diff --git a/azure-cron/add_to_running_db.sh b/azure-cron/add_to_running_db.sh index be3965aa..b25d9114 100755 --- a/azure-cron/add_to_running_db.sh +++ b/azure-cron/add_to_running_db.sh @@ -4,3 +4,6 @@ ls -- *.pem | gsed 's/\.pem//gi' \ | xargs -J{} sh -c 'pem_string=$(cat -- {}.pem);\ curl -k -vvv -X PUT http://admin:couchdb@localhost:5984/_node/_local/_config/jwt_keys/rsa:{} -d "$pem_string"' # | xargs -I {} sh -c 'curl -k -v -X PUT http://admin:couchdb@localhost:5984/_node/_local/_config/jwt_keys/rsa:{} -d <> /etc/environment +echo 'start of configuration jwt_keys update'; -# execute CMD -echo "$@" -exec "$@" +if [ -z "$VUE_APP_AUTH_TENANT_ID" ]; then + echo "VUE_APP_AUTH_TENANT_ID is not set"; + exit 1; +fi +if [ -z "$COUCHDB_USER" ]; then + echo "COUCHDB_USER is not set"; + exit 1; +fi +if [ -z "$COUCHDB_PASSWORD" ]; then + echo "COUCHDB_PASSWORD is not set"; + exit 1; +fi + +if [ -z "$COUCHDB_HOST" ]; then + echo "COUCHDB_HOST is not set"; + exit 1; +fi + +echo "run apk update and install openssl, sed, curl, jq"; +apk update; +apk add openssl; +apk add --update sed; +apk add curl; +apk add jq; +# have tenand-id in env +# get json from https://login.microsoftonline.com//discovery/v2.0/keys + +temp_file=$(mktemp) +keys_json_url="https://login.microsoftonline.com/$VUE_APP_AUTH_TENANT_ID/discovery/v2.0/keys" + +wget -O ${temp_file} $keys_json_url +cat /${temp_file} | python3 -c 'import sys, json; keys = json.load(sys.stdin)["keys"]; [print(i["kid"], i["x5c"][0]) for i in keys]' | awk '{ print "-----BEGIN CERTIFICATE-----\n" $2 "\n" "-----END CERTIFICATE-----\n"> ($1 ".cer") }' + +for file in $(find . -name "*.cer"); do + outputFile=${file%.cer}.pem + echo ${file} + openssl x509 -pubkey -noout -in ${file} >${outputFile} || rm ${outputFile} +done + +result=$(echo "{" +ls -- *.pem | sed 's/\.pem//gi' \ +| xargs -I {} sh -c 'echo "\"rsa:{}\": \"$(cat -- {}.pem)" ' \ +| sed -z 's/\n/\\\\n/g' \ +| sed 's/END PUBLIC KEY-----\\\\n/END PUBLIC KEY-----\\\\n\",\n/g'\ +| sed 's/END CERTIFICATE-----\\\\n/END CERTIFICATE-----\\\\n\",\n/g' +echo "}" +) + + +echo "${result}" >> jwt_keys.json + +sed -zi 's/,\n}/\n}/g' jwt_keys.json + +for key in $(jq -r 'keys[]' jwt_keys.json); do + echo "BEGIN------------------------" + value=$(jq ".