Code

Add OCSP/CRL support#61

Code

Merged

rambo merged 56 commits intomainpvarki/docker-rasenmaeher-integration:mainfrom ocsp_reduxpvarki/docker-rasenmaeher-integration:ocsp_reduxCopy head branch name to clipboardMar 28, 2024

+407-90

Commits

Commits on Mar 1, 2024

• Start adding support for the new ocsp helper

  rambo

  committed
  a460a99

  Copy full SHA for a460a99

• trying to figure out actually working config for either OCSP or CRL

  rambo

  committed
  e3b5752

  Copy full SHA for e3b5752

• update tags for cfssl and rmapi containers

  rambo

  committed
  fc1b750

  Copy full SHA for fc1b750

• Try to put HAProxy with CRL watched in front of webtak and COT to prevent revoked users from connecting (reloading TAK itself is sloooow)

  rambo

  committed
  2194e45

  Copy full SHA for 2194e45

• add missing network to rmapi

  rambo

  committed
  d16d031

  Copy full SHA for d16d031

• call dump_crl also when calling ocsp refresh

  rambo

  committed
  c09cea2

  Copy full SHA for c09cea2

• enable CRL checking

  rambo

  committed
  194b40b

  Copy full SHA for 194b40b

• attempt to use caddy CRL refresh plugin

  rambo

  committed
  f3ed743

  Copy full SHA for f3ed743

• fix typo, it does not do what we want though, TLS is terminated instead of passed through

  rambo

  committed
  f815e8a

  Copy full SHA for f815e8a

• do not attempt to haproxy tak traffic

  rambo

  committed
  c0934ce

  Copy full SHA for c0934ce

• build custom nginx with inotify watcher for CRL

  rambo

  committed
  55bafbe

  Copy full SHA for 55bafbe

• use the nginx we build ourself

  rambo

  committed
  4040e4a

  Copy full SHA for 4040e4a

• minor updates to productapi handling

  rambo

  committed
  a3ce13c

  Copy full SHA for a3ce13c

• production side does not need long JWT lifetimes, mTLS is used

  rambo

  committed
  1287c4a

  Copy full SHA for 1287c4a

• improvements to promoting and demoting users via takrmapi

  rambo

  committed
  29acef9

  Copy full SHA for 29acef9

• we cannot both check mTLS cert validity and passthrough TLS at the same time, also it seems TAKServer at least can auto-reload the CRL when the file changes

  rambo

  committed
  c2af697

  Copy full SHA for c2af697

• update submodule pointers

  rambo

  committed
  4d3ac8f

  Copy full SHA for 4d3ac8f

• add healthcheck commands to rm api containers

  rambo

  committed
  2ca2a27

  Copy full SHA for 2ca2a27

• Add healthcheck endpoint to nginxes

  rambo

  committed
  e8b44df

  Copy full SHA for e8b44df

• healthcheck *MUST* exit with 1 (any nonzero code is not accepted) on failure

  rambo

  committed
  3806a53

  Copy full SHA for 3806a53

• auto-restart unhealthy containers (that have the autoheal label)

  rambo

  committed
  417aa21

  Copy full SHA for 417aa21

• make productapi nginx use the same shared resource style as the others

  rambo

  committed
  fecf513

  Copy full SHA for fecf513

• update submodule pointers

  rambo

  committed
  44014f5

  Copy full SHA for 44014f5

• update deps (submodule pointers are to dep update commits)

  rambo

  committed
  d5ea644

  Copy full SHA for d5ea644

• fix OCSP

  rambo

  committed
  773a2a2

  Copy full SHA for 773a2a2

• disable CRL since OCSP works, no need to keep reloading the process

  rambo

  committed
  2302227

  Copy full SHA for 2302227

• enable OCSP for TAK

  rambo

  committed
  6f17e4a

  Copy full SHA for 6f17e4a

• add tak containers to the ocsp network, remove changes to takserver init scripts

  rambo

  committed
  2511ec6

  Copy full SHA for 2511ec6

• unify devel and production configs

  rambo

  committed
  2f405c4

  Copy full SHA for 2f405c4

• make the resolver ip nginx requires configurable

  rambo

  committed
  083c48b

  Copy full SHA for 083c48b

• give takrmapi more time to start

  rambo

  committed
  acfeaab

  Copy full SHA for acfeaab

• use ocsprest merged crl as the crl url

  rambo

  committed
  349605e

  Copy full SHA for 349605e

• update submodule pointers

  rambo

  committed
  7c0de8e

  Copy full SHA for 7c0de8e

• add ENV variables for public OCSP responder URL

  rambo

  committed
  4d8b39c

  Copy full SHA for 4d8b39c

• improve healthchecks

  rambo

  committed
  5c54784

  Copy full SHA for 5c54784

• increase timeouts since signing certs is slower now

  rambo

  committed
  c048e1e

  Copy full SHA for c048e1e

• need trailing slashes for correct proxy_pass behaviour

  rambo

  committed
  e6e15ed

  Copy full SHA for e6e15ed

• update submodules

  rambo

  committed
  fbaa921

  Copy full SHA for fbaa921

• Make it easy to switch TILAUSPALVELU domain via ENV

  rambo

  committed
  5158044

  Copy full SHA for 5158044

• Make sure the healthchecks return code 1 on failue, docker compose has undefined behaviour for other codes

  rambo

  committed
  59d8ad8

  Copy full SHA for 59d8ad8

• new main pointers for all submodules

  rambo

  committed
  5cf9897

  Copy full SHA for 5cf9897

• fix tests dep version conflict

  rambo

  committed
  16c172c

  Copy full SHA for 16c172c

• Fix missed merge conflict

  rambo

  committed
  37c7574

  Copy full SHA for 37c7574

• bump versions of the containers, sadly they do not match versioning in the components or git tags because we have not gotten our procedures mailed down

  rambo

  committed
  1c34e6f

  Copy full SHA for 1c34e6f

• API was changed to not return approvecodes

  rambo

  committed
  a8e61cd

  Copy full SHA for a8e61cd

Commits on Mar 2, 2024

• add versioning to the tak and nginx tags as well so we do not accidentally break production tags when building new containers of the same takserver/nginx version

  rambo

  committed
  e58f64f

  Copy full SHA for e58f64f

Commits on Mar 18, 2024

• new main pointers for ui and takintegration

  rambo

  committed
  0fb9035

  Copy full SHA for 0fb9035

Commits on Mar 19, 2024

• we must not have a trailing slash in the ocsp proxy url

  rambo

  committed
  5ca6154

  Copy full SHA for 5ca6154

• we need to support both POST to /ca/oscp without trailing slash and get to /ca/oscp/something, the regex I tried first did not work so this is the way now

  rambo

  committed
  87c4506

  Copy full SHA for 87c4506

• enable OCSP checking for the product API nginxen as well

  rambo

  committed
  9f06336

  Copy full SHA for 9f06336

Commits on Mar 23, 2024

• ocsprest component updated

  rambo

  committed
  0cd070c

  Copy full SHA for 0cd070c

• update RMapi to 1.3.1

  rambo

  committed
  c6993bc

  Copy full SHA for c6993bc

• update RMapi to 1.3.2

  rambo

  committed
  852f94d

  Copy full SHA for 852f94d

• update ocsprest to 1.0.3

  rambo

  committed
  50b6e70

  Copy full SHA for 50b6e70

• do not give .git to docker context

  rambo

  committed
  e2ea904

  Copy full SHA for e2ea904

• update takintegration actually to 1.1.0, give the correct takserver image name to takrmapi build

  rambo

  committed
  858b53a

  Copy full SHA for 858b53a