Allow roll-back for hydra-dispatcher

Used by the cache when available

defaults/main.yml

@@ -1,4 +1,6 @@
 ---
+install_only: false
+
 # cadoles-pod repository configuration
 cadoles_pod_debian_repository_url: https://vulcain.cadoles.com
 cadoles_pod_debian_repository: bullseye-dev
@@ -15,7 +17,8 @@ cadoles_pod_hydra_oidc_v1_package_version: '*'
 cadoles_pod_hydra_ldap_v1_package_version: '*'
 
 # Hydra database configuration
-hydra_use_external_database: no
+hydra_use_external_database: false
+hydra_auto_migrate: false
 hydra_database_name: hydra
 hydra_database_user: hydra
 hydra_database_password: hydra
@@ -50,6 +53,11 @@ hydra_public_cors_allowed_origins: []
 hydra_log_level: warn
 hydra_log_leak_sensitive_values: no
 
+# Durée de vie des "refresh_token"
+hydra_ttl_refresh_token: "24h"
+
+hydra_bcrypt_cost: 8
+
 # This value should not be changed after first deployment !
 hydra_secrets_seed: "{{ inventory_hostname }}"
 
@@ -61,6 +69,7 @@ hydra_clients:
 
 # Hydra dispatcher configuration
 
+enable_hydra_dispatcher: true
 hydra_dispatcher_cookie_path: "{{ haproxy_hydra_dispatcher_base_path }}"
 hydra_dispatcher_debug: no
 hydra_dispatcher_admin_authorized_hosts:
@@ -73,6 +82,7 @@ hydra_dispatcher_available_locales:
   - en
 hydra_dispatcher_sentry_dsn:
 hydra_dispatcher_sentry_environment:
+hydra_dispatcher_redis_dsn:
 hydra_dispatcher_mounts: []
 hydra_dispatcher_disable_app_auto_select: true
 hydra_dispatcher_webhook: false
@@ -162,9 +172,6 @@ hydra_saml_debug: no
 # Niveau de verbosité du service shibboleth-sp
 hydra_saml_sp_log_level: WARN
 
-# Durée de vie des "refresh_token"
-hydra_ttl_refresh_token: "24h"
-
 # Inclure les règles de cartographie des attributs SAML fournis  par défaut par le projet hydra-shibboleth-sp-v3
 hydra_saml_include_sp_default_attributes_mapping: "yes"
 
@@ -222,6 +229,7 @@ oidc_test_app_public_base_url: "{{ haproxy_public_base_url }}{{ haproxy_oidc_tes
 
 enable_hydra_oidc: no
 hydra_oidc_debug: no
+hydra_oidc_internal_port: 8080
 hydra_oidc_hydra_url_error:
 hydra_oidc_base_url:
 hydra_oidc_cookie_path: "{{ haproxy_hydra_oidc_base_path }}"

files/mpm_prefork.conf

@@ -0,0 +1,10 @@
+# prefork MPM
+
+<IfModule mpm_prefork_module>
+	StartServers       10
+	MinSpareServers	   10
+	MaxSpareServers	   20
+	MaxRequestWorkers 128
+	MaxConnectionsPerChild  2000
+</IfModule>
+

files/www.conf.gotmpl

@@ -0,0 +1,24 @@
+{%- raw -%}
+[www]
+user = www-data
+group = www-data
+
+listen = {{ env.Getenv "PHP_FPM_LISTEN" "/tmp/php-fpm.sock" }}
+listen.owner = www-data
+listen.group = www-data
+listen.mode = 0660
+
+pm = dynamic
+pm.max_children = {{ env.Getenv "PHP_FPM_MAX_CHILDREN" "5" }}
+pm.start_servers = {{ env.Getenv "PHP_FPM_START_SERVERS" "2" }}
+pm.min_spare_servers = {{ env.Getenv "PHP_FPM_MIN_SPARE_SERVERS" "1" }}
+pm.max_spare_servers = {{ env.Getenv "PHP_FPM_MAX_SPARE_SERVERS" "3" }}
+
+pm.status_path = /healthcheck
+pm.status_listen = 127.0.0.1:8091
+
+clear_env = no
+
+php_admin_value[display_errors] = {{ env.Getenv "PHP_FPM_DISPLAY_ERRORS" "off" }}
+php_admin_value[memory_limit] = {{ env.Getenv "PHP_FPM_MEMORY_LIMIT" "32m" }}
+{% endraw %}

