Add production-ready LocalEGA deployment guide

deploy/docker/.env.example

@@ -1,4 +1,4 @@
-# LocalEGA deployment settings for dcontainers00.
+# LocalEGA production deployment settings.
 # Copy to .env and replace every CHANGE_ME value before starting the stack.
 
 APP_NAME=localega
@@ -10,41 +10,31 @@ LOCALEGA_RUNTIME_BASE=/srv/containers/bind/localega/runtime
 INBOX_PORT=8086
 MQ_MANAGEMENT_PORT=15672
 VAULT_DB_PORT=5432
-CEGA_PORT=8080
-CEGA_MQ_MANAGEMENT_PORT=15670
 DISTRIBUTION_PORT=2224
 
 LEGA_UID=1000
 LEGA_GID=1000
 INBOX_GID=1003
-EGA_SSH_BANNER=Affiliated EGA ciber-isciii
+EGA_SSH_BANNER=Affiliated EGA CHANGE_ME_AFFILIATE_NAME
 
-CEGA_ENDPOINT=http://cega:8080
+AFFILIATE_NAME=CHANGE_ME_AFFILIATE_NAME
+CEGA_ENDPOINT=https://CHANGE_ME_CEGA_ENDPOINT
 CEGA_ENDPOINT_CREDS=CHANGE_ME_CEGA_USER:CHANGE_ME_CEGA_PASSWORD
-CEGA_CONNECTION=amqp://CHANGE_ME_CEGA_MQ_USER:CHANGE_ME_CEGA_MQ_PASSWORD@cega-mq:5672/%2F
+CEGA_CONNECTION=amqps://CHANGE_ME_AFFILIATE_MQ_USER:CHANGE_ME_AFFILIATE_MQ_PASSWORD@CHANGE_ME_CEGA_MQ_HOST:5677/affiliates
 
 MQ_USER=CHANGE_ME_MQ_USER
 MQ_PASSWORD=CHANGE_ME_MQ_PASSWORD
 MQ_PASSWORD_HASH=CHANGE_ME_RABBITMQ_PASSWORD_HASH
 MQ_EXCHANGE=cega
 MQ_ROUTING_KEY=files.inbox
-MQ_VERIFY_PEER=no
-MQ_VERIFY_HOSTNAME=no
-AUTH_VERIFY_PEER=no
-AUTH_VERIFY_HOSTNAME=no
-
-# These must match deploy/docker/cega/mq/definitions.json when using the local CEGA mock.
-CEGA_MQ_USER=admin
-CEGA_MQ_PASSWORD=CHANGE_ME_CEGA_MQ_PASSWORD
 
 LEGA_DB_PASSWORD=CHANGE_ME_LEGA_DB_PASSWORD
 DISTRIBUTION_DB_PASSWORD=CHANGE_ME_DISTRIBUTION_DB_PASSWORD
 SERVICE_KEY_PASSPHRASE=CHANGE_ME_SERVICE_KEY_PASSPHRASE
 
-EGAF_COUNTER_START=0
 SYNC_INTERVAL_SECONDS=60
 EGA_PRECREATE_HOMES=0
-LEGA_LOG=debug
+LEGA_LOG=info
 
 # Inbox cleanup is safe-by-default. Keep DRY_RUN=true until candidates and
 # directory permissions have been checked in production.

deploy/docker/README.md

@@ -10,13 +10,12 @@ It requires:
 * a master key
 * a deployment environment file: `.env`
 * a configuration file for the python handler: `lega.ini`
-* a configuration file for docker-compose: `docker-compose.yml`
+* a production configuration file for Compose: `docker-compose.yml`
 * 2 configurations file for postgres: `pg.conf` and `pg_hba.conf`
 
-We assume you have created a local user and a group named `lega`. If not, you can do it with
-
-    groupadd -r lega
-    useradd -M -g lega lega
+Run every Podman command as the same rootless service account. `LEGA_UID` and
+`LEGA_GID` configure the `lega` account inside the images and do not need to
+match the service account IDs on the host.
 
 # Sensitive data
 
@@ -29,9 +28,9 @@ Update `.env` with the deployment-specific values. `docker-compose.yml` reads it
 	cp lega.ini.sample                     lega.ini
 
 
-The included message broker uses an administrator account with
-`admin:secret` as `username:password`. This is up to you to update it
-in your production environment.
+Set a dedicated `MQ_USER`, `MQ_PASSWORD` and matching `MQ_PASSWORD_HASH` in
+`.env`. Do not use the credentials from the Fake CEGA test fixtures for the
+production broker.
 
 Generate the service key with:
 
@@ -167,5 +166,3 @@ podman compose up -d inbox-cleaner
 
 Review its output with `podman logs inbox-cleaner`. A one-off dry run is also
 available with `podman compose run --rm --no-deps inbox-cleaner --once`.
-
-Note that the `mq` component will try to create a federated queue to another RabbitMQ server. In `cega` folder, you will find the necessary components to fake Central EGA, and test your local deployment in isolation.