[\"$key\"]" jwt_keys.json | sed 's/"//gi') + echo "key: $key" + echo "value: \"${value}\"" + curl -k -vvv -X PUT "http://${COUCHDB_USER}:${COUCHDB_PASSWORD}@${COUCHDB_HOST}:5984/_node/_local/_config/jwt_keys/${key}" -d "\"${value}\"" + echo "-----------------------END" +done + +rm jwt_keys.json + +# reload configuration +# POST /_node/nonode@nohost/_config/_reload +curl -X POST "http://${COUCHDB_USER}:${COUCHDB_PASSWORD}@${COUCHDB_HOST}:5984/_node/_local/_config/refresh" + +echo "end of configuration jwt_keys update"; diff --git a/azure-cron/jwt_keys.ini b/azure-cron/jwt_keys.ini new file mode 100644 index 00000000..324e745e --- /dev/null +++ b/azure-cron/jwt_keys.ini @@ -0,0 +1,6 @@ +; https://login.microsoftonline.com//discovery/v2.0/keys +; In format rsa: = -----BEGIN PUBLIC KEY-----\n\n-----END PUBLIC KEY-----\n +; can be get by "x509 -pubkey -noout -in cert.cer" where cert.cer is "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----" +; See /azure/convert.sh +rsa:XRvko8P7A3UaWSnU7bM9nT0MjhA = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRIL3aZt+xVqOZgMOr71\nltWe9YY2Wf/B28C4Jl2nBSTEcFnf/eqOHZ8yzUBbLc4Nti2/ETcCsTUNuzS368BW\nkSgxc45JBH1wFSoWNFUSXaPt8mRwJYTF0H32iNhw/tBb9mvdQVgVs4Ci0dVJRYiz\n+ilk3PeO8wzlwRuwWIsaKFYlMyOKG9DVFbg93DmP5Tjq3C3oJlATyhAiJJc1T2tr\nEP8960an33dDEaWwVAHh3c/34meAO4R6kLzIq0JnSsZMYB9O/6bMyIlzxmdZ8F44\n2SynCUHxhnIh3yZew+xDdeHr6Ofl7KeVUcvSiZP9X44CaVJvknXQbBYNl+H7YF5R\ngQIDAQAB\n-----END PUBLIC KEY-----\n +rsa:qor_VePWgmxWy3r1dpfsWsw2-zY = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArV8eXna9NCyzvgVZvbz1\n8NhLIAfo1Qzn+VQQCbQzyGi2KDe3RI2sLeHltv9mVI2sahcRjgvhYNSETyxqHaKw\n3w8L4jg0kJdfzhD8dvpl32hunOCzuY2WpyJVq6CkxzGN4iikWTEIe/GMGsu9qhdx\nybaTCBTAya8qyKL1sbEByk8FiY6nsm6BhuRUVCh/rzfAp3HY+U/58ORLF1tmZrmS\nljHMFwlxvYuOIlKHacXy9gen8HsT7PUSA4n2PdnT1XAmlKJG1mzvdqyG2L3iRQJ4\n5tcmrERKcd1pYwhb7ZtTyKypkeR9lkKbaYiQUt1QhpeO12pH1bRB1/k9MMzOm8Ca\n1QIDAQAB\n-----END PUBLIC KEY-----\n diff --git a/couchdb/local.ini b/couchdb/local.ini index be18df22..b79ad771 100644 --- a/couchdb/local.ini +++ b/couchdb/local.ini @@ -24,8 +24,12 @@ debug = true ; https://docs.couchdb.org/en/stable/api/server/authn.html#jwt-authentication [jwt_keys] -rsa:XRvko8P7A3UaWSnU7bM9nT0MjhA = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRIL3aZt+xVqOZgMOr71\nltWe9YY2Wf/B28C4Jl2nBSTEcFnf/eqOHZ8yzUBbLc4Nti2/ETcCsTUNuzS368BW\nkSgxc45JBH1wFSoWNFUSXaPt8mRwJYTF0H32iNhw/tBb9mvdQVgVs4Ci0dVJRYiz\n+ilk3PeO8wzlwRuwWIsaKFYlMyOKG9DVFbg93DmP5Tjq3C3oJlATyhAiJJc1T2tr\nEP8960an33dDEaWwVAHh3c/34meAO4R6kLzIq0JnSsZMYB9O/6bMyIlzxmdZ8F44\n2SynCUHxhnIh3yZew+xDdeHr6Ofl7KeVUcvSiZP9X44CaVJvknXQbBYNl+H7YF5R\ngQIDAQAB\n-----END PUBLIC KEY-----\n -rsa:qor_VePWgmxWy3r1dpfsWsw2-zY = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArV8eXna9NCyzvgVZvbz1\n8NhLIAfo1Qzn+VQQCbQzyGi2KDe3RI2sLeHltv9mVI2sahcRjgvhYNSETyxqHaKw\n3w8L4jg0kJdfzhD8dvpl32hunOCzuY2WpyJVq6CkxzGN4iikWTEIe/GMGsu9qhdx\nybaTCBTAya8qyKL1sbEByk8FiY6nsm6BhuRUVCh/rzfAp3HY+U/58ORLF1tmZrmS\nljHMFwlxvYuOIlKHacXy9gen8HsT7PUSA4n2PdnT1XAmlKJG1mzvdqyG2L3iRQJ4\n5tcmrERKcd1pYwhb7ZtTyKypkeR9lkKbaYiQUt1QhpeO12pH1bRB1/k9MMzOm8Ca\n1QIDAQAB\n-----END PUBLIC KEY-----\n +; https://login.microsoftonline.com//discovery/v2.0/keys +; In format rsa: = -----BEGIN PUBLIC KEY-----\n\n-----END PUBLIC KEY-----\n +; can be get by "x509 -pubkey -noout -in cert.cer" where cert.cer is "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----" +; See /azure/convert.sh +rsa:rsa:XRvko8P7A3UaWSnU7bM9nT0MjhA = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRIL3aZt+xVqOZgMOr71\nltWe9YY2Wf/B28C4Jl2nBSTEcFnf/eqOHZ8yzUBbLc4Nti2/ETcCsTUNuzS368BW\nkSgxc45JBH1wFSoWNFUSXaPt8mRwJYTF0H32iNhw/tBb9mvdQVgVs4Ci0dVJRYiz\n+ilk3PeO8wzlwRuwWIsaKFYlMyOKG9DVFbg93DmP5Tjq3C3oJlATyhAiJJc1T2tr\nEP8960an33dDEaWwVAHh3c/34meAO4R6kLzIq0JnSsZMYB9O/6bMyIlzxmdZ8F44\n2SynCUHxhnIh3yZew+xDdeHr6Ofl7KeVUcvSiZP9X44CaVJvknXQbBYNl+H7YF5R\ngQIDAQAB\n-----END PUBLIC KEY-----\n +rsa:rsa:qor_VePWgmxWy3r1dpfsWsw2-zY = -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArV8eXna9NCyzvgVZvbz1\n8NhLIAfo1Qzn+VQQCbQzyGi2KDe3RI2sLeHltv9mVI2sahcRjgvhYNSETyxqHaKw\n3w8L4jg0kJdfzhD8dvpl32hunOCzuY2WpyJVq6CkxzGN4iikWTEIe/GMGsu9qhdx\nybaTCBTAya8qyKL1sbEByk8FiY6nsm6BhuRUVCh/rzfAp3HY+U/58ORLF1tmZrmS\nljHMFwlxvYuOIlKHacXy9gen8HsT7PUSA4n2PdnT1XAmlKJG1mzvdqyG2L3iRQJ4\n5tcmrERKcd1pYwhb7ZtTyKypkeR9lkKbaYiQUt1QhpeO12pH1bRB1/k9MMzOm8Ca\n1QIDAQAB\n-----END PUBLIC KEY-----\n [admins] -admin = -pbkdf2-c597a22d78e26330c4e9ea3a194e5c95ea62869a,5cf4be6e5a075c37f7f57e1f66fb07a5,10 +admin = -pbkdf2-f72cf233302dffc8c0b53b9c4fb65ed7d6c93064,8afa4f826b045b608fdd2be29c17484a,10 diff --git a/docker-compose.yml b/docker-compose.yml index f2da19ea..010dcff0 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -58,6 +58,18 @@ services: depends_on: - couchdb - reverse-proxy + cron_couchdb: + image: python:3.12-alpine + command: /entrypoint.sh + env_file: + - ./frontend/.env + environment: + - COUCHDB_USER=${COUCHDB_USER} + - COUCHDB_PASSWORD=${COUCHDB_PASSWORD} + - COUCHDB_HOST=couchdb + volumes: + - ./azure-cron/entrypoint.sh:/entrypoint.sh + - ./couchdb/local.ini:/local.ini init_couchdb: image: python:3.12-alpine command: /entrypoint.sh