Skip to content

Commit c848368

Browse files
GiooDevGiooDev
committed
Story #15211: Cleaning truststore and configuration.
1 parent ae53c46 commit c848368

File tree

11 files changed

+135
-128
lines changed

11 files changed

+135
-128
lines changed

‎deployment/roles/vitamui/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ jvm_opts:
1010
start_timeout: "{{ vitamui_defaults.services.start_timeout | default(300) }}"
1111
at_boot: "{{ vitamui_defaults.services.at_boot | default(false) }}"
1212
secure: "{{ vitamui_defaults.services.secure | default(true) | bool }}"
13+
ssl_hostname_verification: "{{ vitamui_defaults.services.ssl_hostname_verification | default(true) | bool }}"
1314
jvm_log: "{{ vitamui_defaults.services.jvm_log | default(false) | bool }}"
1415
accesslogs: "{{ vitamui_defaults.services.accesslogs | default('true') | lower }}"
1516
access_retention_days: "{{ vitamui_defaults.services.access_retention_days | default(365) }}"

‎deployment/roles/vitamui/tasks/main.yml‎

Lines changed: 63 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,9 @@
4848
file:
4949
path: "{{ vitamui_defaults.folder.root_path | default('/vitamui') }}/{{ item }}/{{ vitamui_struct.vitamui_component }}"
5050
state: directory
51-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
52-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
53-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
51+
owner: "{{ vitamui_defaults.users.vitamui }}"
52+
group: "{{ vitamui_defaults.users.group }}"
53+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
5454
with_items:
5555
- app
5656
- bin
@@ -66,9 +66,9 @@
6666
file:
6767
path: "{{ vitamui_folder_conf }}/sysconfig"
6868
state: directory
69-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
70-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
71-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
69+
owner: "{{ vitamui_defaults.users.vitamui }}"
70+
group: "{{ vitamui_defaults.users.group }}"
71+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
7272
notify: restart service
7373
when: install_mode != "container"
7474

@@ -83,9 +83,9 @@
8383
template:
8484
src: java_opts.j2
8585
dest: "{{ vitamui_folder_conf }}/sysconfig/java_opts"
86-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
87-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
88-
mode: "{{ vitamui_defaults.folder.conf_permission | default('0440') }}"
86+
owner: "{{ vitamui_defaults.users.vitamui }}"
87+
group: "{{ vitamui_defaults.users.group }}"
88+
mode: "{{ vitamui_defaults.folder.conf_permission }}"
8989
tags:
9090
- update_vitamui_jvmopts
9191
- update_vitamui_configuration
@@ -95,7 +95,7 @@
9595
- name: get passwd for vitamui
9696
getent:
9797
database: passwd
98-
key: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
98+
key: "{{ vitamui_defaults.users.vitamui }}"
9999

100100
- name: Deploy systemd service file
101101
template:
@@ -112,19 +112,19 @@
112112
template:
113113
src: logback.xml.j2
114114
dest: "{{ vitamui_folder_conf }}/logback.xml"
115-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
116-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
117-
mode: "{{ vitamui_defaults.folder.conf_permission | default('0440') }}"
115+
owner: "{{ vitamui_defaults.users.vitamui }}"
116+
group: "{{ vitamui_defaults.users.group }}"
117+
mode: "{{ vitamui_defaults.folder.conf_permission }}"
118118
tags: update_vitamui_configuration
119119
notify: restart service
120120

121121
- name: Deploy specific configuration files
122122
template:
123123
src: "{{ item }}"
124124
dest: "{{ vitamui_folder_conf }}/{{ item | basename | regex_replace('\\.j2$') }}"
125-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
126-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
127-
mode: "{{ vitamui_defaults.folder.conf_permission | default('0440') }}"
125+
owner: "{{ vitamui_defaults.users.vitamui }}"
126+
group: "{{ vitamui_defaults.users.group }}"
127+
mode: "{{ vitamui_defaults.folder.conf_permission }}"
128128
with_fileglob:
129129
- "{{ role_path }}/templates/{{ vitamui_struct.vitamui_component }}/*"
130130
#no_log: "{{ hide_passwords_during_deploy }}"
@@ -133,61 +133,56 @@
133133
- update_vitamui_certificates # Mandatory to update configuration file containing keystore password
134134
notify: restart service
135135