deploy/docker/cega/README.md

@@ -1,28 +1,9 @@
-# Fake Central EGA
+# Fake Central EGA fixtures
 
-We use 2 stubbing services in order to fake the necessary Central EGA components (mostly for local tests or github Actions).
-
-| Container        | Role |
-|-----------------:|------|
-| `cega`           | Sets up a small list of test users, and consumes messages from the broker |
-| `cega-mq`        | Sets up a RabbitMQ message broker with appropriate accounts, exchanges, queues and bindings |
-
-
-We include 2 dummy users: `jane` and `john`.
-> Their password and their ssh-key passphrase are their username.
-
-You can start the Central EGA (fake) component with:
-
-	# Start the Central EGA broker
-	docker-compose up -d cega-mq
-
-    # and after a few seconds, start the Central all-in-one service
-	docker-compose up -d cega
-
-The Central EGA services are at (and you can update `docker-compose.yml` accordingly)
-
-| Service        | URL | Credentials | Example |
-|---------------:|-----|-------------|---------|
-| NSS            | `http://cega:8080` | `fega:testing` | `curl -u fega:testing http://localhost:8080/username/john` |
-| RabbitMQ       | `amqp://cega-mq:5672/%2F` | `admin:secret` | `CEGA_CONNECTION=amqp://admin:secret@cega-mq:5672/%2F` |
+This directory contains development-only fixtures for emulating Central EGA.
+They are not part of the production Compose deployment documented in
+`deploy/docker`.
 
+The fixture credentials and data must never be used in a production
+environment. A separate, explicit test harness is required to run these
+components.

deploy/docker/docker-compose.distribution.yml

@@ -11,7 +11,7 @@ services:
       - vault
     environment:
       FUSE_DB_DSN: postgresql://distribution:${DISTRIBUTION_DB_PASSWORD:?set DISTRIBUTION_DB_PASSWORD in deploy/docker/.env}@vault-db:5432/ega?application_name=EGADistFS
-      EGA_SSH_BANNER: ${EGA_SSH_BANNER:-Affiliated EGA ciber-isciii}
+      EGA_SSH_BANNER: ${EGA_SSH_BANNER:-Affiliated EGA}
     volumes:
       - ${LOCALEGA_DATA_BASE:-/impact_data/lega_data/lega}/vault:/opt/LocalEGA/vault:ro
       - ${LOCALEGA_BIND_BASE:-/srv/containers/bind/localega}/etc:/opt/LocalEGA/etc

deploy/docker/docker-compose.yml

@@ -20,11 +20,7 @@ services:
       MQ_CONNECTION: amqp://${MQ_USER:?set MQ_USER in deploy/docker/.env}:${MQ_PASSWORD:?set MQ_PASSWORD in deploy/docker/.env}@mq:5672/%2F
       MQ_EXCHANGE: ${MQ_EXCHANGE:-cega}
       MQ_ROUTING_KEY: ${MQ_ROUTING_KEY:-files.inbox}
-      MQ_VERIFY_PEER: ${MQ_VERIFY_PEER:-no}
-      MQ_VERIFY_HOSTNAME: ${MQ_VERIFY_HOSTNAME:-no}
-      AUTH_VERIFY_PEER: ${AUTH_VERIFY_PEER:-no}
-      AUTH_VERIFY_HOSTNAME: ${AUTH_VERIFY_HOSTNAME:-no}
-      EGA_SSH_BANNER: ${EGA_SSH_BANNER:-Affiliated EGA ciber-isciii}
+      EGA_SSH_BANNER: ${EGA_SSH_BANNER:-Affiliated EGA}
     ports:
       - "${INBOX_PORT:-8086}:9000"
     image: crg/fega-inbox:latest
@@ -135,35 +131,3 @@ services:
     ports:
       - "${VAULT_DB_PORT:-5432}:5432"
     entrypoint: ['postgres', '-c', 'config_file=/etc/ega/pg.conf']
-
-  cega-mq:
-    hostname: cega-mq
-    ports:
-      - "${CEGA_MQ_MANAGEMENT_PORT:-15670}:15672"
-    image: rabbitmq:3.11.10-management-alpine
-    container_name: cega-mq
-    networks:
-      - internal
-    volumes:
-      - ./cega/mq/definitions.json:/etc/rabbitmq/definitions.json:ro
-      - ./cega/mq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
-      - ${LOCALEGA_LOG_DIR:-/var/log/local/localega/app}/cega-mq:/var/log/local/localega/app
-
-  cega:
-    depends_on:
-      - cega-mq
-    hostname: cega
-    ports:
-      - "${CEGA_PORT:-8080}:8080"
-    image: cega
-    build: ./cega
-    container_name: cega
-    networks:
-      - internal
-    environment:
-      EGAF_COUNTER_START: ${EGAF_COUNTER_START:-0}
-    volumes:
-      - ./cega/users/users.json:/ega/users.json:ro
-      - ${LOCALEGA_LOG_DIR:-/var/log/local/localega/app}/cega:/var/log/local/localega/app
-    entrypoint: ['python', '-m', 'server']
-    command: '-d -f 1 amqp://${CEGA_MQ_USER:?set CEGA_MQ_USER in deploy/docker/.env}:${CEGA_MQ_PASSWORD:?set CEGA_MQ_PASSWORD in deploy/docker/.env}@cega-mq:5672/%2F'

docs/manual_localega_completo.md

@@ -154,10 +154,10 @@ En este modo:
 Desde `deploy/docker`:
 
 ```bash
-cp docker-compose.yml.sample docker-compose.yml
+cp .env.example .env
 cp ../../src/vault/pg.conf.sample pg.conf
 cp ../../src/vault/pg_hba.conf.sample pg_hba.conf
-cp ../../src/handler/conf.ini.sample lega.ini
+cp lega.ini.sample lega.ini
 ```
 
 Genera claves: