From 075721cc1d0792c30e88fe2b3cdb6ed4f347b5d0 Mon Sep 17 00:00:00 2001 From: Basil Bruhn Date: Fri, 18 Sep 2026 17:01:19 +0200 Subject: [PATCH] update compose and README to not forget where i left Signed-off-by: Basil Bruhn --- .env.example | 4 ++-- README.md | 38 +++++++++++++++++++++++--------------- stacks/sap/compose.yaml | 10 ++++++++-- 3 files changed, 33 insertions(+), 19 deletions(-) diff --git a/.env.example b/.env.example index 57622b8..3256566 100644 --- a/.env.example +++ b/.env.example @@ -1,6 +1,6 @@ # Optional nonsecret Compose setting; this is also the default when unset. # Puppet/Hiera owns the deployed .env. Do not replace it with this example: -# SAP/BANF and other applications still use its existing settings. -# Migrated application credentials live in the nine service env files listed +# Other applications and rollback still use its existing settings. +# Migrated application credentials live in the eleven service env files listed # in README.md and are read with format: raw. WEBHOSTING_ENV_DIR=/etc/webhosting diff --git a/README.md b/README.md index 14ee815..925d0cd 100644 --- a/README.md +++ b/README.md @@ -32,8 +32,9 @@ stacks/ Each application stays with its database and supporting containers. `legacy-web` contains the shared Apache sites and scheduler; `elog` groups the four logbooks. -`sap` contains the existing TIA, document-router, and BANF definitions, moved -together without changes to their configuration. +`sap` contains the TIA, document-router, and BANF definitions. TIA and +document-router keep their existing inline WebUI authentication entries; only +the BANF passwords move to separate test and production env files. Run Compose through the root file, using the existing deployment directory and project name. These modules belong to **one Compose project**; their shared @@ -48,7 +49,7 @@ See [Docker's include documentation](https://docs.docker.com/reference/compose-f ## Environment configuration -Swiss eCargo, HedgeDoc, the dashboard, Panda Maintenance, and Tomcat Wiki read +Swiss eCargo, HedgeDoc, the dashboard, Panda Maintenance, Tomcat Wiki, and BANF read their credentials from service-specific files under `/etc/webhosting`. In the `hiera/data-lx` repository, `default/lx-docker-01.psi.ch.yaml` renders these files from the existing `lx-data::docker-env::*` keys. Files are root-owned with mode @@ -66,6 +67,13 @@ with permission to read them. | `panda-maintenance/db.env` | `panda-maintenance-db` | `POSTGRES_PASSWORD` | | `tomcatwiki/app.env` | `tomcatwiki` | `DB_PASS` | | `tomcatwiki/db.env` | `tomcatwikidb` | `POSTGRES_PASSWORD` | +| `sap/banf-test.env` | `banf-fetcher-test` | `SCP_PASSWORD` | +| `sap/banf-prod.env` | `banf-fetcher-prod` | `SCP_PASSWORD` | + +The BANF files reuse the existing `banf_fetcher_password_test` and +`banf_fetcher_password_prod` Hiera keys. The `WEBAPP_SECURITY_AUTH_BASIC_USERNAME` +and `WEBAPP_SECURITY_AUTH_BASIC_PASSWORD` entries remain inline and unchanged +in all four TIA/document-router services. Each service receives only its own file. Stable nonsecret settings remain in `environment:`. The files use `format: raw`: write single-line literal values @@ -77,27 +85,27 @@ The optional `WEBHOSTING_ENV_DIR` variable overrides `/etc/webhosting`, for exam when validating a temporary set of files. `.env.example` documents this nonsecret setting; it must not replace the production `.env`. -The existing `/opt/WebHosting/.env` remains in place for SAP/BANF, applications -outside this repository, and rollback. The migrated services no longer reference +The existing `/opt/WebHosting/.env` remains in place for applications outside +this repository and rollback, including the old BANF entries. Migrated services no longer reference its old credential variables, including overrides of those variables in the shell. There is no fallback to old credentials if a service env file is missing. -Compose requires all nine files, including when validating the whole project for +Compose requires all eleven files, including when validating the whole project for a targeted service update. `required: true` verifies file existence only; it does not enforce the keys or non-empty values listed above. Check those values as part of deployment. This replaces the previous `${VARIABLE:?message}` checks for the migrated credentials. -The root `.env` still supplies YAML interpolation, including SAP/BANF variables -and `WEBHOSTING_ENV_DIR`. It follows normal dotenv quoting rules; service +The root `.env` still supplies YAML interpolation for `WEBHOSTING_ENV_DIR`. +It follows normal dotenv quoting rules; service `env_file` does not supply interpolation values to YAML. Keep credentials out of Git and logs. See [Docker's interpolation documentation](https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/). ## Validate and apply configuration -Deploy the Hiera change first and let Puppet create all nine service env files. +Deploy the Hiera change first and let Puppet create all eleven service env files. Verify their permissions and the non-empty keys listed above before activating -this Compose change. Preserve the existing global env file for SAP/BANF and rollback. +this Compose change. Preserve the existing global env file for other applications and rollback. Deploy the complete `stacks/` directory alongside the root Compose file. Keep the existing deployment directory and Compose project name. From that directory, @@ -166,8 +174,8 @@ and networks are preserved in this configuration fix. See the ## Follow-up organization -After verifying the migration on the host, obsolete non-SAP entries can be removed -from the global `.env` in a separate Hiera change. Preserve values used by SAP/BANF -and applications outside this repository. File secrets and independent Compose -projects can be considered separately. Preserve the supplier's definitions in -`stacks/sap/compose.yaml` without changing their configuration style. +After verifying the migration on the host, obsolete migrated entries (including +the two BANF passwords) can be removed from the global `.env` in a separate Hiera +change. Preserve values used by applications outside this repository. File secrets +and independent Compose projects can be considered separately. Keep the supplier's +inline WebUI authentication entries in `stacks/sap/compose.yaml` unchanged. diff --git a/stacks/sap/compose.yaml b/stacks/sap/compose.yaml index c21ea8f..03848ba 100644 --- a/stacks/sap/compose.yaml +++ b/stacks/sap/compose.yaml @@ -60,6 +60,10 @@ services: networks: - backend banf-fetcher-prod: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/sap/banf-prod.env + required: true + format: raw container_name: banf-fetcher-prod image: python:3.12 restart: always @@ -70,7 +74,6 @@ services: - SCP_HOST=filetransfer.openordering.de - SCP_PORT=22 - SCP_USER=PSIProduktiv - - SCP_PASSWORD=${BANF_FETCHER_PROD_PASSWORD} - SCP_REMOTE_DIR=Anlagen - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" command: > @@ -100,6 +103,10 @@ services: networks: - backend banf-fetcher-test: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/sap/banf-test.env + required: true + format: raw container_name: banf-fetcher-test image: python:3.12 restart: always @@ -110,7 +117,6 @@ services: - SCP_HOST=filetransfer.test.openordering.de - SCP_PORT=22 - SCP_USER=PSITest - - SCP_PASSWORD=${BANF_FETCHER_TEST_PASSWORD} - SCP_REMOTE_DIR=Anlagen - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" command: >