Skip to content

Commit ac0ec87

Browse files
author
Martin
committed
Additional changes
1 parent 7e9959b commit ac0ec87

File tree

3 files changed

+95
-75
lines changed

3 files changed

+95
-75
lines changed

‎imageroot/actions/configure-module/10configure_environment_vars‎

Lines changed: 73 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,48 @@
11
#!/usr/bin/env python3
2-
32
# Copyright (C) 2022 Nethesis S.r.l.
43
# SPDX-License-Identifier: GPL-3.0-or-later
54

65
import json
76
import sys
87
import agent
9-
import secrets
10-
import base64
118
import os
129
from agent.ldapproxy import Ldapproxy
1310

14-
# Parse JSON input
11+
# ------------------------------------------------
12+
# 0. Parse JSON input
13+
# ------------------------------------------------
1514
data = json.load(sys.stdin)
1615

17-
# ------------------------------------------------------------
18-
# 1. Core application settings (always required)
19-
# ------------------------------------------------------------
16+
# ------------------------------------------------
17+
# 1. Core application settings
18+
# ------------------------------------------------
2019
SEMAPHORE_ADMIN_PASSWORD = data.get("SEMAPHORE_ADMIN_PASSWORD", "password")
2120
SEMAPHORE_ADMIN_NAME = data.get("SEMAPHORE_ADMIN_NAME", "admin")
2221
SEMAPHORE_ADMIN_EMAIL = data.get("SEMAPHORE_ADMIN_EMAIL", "admin@admin.com")
2322
SEMAPHORE_ADMIN = data.get("SEMAPHORE_ADMIN", "admin")
2423

25-
# ------------------------------------------------------------
26-
# 2. Reverse-proxy / TLS settings (NEW)
27-
# ------------------------------------------------------------
28-
host = data.get("host", "")
29-
lets_encrypt = data.get("lets_encrypt", False)
30-
http2https = data.get("http2https", True)
24+
# ------------------------------------------------
25+
# 2. Reverse-proxy / TLS
26+
# ------------------------------------------------
27+
host = data.get("host", "")
28+
lets_encrypt = data.get("lets_encrypt", False)
29+
http2https = data.get("http2https", True)
3130

3231
agent.set_env("TRAEFIK_HOST", host)
3332
agent.set_env("TRAEFIK_LETS_ENCRYPT", "True" if lets_encrypt else "False")
3433
agent.set_env("TRAEFIK_HTTP2HTTPS", "True" if http2https else "False")
3534

36-
# ------------------------------------------------------------
37-
# 3. SMTP via SmartHost (unchanged)
38-
# ------------------------------------------------------------
39-
rdb = agent.redis_connect(use_replica=True)
35+
# ------------------------------------------------
36+
# 3. SMTP via SmartHost
37+
# ------------------------------------------------
38+
rdb = agent.redis_connect(use_replica=True)
4039
smtp = agent.get_smarthost_settings(rdb)
4140

4241
MAIL_FROM_NAME = f"SEMAPHORE <{smtp['username']}>"
4342

44-
# ------------------------------------------------------------
45-
# 4. Optional notification channels (unchanged)
46-
# ------------------------------------------------------------
43+
# ------------------------------------------------
44+
# 4. Optional notification channels
45+
# ------------------------------------------------
4746
SEMAPHORE_GOTIFY_ALERT = data.get("SEMAPHORE_GOTIFY_ALERT", "False")
4847
SEMAPHORE_GOTIFY_URL = data.get("SEMAPHORE_GOTIFY_URL", "")
4948
SEMAPHORE_GOTIFY_TOKEN = data.get("SEMAPHORE_GOTIFY_TOKEN", "")
@@ -52,25 +51,52 @@ SEMAPHORE_TELEGRAM_ALERT = data.get("SEMAPHORE_TELEGRAM_ALERT", "False")
5251
SEMAPHORE_TELEGRAM_CHAT = data.get("SEMAPHORE_TELEGRAM_CHAT", "")
5352
SEMAPHORE_TELEGRAM_TOKEN = data.get("SEMAPHORE_TELEGRAM_TOKEN", "")
5453

