Ajout volume cadoles-pod-hydra-dispatcher

defaults/main.yml

@@ -1,6 +1,4 @@
 ---
-install_only: false
-
 # cadoles-pod repository configuration
 cadoles_pod_debian_repository_url: https://vulcain.cadoles.com
 cadoles_pod_debian_repository: bullseye-dev
@@ -17,8 +15,7 @@ cadoles_pod_hydra_oidc_v1_package_version: '*'
 cadoles_pod_hydra_ldap_v1_package_version: '*'
 
 # Hydra database configuration
-hydra_use_external_database: false
-hydra_auto_migrate: false
+hydra_use_external_database: no
 hydra_database_name: hydra
 hydra_database_user: hydra
 hydra_database_password: hydra
@@ -46,18 +43,10 @@ hydra_urls_self_issuer_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_base_
 hydra_urls_consent: "{{ haproxy_public_base_url }}{{ haproxy_hydra_dispatcher_base_path }}/consent"
 hydra_urls_login: "{{ haproxy_public_base_url }}{{ haproxy_hydra_dispatcher_base_path }}/login"
 hydra_urls_logout: "{{ haproxy_public_base_url }}{{ haproxy_hydra_dispatcher_base_path }}/logout"
-hydra_url_post_logout: "{{ haproxy_public_base_url }}"
-hydra_urls_error: "{{ haproxy_public_base_url }}/erreur"
-hydra_public_cors_allowed_origins: []
 
 hydra_log_level: warn
 hydra_log_leak_sensitive_values: no
 
-# Durée de vie des "refresh_token"
-hydra_ttl_refresh_token: "24h"
-
-hydra_bcrypt_cost: 8
-
 # This value should not be changed after first deployment !
 hydra_secrets_seed: "{{ inventory_hostname }}"
 
@@ -69,10 +58,9 @@ hydra_clients:
 
 # Hydra dispatcher configuration
 
-enable_hydra_dispatcher: true
 hydra_dispatcher_cookie_path: "{{ haproxy_hydra_dispatcher_base_path }}"
 hydra_dispatcher_debug: no
-hydra_dispatcher_admin_authorized_hosts:
+hydra_dispatcher_admin_authorized_hosts: 
   - '10.0.0.0/8'
   - '172.16.0.0/12'
   - '192.168.0.0/16'
@@ -82,39 +70,13 @@ hydra_dispatcher_available_locales:
   - en
 hydra_dispatcher_sentry_dsn:
 hydra_dispatcher_sentry_environment:
-hydra_dispatcher_redis_dsn:
 hydra_dispatcher_mounts: []
-hydra_dispatcher_disable_app_auto_select: true
-hydra_dispatcher_webhook: false
-hydra_dispatcher_webhook_api_url:
-hydra_dispatcher_webhook_api_key: YouNeedToChangeMe
-hydra_dispatcher_webhook_rules:
-    email:
-      required: false
-      pattern:
-    family_name:
-      required: false
-    given_name:
-      required: false
-    birthdate:
-      required: false
-    birthplace:
-      required: false
-    birthcountry:
-      required: false
-    crous:
-      required: false
-    idpve:
-      required: false
-    sub:
-      required: false
+
 # Hydra Passwordless configuration
 
 enable_hydra_passwordless: yes
-hydra_passwordless_app_title:
-  fr: Adresse courriel
-hydra_passwordless_app_description: 
-  fr: Authentification via adresse courriel
+hydra_passwordless_app_title: Adresse courriel
+hydra_passwordless_app_description: Authentification via adresse courriel
 hydra_passwordless_app_icon_url: https://upload.wikimedia.org/wikipedia/commons/4/48/You%27ve_got_mail.png
 hydra_passwordless_identity_provider_id: passwordless
 hydra_passwordless_smtp_host: smtp-server
@@ -125,12 +87,12 @@ hydra_passwordless_smtp_insecure_skip_verify: no
 hydra_passwordless_smtp_use_start_tls: no
 hydra_passwordless_sender_address: noreply@localhost
 hydra_passwordless_sender_name: "[hydra-passwordless]"
-hydra_passwordless_attributes_rewrite_rules:
+hydra_passwordless_attributes_rewrite_rules: 
     email:
       - "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
     email_verified:
       - "property_exists(consent.session.id_token, 'email_verified') ? consent.session.id_token.email_verified : false"
-    family_name:
+    family_name: 
       - "property_exists(consent.session.id_token, 'family_name') ? consent.session.id_token.family_name : null"
     given_name:
       - "property_exists(consent.session.id_token, 'given_name') ? consent.session.id_token.given_name : null"
@@ -148,17 +110,12 @@ hydra_passwordless_attributes_rewrite_rules:
 # Hydra SAML configuration
 
 enable_hydra_saml: yes
-hydra_saml_app_title:
-  fr: SAML
-hydra_saml_app_description:
-  fr: Authentification via SAML
+hydra_saml_app_title: SAML
+hydra_saml_app_description: Authentification via SAML
 hydra_saml_app_icon_url:
 hydra_saml_identity_provider_id: saml
 hydra_saml_idp_entity_id: https://samltest.id/saml/idp
 hydra_saml_idp_metadata_url: https://samltest.id/saml/idp
-hydra_saml_app_options:
-  icon_url:
-    fr: 
 
 # Liste des URLs autorisées pour la redirection post-login/logout sur le service shibboleth-sp
 hydra_saml_allowed_redirects: []
@@ -180,10 +137,10 @@ hydra_saml_include_sp_default_attributes_policy: "yes"
 
