add dooris role for setup of dooris interaction on the node itself

roles/dooris/README.md

@@ -0,0 +1,14 @@
+# dooris
+
+Deployment configuration of [dooris](https://git.hamburg.ccc.de/CCCHH/dooris) on our host.
+For an exact description of host requirements, see the README of dooris itself.
+
+## Required Arguments
+
+- `dooris__hostname`: The hostname on which the dooris server is reachable
+- `dooris__ccujack_user`: Username for authentication against homematic ccujack
+- `dooris__ccujack_password` Password for authentication against homematic ccujack
+- `dooris__openid_client_id`: Client-ID in CCCHH ID for dooris
+- `dooris__openid_client_secret`: Client-Secret in CCCHH ID for dooris
+- `dooris__static_api_token`: A static token that is valid on the servers API and can operate locks
+

roles/dooris/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: "reload sshd"
+  become: true
+  ansible.builtin.systemd_service:
+      name: "ssh.service"
+      state: "reloaded"

roles/dooris/meta/argument_specs.yml

@@ -0,0 +1,32 @@
+argument_specs:
+  main:
+    options:
+      dooris__static_api_token:
+        description: "A static token that is valid on the servers API and can operate locks"
+        required: true
+        type: str
+
+      dooris__hostname:
+        description: "The hostname on which the dooris server is reachable"
+        required: true
+        type: str
+
+      dooris__openid_client_id:
+        description: "Client-ID in CCCHH ID for dooris"
+        required: true
+        type: str
+
+      dooris__openid_client_secret:
+        description: "Client-Secret in CCCHH ID for dooris"
+        required: true
+        type: str
+
+      dooris__ccujack_user:
+        description: "Username for authentication against homematic ccujack"
+        required: true
+        type: str
+
+      dooris__ccujack_password:
+        description: "Password for authentication against homematic ccujack"
+        required: true
+        type: str

roles/dooris/meta/main.yml

@@ -0,0 +1,27 @@
+dependencies:
+  - role: docker_compose
+    vars:
+      docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'compose.yaml.j2') }}"
+      docker_compose__configuration_files: []
+
+  - role: certbot
+    vars:
+      certbot__new_cert_commands:
+        - "systemctl restart nginx.service"
+      certbot__certs:
+        - commonName: "dooris.ccchh.net"
+          challengeType: "dns-01-acme-dns"
+          dns_01_acme_dns:
+            subdomain: "37caae1f-b77f-4eb1-aa71-dc3f7ed24360"
+            apiUser: "fd42b696-a394-4e2a-8fcc-d44c9fac5d4e"
+            apiKey: "{{ secret__acme_dns_api_key_dooris_ccchh_net }}"
+
+  - role: nginx
+    vars:
+      nginx__version_spec: ""
+      nginx__deploy_redirect_conf: false
+      nginx__configurations:
+        - name: "{{ dooris__hostname }}"
+          content: "{{ lookup('ansible.builtin.template', 'nginx/site.conf') }}"
+        - name: http_handler
+          content: "{{ lookup('ansible.builtin.template', 'nginx/http_handler.conf') }}"

roles/dooris/tasks/main.yml

@@ -0,0 +1,34 @@
+- name: Create local dooris group
+  become: true
+  ansible.builtin.group:
+      name: "dooris"
+      gid: 10000
+
+- name: Create local dooris user
+  become: true
+  ansible.builtin.user:
+      name: "dooris"
+      uid: 10000
+      group: "dooris"
+      system: true
+      password: "!"
+      home: "/ansible_docker_compose/state/"
+      shell: "/ansible_docker_compose/state/ssh-cli"
+
+- name: Ensure dooris state directory exists and has correct permissions
+  become: true
+  ansible.builtin.file:
+      path: "/ansible_docker_compose/state/"
+      owner: "dooris"
+      group: "dooris"
+      mode: "u=rwx,g=rx,o="
+
+- name: Create ssh server config for dooris user
+  become: true
+  notify: "reload sshd"
+  ansible.builtin.template:
+      src: sshd_config
+      dest: /etc/ssh/sshd_config.d/dooris.conf
+      owner: root
+      group: root
+      mode: u=rw,g=r,o=r

roles/dooris/templates/compose.yaml.j2

@@ -0,0 +1,17 @@
+---
+services:
+  dooris:
+    image: git.hamburg.ccc.de/ccchh/dooris:latest
+    environment:
+      DOORIS_OPENID_ISSUER: https://id.hamburg.ccc.de/realms/ccchh/
+      DOORIS_OPENID_CLIENT_ID: "{{ dooris__openid_client_id }}"
+      DOORIS_OPENID_CLIENT_SECRET: "{{ dooris__openid_client_secret }}"
+      DOORIS_BASE_URL: "https://{{ dooris__hostname }}"
+      DOORIS_CCUJACK_USER: "{{ dooris__ccujack_user }}"
+      DOORIS_CCUJACK_PASSWORD: "{{ dooris__ccujack_password }}"
+      DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys"
+      DOORIS_STATIC_API_TOKENS: "{{ dooris__static_api_token }}"
+    network_mode: host
+    restart: unless-stopped
+    volumes:
+      - "./state:/srv/state/:rw"

roles/dooris/templates/nginx/http_handler.conf

@@ -0,0 +1,12 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        proxy_pass http://127.0.0.1:31820/.well-known/acme-challenge/;
+    }
+}

roles/dooris/templates/nginx/site.conf

@@ -0,0 +1,41 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    listen [::]:443 ssl http2;
+    listen 443 ssl http2;
+
+    server_name {{ dooris__hostname }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ dooris__hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ dooris__hostname }}/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ dooris__hostname }}/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+
+    location / {
+        proxy_pass http://127.0.0.1:8000/;
+        # Increase size to fix nginx error: "upstream sent too big header while reading response header from upstream"
+        proxy_buffer_size 64k;
+        proxy_busy_buffers_size 64k;
+        proxy_buffers 20 4k;
+    }
+}

roles/dooris/templates/sshd_config

@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+Match User dooris
+  AuthorizedKeysFile /ansible_docker_compose/state/dooris_authorized_keys
+  ForceCommand /ansible_docker_compose/state/ssh-cli
+  SetEnv DOORIS_SERVER_URL=https://{{ dooris__hostname }} DOORIS_API_TOKEN={{ dooris__static_api_token}}