55-
# ------------------------------------------------------------
56-
# 5. LDAP (unchanged – still driven by ldap_domain)
57-
# ------------------------------------------------------------
54+
# ------------------------------------------------
55+
# 5. LDAP
56+
# ------------------------------------------------
5857
ldap_domain = data.get("ldap_domain", "")
5958
agent.set_env("LDAP_DOMAIN", ldap_domain)
6059

61-
agent.bind_user_domains([ldap_domain] if ldap_domain else [])
62-
63-
SEMAPHORE_LDAP_ENABLE = "True" if ldap_domain else "False"
64-
SEMAPHORE_LDAP_BIND_DN = os.getenv("LDAP_SEARCH_BIND_DN", "")
65-
SEMAPHORE_LDAP_BIND_PASSWORD = os.getenv("LDAP_SEARCH_BIND_PASSWORD", "")
66-
SEMAPHORE_LDAP_SERVER = os.getenv("LDAP_HOSTNAME", "")
67-
SEMAPHORE_LDAP_SEARCH_DN = os.getenv("LDAP_USER_BASE_DN", "")
68-
SEMAPHORE_LDAP_SEARCH_FILTER = os.getenv("LDAP_USER_SEARCH_FILTER", "")
69-
SEMAPHORE_LDAP_NEEDTLS = "False"
70-
71-
# ------------------------------------------------------------
72-
# 6. Build the final env file for Semaphore
73-
# ------------------------------------------------------------
60+
# unset stale LDAP env vars
61+
for var in [
62+
"LDAP_HOSTNAME", "LDAP_PORT", "LDAP_SEARCH_BIND_DN",
63+
"LDAP_SEARCH_BIND_PASSWORD", "LDAP_USER_BASE_DN",
64+
"LDAP_MEMBER_ATTRIBUTE", "LDAP_MEMBER_ATTRIBUTE_TYPE",
65+
"LDAP_GROUP_BASE_DN", "LDAP_USERNAME_ATTRIBUTE",
66+
"LDAP_USER_SEARCH_FILTER", "LDAP_GROUP_SEARCH_FILTER"
67+
]:
68+
agent.unset_env(var)
69+
70+
if ldap_domain:
71+
agent.bind_user_domains([ldap_domain])
72+
odom = Ldapproxy().get_domain(ldap_domain)
73+
base_dn = odom["base_dn"]
74+
75+
agent.set_env("LDAP_HOSTNAME", odom["host"])
76+
agent.set_env("LDAP_PORT", str(odom["port"]))
77+
agent.set_env("LDAP_SEARCH_BIND_DN", odom["bind_dn"])
78+
agent.set_env("LDAP_SEARCH_BIND_PASSWORD", odom["bind_password"])
79+
80+
if odom["schema"] == "rfc2307":
81+
agent.set_env("LDAP_USER_BASE_DN", f"ou=People,{base_dn}")
82+
agent.set_env("LDAP_GROUP_BASE_DN", f"ou=Groups,{base_dn}")
83+
agent.set_env("LDAP_MEMBER_ATTRIBUTE", "memberUid")
84+
agent.set_env("LDAP_MEMBER_ATTRIBUTE_TYPE", "uid")
85+
86+
elif odom["schema"] == "ad":
87+
agent.set_env("LDAP_USER_BASE_DN", f"cn=Users,{base_dn}")
88+
agent.set_env("LDAP_GROUP_BASE_DN", f"cn=Users,{base_dn}")
89+
agent.set_env("LDAP_USERNAME_ATTRIBUTE", "samaccountname")
90+
agent.set_env("LDAP_USER_SEARCH_FILTER",
91+
"(&(objectClass=top)(objectClass=user)(objectClass=person)(objectClass=organizationalPerson))")
92+
agent.set_env("LDAP_GROUP_SEARCH_FILTER",
93+
"(&(objectClass=top)(objectClass=group))")
94+
else:
95+
agent.bind_user_domains([])
96+
97+
# ------------------------------------------------
98+
# 6. Build final env file
99+
# ------------------------------------------------
74100
app_env = {
75101
# Admin
76102
"SEMAPHORE_ADMIN_PASSWORD": SEMAPHORE_ADMIN_PASSWORD,
@@ -94,13 +120,13 @@ app_env = {
94120
"SEMAPHORE_TELEGRAM_TOKEN": SEMAPHORE_TELEGRAM_TOKEN,
95121

