import join, dirname +import logging.config +import json + +import click +import yaml +import jsonschema + +from .registrar import register_file +from .daemon import run_daemon +from .config import load_config + + +def setup_logging(debug=False): + logging.config.dictConfig({ + 'version': 1, + 'disable_existing_loggers': False, + 'formatters': { + 'brief': { + 'format': '%(levelname)s %(name)s: %(message)s' + } + }, + 'handlers': { + 'console': { + 'class': 'logging.StreamHandler', + 'level': 'DEBUG' if debug else 'INFO', + 'formatter': 'brief', + } + }, + 'root': { + 'handlers': ['console'], + 'level': 'DEBUG' if debug else 'INFO', + } + }) + + +def validate_config(config): + with open(join(dirname(__file__), 'config-schema.yaml')) as f: + schema = yaml.load(f) + + jsonschema.validate(config, schema) + + +@click.group() +def cli(): + pass + + +@cli.command(help='Run the registrar daemon, attaching to a Redis queue') +@click.option('--config-file', type=click.File('r')) +@click.option('--validate/--no-validate', default=False) +@click.option('--host', type=str) +@click.option('--port', type=int) +@click.option('--listen-queue', type=str) +@click.option('--write-queue', type=str) +@click.option('--debug/--no-debug', default=False) +def daemon(config_file=None, validate=False, host=None, port=None, listen_queue=None, write_queue=None, debug=False): + setup_logging(debug) + config = load_config(config_file) + if validate: + validate_config(config) + run_daemon(config, host, port, listen_queue, write_queue) + + +@cli.command(help='Run a single, one-off registration') +@click.argument('file_path', type=str) +@click.option('--config-file', type=click.File('r')) +@click.option('--validate/--no-validate', default=False) +@click.option('--replace/--no-replace', default=False) +@click.option('--debug/--no-debug', default=False) +def register(file_path, config_file=None, validate=False, debug=False): + setup_logging(debug) + config = load_config(config_file) + if validate: + validate_config(config) + + register_file(config, file_path) + +if __name__ == '__main__': + cli() diff --git a/core/registrar/config-schema.yaml b/core/registrar/config-schema.yaml new file mode 100644 index 00000000..ed85899e --- /dev/null +++ b/core/registrar/config-schema.yaml @@ -0,0 +1,67 @@ +$id: https://example.com/address.schema.json +$schema: http://json-schema.org/draft-07/schema# +type: object +properties: + source: + description: Input sources definitions + type: array + items: + description: A single source definition + type: object + properties: + type: + description: The source type. + type: string + enum: ['local', 's3', 'swift'] + filter: + description: Optional filter to only be used for these paths + type: string + args: + description: Constructor arguments + type: array + kwargs: + description: Constructor keyword arguments + type: object + schemes: + description: Registration schemes definitions + type: array + items: + description: A single registration scheme definition + type: object + properties: + type: + description: The registration scheme type. + type: string + enum: ['gsc', 'sentinel-2'] + filter: + description: Optional filter to only be used for these paths + type: string + args: + description: Constructor arguments + type: array + kwargs: + description: Constructor keyword arguments + type: object + backends: + description: Registration backends definitions + type: array + items: + description: A single registration scheme definition + type: object + properties: + type: + description: The registration scheme type. + type: string + enum: ['eoxserver'] + filter: + description: Optional filter to only be used for these paths + type: string + args: + description: Constructor arguments + type: array + kwargs: + description: Constructor keyword arguments + type: object + + # TODO: describe type specific args/kwargs + diff --git a/core/registrar/config.py b/core/registrar/config.py new file mode 100644 index 00000000..77534e94 --- /dev/null +++ b/core/registrar/config.py @@ -0,0 +1,39 @@ +import os +from typing import TextIO +import re + +import yaml + + +ENV_PATTERN = re.compile(r'.