Skip to content

Commit 6c130dc

Browse files
shingo78shingo78
authored
Merge pull request #52 from shingo78/update/ubuntu-24.04-replace-j2
Update ubuntu to 24.04 and replace j2cli with jinja2-cli
2 parents bea7850 + b2e1253 commit 6c130dc

10 files changed

Lines changed: 47 additions & 39 deletions

File tree

‎auth-proxy/Dockerfile‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM ubuntu:22.04
1+
FROM ubuntu:24.04
22

33
ARG SIMPLESAMLPHP_VERSION="2.3.7"
44
ARG ATTRIBUTE_AGGREGATOR_URL="https://github.com/NII-cloud-operation/simplesamlphp-module-attributeaggregator"
@@ -135,10 +135,14 @@ COPY resources/supervisord.conf /etc/
135135
RUN set -x \
136136
&& apt-get update \
137137
&& apt-get -y --no-install-recommends --no-install-suggests install \
138-
python3-pip \
138+
python3-venv \
139139
&& apt-get clean \
140140
&& rm -rf /var/lib/apt/lists/* \
141-
&& pip install --no-cache-dir j2cli
141+
&& mkdir /opt/venv \
142+
&& python3 -m venv /opt/venv \
143+
&& /opt/venv/bin/pip install --no-cache-dir jinja2-cli
144+
145+
ENV PATH=/opt/venv/bin:$PATH
142146

143147
# Install config template files
144148
COPY resources/etc/templates /etc/templates

‎auth-proxy/resources/etc/templates/authsources.php.j2‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ $config = [
1010
'core:AdminPassword',
1111
],
1212

13-
{% set enable_federation = env("ENABLE_FEDERATION", "no")%}
13+
{% set enable_federation = environ("ENABLE_FEDERATION") | default("no", true) %}
1414

1515
// An authentication source which can authenticate against SAML 2.0 IdPs.
1616
'default-sp' => [
@@ -20,17 +20,17 @@ $config = [
2020

2121
// The entity ID of this SP.
2222
{% if enable_federation=="1" or enable_federation=="yes" %}
23-
'entityID' => 'https://{{ env("MASTER_FQDN") }}/shibboleth-sp',
23+
'entityID' => 'https://{{ environ("MASTER_FQDN") }}/shibboleth-sp',
2424
{% else %}
25-
'entityID' => 'https://{{ env("MASTER_FQDN") }}/simplesaml/module.php',
25+
'entityID' => 'https://{{ environ("MASTER_FQDN") }}/simplesaml/module.php',
2626
{% endif %}
2727

2828
// The entity ID of the IdP this SP should contact.
2929
// Can be NULL/unset, in which case the user will be shown a list of available IdPs.
3030
{% if enable_federation=="1" or enable_federation=="yes" %}
3131
'idp' => null,
3232
{% else %}
33-
'idp' => 'https://{{ env("AUTH_FQDN") }}/simplesaml/saml2/idp/metadata.php',
33+
'idp' => 'https://{{ environ("AUTH_FQDN") }}/simplesaml/saml2/idp/metadata.php',
3434
{% endif %}
3535

3636
// The URL to the discovery service.

‎auth-proxy/resources/etc/templates/config.php.j2‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ $config = [
195195
* metadata listing and diagnostics pages.
196196
* You can also put a hash here; run "bin/pwgen.php" to generate one.
197197
*/
198-
'auth.adminpassword' => '{{ env("SIMPLESAMLPHP_ADMIN_PASSWORD", "axsh0720") }}',
198+
'auth.adminpassword' => '{{ environ("SIMPLESAMLPHP_ADMIN_PASSWORD") }}',
199199

200200
/*
201201
* Set this option to true if you want to require administrator password to access the metadata.
@@ -282,11 +282,11 @@ $config = [
282282
'Referrer-Policy' => 'origin-when-cross-origin',
283283
],
284284

285-
{% set enable_federation = env("ENABLE_FEDERATION", "no")%}
285+
{% set enable_federation = environ("ENABLE_FEDERATION") | default("no", true) %}
286286

