WIP: Kopano Konnect und Rest API (#72)

* add a new image for konnect
* add konnect to compose file
* adapt gencerts for konnect certs
* integrate gencerts into start.sh and adapt if to only skip individual parts
* add container for kapi
* use same config for webapp and z-push as https://stash.kopano.io/projects/KGOL/repos/kweb/browse/config/legacy.go
* use example compose file in make test target
* make compose file configurable through an env variable
* remove legacy links in compose
* write certificates first to a tempfile
* remove unnecessary paths
* add option to run kapi insecure for testing
* configure openid for kopano-server
* add local playground to test functionality of konnect and kapi
* print errors and logs to stdout in web
* add extrahosts to kopano_server
* adapt extrahosts for ip command on ubuntu 18.04
* add documentation

Signed-off-by: Felix Bartels <felix@host-consultants.de>

konnect/Dockerfile

@@ -0,0 +1,14 @@
+FROM kopano/konnectd:0.16.1
+
+RUN apk add --update \
+	openssl \
+	&& rm -rf /var/cache/apk/*
+
+ENV DOCKERIZE_VERSION v0.6.1
+RUN wget https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
+    && tar -C /usr/local/bin -xzvf dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
+    && rm dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz
+
+RUN mkdir -p /etc/kopano/
+COPY identifier-registration.yaml /etc/kopano
+COPY wrapper.sh /usr/local/bin

konnect/identifier-registration.yaml

@@ -0,0 +1,54 @@
+---
+
+# OpenID Connect client registry.
+clients:
+#  - id: oidc-client-example.js
+#    name: OIDC Playground
+#    application_type: web
+#    redirect_uris:
+#       - https://devmail.kopano.com/kapi-playground/
+#  - id: playground.js
+#    name: OIDC Playground
+#    application_type: web
+#    redirect_uris:
+#       - https://my-host:8509/
+
+#  - id: playground-trusted.js
+#    name: Trusted OIDC Playground
+#    trusted: yes
+#    application_type: web
+#    redirect_uris:
+#       - https://my-host:8509/
+
+#  - id: playground-trusted.js
+#    name: Trusted Insecure OIDC Playground
+#    trusted: yes
+#    application_type: web
+#    insecure: yes
+
+#  - id: client-with-keys
+#    secret: super
+#    application_type: native
+#    redirect_uris:
+#      - http://localhost
+#    jwks:
+#      keys:
+#        - kty: EC
+#          use: sig
+#          kid: client-with-keys-key-1
+#          crv: P-256
+#          x: RTZpWoRbjwX1YavmSHVBj6Cy3Yzdkkp6QLvTGB22D0c
+#          y: jeavjwcX0xlDSchFcBMzXSU7wGs2VPpNxWCwmxFvmF0
+#    request_object_signing_alg: ES256
+
+#  - id: first
+#    secret: lala
+#    application_type: native
+#    redirect_uris:
+#      - my://app
+
+#  - id: second
+#    secret: lulu
+#    application_type: native
+#    redirect_uris:
+#      - http://localhost

konnect/wrapper.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -e
+
+dockerize \
+	-wait file:///kopano/ssl/konnectd-tokens-signing-key.pem \
+	-wait file:///kopano/ssl/konnectd-encryption.key \
+	-timeout 360s
+exec konnectd serve \
+	--signing-private-key=/kopano/ssl/konnectd-tokens-signing-key.pem \
+	--encryption-secret=/kopano/ssl/konnectd-encryption.key \
+	--iss=https://$FQDN \
+	--identifier-registration-conf /etc/kopano/identifier-registration.yaml \
+	kc