136-
- name: "Copy {{ vitamui_struct.service_name | default(service_name) }} jks keystore (server)"
137-
copy:
138-
src: "{{ inventory_dir }}/keystores/vitamui-services/server/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks"
139-
dest: "{{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks"
140-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
141-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
142-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
143-
when:
144-
- vitamui_struct.secure | default(secure) | lower == 'true'
145-
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/vitamui-services/server/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks || echo nofile') == ''
146-
tags: update_vitamui_certificates
147-
notify: restart service
136+
- block: # when secure is true
148137

149-
- name: "Copy {{ vitamui_struct.service_name | default(service_name) }} jks keystore (client)"
150-
copy:
151-
src: "{{ inventory_dir }}/keystores/vitamui-services/clients/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks"
152-
dest: "{{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks"
153-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
154-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
155-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
156-
when:
157-
- vitamui_struct.secure | default(secure) | lower == 'true'
158-
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/vitamui-services/clients/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks || echo nofile') == ''
159-
tags: update_vitamui_certificates
160-
notify: restart service
138+
- name: "Copy {{ vitamui_struct.service_name | default(service_name) }} jks keystore (server)"
139+
copy:
140+
src: "{{ inventory_dir }}/keystores/vitamui-services/server/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks"
141+
dest: "{{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks"
142+
owner: "{{ vitamui_defaults.users.vitamui }}"
143+
group: "{{ vitamui_defaults.users.group }}"
144+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
145+
tags: update_vitamui_certificates
146+
notify: restart service
161147

162-
# Copy the trustore for all vitamui components in order to communicate between them.
163-
- name: Copy vitamui-services truststore
164-
copy:
165-
src: "{{ inventory_dir }}/keystores/vitamui-services/truststore_vitamui.jks"
166-
dest: "{{ vitamui_folder_conf }}/truststore_vitamui.jks"
167-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
168-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
169-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
170-
when:
171-
- vitamui_struct.secure | default(secure) | lower == 'true'
172-
- vitamui_certificate_type | default('none') | lower == 'vitamui-services'
173-
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/vitamui-services/truststore_vitamui.jks || echo nofile') == ''
174-
tags: update_vitamui_certificates
175-
notify: restart service
148+
- name: "Copy {{ vitamui_struct.service_name | default(service_name) }} jks keystore (client)"
149+
copy:
150+
src: "{{ inventory_dir }}/keystores/vitamui-services/clients/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks"
151+
dest: "{{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks"
152+
owner: "{{ vitamui_defaults.users.vitamui }}"
153+
group: "{{ vitamui_defaults.users.group }}"
154+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
155+
when:
156+
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/vitamui-services/clients/{{ vitamui_struct.vitamui_component }}/keystore_{{ vitamui_struct.vitamui_component }}.jks || echo nofile') == ''
157+
tags: update_vitamui_certificates
158+
notify: restart service
176159

177-
# Copy the truststore for all external API in order to communicate with vitamui components (ui, external APIs, cas) and externals apps.
178-
- name: Copy external truststore
179-
copy:
180-
src: "{{ inventory_dir }}/keystores/client-{{ vitamui_certificate_type }}/truststore_{{ vitamui_certificate_type }}.jks"
181-
dest: "{{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks"
182-
owner: "{{ vitamui_defaults.users.vitamui | default('vitamui') }}"
183-
group: "{{ vitamui_defaults.users.group | default('vitamui') }}"
184-
mode: "{{ vitamui_defaults.folder.folder_permission | default('0750') }}"
185-
when:
186-
- vitamui_struct.secure | default(secure) | lower == 'true'
187-
- vitamui_certificate_type | default('none') | lower == 'external'
188-
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/client-{{ vitamui_certificate_type }}/truststore_{{ vitamui_certificate_type }}.jks || echo nofile') == ''
189-
tags: update_vitamui_certificates
190-
notify: restart service
160+
# Copy the trustore for all vitamui components in order to communicate between them.
161+
- name: Copy vitamui-services truststore
162+
copy:
163+
src: "{{ inventory_dir }}/keystores/vitamui-services/truststore_vitamui.jks"
164+
dest: "{{ vitamui_folder_conf }}/truststore_vitamui.jks"
165+
owner: "{{ vitamui_defaults.users.vitamui }}"
166+
group: "{{ vitamui_defaults.users.group }}"
167+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
168+
tags: update_vitamui_certificates
169+
notify: restart service
170+
171+
# Copy the truststore for all external API in order to communicate with vitamui components (ui, external APIs, cas) and externals apps.
172+
- name: Copy external truststore
173+
copy:
174+
src: "{{ inventory_dir }}/keystores/client-external/truststore_external.jks"
175+
dest: "{{ vitamui_folder_conf }}/truststore_external.jks"
176+
owner: "{{ vitamui_defaults.users.vitamui }}"
177+
group: "{{ vitamui_defaults.users.group }}"
178+
mode: "{{ vitamui_defaults.folder.folder_permission }}"
179+
when:
180+
- vitamui_certificate_type | default('none') | lower == 'external'
181+
- lookup('pipe', 'test -f {{ inventory_dir }}/keystores/client-external/truststore_external.jks || echo nofile') == ''
182+
tags: update_vitamui_certificates
183+
notify: restart service
184+
185+
when: vitamui_struct.secure | default(secure) | bool
191186