287287
{% if enable_federation=="1" or enable_federation=="yes" %}
288288
'disco.headers.security' => [
289-
'Content-Security-Policy' => "default-src 'none'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' https://{{ env("DS_FQDN", default="ds.gakunin.nii.ac.jp" )}}; style-src 'self' 'unsafe-inline' https://{{ env("DS_FQDN", default="ds.gakunin.nii.ac.jp") }}; font-src 'self'; connect-src 'self'; img-src 'self' data: https:; base-uri 'none'",
289+
'Content-Security-Policy' => "default-src 'none'; frame-ancestors 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' https://{{ environ("DS_FQDN") | default("ds.gakunin.nii.ac.jp", true)}}; style-src 'self' 'unsafe-inline' https://{{ environ("DS_FQDN") | default("ds.gakunin.nii.ac.jp", true) }}; font-src 'self'; connect-src 'self'; img-src 'self' data: https:; base-uri 'none'",
290290
],
291291
{% endif %}
292292

@@ -370,7 +370,7 @@ $config = [
370370
* must exist and be writable for SimpleSAMLphp. If set to something else, set
371371
* loggingdir above to 'null'.
372372
*/
373-
'logging.level' => SimpleSAML\Logger::{{ env("SIMPLESAMLPHP_LOGLEVEL", "INFO") }},
373+
'logging.level' => SimpleSAML\Logger::{{ environ("SIMPLESAMLPHP_LOGLEVEL") | default("INFO", true) }},
374374
'logging.handler' => 'file',
375375

376376
/*
@@ -1051,12 +1051,12 @@ $config = [
10511051
],
10521052
*/
10531053

1054-
{% set enable_federation = env("ENABLE_FEDERATION", "no")%}
1054+
{% set enable_federation = environ("ENABLE_FEDERATION") | default("no", true) %}
10551055

10561056
{% if enable_federation=="1" or enable_federation=="yes" %}
10571057
59 => array(
10581058
'class' => 'attributeaggregator:attributeaggregator',
1059-
'entityId' => 'https://{{ env("CG_FQDN", default="cg.gakunin.jp") }}/idp/shibboleth',
1059+
'entityId' => 'https://{{ environ("CG_FQDN") | default("cg.gakunin.jp", true) }}/idp/shibboleth',
10601060

10611061
/**
10621062
* The subject of the attribute query. Default: urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (eduPersonPrincipalName)
@@ -1103,7 +1103,7 @@ $config = [
11031103

11041104
69 => array(
11051105
'class' => 'attributeaggregator:attributeaggregator',
1106-
'entityId' => 'https://{{ env("CG_FQDN", default="cg.gakunin.jp") }}/idp/shibboleth',
1106+
'entityId' => 'https://{{ environ("CG_FQDN") | default("cg.gakunin.jp", true) }}/idp/shibboleth',
11071107

11081108
/**
11091109
* The subject of the attribute query. Default: urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (eduPersonPrincipalName)
@@ -1265,8 +1265,8 @@ $config = [
12651265
* ],
12661266
*/
12671267

1268-
{% set cgidp_localfile_metadata = env("CGIDP_LOCALFILE_METADATA", "no") %}
1269-
{% set enable_test_federation = env("ENABLE_TEST_FEDERATION", "no") %}
1268+
{% set cgidp_localfile_metadata = environ("CGIDP_LOCALFILE_METADATA") | default( "no", true) %}
1269+
{% set enable_test_federation = environ("ENABLE_TEST_FEDERATION") | default("no", true) %}
12701270

12711271
'metadata.sources' => [
12721272
['type' => 'flatfile'],

‎auth-proxy/resources/etc/templates/cron_root.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
@reboot /bin/sleep 10 && /usr/bin/curl --silent --insecure "https://localhost/simplesaml/module.php/cron/run/daily/{{ env("CRON_SECRET") }}"
2-
0 0 * * * /usr/bin/curl --silent --insecure "https://localhost/simplesaml/module.php/cron/run/daily/{{ env("CRON_SECRET") }}"
1+
@reboot /bin/sleep 10 && /usr/bin/curl --silent --insecure "https://localhost/simplesaml/module.php/cron/run/daily/{{ environ("CRON_SECRET") }}"
2+
0 0 * * * /usr/bin/curl --silent --insecure "https://localhost/simplesaml/module.php/cron/run/daily/{{ environ("CRON_SECRET") }}"
33