 # Règles de sélection et réécritures des attributs du jeton OIDC
 # en provenance de la login-app sélectionnée
-hydra_saml_attributes_rewrite_rules:
+hydra_saml_attributes_rewrite_rules: 
   email:
     - "consent.session.id_token.email ? consent.session.id_token.email : null"
-  family_name:
+  family_name: 
     - "consent.session.id_token.family_name ? consent.session.id_token.family_name : null"
   given_name:
     - "consent.session.id_token.given_name ? consent.session.id_token.given_name : null"
@@ -214,7 +171,7 @@ saml_attributes:
     nameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri
   - id: mail
     name: urn:oid:0.9.2342.19200300.100.1.3
-    nameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri
+    nameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri 
 
 saml_attribute_policies: []
 
@@ -229,34 +186,26 @@ oidc_test_app_public_base_url: "{{ haproxy_public_base_url }}{{ haproxy_oidc_tes
 
 enable_hydra_oidc: no
 hydra_oidc_debug: no
-hydra_oidc_internal_port: 8080
-hydra_oidc_hydra_url_error:
-hydra_oidc_base_url:
 hydra_oidc_cookie_path: "{{ haproxy_hydra_oidc_base_path }}"
-hydra_oidc_app_title:
-  fr: OIDC
-hydra_oidc_app_description:
-  fr: Authentification via OIDC
+hydra_oidc_app_title: OpenID Connect
+hydra_oidc_app_description: Authentification via OpenID Connect
 hydra_oidc_app_icon_url: https://openid.net/wordpress-content/uploads/2014/09/openid-r-logo-900x360.png
 hydra_oidc_identity_provider_id: oidc
 hydra_oidc_authorize_endpoint:
 hydra_oidc_token_endpoint:
 hydra_oidc_userinfo_endpoint:
-hydra_oidc_logout_endpoint:
+hydra_oidc_logout_endpoint: 
 hydra_oidc_post_logout_redirect_url:
 hydra_oidc_scope: openid email
 hydra_oidc_client_id:
-hydra_oidc_client_secret:
-hydra_oidc_additionnal_env: {}
-hydra_oidc_app_options:
-  icon_url:
-    fr:
+hydra_oidc_client_secret: 
+
 hydra_oidc_attributes_rewrite_rules:
   email:
     - "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
   email_verified:
     - "property_exists(consent.session.id_token, 'email_verified') ? consent.session.id_token.email_verified : false"
-  family_name:
+  family_name: 
     - "property_exists(consent.session.id_token, 'family_name') ? consent.session.id_token.family_name : null"
   given_name:
     - "property_exists(consent.session.id_token, 'given_name') ? consent.session.id_token.given_name : null"
@@ -274,10 +223,8 @@ hydra_oidc_attributes_rewrite_rules:
 # Hydra LDAP configuration
 
 enable_hydra_ldap: no
-hydra_ldap_app_title:
-  fr: LDAP
-hydra_ldap_app_description: 
-  fr: Authentification via LDAP
+hydra_ldap_app_title: LDAP
+hydra_ldap_app_description: Authentification via LDAP
 hydra_ldap_app_icon_url:
 hydra_ldap_dev_mode: false
 hydra_ldap_attributes_rewrite_rules:
@@ -285,7 +232,7 @@ hydra_ldap_attributes_rewrite_rules:
     - "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
   email_verified:
     - "property_exists(consent.session.id_token, 'email_verified') ? consent.session.id_token.email_verified : false"
-  family_name:
+  family_name: 
     - "property_exists(consent.session.id_token, 'family_name') ? consent.session.id_token.family_name : null"
   given_name:
     - "property_exists(consent.session.id_token, 'given_name') ? consent.session.id_token.given_name : null"

files/mpm_prefork.conf

@@ -1,10 +0,0 @@
-# prefork MPM
-
-<IfModule mpm_prefork_module>
-	StartServers       10
-	MinSpareServers	   10
-	MaxSpareServers	   20
-	MaxRequestWorkers 128
-	MaxConnectionsPerChild  2000
-</IfModule>
-

files/www.conf.gotmpl

@@ -1,24 +0,0 @@
-{%- raw -%}
-[www]
-user = www-data
-group = www-data
-
-listen = {{ env.Getenv "PHP_FPM_LISTEN" "/tmp/php-fpm.sock" }}
-listen.owner = www-data
-listen.group = www-data
-listen.mode = 0660
-
-pm = dynamic
-pm.max_children = {{ env.Getenv "PHP_FPM_MAX_CHILDREN" "5" }}
-pm.start_servers = {{ env.Getenv "PHP_FPM_START_SERVERS" "2" }}
-pm.min_spare_servers = {{ env.Getenv "PHP_FPM_MIN_SPARE_SERVERS" "1" }}
-pm.max_spare_servers = {{ env.Getenv "PHP_FPM_MAX_SPARE_SERVERS" "3" }}
-
-pm.status_path = /healthcheck
-pm.status_listen = 127.0.0.1:8091
-
-clear_env = no
-
-php_admin_value[display_errors] = {{ env.Getenv "PHP_FPM_DISPLAY_ERRORS" "off" }}
-php_admin_value[memory_limit] = {{ env.Getenv "PHP_FPM_MEMORY_LIMIT" "32m" }}
-{% endraw %}

handlers/main.yml

@@ -4,65 +4,49 @@
     name: haproxy
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-v1
   service:
     name: cadoles-pod-hydra-v1
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-dispatcher-v1
   service:
     name: cadoles-pod-hydra-dispatcher-v1
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-passwordless-v1
   service:
     name: cadoles-pod-hydra-passwordless-v1
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-remote-user-v1
   service:
     name: cadoles-pod-hydra-remote-user-v1
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-shibboleth-sp-v3
   service:
     name: cadoles-pod-shibboleth-sp-v3
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-oidc-v1
   service:
     name: cadoles-pod-hydra-oidc-v1
     state: restarted
   become: true
-  when: not install_only
 