192187
- name: "Execute sub-tasks for the component: {{ vitamui_struct.vitamui_component }}"
193188
include_tasks: "{{ vitamui_struct.vitamui_component }}.yml"

‎deployment/roles/vitamui/templates/api-gateway/application.yml.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ server:
77
key-store: {{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks
88
key-store-password: {{ password_keystore_server }}
99
key-password: {{ password_keystore_server }}
10-
trust-store: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
11-
trust-store-password: {{ password_truststore }}
10+
trust-store: {{ vitamui_folder_conf }}/truststore_vitamui.jks
11+
trust-store-password: {{ truststores_vitamui }}
1212
client-auth: need
1313
{% endif %}
1414
max-http-request-header-size: {{ vitamui_struct.server_max_http_header_size | default('10KB') }}

‎deployment/roles/vitamui/templates/archive-search/application.yml.j2‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ server:
2727
key-store: {{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks
2828
key-store-password: {{ password_keystore_server }}
2929
key-password: {{ password_keystore_server }}
30-
trust-store: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
31-
trust-store-password: {{ password_truststore }}
30+
trust-store: {{ vitamui_folder_conf }}/truststore_vitamui.jks
31+
trust-store-password: {{ truststores_vitamui }}
3232
client-auth: want
3333
client-certificate-header-name: {{ vitamui.api_gateway.client_certificate_header_name | default('x-ssl-cert') }}
3434
{% endif %}
@@ -67,28 +67,30 @@ archive-search:
6767
security-client:
6868
server-host: {{ vitamui.security.host }}
6969
server-port: {{ vitamui.security.port_service }}
70-
{% if vitamui.security.secure | default(secure) | bool == true %}
71-
secure: {{ vitamui.security.secure | default(secure) | lower }}
70+
{% if vitamui.security.secure | default(secure) | bool %}
71+
secure: true
7272
ssl-configuration:
73+
keystore:
74+
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
75+
key-password: {{ password_keystore_client }}
7376
truststore:
7477
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
7578
key-password: {{ password_truststore }}
76-
hostname-verification: true
79+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
7780
{% endif %}
7881
iam-client:
7982
server-host: {{ vitamui.iam.host }}
8083
server-port: {{ vitamui.iam.port_service }}
81-
{% if vitamui.iam.secure | default(secure) | bool == true %}
82-
secure: {{ vitamui.iam.secure | default(secure) | lower }}
84+
{% if vitamui.iam.secure | default(secure) | bool %}
85+
secure: true
8386
ssl-configuration:
8487
keystore:
8588
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
8689
key-password: {{ password_keystore_client }}
87-
type: JKS
8890
truststore:
8991
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
9092
key-password: {{ password_truststore }}
91-
hostname-verification: true
93+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
9294
{% endif %}
9395

9496
{% if opentracing.jaeger.enabled | default(false) | bool %}

‎deployment/roles/vitamui/templates/cas-server/application.yml.j2‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,10 @@ iam-client:
6969
keystore:
7070
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
7171
key-password: {{ password_keystore_client }}
72-
type: JKS
7372
truststore:
7473
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
7574
key-password: {{ password_truststore }}
76-
hostname-verification: true
75+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
7776
{% endif %}
7877

7978
cas.authn.accept.users:

