Adapt Konnect Container for Univention (#236)

* precreate meet keys in ssl, but do the actual action in konnect
* generate all keys for meet within Konnect
* incorporate explicit logging and settings set by ucs app
* make konnect container more dynamic
* set default oidc_issuer_identifier
* print size of container
* builder image is not required for security scanning
* define entrypoint instead of using command
* more cleanup of testing containers
* give logs in case of error

konnect/Dockerfile

@@ -4,8 +4,16 @@ FROM kopano/konnectd:${CODE_VERSION}
 ARG VCS_REF
 ARG CODE_VERSION
 
-ENV CODE_VERSION="${CODE_VERSION}"
-ENV KONNECT_BACKEND="kc"
+ENV CODE_VERSION="${CODE_VERSION}" \
+    DEBUG="" \
+    FQDN=localhost \
+    KONNECT_BACKEND="kc" \
+    ecparam=/etc/kopano/ecparam.pem \
+    eckey=/etc/kopano/meet-kwmserver.pem \
+    signing_private_key=/etc/kopano/konnectd-signing-private-key.pem \
+    encryption_secret_key=/etc/kopano/konnectd-encryption-secret.key \
+    identifier_registration_conf=/etc/kopano/konnectd-identifier-registration.yaml \
+    identifier_scopes_conf=/etc/kopano/konnectd-identifier-scopes.yaml
 
 LABEL maintainer=az@zok.xyz \
     org.label-schema.name="Kopano Konnect container" \
@@ -16,6 +24,8 @@ LABEL maintainer=az@zok.xyz \
     org.label-schema.version=$CODE_VERSION \
     org.label-schema.schema-version="1.0"
 
+# TODO use docker multistage for pip install yq https://pythonspeed.com/articles/multi-stage-docker-python/
+# TODO moreutils (required for sponge) bloats the image quite a bit
 RUN apk add --no-cache \
     jq \
     moreutils \
@@ -30,3 +40,5 @@ RUN wget https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSI
 
 COPY --chown=nobody:nogroup konnectd-identifier-registration.yaml konnectd-identifier-scopes.yaml /etc/kopano/
 COPY wrapper.sh /usr/local/bin
+
+ENTRYPOINT ["wrapper.sh"]

konnect/wrapper.sh

@@ -1,42 +1,61 @@
 #!/bin/sh
 
-set -e
+set -eu
+[ "$DEBUG" ] && set -x
 
-# TODO since this file is only used here, also generate it here.
 dockerize \
-	-wait file:///kopano/ssl/meet-kwmserver.pem \
+	-wait file://"${ecparam:?}" \
+	-wait file://"${eckey:?}" \
 	-timeout 360s
-cd /kopano/ssl/
 
-konnectd utils jwk-from-pem --use sig /kopano/ssl/meet-kwmserver.pem > /tmp/jwk-meet.json
+# Key generation for Meet guest mode
+if [ ! -s "$ecparam" ]; then
+	echo "Creating ec param key for Meet..."
+	openssl ecparam -name prime256v1 -genkey -noout -out "$ecparam" >/dev/null 2>&1
+fi
+
+if [ ! -s "$eckey" ]; then
+	echo "Creating ec key for Meet..."
+	openssl ec -in "$ecparam" -out "$eckey" >/dev/null 2>&1
+fi
+
+konnectd utils jwk-from-pem --use sig "$eckey" > /tmp/jwk-meet.json
 CONFIG_JSON=/etc/kopano/konnectd-identifier-registration.yaml
 #yq -y ".clients += [{\"id\": \"grapi-explorer.js\", \"name\": \"Grapi Explorer\", \"application_type\": \"web\", \"trusted\": true, \"insecure\": true, \"redirect_uris\": [\"http://$FQDNCLEANED:3000/\"]}]" $CONFIG_JSON | sponge $CONFIG_JSON
 yq -y ".clients += [{\"id\": \"kpop-https://$FQDN/meet/\", \"name\": \"Kopano Meet\", \"application_type\": \"web\", \"trusted\": true, \"redirect_uris\": [\"https://$FQDN/meet/\"], \"trusted_scopes\": [\"konnect/guestok\", \"kopano/kwm\"], \"jwks\": {\"keys\": [{\"kty\": $(jq .kty /tmp/jwk-meet.json), \"use\": $(jq .use /tmp/jwk-meet.json), \"crv\": $(jq .crv /tmp/jwk-meet.json), \"d\": $(jq .d /tmp/jwk-meet.json), \"kid\": $(jq .kid /tmp/jwk-meet.json), \"x\": $(jq .x /tmp/jwk-meet.json), \"y\": $(jq .y /tmp/jwk-meet.json)}]},\"request_object_signing_alg\": \"ES256\"}]" $CONFIG_JSON | sponge $CONFIG_JSON
+# TODO this last bit can likely go
 yq -y . $CONFIG_JSON | sponge /kopano/ssl/konnectd-identifier-registration.yaml
 
-# shellcheck disable=SC2154
-if [ -n "$log_level" ]; then
+# source additional configuration from Konnect cfg (potentially overwrites env vars)
+if [ -e /etc/kopano/konnectd.cfg ]; then
+	# shellcheck disable=SC1091
+	. /etc/kopano/konnectd.cfg
+fi
+
+oidc_issuer_identifier=${oidc_issuer_identifier:-https://$FQDN}
+set -- "$@" --iss="$oidc_issuer_identifier"
+echo "Entrypoint: Issuer url (--iss): $oidc_issuer_identifier"
+
+if [ -n "${log_level:-}" ]; then
 	set -- "$@" --log-level="$log_level"
 fi
 
-# shellcheck disable=SC2154
-if [ "$allow_client_guests" = "yes" ]; then
+if [ "${allow_client_guests:-}" = "yes" ]; then
 	set -- "$@" "--allow-client-guests"
 fi
 
-# shellcheck disable=SC2154
-if [ "$allow_dynamic_client_registration" = "yes" ]; then
+if [ "${allow_dynamic_client_registration:-}" = "yes" ]; then
+	echo "Entrypoint: Allowing dynamic client registration"
 	set -- "$@" "--allow-dynamic-client-registration"
 fi
 
 dockerize \
-	-wait file:///kopano/ssl/konnectd-tokens-signing-key.pem \
-	-wait file:///kopano/ssl/konnectd-encryption.key \
+	-wait file://"${signing_private_key:?}" \
+	-wait file://"${encryption_secret_key:?}" \
 	-timeout 360s
 exec konnectd serve \
-	--signing-private-key=/kopano/ssl/konnectd-tokens-signing-key.pem \
-	--encryption-secret=/kopano/ssl/konnectd-encryption.key \
-	--iss=https://"$FQDN" \
-	--identifier-registration-conf /kopano/ssl/konnectd-identifier-registration.yaml \
-	--identifier-scopes-conf /etc/kopano/konnectd-identifier-scopes.yaml \
+	--signing-private-key="${signing_private_key:?}" \
+	--encryption-secret="${encryption_secret_key:?}" \
+	--identifier-registration-conf "${identifier_registration_conf:?}" \
+	--identifier-scopes-conf "${identifier_scopes_conf:?}" \
 	"$@" "$KONNECT_BACKEND"