handlers/main.yml

@@ -4,55 +4,65 @@
     name: haproxy
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-v1
   service:
     name: cadoles-pod-hydra-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-dispatcher-v1
   service:
     name: cadoles-pod-hydra-dispatcher-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-passwordless-v1
   service:
     name: cadoles-pod-hydra-passwordless-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-remote-user-v1
   service:
     name: cadoles-pod-hydra-remote-user-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-shibboleth-sp-v3
   service:
     name: cadoles-pod-shibboleth-sp-v3
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-oidc-v1
   service:
     name: cadoles-pod-hydra-oidc-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-hydra-ldap-v1
   service:
     name: cadoles-pod-hydra-ldap-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Restart cadoles-pod-goweb-oidc-v1
   service:
     name: cadoles-pod-goweb-oidc-v1
     state: restarted
   become: true
+  when: not install_only
 
 - name: Reload hydra clients
   ansible.builtin.include_tasks:
     file: hydra-reload-clients.yml
+  when: not install_only

sso.schema.yml

@@ -89,6 +89,10 @@ properties:
   hydra_ttl_refresh_token:
     type: string
 
+  hydra_brypt_cost:
+    type: number
+    description: Coût CPU pour calculer des hachages de secret (4-31)
+
   # This value should not be changed after first deployment !
   hydra_secrets_seed:
     type: string

tasks/configure-hydra-sp.yml

@@ -0,0 +1,21 @@
+---
+# Simple task to update the config files of cadoles-pod-shibboleth-sp only.
+
+- name: Configure cadoles-pod-shibboleth-sp-v3
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  with_items:
+    - src:  cadoles-pod-shibboleth-sp-v3.conf.j2
+      dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
+      mode: u=rw,g=r
+    - src:  shibboleth-attribute-map.inc.xml.j2
+      dest: /etc/shibboleth/attribute-map.inc.xml
+      mode: u=rw,g=r,o=r
+    - src:  shibboleth-attribute-policy.inc.xml.j2
+      dest: /etc/shibboleth/attribute-policy.inc.xml
+      mode: u=rw,g=r,o=r
+  notify:
+    - Restart cadoles-pod-shibboleth-sp-v3
+  become: true

tasks/hydra-saml.yml

@@ -27,8 +27,13 @@
 
 - name: Configure cadoles-pod-hydra-remote-user-v1 (2)
   ansible.builtin.copy:
-    src:  hydra-remote-user-v1-apache.conf
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  hydra-remote-user-v1-apache.conf
       dest: /etc/hydra-remote-user/apache.conf
+    - src:  mpm_prefork.conf
+      dest: /etc/hydra-remote-user/mpm_prefork.conf
   notify:
     - Restart cadoles-pod-hydra-remote-user-v1
   become: true

tasks/install-hydra.yml

@@ -0,0 +1,45 @@
+---
+
+- name: Install Hydra
+  ansible.builtin.apt:
+    name:
+      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
+    update_cache: yes
+    state: present
+  become: true
+
+- name: Configure Hydra local database
+  ansible.builtin.include_tasks: hydra-database.yml
+  when: not hydra_use_external_database
+
+- name: Configure cadoles-pod-hydra-v1
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  cadoles-pod-hydra-v1.conf.j2
+      dest: /etc/cadoles-pod-hydra-v1.conf
+  notify:
+    - Restart cadoles-pod-hydra-v1
+  become: true
+
+- name: Check cadoles-pod-hydra-v1 status
+  service:
+    name: cadoles-pod-hydra-v1
+    state: started
+  become: true
+
+- name: Migrate Hydra database schema
+  command: podman exec -it cadoles-pod-hydra-v1 migrate-hydra-schema
+  become: true
+  when: hydra_auto_migrate
+
+- name: Create hydra-clients
+  template:
+    src: hydra-client.json.j2
+    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
+  with_items: "{{ hydra_clients }}"
+  notify:
+    - Reload hydra clients
+  become: true
+

tasks/main.yml

@@ -9,24 +9,28 @@
     update_cache: yes
     state: present
   become: true
+  tags: [ hydra-only ]
 