 - name: Restart cadoles-pod-hydra-ldap-v1
   service:
     name: cadoles-pod-hydra-ldap-v1
     state: restarted
   become: true
-  when: not install_only
-
-- name: Restart cadoles-pod-goweb-oidc-v1
-  service:
-    name: cadoles-pod-goweb-oidc-v1
-    state: restarted
-  become: true
-  when: not install_only
 
 - name: Reload hydra clients
   ansible.builtin.include_tasks:
-    file: hydra-reload-clients.yml
-  when: not install_only
+    file: hydra-reload-clients.yml

sso.schema.yml

@@ -78,21 +78,12 @@ properties:
     type: string
   hydra_urls_logout:
     type: string
-  hydra_url_post_logout:
-    type: string
 
   hydra_log_level:
     type: string
   hydra_log_leak_sensitive_values:
     type: boolean
 
-  hydra_ttl_refresh_token:
-    type: string
-
-  hydra_brypt_cost:
-    type: number
-    description: Coût CPU pour calculer des hachages de secret (4-31)
-
   # This value should not be changed after first deployment !
   hydra_secrets_seed:
     type: string
@@ -116,9 +107,9 @@ properties:
   enable_hydra_passwordless:
     type: boolean
   hydra_passwordless_app_title:
-    type: object
+    type: string
   hydra_passwordless_app_description:
-    type: object
+    type: string
   hydra_passwordless_app_icon_url:
     type: string
   hydra_passwordless_smtp_host:
@@ -141,9 +132,9 @@ properties:
   enable_hydra_saml:
     type: boolean
   hydra_saml_app_title:
-    type: object
+    type: string
   hydra_saml_app_description:
-    type: object
+    type: string
   hydra_saml_app_icon_url:
     type: string
   hydra_saml_idp_entity_id:
@@ -162,4 +153,4 @@ properties:
   oidc_test_app_client_secret:
     type: string
 
-additionalProperties: true
+additionalProperties: true

tasks/configure-hydra-sp.yml

@@ -1,21 +0,0 @@
----
-# Simple task to update the config files of cadoles-pod-shibboleth-sp only.
-
-- name: Configure cadoles-pod-shibboleth-sp-v3
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "{{ item.mode }}"
-  with_items:
-    - src:  cadoles-pod-shibboleth-sp-v3.conf.j2
-      dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
-      mode: u=rw,g=r
-    - src:  shibboleth-attribute-map.inc.xml.j2
-      dest: /etc/shibboleth/attribute-map.inc.xml
-      mode: u=rw,g=r,o=r
-    - src:  shibboleth-attribute-policy.inc.xml.j2
-      dest: /etc/shibboleth/attribute-policy.inc.xml
-      mode: u=rw,g=r,o=r
-  notify:
-    - Restart cadoles-pod-shibboleth-sp-v3
-  become: true

tasks/goweb-oidc.yml

@@ -1,22 +0,0 @@
----
-
-- name: Install cadoles-pod-goweb-oidc-v1 package
-  ansible.builtin.apt:
-    name:
-      - "cadoles-pod-goweb-oidc-v1={{ cadoles_pod_goweb_oidc_v1_package_version }}"
-    update_cache: yes
-    state: present
-  become: true
-
-- name: Configure cadoles-pod-goweb-oidc-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "{{ item.mode }}"
-  with_items:
-    - src:  cadoles-pod-goweb-oidc-v1.conf.j2
-      dest: /etc/cadoles-pod-goweb-oidc-v1.conf
-      mode: u=rw,g=r,o=r
-  notify:
-    - Restart cadoles-pod-goweb-oidc-v1
-  become: true

tasks/hydra-create-client.yml

@@ -1,25 +0,0 @@
----
-# Simple task to create 1 client for hydra. Fails if the client already exists.
-# Parameter: client_id
-
-- fail: msg='Error, client does not exist. Please define the client first'
-  when: hydra_clients|selectattr("client_id", "equalto", client_id)|list|length == 0
-
-# Creating a client which already exists could create problems
-- name: Check client doesn't already exists
-  command: podman exec -t cadoles-pod-hydra-v1 /bin/sh -c "hydra clients get {{ client_id }} --endpoint http://127.0.0.1:4445"
-  register: command_result
-  failed_when: command_result.rc == 0
-  become: true
-
-- name: Create hydra-client
-  template:
-    src: hydra-client.json.j2
-    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
-  with_items: "{{ hydra_clients }}"
-  when: item.client_id == client_id
-  become: true
-
-- name: Import client
-  command: podman exec -t cadoles-pod-hydra-v1 /bin/sh -c "hydra clients import /etc/hydra/clients.d/{{ client_id }}.json --endpoint http://127.0.0.1:4445"
-  become: true

tasks/hydra-saml.yml

@@ -27,13 +27,8 @@
 
 - name: Configure cadoles-pod-hydra-remote-user-v1 (2)
   ansible.builtin.copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  hydra-remote-user-v1-apache.conf
-      dest: /etc/hydra-remote-user/apache.conf
-    - src:  mpm_prefork.conf
-      dest: /etc/hydra-remote-user/mpm_prefork.conf
+    src:  hydra-remote-user-v1-apache.conf
+    dest: /etc/hydra-remote-user/apache.conf
   notify:
     - Restart cadoles-pod-hydra-remote-user-v1
   become: true
@@ -64,4 +59,4 @@
       mode: u=rw,g=r,o=r
   notify:
     - Restart cadoles-pod-shibboleth-sp-v3
-  become: true
+  become: true