96122
# LDAP
97-
"SEMAPHORE_LDAP_ENABLE": SEMAPHORE_LDAP_ENABLE,
98-
"SEMAPHORE_LDAP_BIND_DN": SEMAPHORE_LDAP_BIND_DN,
99-
"SEMAPHORE_LDAP_BIND_PASSWORD": SEMAPHORE_LDAP_BIND_PASSWORD,
100-
"SEMAPHORE_LDAP_SERVER": SEMAPHORE_LDAP_SERVER,
101-
"SEMAPHORE_LDAP_SEARCH_DN": SEMAPHORE_LDAP_SEARCH_DN,
102-
"SEMAPHORE_LDAP_SEARCH_FILTER": SEMAPHORE_LDAP_SEARCH_FILTER,
103-
"SEMAPHORE_LDAP_NEEDTLS": SEMAPHORE_LDAP_NEEDTLS,
123+
"SEMAPHORE_LDAP_ENABLE": "True" if ldap_domain else "False",
124+
"SEMAPHORE_LDAP_BIND_DN": os.getenv("LDAP_SEARCH_BIND_DN", ""),
125+
"SEMAPHORE_LDAP_BIND_PASSWORD": os.getenv("LDAP_SEARCH_BIND_PASSWORD", ""),
126+
"SEMAPHORE_LDAP_SERVER": os.getenv("LDAP_HOSTNAME", ""),
127+
"SEMAPHORE_LDAP_SEARCH_DN": os.getenv("LDAP_USER_BASE_DN", ""),
128+
"SEMAPHORE_LDAP_SEARCH_FILTER": os.getenv("LDAP_USER_SEARCH_FILTER", ""),
129+
"SEMAPHORE_LDAP_NEEDTLS": "False",
104130
"SEMAPHORE_LDAP_MAPPING_DN": "dn",
105131
"SEMAPHORE_LDAP_MAPPING_MAIL": "mail",
106132
"SEMAPHORE_LDAP_MAPPING_UID": "uid",
@@ -109,15 +135,15 @@ app_env = {
109135

110136
agent.write_envfile("app.env", app_env)
111137

112-
# ------------------------------------------------------------
113-
# 7. Echo back the whole configuration so the UI can reload it
114-
# ------------------------------------------------------------
138+
# ------------------------------------------------
139+
# 7. Echo back the configuration for the UI
140+
# ------------------------------------------------
115141
json.dump({
116142
"host": host,
117143
"lets_encrypt": lets_encrypt,
118144
"http2https": http2https,
119145
"ldap_domain": ldap_domain,
120-
"domains_list": agent.list_user_domains(), # used by combo-box
146+
"domains_list": agent.list_user_domains(),
121147
"semaphore_admin": SEMAPHORE_ADMIN,
122148
"semaphore_admin_name": SEMAPHORE_ADMIN_NAME,
123149
"semaphore_admin_email": SEMAPHORE_ADMIN_EMAIL,

‎imageroot/bin/discover-ldap‎

Lines changed: 17 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,42 @@
11
#!/usr/bin/env python3
2-
32
import os
4-
import sys
5-
import json
63
import agent
74
from agent.ldapproxy import Ldapproxy
85

9-
ldap_domain = os.getenv('LDAP_DOMAIN', '')
6+
ldap_domain = os.getenv("LDAP_DOMAIN", "")
107
agent.set_env("LDAP_DOMAIN", ldap_domain)
118