 - name: Add LetsEncrypt missing intermediate certificates
   command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'"
   args:
     creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem
   become: true
+  tags: [ hydra-only ]
 
 - name: Add cadoles-pod debian repository key
   ansible.builtin.apt_key:
     url: "{{ cadoles_pod_debian_repository_key_url }}"
     state: present
   become: true
+  tags: [ hydra-only ]
 
 - name: Configure cadoles-pod debian repository
   ansible.builtin.apt_repository:
     repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main"
     state: present
   become: true
+  tags: [ hydra-only ]
 
 - name: Ensure sysctl configuration
   ansible.posix.sysctl:
@@ -39,39 +43,30 @@
     - name: fs.inotify.max_user_watches
       value: 204800
   become: true
+  tags: [ hydra-only ]
 
-- name: Install core packages
+- name: Install HAProxy
   ansible.builtin.apt:
     name:
       - haproxy={{ haproxy_package_version }}
-      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
-      - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
     update_cache: yes
     state: present
   become: true
+  tags: [ hydra-only ]
 
-- name: Configure Hydra local database
-  ansible.builtin.include_tasks: hydra-database.yml
-  when: not hydra_use_external_database  
+- name: Install Hydra
+  include_tasks: 
+    file: ./install-hydra.yml
+    apply:
+      tags: [ hydra-only ]
+  tags: [ hydra-only ]
 
-- name: Create hydra-clients
-  template:
-    src: hydra-client.json.j2
-    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
-  with_items: "{{ hydra_clients }}"
-  notify:
-    - Reload hydra clients
-  become: true
-
-- name: Configure cadoles-pod-hydra-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  cadoles-pod-hydra-v1.conf.j2
-      dest: /etc/cadoles-pod-hydra-v1.conf
-  notify:
-    - Restart cadoles-pod-hydra-v1
+- name: Install hydra-dispatcher
+  ansible.builtin.apt:
+    name:
+      - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
+    update_cache: yes
+    state: present
   become: true
 
 - name: Configure cadoles-pod-hydra-dispatcher-v1
@@ -90,6 +85,17 @@
     - Restart cadoles-pod-hydra-dispatcher-v1
   become: true
 
+- name: Configure cadoles-pod-hydra-dispatcher-v1 (2)
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  www.conf.gotmpl
+      dest: /etc/hydra-dispatcher/www.conf.gotmpl
+  notify:
+    - Restart cadoles-pod-hydra-dispatcher-v1
+  become: true
+
 - name: Configure passwordless authentification if enabled
   ansible.builtin.include_tasks: hydra-passwordless.yml
   when: enable_hydra_passwordless
@@ -108,11 +114,11 @@
 
 - name: Start OIDC Test app if enabled
   ansible.builtin.include_tasks: start-oidc-test.yml
-  when: enable_oidc_test_app
+  when: enable_oidc_test_app and not install_only
 
 - name: Stop OIDC Test app if disabled
   ansible.builtin.include_tasks: stop-oidc-test.yml
-  when: not enable_oidc_test_app
+  when: not enable_oidc_test_app and not install_only
 
 - name: Configure HAProxy
   template:
@@ -122,3 +128,4 @@
   notify:
     - Restart HAProxy
   become: true
+  tags: [ hydra-only ]

tasks/update-hydra-dispatcher.yml

@@ -5,6 +5,7 @@
     name:
       - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
     update_cache: yes
+    allow_downgrade: true
     state: present
   become: true
 
