regen certificate in lemur

dicos/50_lemur.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <creole>
     <files>
-        <!--service>lemur</service-->
+        <service>lemur</service>
         <file name='/etc/lemur/lemur.conf.py' mkdir='True'/>
         <file name='/etc/eole/eole-db.d/lemur.yml'/>
         <file name='/etc/nginx/web.d/lemur.conf' source='nginx-lemur.conf'/>
@@ -18,6 +18,18 @@
                 <value>lemur</value>
             </variable>
             <variable name='lemur_admin_password' type='password' description="Mot de passe de l'utilisateur admin de Lemur" auto_save="True"/>
+            <variable name='lemur_admin_email' type='mail' description="Adresse courriel d'administration de Lemur" mandatory="True"/>
+            <variable name='lemur_default_country' type='string' description="" mandatory="True">
+                <value>FR</value>
+            </variable>
+            <variable name='lemur_default_state' type='string' description="" mandatory="True">
+                <value>Bourgogne</value>
+            </variable>
+            <variable name='lemur_default_location' type='string' description="" mandatory="True">
+                <value>Dijon</value>
+            </variable>
+            <variable name='lemur_default_organization' type='string' description="" mandatory="True"/>
+            <variable name='lemur_default_organization_unit' type='string' description="" mandatory="True"/>
         </family>
     </variables>
     <constraints>

lemur.service

@@ -3,7 +3,7 @@ Description=Lemur
 After=postgresql.service
 
 [Service]
-ExecStart=/usr/bin/lemur start -b 127.0.0.1:8002 -c /etc/lemur/lemur.conf.py
+ExecStart=/usr/bin/lemur -c /etc/lemur/lemur.conf.py start -b 127.0.0.1:8002
 User=lemur
 Group=lemur
 

lemur_cron.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Lemur
+After=lemur.service
+
+[Service]
+Environment="LEMUR_CONF=/etc/lemur/lemur.conf.py"
+ExecStart=/usr/bin/lemur certificate reissue --commit
+User=lemur
+Group=lemur
+
+[Install]
+WantedBy=basic.target

lemur_cron.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Crontab for Lemur
+
+[Timer]
+OnCalendar=daily
+Unit=lemur_cron.service
+
+[Install]
+WantedBy=timers.target

posttemplate/03-lemur

@@ -3,7 +3,7 @@
 set -e
 
 # install unrelease python modules
-pip3 install alembic-autogenerate-enums==0.0.2 asyncpool==1.0 certsrv==2.1.1 cryptography==3.1.1 dnspython3==1.15.0 dyn==1.8.1 flask-replicated==1.4 javaobj-py3==0.4.0.1 jsonlines==1.2.0 logmatic-python==0.1.7 marshmallow==2.20.4 pycryptodomex==3.9.7 pyjks==20.0.0 raven[flask]==6.10.0 twofish==0.3.0
+pip3 install alembic-autogenerate-enums==0.0.2 asyncpool==1.0 certsrv==2.1.1 cryptography==3.1.1 dnspython3==1.15.0 dyn==1.8.1 flask-replicated==1.4 javaobj-py3==0.4.0.1 jsonlines==1.2.0 logmatic-python==0.1.7 marshmallow==2.20.4 pycryptodomex==3.9.7 pyjks==20.0.0 raven[flask]==6.10.0 twofish==0.3.0 pyjwt==2.1.0
 
 mkdir -p /var/log/lemur/
 chown lemur: /var/log/lemur/
@@ -12,8 +12,12 @@ chown lemur: /var/log/lemur/
 chmod 640 /etc/lemur/*
 chgrp lemur /etc/lemur/*
 systemctl start postgresql.service
+psql -Upostgres -c "grant all on all tables in schema public to lemur" lemur
+psql -Upostgres -c "grant all on all sequences in schema public to lemur" lemur
+psql -Upostgres -c "grant all on all functions in schema public to lemur" lemur
 su - lemur -s /bin/bash -c "lemur --config=/etc/lemur/lemur.conf.py init --password $(CreoleGet lemur_admin_password)"
 systemctl stop postgresql.service
-rm -f *.log
+
+systemctl enable --now lemur_cron.timer
 
 exit 0

tmpl/lemur.conf.py

@@ -24,16 +24,21 @@ LEMUR_ALLOWED_DOMAINS = []
 
 # Mail Server
 
-LEMUR_EMAIL = ''
+LEMUR_EMAIL = '%%lemur_admin_email'
 LEMUR_SECURITY_TEAM_EMAIL = []
+LEMUR_EMAIL_SENDER = 'smtp'
 
 # Certificate Defaults
 
-LEMUR_DEFAULT_COUNTRY = ''
+LEMUR_DEFAULT_COUNTRY = '%%lemur_default_country'
-LEMUR_DEFAULT_STATE = ''
+LEMUR_DEFAULT_STATE = '%%lemur_default_state'
-LEMUR_DEFAULT_LOCATION = ''
+LEMUR_DEFAULT_LOCATION = '%%lemur_default_location'
-LEMUR_DEFAULT_ORGANIZATION = ''
+LEMUR_DEFAULT_ORGANIZATION = '%%lemur_default_organization'
-LEMUR_DEFAULT_ORGANIZATIONAL_UNIT = ''
+LEMUR_DEFAULT_ORGANIZATIONAL_UNIT = '%%lemur_default_organization_unit'
+
+# Default issuer
+
+LEMUR_DEFAULT_ISSUER_PLUGIN = 'cryptography-issuer'
 
 # Authentication Providers
 ACTIVE_PROVIDERS = []
@@ -45,6 +50,7 @@ METRIC_PROVIDERS = []
 
 LOG_LEVEL = "DEBUG"
 LOG_FILE = "/var/log/lemur/lemur.log"
+LOG_UPGRADE_FILE = '/var/log/lemur/db_upgrade.log'
 
 
 # Database

tmpl/lemur.yml

@@ -16,3 +16,7 @@ sqlscripts:
   - /usr/share/eole/db/lemur/gen/lemur.sql
 pwd_files:
   - {'file': '/etc/lemur/lemur.conf.py', 'pattern': "SQLALCHEMY_DATABASE_PASSWORD = '"}
+%set %%var = %%getVar('risotto_main_dbname', None)
+%if not %%is_empty(%%var)
+  - {'file': '/etc/risotto/risotto.conf', 'pattern': "LEMUR_DB_PASSWORD='"}
+%end if