‎auth-proxy/resources/etc/templates/embedded-wayf-config.js.j2‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
// URL of the WAYF to use
1111
// Examples: "https://wayf.switch.ch/SWITCHaai/WAYF", "https://wayf-test.switch.ch/aaitest/WAYF";
1212
// [Mandatory]
13-
var wayf_URL = "https://{{ env("DS_FQDN", default="ds.gakunin.nii.ac.jp") }}/WAYF";
13+
var wayf_URL = "https://{{ environ("DS_FQDN") | default("ds.gakunin.nii.ac.jp", true) }}/WAYF";
1414
1515
// EntityID of the Service Provider that protects this Resource
1616
// Examples: "https://econf.switch.ch/shibboleth", "https://dokeos.unige.ch/shibboleth"
@@ -20,7 +20,7 @@ var wayf_sp_entityID = "{% raw %}{{ entityID }}{% endraw %}";
2020
// Shibboleth Service Provider handler URL
2121
// Examples: "https://point.switch.ch/Shibboleth.sso", "https://rr.aai.switch.ch/aaitest/Shibboleth.sso"
2222
// [Mandatory, if wayf_use_discovery_service = false]
23-
var wayf_sp_handlerURL = "https://{{ env("MASTER_FQDN") }}/simplesaml/module.php/saml/sp/discoresp.php";
23+
var wayf_sp_handlerURL = "https://{{ environ("MASTER_FQDN") }}/simplesaml/module.php/saml/sp/discoresp.php";
2424
2525
// URL on this resource that the user shall be returned to after authentication
2626
// Examples: "https://econf.switch.ch/aai/home", "https://olat.uzh.ch/my/courses"
@@ -199,7 +199,7 @@ var wayf_sp_samlDSURL = wayf_sp_handlerURL;
199199
// that shall be added to the drop-down list
200200
// The IdPs will be displayed in the sequence they are defined
201201
// [Optional, commented out by default]
202-
{% set enable_test_federation = env("ENABLE_TEST_FEDERATION", "no") %}
202+
{% set enable_test_federation = environ("ENABLE_TEST_FEDERATION") | default("no", true) %}
203203
var wayf_additional_idps = [
204204
{% if enable_test_federation=="1" or enable_test_federation=="yes" %}
205205
{name:"Orthros",

‎auth-proxy/resources/etc/templates/embedded-wayf-loader.js.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
<!--
2-
var embedded_wayf_URL = "https://{{ env("DS_FQDN", default="ds.gakunin.nii.ac.jp") }}/WAYF/embedded-wayf.js";
2+
var embedded_wayf_URL = "https://{{ environ("DS_FQDN") | default("ds.gakunin.nii.ac.jp", true) }}/WAYF/embedded-wayf.js";
33
document.write('<script type="text/javascript" src="' + embedded_wayf_URL + '?' + (new Date().getTime()) + '"></scr'+'ipt>');
44
//-->

‎auth-proxy/resources/etc/templates/module_cron.php.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*/
55

66
$config = [
7-
'key' => '{{ env("CRON_SECRET") }}',
7+
'key' => '{{ environ("CRON_SECRET") }}',
88
'allowed_tags' => ['daily', 'hourly', 'frequent'],
99
'debug_message' => TRUE,
1010
'sendemail' => FALSE,

‎auth-proxy/resources/etc/templates/module_metarefresh.php.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ $config = [
66
'cron' => ['daily'],
77
'sources' => [
88
[
9-
'src' => 'https://{{ env("AUTH_FQDN") }}/simplesaml/saml2/idp/metadata.php',
9+
'src' => 'https://{{ environ("AUTH_FQDN") }}/simplesaml/saml2/idp/metadata.php',
1010
'certificates' => [
1111
'idp-proxy.cer'
1212
]

‎auth-proxy/resources/etc/templates/nginx.conf.j2‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ http {
3232
include /etc/nginx/mime.types;
3333
default_type application/octet-stream;
3434

35-
upstream {{ env("MASTER_FQDN") }} {
36-
server {{ env("MASTER_FQDN") }}:443;
35+
upstream {{ environ("MASTER_FQDN") }} {
36+
server {{ environ("MASTER_FQDN") }}:443;
3737
}
3838

3939
map $http_upgrade $connection_upgrade {
@@ -106,7 +106,7 @@ http {
106106
}
107107