@@ -23,3 +24,14 @@
   notify:
     - Restart cadoles-pod-hydra-dispatcher-v1
   become: true
+
+- name: Configure cadoles-pod-hydra-dispatcher-v1 (2)
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  www.conf.gotmpl
+      dest: /etc/hydra-dispatcher/www.conf.gotmpl
+  notify:
+    - Restart cadoles-pod-hydra-dispatcher-v1
+  become: true

tasks/update-hydra-remote-user.yml

@@ -0,0 +1,38 @@
+---
+# Simple task to update the package/container cadoles-pod-hydra-remote-user only.
+- name: Install hydra-remote-user package
+  ansible.builtin.apt:
+    name:
+      - cadoles-pod-hydra-remote-user-v1={{ cadoles_pod_hydra_remote_user_v1_package_version }}
+    update_cache: yes
+    state: present
+  become: true
+
+- name: Configure cadoles-pod-hydra-remote-user-v1
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  with_items:
+    - src:  cadoles-pod-hydra-remote-user-v1.conf.j2
+      dest: /etc/cadoles-pod-hydra-remote-user-v1.conf
+      mode: u=rw,g=r
+    - src:  hydra-remote-user.yml.j2
+      dest: /etc/hydra-remote-user/conf.d/remote-user.yml
+      mode: u=rw,g=r,o=r
+  notify:
+    - Restart cadoles-pod-hydra-remote-user-v1
+  become: true
+
+- name: Configure cadoles-pod-hydra-remote-user-v1 (2)
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  hydra-remote-user-v1-apache.conf
+      dest: /etc/hydra-remote-user/apache.conf
+    - src:  mpm_prefork.conf
+      dest: /etc/hydra-remote-user/mpm_prefork.conf
+  notify:
+    - Restart cadoles-pod-hydra-remote-user-v1
+  become: true

tasks/update-hydra-sp.yml

@@ -0,0 +1,12 @@
+---
+# Simple task to update the package/container cadoles-pod-shibboleth-sp only.
+- name: Install hydra-shibboleth package
+  ansible.builtin.apt:
+    name:
+      - cadoles-pod-shibboleth-sp-v3={{ cadoles_pod_shibboleth_sp_v3_package_version }}
+    update_cache: yes
+    state: present
+  become: true
+
+- name: Configure hydra SP
+  ansible.builtin.include_tasks: configure-hydra-sp.yml

tasks/update-hydra.yml

@@ -0,0 +1,31 @@
+---
+# Simple task to update the package/container cadoles-pod-hydra only.
+- name: Install hydra package
+  ansible.builtin.apt:
+    name:
+      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
+    update_cache: yes
+    state: present
+  become: true
+
+- name: Configure cadoles-pod-hydra-v1
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  with_items:
+    - src:  cadoles-pod-hydra-v1.conf.j2
+      dest: /etc/cadoles-pod-hydra-v1.conf
+      mode: u=rw,g=r
+  notify:
+    - Restart cadoles-pod-hydra-v1
+  become: true
+
+- name: Create hydra-clients
+  template:
+    src: hydra-client.json.j2
+    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
+  with_items: "{{ hydra_clients }}"
+  notify:
+     - Reload hydra clients
+  become: true

templates/cadoles-pod-hydra-dispatcher-v1.conf.j2

@@ -4,7 +4,7 @@ PODMAN_ARGS="\
     --replace \
     --network=slirp4netns:allow_host_loopback=true \
     --tz=local \
-    -p 127.0.0.1:3000:80 \
+    -p 127.0.0.1:3000:8080 \
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_dispatcher_debug }}' \
     -e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:4445 \
@@ -20,8 +20,16 @@ PODMAN_ARGS="\
     -e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \
     -e 'SENTRY_DSN={{ hydra_dispatcher_sentry_dsn }}' \
     -e 'SENTRY_ENVIRONMENT={{ hydra_dispatcher_sentry_environment }}' \
+    -e 'REDIS_DSN={{ hydra_dispatcher_redis_dsn }}' \
+    --mount type=tmpfs,tmpfs-size=512M,destination=/app/var/cache \
     -e 'DISABLE_APP_AUTO_SELECT={{ hydra_dispatcher_disable_app_auto_select }}' \
-    -v /etc/hydra-dispatcher/conf.d:/var/www/config/hydra \
+    -e 'PHP_FPM_MEMORY_LIMIT=128m' \
+    -e 'PHP_FPM_MAX_CHILDREN=128' \
+    -e 'PHP_FPM_START_SERVERS=42' \
+    -e 'PHP_FPM_MIN_SPARE_SERVERS=24' \
+    -e 'PHP_FPM_MAX_SPARE_SERVERS=64' \
+    -v /etc/hydra-dispatcher/www.conf.gotmpl:/etc/php81/php-fpm.d/www.conf.gotmpl \
+    -v /etc/hydra-dispatcher/conf.d:/app/config/hydra \
     {% for item in hydra_dispatcher_mounts %}
     -v {{ item.host }}:{{ item.container }} \
     {% endfor %}

