Stepup tiqr: Add docker deployment option

roles/stepuptiqr/handlers/main.yml

@@ -6,3 +6,10 @@
   service:
     name: php72-php-fpm
     state: reloaded
+
+- name: restart tiqr
+  community.docker.docker_container:
+    name: tiqr
+    state: started
+    restart: true
+

roles/stepuptiqr/tasks/docker.yml

@@ -0,0 +1,79 @@
+- name: Include docker vars
+  ansible.builtin.include_vars: docker.yml
+
+- name: Add group {{ appname }}
+  ansible.builtin.group:
+    name: "{{ appname }}"
+    state: present
+  register: tiqr_guid
+
+- name: Add user {{ appname }}
+  ansible.builtin.user:
+    name: "{{ appname }}"
+    group: "{{ appname }}"
+    createhome: no
+    state: present
+  register: tiqr_uid
+
+- name: Create some dirs
+  ansible.builtin.file:
+    state: directory
+    dest: "{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - "{{ current_release_config_dir_name }}"
+    - "{{ current_release_appdir }}/public/images"
+
+- name: Install images
+  ansible.builtin.include_role:
+    name: stepupapp
+    tasks_from: copyimages
+
+- name: Install GSSP IdP key and certificates
+  ansible.builtin.include_role:
+    name: stepupapp
+    tasks_from: copygsspidpcerts
+
+- name: Write tiqr APNS certificate
+  ansible.builtin.copy:
+    content: "{{ tiqr_apns_pemfile }}"
+    dest: "{{ current_release_config_file_dir_name }}/apns.pem"
+    owner: "{{ appname }}"
+    mode: "0400"
+  when: tiqr_apns_pemfile is defined
+
+- name: Place parameters.yml
+  ansible.builtin.template:
+    src: parameters.yaml.j2
+    dest: "{{ current_release_config_dir_name }}/parameters.yaml"
+    mode: "0640"
+    owner: root
+    group: "{{ appname }}"
+  notify:
+    - restart tiqr
+
+- name: Create the container
+  community.docker.docker_container:
+    name: "{{ appname }}"
+    image: ghcr.io/openconext/stepup-tiqr/stepup-tiqr:{{ tiqr_version }}
+    pull: true
+    restart_policy: "always"
+    networks:
+      - name: "loadbalancer"
+    labels:
+      traefik.http.routers.tiqr.rule: "Host(`tiqr.{{ base_domain }}`)"
+      traefik.http.routers.tiqr.tls: "true"
+      traefik.enable: "true"
+    env:
+      APACHE_UID: "#{{ tiqr_uid.uid }}"
+      APACHE_GUID: "#{{ tiqr_guid.gid }}"
+      APP_ENV: prod
+    mounts:
+      - source: /opt/openconext/tiqr/public/images/header-logo.png
+        target: /var/www/html/public/images/header-logo.png
+        type: bind
+      - source: /opt/openconext/tiqr
+        target: /var/www/html/config/openconext
+        type: bind

roles/stepuptiqr/tasks/main.yml

@@ -1,85 +1,7 @@
-- debug:
-    msg: "{{ tiqr_statestorage }}"
+- name: Include docker tasks when running docker
+  ansible.builtin.include_tasks: docker.yml
+  when: "'docker' in group_names"
 
-- name: Install Apache and FPM config
-  include_role:
-    name: apachefpm
-
-- name: Install the symfony app
-  include_role:
-    name: stepupapp
-
-- name: Install images
-  include_role:
-    name: stepupapp
-    tasks_from: copyimages
-
-- name: Install the GSSP certificates
-  include_role:
-    name: stepupapp
-    tasks_from: copygsspidpcerts
-
-- name: Write tiqr APNS certificate
-  copy:
-    content: "{{ tiqr_apns_pemfile }}"
-    dest: "{{ current_release_config_file_dir_name }}/apns.pem"
-    owner: "{{ appname }}"
-    mode: 0400
-  when: tiqr_apns_pemfile is defined
-
-- name: Place parameters.yml
-  template:
-    src: parameters.yaml.j2
-    dest: "{{ current_release_config_dir_name }}/parameters.yaml"
-    mode: 0640
-    owner: root
-    group: "{{ appname }}"
-  notify:
-    - clear cache {{ appname }}
-    - reload php72-fpm {{ appname }}
-
-- name: Place .env file
-  template:
-    src: env.j2
-    dest: "{{ current_release_appdir }}/.env.local"
-    mode: 0640
-    owner: root
-    group: "{{ appname }}"
-  notify: clear cache {{ appname }}
-
-- name: Install assets
-  command: php72 {{ current_release_appdir }}/bin/console assets:install 
-
-- name: Activate the symlink
-  file:
-    src: "{{ current_release_appdir }}"
-    dest: "{{ current_release_symlink }}"
-    state: link
-
-- name: Put tiqr configuration script in /root/
-  template: 
-    src: "{{ item }}.j2"
-    dest: "/root/{{ item }}" 
-    group: root 
-    owner: root 
-    mode: "0500"
-  with_items:
-  - "01-tiqr-db_init.sh"
-
-- name: Put tiqr keyserver migration script in /root/
-  template: 
-    src: "{{ item }}.j2"
-    dest: "/root/{{ item }}" 
-    group: root 
-    owner: root 
-    mode: "500"
-  with_items:
-  - "02-tiqr-migrate-to-keyserver.php"
-  when: keyserver_consumerkey is defined
-
-- meta: flush_handlers
-
-- name: Include post installation tasks
-  include_role:
-    name: stepupapp
-    tasks_from: postinstall
+- name: Include docker tasks when running docker
+  ansible.builtin.include_tasks: vm.yml
+  when: "'docker' not in group_names"