‎deployment/roles/vitamui/templates/collect/application.yml.j2‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ server:
3636
key-store: {{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks
3737
key-store-password: {{ password_keystore_server }}
3838
key-password: {{ password_keystore_server }}
39-
trust-store: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
40-
trust-store-password: {{ password_truststore }}
39+
trust-store: {{ vitamui_folder_conf }}/truststore_vitamui.jks
40+
trust-store-password: {{ truststores_vitamui }}
4141
client-auth: want
4242
client-certificate-header-name: {{ vitamui.api_gateway.client_certificate_header_name | default('x-ssl-cert') }}
4343
{% endif %}
@@ -76,28 +76,30 @@ collect:
7676
security-client:
7777
server-host: {{ vitamui.security.host }}
7878
server-port: {{ vitamui.security.port_service }}
79-
{% if vitamui.security.secure | default(secure) | bool == true %}
80-
secure: {{ vitamui.security.secure | default(secure) | lower }}
79+
{% if vitamui.security.secure | default(secure) | bool %}
80+
secure: true
8181
ssl-configuration:
82+
keystore:
83+
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
84+
key-password: {{ password_keystore_client }}
8285
truststore:
8386
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
8487
key-password: {{ password_truststore }}
85-
hostname-verification: true
88+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
8689
{% endif %}
8790
iam-client:
8891
server-host: {{ vitamui.iam.host }}
8992
server-port: {{ vitamui.iam.port_service }}
90-
{% if vitamui.iam.secure | default(secure) | bool == true %}
91-
secure: {{ vitamui.iam.secure | default(secure) | lower }}
93+
{% if vitamui.iam.secure | default(secure) | bool %}
94+
secure: true
9295
ssl-configuration:
9396
keystore:
9497
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
9598
key-password: {{ password_keystore_client }}
96-
type: JKS
9799
truststore:
98100
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
99101
key-password: {{ password_truststore }}
100-
hostname-verification: true
102+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
101103
{% endif %}
102104

103105
ontologies_file_path: {{ vitamui_folder_data }}/external_ontology_fields.json

‎deployment/roles/vitamui/templates/iam/application.yml.j2‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ server:
3030
key-store: {{ vitamui_folder_conf }}/keystore_{{ vitamui_struct.service_name | default(service_name) }}.jks
3131
key-store-password: {{ password_keystore_server }}
3232
key-password: {{ password_keystore_server }}
33-
trust-store: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
34-
trust-store-password: {{ password_truststore }}
33+
trust-store: {{ vitamui_folder_conf }}/truststore_vitamui.jks
34+
trust-store-password: {{ truststores_vitamui }}
3535
client-auth: want
3636
client-certificate-header-name: {{ vitamui.api_gateway.client_certificate_header_name | default('x-ssl-cert') }}
3737
{% endif %}
@@ -72,13 +72,16 @@ iam:
7272
security-client:
7373
server-host: {{ vitamui.security.host }}
7474
server-port: {{ vitamui.security.port_service }}
75-
{% if vitamui.security.secure | default(secure) | bool == true %}
75+
{% if vitamui.security.secure | default(secure) | bool %}
7676
secure: true
7777
ssl-configuration:
78+
keystore:
79+
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
80+
key-password: {{ password_keystore_client }}
7881
truststore:
7982
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
8083
key-password: {{ password_truststore }}
81-
hostname-verification: true
84+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
8285
{% endif %}
8386

8487
list-enable-external-identifiers:
@@ -104,17 +107,16 @@ login:
104107
cas-client:
105108
server-host: {{ vitamui.cas_server.host }}
106109
server-port: {{ vitamui.cas_server.port_service }}
107-
{% if vitamui.cas_server.secure | default(secure) | bool == true %}
110+
{% if vitamui.cas_server.secure | default(secure) | bool %}
108111
secure: true
109112
ssl-configuration:
110113
keystore:
111114
key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks
112115
key-password: {{ password_keystore_client }}
113-
type: JKS
114116
truststore:
115117
key-path: {{ vitamui_folder_conf }}/truststore_{{ vitamui_certificate_type }}.jks
116118
key-password: {{ password_truststore }}
117-
hostname-verification: true
119+
hostname-verification: {{ vitamui_struct.ssl_hostname_verification | default(ssl_hostname_verification) | lower }}
118120
{% endif %}
119121

120122
cas.reset.password.url: {{ vitamui.cas_server.base_url | default('/cas') }}{{ vitamui.cas_server.reset_password_url | default('/extras/resetPassword?username={username}&firstname={firstname}&lastname={lastname}&language={language}&customerId={customerId}&ttl=1day') }}

0 commit comments

Comments
 (0)