templates/cadoles-pod-hydra-oidc-v1.conf.j2

@@ -4,7 +4,7 @@ PODMAN_ARGS="\
     --replace \
     --network=slirp4netns:allow_host_loopback=true \
     --tz=local \
-    -p 127.0.0.1:3004:80 \
+    -p 127.0.0.1:3004:{{ hydra_oidc_internal_port | default(8080) }} \
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_oidc_debug }}' \
     -e 'HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000' \

templates/cadoles-pod-hydra-remote-user-v1.conf.j2

@@ -6,6 +6,7 @@ PODMAN_ARGS="\
     --tz=local \
     -v /etc/hydra-remote-user/conf.d:/var/www/config/remote_user \
     -v /etc/hydra-remote-user/apache.conf:/etc/apache2/sites-available/000-default.conf \
+    -v /etc/hydra-remote-user/mpm_prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf \
     -v /etc/hosts:/etc/hosts:ro \
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_saml_debug }}' \

templates/cadoles-pod-hydra-v1.conf.j2

@@ -25,5 +25,6 @@ PODMAN_ARGS="\
     {% endif %}
     -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
     -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
+    -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
     -v /etc/hydra/clients.d:/etc/hydra/clients.d \
 "

templates/cadoles-pod-shibboleth-sp-v3.conf.j2

@@ -12,7 +12,7 @@ PODMAN_ARGS="\
     -e 'APACHE_FORCE_HTTPS={{ "true" if haproxy_public_base_url.startswith('https') else "false" }}' \
     -e 'SP_HANDLER_BASE_PATH={{ haproxy_hydra_saml_base_path }}' \
     -e 'SP_SESSIONS_REDIRECT_LIMIT=host+allow' \
-    -e 'SP_SESSIONS_REDIRECT_ALLOW={{ hydra_saml_allowed_redirects | join(',') }}' \
+    -e 'SP_SESSIONS_REDIRECT_ALLOW={{ hydra_saml_allowed_redirects | join(' ') }}' \
     -e 'SP_INCLUDE_DEFAULT_ATTRIBUTES_MAPPING={{ hydra_saml_include_sp_default_attributes_mapping }}' \
     -e 'SP_INCLUDE_DEFAULT_ATTRIBUTES_POLICY={{ hydra_saml_include_sp_default_attributes_policy }}' \
     -v '/etc/shibboleth/attribute-map.inc.xml:/etc/shibboleth/attribute-map.inc.xml' \

templates/haproxy.cfg.j2

@@ -39,8 +39,9 @@ frontend http-in
     mode http
     
     maxconn 2000
-
+{% if enable_hydra_dispatcher %}
     acl login_dispatcher path_beg -i {{ haproxy_hydra_dispatcher_base_path }}
+{% endif %}
 {% if enable_hydra_passwordless %}
     acl login_passwordless path_beg -i {{ haproxy_hydra_passwordless_base_path }}
 {% endif %}
@@ -57,7 +58,9 @@ frontend http-in
     acl oidc_test path_beg -i {{ haproxy_oidc_test_base_path }}
 {% endif %}
 
+{% if enable_hydra_dispatcher %}
     use_backend hydra_dispatcher if login_dispatcher
+{% endif %}
 {% if enable_hydra_passwordless %}
     use_backend hydra_passwordless if login_passwordless
 {% endif %}
@@ -86,6 +89,7 @@ backend hydra
     http-request set-path %[path,regsub(^{{ haproxy_hydra_base_path }},)]
     server hydra 127.0.0.1:4444 check
 
+{% if enable_hydra_dispatcher %}
 # Backend Hydra Dispatcher
 backend hydra_dispatcher
     balance roundrobin
@@ -94,6 +98,7 @@ backend hydra_dispatcher
     http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_dispatcher_base_path }}
 
     server hydra-login-dispatcher 127.0.0.1:3000 check
+{%- endif %}
 
 {% if enable_hydra_passwordless %}
 # Backend Hydra Passwordless