tasks/hydra-update-client.yml

@@ -1,33 +0,0 @@
----
-# Simple task to update 1 client for hydra.
-# Parameter: client_id
-
-- fail: msg='Error, client does not exist. Please define the client first'
-  when: hydra_clients|selectattr("client_id", "equalto", client_id)|list|length == 0
-
-- name: Create or overwrite hydra-client
-  template:
-    src: hydra-client.json.j2
-    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
-  with_items: "{{ hydra_clients }}"
-  when: item.client_id == client_id
-  become: true
-
-- name: Update client
-  command: >
-    podman exec -t cadoles-pod-hydra-v1 /bin/sh -c "hydra clients update '{{ client_id }}'
-    --endpoint http://127.0.0.1:4445
-    --name '{{ item.client_name | default(item.client_id) }}'
-    --secret '{{ item.client_secret | default(lookup('ansible.builtin.password', '/dev/null chars=ascii_lowercase,digits length=32 seed=inventory_hostname')) }}'
-    --grant-types '{{ ','.join(item.grant_types) if "grant_types" in item else "authorization_code, refresh_token" }}'
-    --post-logout-callbacks '{{ ','.join(item.post_logout_redirect_uris) if "post_logout_redirect_uris" in item else "" }}'
-    --callbacks '{{ ','.join(item.redirect_uris) }}'
-    --response-types '{{ ','.join(item.response_types) if "response_types" in item else "code" }}'
-    --logo-uri '{{ item.logo_uri if "logo_uri" in item else "" }}'
-    --scope '{{ ','.join(item.scope) if "scope" in item else "openid profile email webhook" }}'
-    --token-endpoint-auth-method '{{ item.token_endpoint_auth_method if "token_endpoint_auth_method" in item else "client_secret_post" }}'
-    "
-  with_items: "{{ hydra_clients }}"
-  when: item.client_id == client_id
-  become: true
-

tasks/install-hydra.yml

@@ -1,45 +0,0 @@
----
-
-- name: Install Hydra
-  ansible.builtin.apt:
-    name:
-      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
-    update_cache: yes
-    state: present
-  become: true
-
-- name: Configure Hydra local database
-  ansible.builtin.include_tasks: hydra-database.yml
-  when: not hydra_use_external_database
-
-- name: Configure cadoles-pod-hydra-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  cadoles-pod-hydra-v1.conf.j2
-      dest: /etc/cadoles-pod-hydra-v1.conf
-  notify:
-    - Restart cadoles-pod-hydra-v1
-  become: true
-
-- name: Check cadoles-pod-hydra-v1 status
-  service:
-    name: cadoles-pod-hydra-v1
-    state: started
-  become: true
-
-- name: Migrate Hydra database schema
-  command: podman exec -it cadoles-pod-hydra-v1 migrate-hydra-schema
-  become: true
-  when: hydra_auto_migrate
-
-- name: Create hydra-clients
-  template:
-    src: hydra-client.json.j2
-    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
-  with_items: "{{ hydra_clients }}"
-  notify:
-    - Reload hydra clients
-  become: true
-

tasks/main.yml

@@ -9,28 +9,24 @@
     update_cache: yes
     state: present
   become: true
-  tags: [ hydra-only ]
 
 - name: Add LetsEncrypt missing intermediate certificates
   command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'"
   args:
     creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem
   become: true
-  tags: [ hydra-only ]
 
 - name: Add cadoles-pod debian repository key
   ansible.builtin.apt_key:
     url: "{{ cadoles_pod_debian_repository_key_url }}"
     state: present
   become: true
-  tags: [ hydra-only ]
 
 - name: Configure cadoles-pod debian repository
   ansible.builtin.apt_repository:
     repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main"
     state: present
   become: true
-  tags: [ hydra-only ]
 
 - name: Ensure sysctl configuration
   ansible.posix.sysctl:
@@ -43,32 +39,50 @@
     - name: fs.inotify.max_user_watches
       value: 204800
   become: true
-  tags: [ hydra-only ]
 
-- name: Install HAProxy
+- name: Install core packages
   ansible.builtin.apt:
     name:
       - haproxy={{ haproxy_package_version }}
-    update_cache: yes
-    state: present
-  become: true
-  tags: [ hydra-only ]
-
-- name: Install Hydra
-  include_tasks: 
-    file: ./install-hydra.yml
-    apply:
-      tags: [ hydra-only ]
-  tags: [ hydra-only ]
-
-- name: Install hydra-dispatcher
-  ansible.builtin.apt:
-    name:
+      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
       - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
     update_cache: yes
     state: present
   become: true
 
+- name: Configure Hydra local database
+  ansible.builtin.include_tasks: hydra-database.yml
+  when: not hydra_use_external_database  
+
+- name: Configure HAProxy
+  template:
+    src: haproxy.cfg.j2
+    dest: /etc/haproxy/haproxy.cfg
+    validate: "haproxy -c -f %s"
+  notify:
+    - Restart HAProxy
+  become: true
+
+- name: Create hydra-clients
+  template:
+    src: hydra-client.json.j2
+    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
+  with_items: "{{ hydra_clients }}"
+  notify:
+    - Reload hydra clients
+  become: true
+
+- name: Configure cadoles-pod-hydra-v1
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - src:  cadoles-pod-hydra-v1.conf.j2
+      dest: /etc/cadoles-pod-hydra-v1.conf
+  notify:
+    - Restart cadoles-pod-hydra-v1
+  become: true
+
 - name: Configure cadoles-pod-hydra-dispatcher-v1
   template:
     src: "{{ item.src }}"
@@ -85,17 +99,6 @@
     - Restart cadoles-pod-hydra-dispatcher-v1
   become: true
 