12-
# Unset existing LDAP vars
139
for var in [
14-
"LDAP_HOSTNAME", "LDAP_PORT", "LDAP_SEARCH_BIND_DN", "LDAP_SEARCH_BIND_PASSWORD",
15-
"LDAP_USER_BASE_DN", "LDAP_MEMBER_ATTRIBUTE", "LDAP_MEMBER_ATTRIBUTE_TYPE",
16-
"LDAP_GROUP_BASE_DN", "LDAP_USERNAME_ATTRIBUTE", "LDAP_USER_SEARCH_FILTER", "LDAP_GROUP_SEARCH_FILTER"
10+
"LDAP_HOSTNAME", "LDAP_PORT", "LDAP_SEARCH_BIND_DN",
11+
"LDAP_SEARCH_BIND_PASSWORD", "LDAP_USER_BASE_DN",
12+
"LDAP_MEMBER_ATTRIBUTE", "LDAP_MEMBER_ATTRIBUTE_TYPE",
13+
"LDAP_GROUP_BASE_DN", "LDAP_USERNAME_ATTRIBUTE",
14+
"LDAP_USER_SEARCH_FILTER", "LDAP_GROUP_SEARCH_FILTER"
1715
]:
1816
agent.unset_env(var)
1917

2018
if ldap_domain:
21-
agent.bind_user_domains([ldap_domain])
2219
odom = Ldapproxy().get_domain(ldap_domain)
23-
base_dn = odom['base_dn']
20+
base_dn = odom["base_dn"]
2421

25-
agent.set_env("LDAP_HOSTNAME", "10.0.2.2")
26-
agent.set_env("LDAP_PORT", odom["port"])
22+
agent.set_env("LDAP_HOSTNAME", odom["host"])
23+
agent.set_env("LDAP_PORT", str(odom["port"]))
2724
agent.set_env("LDAP_SEARCH_BIND_DN", odom["bind_dn"])
2825
agent.set_env("LDAP_SEARCH_BIND_PASSWORD", odom["bind_password"])
2926

3027
if odom["schema"] == "rfc2307":
31-
agent.set_env("LDAP_USER_BASE_DN", f"ou=People,{base_dn}")
28+
agent.set_env("LDAP_USER_BASE_DN", f"ou=People,{base_dn}")
29+
agent.set_env("LDAP_GROUP_BASE_DN", f"ou=Groups,{base_dn}")
3230
agent.set_env("LDAP_MEMBER_ATTRIBUTE", "memberUid")
3331
agent.set_env("LDAP_MEMBER_ATTRIBUTE_TYPE", "uid")
34-
agent.set_env("LDAP_GROUP_BASE_DN", f"ou=Groups,{base_dn}")
3532

3633
elif odom["schema"] == "ad":
37-
agent.set_env("LDAP_USER_BASE_DN", f"cn=Users,{base_dn}")
34+
agent.set_env("LDAP_USER_BASE_DN", f"cn=Users,{base_dn}")
3835
agent.set_env("LDAP_GROUP_BASE_DN", f"cn=Users,{base_dn}")
3936
agent.set_env("LDAP_USERNAME_ATTRIBUTE", "samaccountname")
40-
agent.set_env("LDAP_USER_SEARCH_FILTER", "(&(objectClass=top)(objectClass=user)(objectClass=person)(objectClass=organizationalPerson))")
41-
agent.set_env("LDAP_GROUP_SEARCH_FILTER", "(&(objectClass=top)(objectClass=group))")
42-
else:
43-
agent.bind_user_domains([])
37+
agent.set_env("LDAP_USER_SEARCH_FILTER",
38+
"(&(objectClass=top)(objectClass=user)(objectClass=person)(objectClass=organizationalPerson))")
39+
agent.set_env("LDAP_GROUP_SEARCH_FILTER",
40+
"(&(objectClass=top)(objectClass=group))")
4441

45-
# Persist all
46-
agent.dump_env()
42+
agent.dump_env()

‎imageroot/update-module.d/30bind_user_domain‎

100644100755
Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ import os
1010
import sys
1111
import json
1212

13-
if not hasattr(agent, 'get_bound_domain_list'):
14-
sys.exit(0) # core version too old, skip and try on next update
15-
16-
user_ldap_domain= os.getenv('LDAP_DOMAIN')
17-
rdb = agent.redis_connect(use_replica=True)
18-
if user_ldap_domain and not agent.get_bound_domain_list(rdb):
19-
agent.bind_user_domains([user_ldap_domain])
13+
ldap_domain = os.getenv("LDAP_DOMAIN", "")
14+
if ldap_domain:
15+
agent.bind_user_domains([ldap_domain])
16+
else:
17+
agent.bind_user_domains([])

0 commit comments

Comments
 (0)