add dooris role for setup of dooris interaction on the node itself

roles/dooris/templates/compose.yaml.j2

@@ -0,0 +1,17 @@
+---
+services:
+  dooris:
+    image: git.hamburg.ccc.de/ccchh/dooris:latest
+    environment:
+      DOORIS_OPENID_ISSUER: https://id.hamburg.ccc.de/realms/ccchh/
+      DOORIS_OPENID_CLIENT_ID: "{{ dooris__openid_client_id }}"
+      DOORIS_OPENID_CLIENT_SECRET: "{{ dooris__openid_client_secret }}"
+      DOORIS_BASE_URL: "https://{{ dooris__hostname }}"
+      DOORIS_CCUJACK_USER: "{{ dooris__ccujack_user }}"
+      DOORIS_CCUJACK_PASSWORD: "{{ dooris__ccujack_password }}"
+      DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys"
+      DOORIS_STATIC_API_TOKENS: "{{ dooris__static_api_token }}"
+    network_mode: host
+    restart: unless-stopped
+    volumes:
+      - "./state:/srv/state/:rw"

roles/dooris/templates/nginx/http_handler.conf

@@ -0,0 +1,12 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        proxy_pass http://127.0.0.1:31820/.well-known/acme-challenge/;
+    }
+}

roles/dooris/templates/nginx/site.conf

@@ -0,0 +1,41 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    listen [::]:443 ssl http2;
+    listen 443 ssl http2;
+
+    server_name {{ dooris__hostname }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ dooris__hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ dooris__hostname }}/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ dooris__hostname }}/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+
+    location / {
+        proxy_pass http://127.0.0.1:8000/;
+        # Increase size to fix nginx error: "upstream sent too big header while reading response header from upstream"
+        proxy_buffer_size 64k;
+        proxy_busy_buffers_size 64k;
+        proxy_buffers 20 4k;
+    }
+}

roles/dooris/templates/sshd_config

@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+Match User dooris
+  AuthorizedKeysFile /ansible_docker_compose/state/dooris_authorized_keys
+  ForceCommand /ansible_docker_compose/state/ssh-cli
+  SetEnv DOORIS_SERVER_URL=https://{{ dooris__hostname }} DOORIS_API_TOKEN={{ dooris__static_api_token}}