-- name: Configure cadoles-pod-hydra-dispatcher-v1 (2)
-  ansible.builtin.copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  www.conf.gotmpl
-      dest: /etc/hydra-dispatcher/www.conf.gotmpl
-  notify:
-    - Restart cadoles-pod-hydra-dispatcher-v1
-  become: true
-
 - name: Configure passwordless authentification if enabled
   ansible.builtin.include_tasks: hydra-passwordless.yml
   when: enable_hydra_passwordless
@@ -114,18 +117,8 @@
 
 - name: Start OIDC Test app if enabled
   ansible.builtin.include_tasks: start-oidc-test.yml
-  when: enable_oidc_test_app and not install_only
+  when: enable_oidc_test_app
 
 - name: Stop OIDC Test app if disabled
   ansible.builtin.include_tasks: stop-oidc-test.yml
-  when: not enable_oidc_test_app and not install_only
-
-- name: Configure HAProxy
-  template:
-    src: haproxy.cfg.j2
-    dest: /etc/haproxy/haproxy.cfg
-    validate: "haproxy -c -f %s"
-  notify:
-    - Restart HAProxy
-  become: true
-  tags: [ hydra-only ]
+  when: not enable_oidc_test_app

tasks/update-hydra-dispatcher.yml

@@ -1,37 +0,0 @@
----
-# Simple task to update the package/container cadoles-pod-hydra-dispatcher only.
-- name: Install hydra-dispatcher package
-  ansible.builtin.apt:
-    name:
-      - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
-    update_cache: yes
-    allow_downgrade: true
-    state: present
-  become: true
-
-- name: Configure cadoles-pod-hydra-dispatcher-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "{{ item.mode }}"
-  with_items:
-    - src:  cadoles-pod-hydra-dispatcher-v1.conf.j2
-      dest: /etc/cadoles-pod-hydra-dispatcher-v1.conf
-      mode: u=rw,g=r
-    - src:  hydra-dispatcher-apps.yml.j2
-      dest: /etc/hydra-dispatcher/conf.d/apps.yml
-      mode: u=rw,g=r,o=r
-  notify:
-    - Restart cadoles-pod-hydra-dispatcher-v1
-  become: true
-
-- name: Configure cadoles-pod-hydra-dispatcher-v1 (2)
-  ansible.builtin.copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  www.conf.gotmpl
-      dest: /etc/hydra-dispatcher/www.conf.gotmpl
-  notify:
-    - Restart cadoles-pod-hydra-dispatcher-v1
-  become: true

tasks/update-hydra-remote-user.yml

@@ -1,38 +0,0 @@
----
-# Simple task to update the package/container cadoles-pod-hydra-remote-user only.
-- name: Install hydra-remote-user package
-  ansible.builtin.apt:
-    name:
-      - cadoles-pod-hydra-remote-user-v1={{ cadoles_pod_hydra_remote_user_v1_package_version }}
-    update_cache: yes
-    state: present
-  become: true
-
-- name: Configure cadoles-pod-hydra-remote-user-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "{{ item.mode }}"
-  with_items:
-    - src:  cadoles-pod-hydra-remote-user-v1.conf.j2
-      dest: /etc/cadoles-pod-hydra-remote-user-v1.conf
-      mode: u=rw,g=r
-    - src:  hydra-remote-user.yml.j2
-      dest: /etc/hydra-remote-user/conf.d/remote-user.yml
-      mode: u=rw,g=r,o=r
-  notify:
-    - Restart cadoles-pod-hydra-remote-user-v1
-  become: true
-
-- name: Configure cadoles-pod-hydra-remote-user-v1 (2)
-  ansible.builtin.copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - src:  hydra-remote-user-v1-apache.conf
-      dest: /etc/hydra-remote-user/apache.conf
-    - src:  mpm_prefork.conf
-      dest: /etc/hydra-remote-user/mpm_prefork.conf
-  notify:
-    - Restart cadoles-pod-hydra-remote-user-v1
-  become: true

tasks/update-hydra-sp.yml

@@ -1,12 +0,0 @@
----
-# Simple task to update the package/container cadoles-pod-shibboleth-sp only.
-- name: Install hydra-shibboleth package
-  ansible.builtin.apt:
-    name:
-      - cadoles-pod-shibboleth-sp-v3={{ cadoles_pod_shibboleth_sp_v3_package_version }}
-    update_cache: yes
-    state: present
-  become: true
-
-- name: Configure hydra SP
-  ansible.builtin.include_tasks: configure-hydra-sp.yml

tasks/update-hydra.yml

@@ -1,31 +0,0 @@
----
-# Simple task to update the package/container cadoles-pod-hydra only.
-- name: Install hydra package
-  ansible.builtin.apt:
-    name:
-      - cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
-    update_cache: yes
-    state: present
-  become: true
-
-- name: Configure cadoles-pod-hydra-v1
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "{{ item.mode }}"
-  with_items:
-    - src:  cadoles-pod-hydra-v1.conf.j2
-      dest: /etc/cadoles-pod-hydra-v1.conf
-      mode: u=rw,g=r
-  notify:
-    - Restart cadoles-pod-hydra-v1
-  become: true
-
-- name: Create hydra-clients
-  template:
-    src: hydra-client.json.j2
-    dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
-  with_items: "{{ hydra_clients }}"
-  notify:
-     - Reload hydra clients
-  become: true