roles/stepuptiqr/tasks/vm.yml

@@ -0,0 +1,85 @@
+- debug:
+    msg: "{{ tiqr_statestorage }}"
+
+- name: Install Apache and FPM config
+  include_role:
+    name: apachefpm
+
+- name: Install the symfony app
+  include_role:
+    name: stepupapp
+
+- name: Install images
+  include_role:
+    name: stepupapp
+    tasks_from: copyimages
+
+- name: Install the GSSP certificates
+  include_role:
+    name: stepupapp
+    tasks_from: copygsspidpcerts
+
+- name: Write tiqr APNS certificate
+  copy:
+    content: "{{ tiqr_apns_pemfile }}"
+    dest: "{{ current_release_config_file_dir_name }}/apns.pem"
+    owner: "{{ appname }}"
+    mode: 0400
+  when: tiqr_apns_pemfile is defined
+
+- name: Place parameters.yml
+  template:
+    src: parameters.yaml.j2
+    dest: "{{ current_release_config_dir_name }}/parameters.yaml"
+    mode: 0640
+    owner: root
+    group: "{{ appname }}"
+  notify:
+    - clear cache {{ appname }}
+    - reload php72-fpm {{ appname }}
+
+- name: Place .env file
+  template:
+    src: env.j2
+    dest: "{{ current_release_appdir }}/.env.local"
+    mode: 0640
+    owner: root
+    group: "{{ appname }}"
+  notify: clear cache {{ appname }}
+
+- name: Install assets
+  command: php72 {{ current_release_appdir }}/bin/console assets:install 
+
+- name: Activate the symlink
+  file:
+    src: "{{ current_release_appdir }}"
+    dest: "{{ current_release_symlink }}"
+    state: link
+
+- name: Put tiqr configuration script in /root/
+  template: 
+    src: "{{ item }}.j2"
+    dest: "/root/{{ item }}" 
+    group: root 
+    owner: root 
+    mode: "0500"
+  with_items:
+  - "01-tiqr-db_init.sh"
+
+- name: Put tiqr keyserver migration script in /root/
+  template: 
+    src: "{{ item }}.j2"
+    dest: "/root/{{ item }}" 
+    group: root 
+    owner: root 
+    mode: "500"
+  with_items:
+  - "02-tiqr-migrate-to-keyserver.php"
+  when: keyserver_consumerkey is defined
+
+- meta: flush_handlers
+
+- name: Include post installation tasks
+  include_role:
+    name: stepupapp
+    tasks_from: postinstall

roles/stepuptiqr/templates/parameters.yaml.j2

@@ -1,16 +1,22 @@
 parameters:
+{% if 'docker' in group_names %}
+    app_env: prod
+    app_debug: false 
+    app_secret: {{ tiqr_secret }}
+{% endif %}
+
     # All locales supported by the application
     locales: [{{ enabled_locales | join(",") }}]
 
     # SAML configuration
-    saml_idp_publickey: '{{ current_release_config_file_dir_name }}/cert.pem'
-    saml_idp_privatekey: '{{ current_release_config_file_dir_name }}/key.pem'
+    saml_idp_publickey: '{{ current_release_config_file_dir_name_in_config }}/cert.pem'
+    saml_idp_privatekey: '{{ current_release_config_file_dir_name_in_config }}/key.pem'
     # NOTE: same key used for metadata and response/assertion signing
-    saml_metadata_publickey: '{{ current_release_config_file_dir_name }}/cert.pem'
-    saml_metadata_privatekey: '{{ current_release_config_file_dir_name }}/key.pem'
+    saml_metadata_publickey: '{{ current_release_config_file_dir_name_in_config }}/cert.pem'
+    saml_metadata_privatekey: '{{ current_release_config_file_dir_name_in_config }}/key.pem'
 
     saml_remote_sp_entity_id: 'https://{{ gateway_vhost_name }}/gssp/tiqr/metadata'
-    saml_remote_sp_certificate: '{{ current_release_config_file_dir_name }}/gateway.crt'
+    saml_remote_sp_certificate: '{{ current_release_config_file_dir_name_in_config }}/gateway.crt'
     saml_remote_sp_acs: 'https://{{ gateway_vhost_name }}/gssp/tiqr/consume-assertion'
 
     base_url: 'https://{{ vhost_name }}'
@@ -50,7 +56,7 @@ parameters:
             apikey: '{{ tiqr_firebase_apikey }}'
 {% endif %}
           apns:
-            certificate: '{{ current_release_config_file_dir_name }}/apns.pem'
+            certificate: '{{ current_release_config_file_dir_name_in_config }}/apns.pem'
             environment: production
         accountblocking:
             maxAttempts: 5

roles/stepuptiqr/vars/docker.yml

@@ -0,0 +1,5 @@
+
+current_release_appdir: /opt/openconext/tiqr
+current_release_config_file_dir_name: /opt/openconext/tiqr
+current_release_config_file_dir_name_in_config: /var/www/html/config/openconext
+current_release_config_dir_name: /opt/openconext/tiqr

roles/stepuptiqr/vars/main.yml

@@ -9,6 +9,7 @@ current_release_symlink: "/opt/openconext/OpenConext-{{ appname }}"
 current_release_appdir: "{{ current_release_symlink }}-{{ appversion }}"
 current_release_config_file_dir_name: "{{ current_release_appdir }}/app/files"
 current_release_config_dir_name: "{{ current_release_appdir }}/config/legacy"
+current_release_config_file_dir_name_in_config: "{{ current_release_config_file_dir_name }}"
 gssp_idp_private_key: "{{ lookup('file', inventory_dir+'/files/certs/stepup/tiqr_idp.key') }}"
 database_tiqr_user: tiqrrw
 database_tiqr_deploy_user: tiqrdeploy