*?\${(\w+)}.*?') + +def constructor_env_variables(loader, node): + """ + Extracts the environment variable from the node's value + :param yaml.Loader loader: the yaml loader + :param node: the current node in the yaml + :return: the parsed string that contains the value of the environment + variable + """ + value = loader.construct_scalar(node) + match = ENV_PATTERN.findall(value) # to find all env variables in line + if match: + full_value = value + for g in match: + full_value = full_value.replace( + f'${{{g}}}', os.environ.get(g, g) + ) + return full_value + return value + + +def load_config(input_file: TextIO): + tag = '!env' + loader = yaml.SafeLoader + + # the tag will be used to mark where to start searching for the pattern + # e.g. somekey: !env somestring${MYENVVAR}blah blah blah + loader.add_implicit_resolver(tag, ENV_PATTERN, None) + loader.add_constructor(tag, constructor_env_variables) + + return yaml.load(input_file, Loader=loader) diff --git a/core/registrar/daemon.py b/core/registrar/daemon.py new file mode 100644 index 00000000..7c943627 --- /dev/null +++ b/core/registrar/daemon.py @@ -0,0 +1,26 @@ +import logging +import json + +import redis + +from .registrar import register_file + + +logger = logging.getLogger(__name__) + + +def run_daemon(config, host, port, listen_queue, write_queue): + """ Run the registrar daemon, listening on a redis queue + for files to be registered. After preprocessing the filename + of the registered files will be pushed to the output queue. + """ + # initialize the queue client + client = redis.Redis( + host=host, port=port, charset="utf-8", decode_responses=True + ) + logger.debug("waiting for redis queue '%s'..." % listen_queue) + while True: + # fetch an item from the queue to be registered + _, value = client.brpop(listen_queue) + # start the registration on that file + register_file(config, value) diff --git a/core/registrar/registrar.py b/core/registrar/registrar.py index 53e2379e..f7f984e8 100644 --- a/core/registrar/registrar.py +++ b/core/registrar/registrar.py @@ -1,14 +1,13 @@ import re from .source import get_source +from .scheme import get_scheme from .exceptions import RegistrationError - -def register(config, path): - # TODO: select registration scheme (config, path) +def register_file(config: dict, path: str): source = get_source(config, path) - scheme = select_registation_scheme(config, path) + scheme = get_scheme(config, path) context = scheme.get_context(source, path) for pre_handler in get_pre_handlers(config): @@ -27,19 +26,6 @@ def register(config, path): post_handler(config, path, context) -def select_registation_scheme(config, path): - cfg_schemes = config['schemes'] - for cfg_scheme in cfg_schemes: - if cfg_scheme['filter']: - if re.match(cfg_scheme['filter'], path): - break - else: - break - else: - # no source found - raise RegistrationError(f'Could not find a suitable scheme for the path {path}') - - def get_pre_handlers(config): pass -- GitLab From 352cc2368c345a60f8049753a3590608ed22468b Mon Sep 17 00:00:00 2001 From: Fabian Schindler Date: Tue, 20 Oct 2020 16:07:29 +0200 Subject: [PATCH 054/162] Adding additional dependencies for registrar --- core/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/Dockerfile b/core/Dockerfile index 33baf310..e583326e 100644 --- a/core/Dockerfile +++ b/core/Dockerfile @@ -43,7 +43,7 @@ RUN apt update && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* RUN pip3 install . && \ - pip3 install python-keystoneclient python-swiftclient redis + pip3 install python-keystoneclient python-swiftclient redis click setuptools jsonschema ENV INSTANCE_ID="prism-view-server_core" \ INSTANCE_NAME="pvs_instance"\ -- GitLab From 2f3c0a34164acee32935adcc9a2cfc393b6b95e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 21 Oct 2020 11:40:38 +0200 Subject: [PATCH 055/162] fix database host --- chart/templates/renderer-deployment.yaml | 4 +++- chart/values.yaml | 1 - 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/chart/templates/renderer-deployment.yaml b/chart/templates/renderer-deployment.yaml index 36f65516..33a17953 100644 --- a/chart/templates/renderer-deployment.yaml +++ b/chart/templates/renderer-deployment.yaml @@ -56,6 +56,8 @@ spec: - name: {{ $key }} value: {{ $value | quote }} {{- end }} + - name: DB_HOST + value: {{ .Release.Name }}-database {{- range $key, $value := .Values.config.django }} - name: {{ $key }} value: {{ $value | quote }} @@ -73,7 +75,7 @@ spec: - name: STARTUP_SCRIPTS value: /wait-initialized.sh - name: WAIT_SERVICES - value: {{ .Values.config.database.DB_HOST }}:{{ .Values.config.database.DB_PORT }} + value: {{ .Release.Name }}-database:{{ .Values.config.database.DB_PORT }} volumeMounts: - mountPath: /init-db.sh name: init-db diff --git a/chart/values.yaml b/chart/values.yaml index a779f6ca..77a4950c 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -5,7 +5,6 @@ config: GDAL_DISABLE_READDIR_ON_OPEN: "TRUE" COLLECT_STATIC: "false" database: - DB_HOST: database DB_NAME: dbname DB_PORT: "5432" DB_PW: dbpw -- GitLab From 25264f56446144540f39cb40602d09a5d14ada69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 21 Oct 2020 11:59:50 +0200 Subject: [PATCH 056/162] adjust init-db.sh loading --- chart/README.md | 9 +++ chart/files/init-db.sh | 79 +++++++++++++++++++++++++ chart/templates/init-db-configmap.yaml | 5 +- chart/values-init-db.yaml | 80 -------------------------- 4 files changed, 90 insertions(+), 83 deletions(-) create mode 100644 chart/files/init-db.sh delete mode 100644 chart/values-init-db.yaml diff --git a/chart/README.md b/chart/README.md index 9ef273a0..acc5e453 100644 --- a/chart/README.md +++ b/chart/README.md @@ -1 +1,10 @@ Chart for the View Server (VS) bundling all services + +Useful commands: + +```bash +helm dependency update + +helm template testing . --output-dir ../tmp/ -f values.yaml + +``` diff --git a/chart/files/init-db.sh b/chart/files/init-db.sh new file mode 100644 index 00000000..5b05895c --- /dev/null +++ b/chart/files/init-db.sh @@ -0,0 +1,79 @@ +# Check if collection exits in database and initialize database only if not +if python3 manage.py id check "${COLLECTION}"; then + echo "Initialize database" + + python3 manage.py coveragetype import /rgbnir_definition.json --traceback + + if [ "${COLLECTION}" == "VHR_IMAGE_2018" ]; then + echo "Initializing collection '${COLLECTION}'." + + # PL00 + python3 manage.py producttype create "${COLLECTION}"_Product_PL00 --traceback \ + --coverage-type "RGBNir" + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 --traceback \ + --red "red" \ + --green "green" \ + --blue "blue" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "TRUE_COLOR" --traceback \ + --red "red" \ + --green "green" \ + --blue "blue" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "FALSE_COLOR" --traceback \ + --red "nir" \ + --green "red" \ + --blue "green" \ + --red-range 1000 15000 \ + --green-range 1000 15000 \ + --blue-range 1000 15000 \ + --red-nodata 0 \ + --green-nodata 0 \ + --blue-nodata 0 + python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "NDVI" --traceback \ + --grey "(nir-red)/(nir+red)" --grey-range -1 1 + + + python3 manage.py collectiontype create "${COLLECTION}"_Collection --traceback \ + --coverage-type "RGBNir" \ + --product-type "${COLLECTION}"_Product_PL00 + + # Create collections for all products + python3 manage.py collection create "${COLLECTION}" --type "${COLLECTION}"_Collection --traceback + + # Register mask type + python3 manage.py masktype create --validity "${COLLECTION}"_Product_PL00 validity + + else + echo "Provided collection '${COLLECTION}' not valid." + fi + + python3 manage.py storageauth create auth-cloud-ovh "${OS_AUTH_URL_SHORT}" \ + --type keystone \ + -p auth-version "${ST_AUTH_VERSION}" \ + -p identity-api-version="${ST_AUTH_VERSION}" \ + -p username "${OS_USERNAME}" \ + -p password "${OS_PASSWORD}" \ + -p tenant-name "${OS_TENANT_NAME}" \ + -p tenant-id "${OS_TENANT_ID}" \ + -p region-name "${OS_REGION_NAME}" + + python3 manage.py storage create \ + ${UPLOAD_CONTAINER} ${UPLOAD_CONTAINER} \ + --type swift \ + --storage-auth auth-cloud-ovh + + +else + echo "Using existing database" +fi diff --git a/chart/templates/init-db-configmap.yaml b/chart/templates/init-db-configmap.yaml index a0516d5b..6e130e1c 100644 --- a/chart/templates/init-db-configmap.yaml +++ b/chart/templates/init-db-configmap.yaml @@ -1,7 +1,6 @@ apiVersion: v1 -data: - init-db.sh: | - {{- .Values.initDb | nindent 4 }} kind: ConfigMap metadata: name: {{ include "vs.fullname" . }}-init-db +data: + {{ (.Files.Glob "files/init-db.sh").AsConfig | nindent 2}} diff --git a/chart/values-init-db.yaml b/chart/values-init-db.yaml deleted file mode 100644 index 23118ada..00000000 --- a/chart/values-init-db.yaml +++ /dev/null @@ -1,80 +0,0 @@ -initDb: | - # Check if collection exits in database and initialize database only if not - if python3 manage.py id check "${COLLECTION}"; then - echo "Initialize database" - - python3 manage.py coveragetype import /rgbnir_definition.json --traceback - - if [ "${COLLECTION}" == "VHR_IMAGE_2018" ]; then - echo "Initializing collection '${COLLECTION}'." - - # PL00 - python3 manage.py producttype create "${COLLECTION}"_Product_PL00 --traceback \ - --coverage-type "RGBNir" - python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 --traceback \ - --red "red" \ - --green "green" \ - --blue "blue" \ - --red-range 1000 15000 \ - --green-range 1000 15000 \ - --blue-range 1000 15000 \ - --red-nodata 0 \ - --green-nodata 0 \ - --blue-nodata 0 - python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "TRUE_COLOR" --traceback \ - --red "red" \ - --green "green" \ - --blue "blue" \ - --red-range 1000 15000 \ - --green-range 1000 15000 \ - --blue-range 1000 15000 \ - --red-nodata 0 \ - --green-nodata 0 \ - --blue-nodata 0 - python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "FALSE_COLOR" --traceback \ - --red "nir" \ - --green "red" \ - --blue "green" \ - --red-range 1000 15000 \ - --green-range 1000 15000 \ - --blue-range 1000 15000 \ - --red-nodata 0 \ - --green-nodata 0 \ - --blue-nodata 0 - python3 manage.py browsetype create "${COLLECTION}"_Product_PL00 "NDVI" --traceback \ - --grey "(nir-red)/(nir+red)" --grey-range -1 1 - - - python3 manage.py collectiontype create "${COLLECTION}"_Collection --traceback \ - --coverage-type "RGBNir" \ - --product-type "${COLLECTION}"_Product_PL00 - - # Create collections for all products - python3 manage.py collection create "${COLLECTION}" --type "${COLLECTION}"_Collection --traceback - - # Register mask type - python3 manage.py masktype create --validity "${COLLECTION}"_Product_PL00 validity - - else - echo "Provided collection '${COLLECTION}' not valid." - fi - - python3 manage.py storageauth create auth-cloud-ovh "${OS_AUTH_URL_SHORT}" \ - --type keystone \ - -p auth-version "${ST_AUTH_VERSION}" \ - -p identity-api-version="${ST_AUTH_VERSION}" \ - -p username "${OS_USERNAME}" \ - -p password "${OS_PASSWORD}" \ - -p tenant-name "${OS_TENANT_NAME}" \ - -p tenant-id "${OS_TENANT_ID}" \ - -p region-name "${OS_REGION_NAME}" - - python3 manage.py storage create \ - ${UPLOAD_CONTAINER} ${UPLOAD_CONTAINER} \ - --type swift \ - --storage-auth auth-cloud-ovh - - - else - echo "Using existing database" - fi -- GitLab From 80aea98846f664e4ec7437662ae5752eca00e4ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20Mei=C3=9Fl?= Date: Wed, 21 Oct 2020 17:14:36 +0200 Subject: [PATCH 057/162] use index.html like a template --- chart/files/index.html | 10 +++++----- chart/templates/client-configmap.yaml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/chart/files/index.html b/chart/files/index.html index 23b59e21..e5c65647 100644 --- a/chart/files/index.html +++ b/chart/files/index.html @@ -17,12 +17,12 @@