templates/cadoles-pod-goweb-oidc-v1.conf.j2

@@ -1,14 +0,0 @@
-# {{ ansible_managed }}
-PODMAN_ARGS="\
-    --name 'cadoles-pod-goweb-oidc-demo-v1' \
-    --replace \
-    -p 80:3002 \
-    -e LOG_LEVEL=0 \
-    -e HTTP_ADDRESS=0.0.0.0:3002 \
-    -e OIDC_CLIENT_ID=mse-demo \
-    -e OIDC_CLIENT_SECRET={{ hydra_clients|selectattr('client_id', 'equalto', 'mse-demo')|map(attribute='client_secret')|first }} \
-    -e OIDC_ISSUER_URL=https://pp.messervices.etudiant.gouv.fr/auth/ \
-    -e OIDC_REDIRECT_URL=https://auth.lescrous.fr/oauth2/callback \
-    -e OIDC_POST_LOGOUT_REDIRECT_URL=https://auth.lescrous.fr \
-    -e OIDC_ACR_VALUES= \
-"

templates/cadoles-pod-hydra-dispatcher-v1.conf.j2

@@ -4,7 +4,12 @@ PODMAN_ARGS="\
     --replace \
     --network=slirp4netns:allow_host_loopback=true \
     --tz=local \
-    -p 127.0.0.1:3000:8080 \
+    -p 127.0.0.1:3000:80 \
+    -v /etc/hydra-dispatcher/conf.d:/var/www/config/hydra \ 
+        /etc/hydra-dispatcher/theme/templates:/var/www/templates \ 
+        /etc/hydra-dispatcher/theme/fonts:/var/www/public/build/fonts \ 
+        /etc/hydra-dispatcher/theme/theme.css:/var/www/public/build/theme/theme.css \ 
+        /etc/hydra-dispatcher/theme/images:/var/www/public/build/images
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_dispatcher_debug }}' \
     -e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:4445 \
@@ -20,17 +25,4 @@ PODMAN_ARGS="\
     -e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \
     -e 'SENTRY_DSN={{ hydra_dispatcher_sentry_dsn }}' \
     -e 'SENTRY_ENVIRONMENT={{ hydra_dispatcher_sentry_environment }}' \
-    -e 'REDIS_DSN={{ hydra_dispatcher_redis_dsn }}' \
-    --mount type=tmpfs,tmpfs-size=512M,destination=/app/var/cache \
-    -e 'DISABLE_APP_AUTO_SELECT={{ hydra_dispatcher_disable_app_auto_select }}' \
-    -e 'PHP_FPM_MEMORY_LIMIT=128m' \
-    -e 'PHP_FPM_MAX_CHILDREN=128' \
-    -e 'PHP_FPM_START_SERVERS=42' \
-    -e 'PHP_FPM_MIN_SPARE_SERVERS=24' \
-    -e 'PHP_FPM_MAX_SPARE_SERVERS=64' \
-    -v /etc/hydra-dispatcher/www.conf.gotmpl:/etc/php81/php-fpm.d/www.conf.gotmpl \
-    -v /etc/hydra-dispatcher/conf.d:/app/config/hydra \
-    {% for item in hydra_dispatcher_mounts %}
-    -v {{ item.host }}:{{ item.container }} \
-    {% endfor %}
 "

templates/cadoles-pod-hydra-oidc-v1.conf.j2

@@ -4,7 +4,7 @@ PODMAN_ARGS="\
     --replace \
     --network=slirp4netns:allow_host_loopback=true \
     --tz=local \
-    -p 127.0.0.1:3004:{{ hydra_oidc_internal_port | default(8080) }} \
+    -p 127.0.0.1:3004:80 \
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_oidc_debug }}' \
     -e 'HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000' \
@@ -13,13 +13,10 @@ PODMAN_ARGS="\
     -e 'OIDC_TOKEN_ENDPOINT={{ hydra_oidc_token_endpoint }}' \
     -e 'OIDC_USERINFO_ENDPOINT={{ hydra_oidc_userinfo_endpoint }}' \
     -e 'OIDC_LOGOUT_ENDPOINT={{ hydra_oidc_logout_endpoint }}' \
-    -e 'BASE_URL={{ hydra_oidc_base_url }}{{ haproxy_hydra_oidc_base_path }}' \
-    -e 'REDIRECT_ON_ERROR_URL={{ hydra_oidc_hydra_url_error }}' \
+    -e 'POST_LOGOUT_REDIRECT_URL={{ hydra_oidc_post_logout_redirect_url }}' \
+    -e 'BASE_URL={{ haproxy_public_base_url }}{{ haproxy_hydra_oidc_base_path }}' \
     -e 'OIDC_SCOPE={{ hydra_oidc_scope }}' \
-    -e 'CLIENT_ID={{ hydra_oidc_client_id }}' \
-    -e 'CLIENT_SECRET={{ hydra_oidc_client_secret }}' \
+    -e 'CLIENT_ID_FC={{ hydra_oidc_client_id }}' \
+    -e 'CLIENT_SECRET_FC={{ hydra_oidc_client_secret }}' \
     -e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \
-    {% for key,value in hydra_oidc_additionnal_env.items() %}
-    -e '{{ key }}={{ value }}' \
-    {% endfor %}
-"
+"

templates/cadoles-pod-hydra-remote-user-v1.conf.j2

@@ -6,7 +6,6 @@ PODMAN_ARGS="\
     --tz=local \
     -v /etc/hydra-remote-user/conf.d:/var/www/config/remote_user \
     -v /etc/hydra-remote-user/apache.conf:/etc/apache2/sites-available/000-default.conf \
-    -v /etc/hydra-remote-user/mpm_prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf \
     -v /etc/hosts:/etc/hosts:ro \
     -e APP_ENV=prod \
     -e 'APP_DEBUG={{ hydra_saml_debug }}' \
@@ -15,4 +14,4 @@ PODMAN_ARGS="\
     -e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000 \
     -e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \
     -e 'LOGOUT_REDIRECT_URL_PATTERN={{ haproxy_public_base_url }}{{ haproxy_hydra_saml_base_path }}/Shibboleth.sso/Logout?return=%s' \
-"
+"

