Add support for meet guest mode and make meet configurable through env (#105)

* get settings for meet from env
* prepare ssl container for device registration for konnect/kwmserver
* move device registry modification to konnect container
* enable WebApp in the app switcher
* upstream docker container has been updated to alpine 3.9
* update konnect
* add further config for guest mode
* replace the check for the file with a check for konnect startup
* fix kwmserver wrapper
* add possibility to change logging in kwmserver

konnect/Dockerfile

@@ -1,16 +1,19 @@
-ARG CODE_VERSION=0.19.1
+ARG CODE_VERSION=0.20.0
 FROM kopano/konnectd:${CODE_VERSION}
 ARG CODE_VERSION
 ENV CODE_VERSION="${CODE_VERSION}"
 
 RUN apk add --no-cache \
-	openssl
+	jq \
+	moreutils \
+	openssl \
+	py-pip \
+	&& pip install yq==2.7.2
 
 ENV DOCKERIZE_VERSION v0.6.1
 RUN wget https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
     && tar -C /usr/local/bin -xzvf dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
     && rm dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz
 
-RUN mkdir -p /etc/kopano/
-COPY konnectd-identifier-registration.yaml konnectd-identifier-scopes.yaml /etc/kopano/
+COPY --chown=nobody:nogroup konnectd-identifier-registration.yaml konnectd-identifier-scopes.yaml /etc/kopano/
 COPY wrapper.sh /usr/local/bin

konnect/wrapper.sh

@@ -2,6 +2,25 @@
 
 set -e
 
+dockerize \
+	-wait file:///kopano/ssl/meet-kwmserver.pem \
+	-timeout 360s
+cd /kopano/ssl/
+
+konnectd utils jwk-from-pem --use sig /kopano/ssl/meet-kwmserver.pem > /tmp/jwk-meet.json
+CONFIG_JSON=/etc/kopano/konnectd-identifier-registration.yaml
+yq -y ".clients |= [{\"id\": \"kpop-https://$FQDN/meet/\", \"name\": \"Kopano Meet\", \"application_type\": \"web\", \"trusted\": true, \"redirect_uris\": [\"https://$FQDN/meet/\"], \"trusted_scopes\": [\"konnect/guestok\", \"kopano/kwm\"], \"jwks\": {\"keys\": [{\"kty\": $(jq .kty /tmp/jwk-meet.json), \"use\": $(jq .use /tmp/jwk-meet.json), \"crv\": $(jq .crv /tmp/jwk-meet.json), \"d\": $(jq .d /tmp/jwk-meet.json), \"kid\": $(jq .kid /tmp/jwk-meet.json), \"x\": $(jq .x /tmp/jwk-meet.json), \"y\": $(jq .y /tmp/jwk-meet.json)}]},\"request_object_signing_alg\": \"ES256\"}]" $CONFIG_JSON | sponge /kopano/ssl/konnectd-identifier-registration.yaml
+
+# shellcheck disable=SC2154
+if [ -n "$log_level" ]; then
+	set -- "$@" --log-level="$log_level"
+fi
+
+# shellcheck disable=SC2154
+if [ "$allow_client_guests" = "yes" ]; then
+	set -- "$@" "--allow-client-guests"
+fi
+
 dockerize \
 	-wait file:///kopano/ssl/konnectd-tokens-signing-key.pem \
 	-wait file:///kopano/ssl/konnectd-encryption.key \
@@ -10,6 +29,6 @@ dockerize \
 	--signing-private-key=/kopano/ssl/konnectd-tokens-signing-key.pem \
 	--encryption-secret=/kopano/ssl/konnectd-encryption.key \
 	--iss=https://"$FQDN" \
-	--identifier-registration-conf /etc/kopano/konnectd-identifier-registration.yaml \
+	--identifier-registration-conf /kopano/ssl/konnectd-identifier-registration.yaml \
 	--identifier-scopes-conf /etc/kopano/konnectd-identifier-scopes.yaml \
-	kc
+	"$@" kc