108108
location / {
109-
set $jupyterhub_url http://{{ env("HUB_NAME", default="jupyterhub") }}:8000;
109+
set $jupyterhub_url http://{{ environ("HUB_NAME") | default("jupyterhub", true) }}:8000;
110110
proxy_pass $jupyterhub_url;
111111
proxy_set_header X-Real-IP $remote_addr;
112112
proxy_set_header Host $host;

‎auth-proxy/resources/scripts/start.sh‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,33 @@
11
#!/bin/bash
2-
set -e
2+
set -xe
33

44
TEMPLATE_DIR=/etc/templates
55

6-
j2 ${TEMPLATE_DIR}/embedded-wayf-config.js.j2 -o /var/www/simplesamlphp/templates/includes/embedded-wayf-config.js
7-
j2 ${TEMPLATE_DIR}/embedded-wayf-loader.js.j2 -o /var/www/simplesamlphp/templates/includes/embedded-wayf-loader.js
8-
j2 ${TEMPLATE_DIR}/nginx.conf.j2 -o /etc/nginx/nginx.conf
9-
j2 ${TEMPLATE_DIR}/config.php.j2 -o /var/www/simplesamlphp/config/config.php
10-
j2 ${TEMPLATE_DIR}/module_cron.php.j2 -o /var/www/simplesamlphp/config/module_cron.php
11-
j2 ${TEMPLATE_DIR}/cron_root.j2 -o /var/spool/cron/crontabs/root
6+
if [[ -z ${SIMPLESAMLPHP_ADMIN_PASSWORD} ]]; then
7+
export SIMPLESAMLPHP_ADMIN_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 12)
8+
fi
9+
10+
jinja2 ${TEMPLATE_DIR}/embedded-wayf-config.js.j2 -o /var/www/simplesamlphp/templates/includes/embedded-wayf-config.js
11+
jinja2 ${TEMPLATE_DIR}/embedded-wayf-loader.js.j2 -o /var/www/simplesamlphp/templates/includes/embedded-wayf-loader.js
12+
jinja2 ${TEMPLATE_DIR}/nginx.conf.j2 -o /etc/nginx/nginx.conf
13+
jinja2 ${TEMPLATE_DIR}/config.php.j2 -o /var/www/simplesamlphp/config/config.php
14+
jinja2 ${TEMPLATE_DIR}/module_cron.php.j2 -o /var/www/simplesamlphp/config/module_cron.php
15+
jinja2 ${TEMPLATE_DIR}/cron_root.j2 -o /var/spool/cron/crontabs/root
1216

1317
chmod 600 /var/spool/cron/crontabs/root
1418

1519
if [[ -n "${AUTH_FQDN}" ]] ; then
1620
# Join federation via IdP Proxy
17-
j2 ${TEMPLATE_DIR}/module_metarefresh.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
18-
j2 ${TEMPLATE_DIR}/authsources.php.j2 -o /var/www/simplesamlphp/config/authsources.php
21+
jinja2 ${TEMPLATE_DIR}/module_metarefresh.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
22+
jinja2 ${TEMPLATE_DIR}/authsources.php.j2 -o /var/www/simplesamlphp/config/authsources.php
1923
elif [[ "$ENABLE_FEDERATION" == "1" || "$ENABLE_FEDERATION" == "yes" ]]; then
2024
# Join federation directly
2125
if [[ "$ENABLE_TEST_FEDERATION" == "1" || "$ENABLE_TEST_FEDERATION" == "yes" ]]; then
22-
j2 ${TEMPLATE_DIR}/federation/module_metarefresh-test.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
26+
jinja2 ${TEMPLATE_DIR}/federation/module_metarefresh-test.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
2327
else
24-
j2 ${TEMPLATE_DIR}/federation/module_metarefresh.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
28+
jinja2 ${TEMPLATE_DIR}/federation/module_metarefresh.php.j2 -o /var/www/simplesamlphp/config/module_metarefresh.php
2529
fi
26-
j2 ${TEMPLATE_DIR}/authsources.php.j2 -o /var/www/simplesamlphp/config/authsources.php
30+
jinja2 ${TEMPLATE_DIR}/authsources.php.j2 -o /var/www/simplesamlphp/config/authsources.php
2731
fi
2832

2933
/usr/bin/supervisord -n -c /etc/supervisord.conf

0 commit comments

Comments
 (0)