templates/cadoles-pod-hydra-v1.conf.j2

@@ -14,17 +14,9 @@ PODMAN_ARGS="\
     -e 'HYDRA_URLS_CONSENT={{ hydra_urls_consent }}' \
     -e 'HYDRA_URLS_LOGIN={{ hydra_urls_login }}' \
     -e 'HYDRA_URLS_LOGOUT={{ hydra_urls_logout }}' \
-    -e 'HYDRA_URLS_ERROR={{ hydra_urls_error }}' \
-    -e 'HYDRA_URL_POST_LOGOUT={{ hydra_url_post_logout }}' \
     -e 'HYDRA_ALLOW_INSECURE=yes' \
     -e 'HYDRA_LEVEL={{ hydra_log_level }}' \
-    -e 'TTL_REFRESH_TOKEN={{ hydra_ttl_refresh_token }}'\
-    {% if hydra_public_cors_allowed_origins | default([]) | length > 0 %}
-    -e 'SERVE_PUBLIC_CORS_ENABLED=true' \
-    -e 'SERVE_PUBLIC_CORS_ALLOWED_ORIGINS={{ hydra_public_cors_allowed_origins | join(',') }}' \
-    {% endif %}
     -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
     -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-    -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
     -v /etc/hydra/clients.d:/etc/hydra/clients.d \
-"
+"

templates/cadoles-pod-shibboleth-sp-v3.conf.j2

@@ -12,10 +12,10 @@ PODMAN_ARGS="\
     -e 'APACHE_FORCE_HTTPS={{ "true" if haproxy_public_base_url.startswith('https') else "false" }}' \
     -e 'SP_HANDLER_BASE_PATH={{ haproxy_hydra_saml_base_path }}' \
     -e 'SP_SESSIONS_REDIRECT_LIMIT=host+allow' \
-    -e 'SP_SESSIONS_REDIRECT_ALLOW={{ hydra_saml_allowed_redirects | join(' ') }}' \
+    -e 'SP_SESSIONS_REDIRECT_ALLOW={{ hydra_saml_allowed_redirects | join(',') }}' \
     -e 'SP_INCLUDE_DEFAULT_ATTRIBUTES_MAPPING={{ hydra_saml_include_sp_default_attributes_mapping }}' \
     -e 'SP_INCLUDE_DEFAULT_ATTRIBUTES_POLICY={{ hydra_saml_include_sp_default_attributes_policy }}' \
     -v '/etc/shibboleth/attribute-map.inc.xml:/etc/shibboleth/attribute-map.inc.xml' \
     -v '/etc/shibboleth/attribute-policy.inc.xml:/etc/shibboleth/attribute-policy.inc.xml' \
     -v '/etc/shibboleth/credentials:/etc/shibboleth/credentials' \
-"
+"

templates/haproxy.cfg.j2

@@ -1,7 +1,7 @@
 # {{ ansible_managed }}
 global
-    log /dev/log	local0 err
-    log /dev/log	local1 err
+    log /dev/log	local0
+    log /dev/log	local1 notice
     chroot /var/lib/haproxy
     stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
     stats timeout 30s
@@ -39,9 +39,8 @@ frontend http-in
     mode http
     
     maxconn 2000
-{% if enable_hydra_dispatcher %}
+
     acl login_dispatcher path_beg -i {{ haproxy_hydra_dispatcher_base_path }}
-{% endif %}
 {% if enable_hydra_passwordless %}
     acl login_passwordless path_beg -i {{ haproxy_hydra_passwordless_base_path }}
 {% endif %}
@@ -58,9 +57,7 @@ frontend http-in
     acl oidc_test path_beg -i {{ haproxy_oidc_test_base_path }}
 {% endif %}
 
-{% if enable_hydra_dispatcher %}
     use_backend hydra_dispatcher if login_dispatcher
-{% endif %}
 {% if enable_hydra_passwordless %}
     use_backend hydra_passwordless if login_passwordless
 {% endif %}
@@ -89,7 +86,6 @@ backend hydra
     http-request set-path %[path,regsub(^{{ haproxy_hydra_base_path }},)]
     server hydra 127.0.0.1:4444 check
 
-{% if enable_hydra_dispatcher %}
 # Backend Hydra Dispatcher
 backend hydra_dispatcher
     balance roundrobin
@@ -98,7 +94,6 @@ backend hydra_dispatcher
     http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_dispatcher_base_path }}
 
     server hydra-login-dispatcher 127.0.0.1:3000 check
-{%- endif %}
 
 {% if enable_hydra_passwordless %}
 # Backend Hydra Passwordless
@@ -146,4 +141,4 @@ backend oidc_test
     http-request set-header X-Forwarded-Prefix {{ haproxy_oidc_test_base_path }}
 
     server oidc-test 127.0.0.1:8080 check
-{% endif %}
+{% endif %}

templates/hydra-client.json.j2

@@ -9,6 +9,6 @@
 	"redirect_uris": {{ item.redirect_uris | default([]) | to_json }},
 	"response_types": {{ item.response_types | default(["code"]) | to_json }},
 	"logo_uri": {{ item.logo_uri | default("") | to_json }},
-	"scope": {{ item.scope | default("openid profile email webhook") | to_json }},
+	"scope": {{ item.scope | default("openid profile email roles") | to_json }},
 	"token_endpoint_auth_method": {{ item.token_endpoint_auth_method | default("client_secret_post") | to_json }}
-}
+}

templates/hydra-dispatcher-apps.yml.j2

@@ -4,72 +4,48 @@ hydra:
 {% if enable_hydra_passwordless %}
     - id: {{ hydra_passwordless_identity_provider_id | default("passwordless") }}
       title:
-        fr: "{{ hydra_passwordless_app_title.fr }}"
-        en: "{{ hydra_passwordless_app_title.en | default(hydra_passwordless_app_title.fr)  }}"
-      description:
-        fr: "{{ hydra_passwordless_app_description.fr }}"
-        en: "{{ hydra_passwordless_app_description.en | default(hydra_passwordless_app_description.fr)  }}"
+        fr: "{{ hydra_passwordless_app_title }}"
+      description: 
+        fr: "{{ hydra_passwordless_app_description }}"
       login_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_passwordless_base_path }}/login"
       consent_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_passwordless_base_path }}/consent"
       logout_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_passwordless_base_path }}/logout"
-      attributes_rewrite_configuration: {{ hydra_passwordless_attributes_rewrite_configuration | default({}) | to_json }}
+      attributes_rewrite_rules: {{ hydra_passwordless_attributes_rewrite_rules | to_json }}
       icon_url: "{{ hydra_passwordless_app_icon_url }}"
 {% endif %}
 {% if enable_hydra_saml %}
     - id: {{ hydra_saml_identity_provider_id | default("saml") }}
-      title:
-        fr: "{{ hydra_saml_app_title.fr }}"
-        en: "{{ hydra_saml_app_title.en | default(hydra_saml_app_title.fr)  }}"
-      description:
-        fr: "{{ hydra_saml_app_description.fr }}"
-        en: "{{ hydra_saml_app_description.en | default(hydra_saml_app_description.fr)  }}"
+      title: 
+        fr: "{{ hydra_saml_app_title }}"
+      description: 
+        fr: "{{ hydra_saml_app_description }}"
       login_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_saml_base_path }}/login"
       consent_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_saml_base_path }}/consent"
       logout_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_saml_base_path }}/logout"
-      attributes_rewrite_configuration: {{ hydra_saml_attributes_rewrite_configuration  | default({}) | to_json }}
+      attributes_rewrite_rules: {{ hydra_saml_attributes_rewrite_rules | to_json }}
       icon_url: "{{ hydra_saml_app_icon_url }}"
-      options:
-        icon_url:
-          fr: "{{ hydra_saml_app_options.icon_url.fr }}"
-          en: "{{ hydra_saml_app_options.icon_url.en | default( hydra_saml_app_options.icon_url.fr) }}"
 {% endif %}
 {% if enable_hydra_oidc %}
     - id: {{ hydra_oidc_identity_provider_id | default("oidc") }}
-      title:
-        fr: "{{ hydra_oidc_app_title.fr }}"
-        en: "{{ hydra_oidc_app_title.en | default(hydra_oidc_app_title.fr)  }}"
-      description:
-        fr: "{{ hydra_oidc_app_description.fr }}"
-        en: "{{ hydra_oidc_app_description.en | default(hydra_oidc_app_description.fr)  }}"
-      login_url: "{{ hydra_oidc_base_url }}{{ haproxy_hydra_oidc_base_path }}/login"
-      consent_url: "{{ hydra_oidc_base_url }}{{ haproxy_hydra_oidc_base_path }}/consent"
-      logout_url: "{{ hydra_oidc_base_url }}{{ haproxy_hydra_oidc_base_path }}/logout"
-      attributes_rewrite_configuration: {{ hydra_oidc_attributes_rewrite_configuration  | default({}) | to_json }}
+      title: 
+        fr: "{{ hydra_oidc_app_title }}"
+      description: 
+        fr: "{{ hydra_oidc_app_description }}"
+      login_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_oidc_base_path }}/login"
+      consent_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_oidc_base_path }}/consent"
+      logout_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_oidc_base_path }}/logout"
+      attributes_rewrite_rules: {{ hydra_oidc_attributes_rewrite_rules | to_json }}
       icon_url: "{{ hydra_oidc_app_icon_url }}"
-      options:
-        icon_url:
-          fr: "{{ hydra_oidc_app_options.icon_url.fr }}"
-          en: "{{ hydra_oidc_app_options.icon_url.en | default(hydra_oidc_app_options.icon_url.fr) }}"
 {% endif %}
 {% if enable_hydra_ldap %}
     - id: ldap
-      title:
-        fr: "{{ hydra_ldap_app_title.fr }}"
-        en: "{{ hydra_ldap_app_title.en | default(hydra_ldap_app_title.fr)  }}"
-      description:
-        fr: "{{ hydra_ldap_app_description.fr }}"
-        en: "{{ hydra_ldap_app_description.en | default(hydra_ldap_app_description.fr)  }}"
+      title: 
+        fr: "{{ hydra_ldap_app_title }}"
+      description: 
+        fr: "{{ hydra_ldap_app_description }}"
       login_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_ldap_base_path }}/auth/login"
       consent_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_ldap_base_path }}/auth/consent"
       logout_url: "{{ haproxy_public_base_url }}{{ haproxy_hydra_ldap_base_path }}/auth/logout"
-      attributes_rewrite_configuration: {{ hydra_ldap_attributes_rewrite_configuration  | default({}) | to_json }}
+      attributes_rewrite_rules: {{ hydra_ldap_attributes_rewrite_rules | to_json }}
       icon_url: "{{ hydra_ldap_app_icon_url }}"
-{% endif %}
-  webhook:
-    enabled: {{ hydra_dispatcher_webhook }}
-    api_url: {{ hydra_dispatcher_webhook_api_url }}
-    api_key: {{ hydra_dispatcher_webhook_api_key }}
-    api_method: POST
-  firewall:
-    additional_properties: true
-    rules: {{ hydra_dispatcher_webhook_rules | to_json }}
+{% endif %}