WIP: Kopano Konnect und Rest API (#72)

* add a new image for konnect
* add konnect to compose file
* adapt gencerts for konnect certs
* integrate gencerts into start.sh and adapt if to only skip individual parts
* add container for kapi
* use same config for webapp and z-push as https://stash.kopano.io/projects/KGOL/repos/kweb/browse/config/legacy.go
* use example compose file in make test target
* make compose file configurable through an env variable
* remove legacy links in compose
* write certificates first to a tempfile
* remove unnecessary paths
* add option to run kapi insecure for testing
* configure openid for kopano-server
* add local playground to test functionality of konnect and kapi
* print errors and logs to stdout in web
* add extrahosts to kopano_server
* adapt extrahosts for ip command on ubuntu 18.04
* add documentation

Signed-off-by: Felix Bartels <felix@host-consultants.de>

ssl/Dockerfile

@@ -16,8 +16,7 @@ RUN apk add --update \
     && rm -rf /var/cache/apk/*
 
 COPY start.sh /start.sh
-COPY gencerts.sh /gencerts.sh
 
-RUN chmod a+x /start.sh /gencerts.sh
+RUN chmod a+x /start.sh
 
-CMD ["/start.sh"]
+CMD ["/start.sh"]

ssl/gencerts.sh

@@ -1,20 +0,0 @@
-#!/bin/sh
-# https://github.com/google/easypki
-
-# TODO integrate this directly into start.sh?
-
-echo "Creating CA and Server certificates..."
-easypki create --filename internalca --organizational-unit primary --expire 3650 --ca "Internal Kopano System"
-
-mkdir -p /kopano/ssl/clients/
-cp /kopano/easypki/internalca/certs/internalca.crt /kopano/ssl/ca.pem
-
-for s in kserver kdagent kmonitor ksearch kspooler kwebapp
-  do
-    easypki create --ca-name internalca --organizational-unit $s --expire 3650 $s
-    cp /kopano/easypki/internalca/keys/$s.key /kopano/ssl/$s.pem
-    cat /kopano/easypki/internalca/certs/$s.crt >> /kopano/ssl/$s.pem
-    openssl x509 -in /kopano/easypki/internalca/certs/$s.crt -pubkey -noout > /kopano/ssl/clients/$s-public.pem
-done
-
-ls -l /kopano/ssl/*.pem

ssl/start.sh

@@ -1,7 +1,47 @@
 #!/bin/sh
 
-if [ -f /kopano/ssl/ca.pem ]; then
-	exit 0
+mkdir -p /kopano/ssl/clients/
+
+if [ ! -f /kopano/ssl/ca.pem ]; then
+	# https://github.com/google/easypki
+	echo "Creating CA and server certificates..."
+	easypki create --filename internalca --organizational-unit primary --expire 3650 --ca "Internal Kopano System"
+
+	for s in kserver kdagent kmonitor ksearch kspooler kwebapp; do
+		easypki create --ca-name internalca --organizational-unit $s --expire 3650 $s
+		cp /kopano/easypki/internalca/keys/$s.key /kopano/ssl/$s.pem.tmp
+		cat /kopano/easypki/internalca/certs/$s.crt >> /kopano/ssl/$s.pem.tmp
+		openssl x509 -in /kopano/easypki/internalca/certs/$s.crt -pubkey -noout >  /kopano/ssl/clients/$s-public.pem.tmp
+		mv /kopano/ssl/$s.pem.tmp /kopano/ssl/$s.pem
+		mv /kopano/ssl/clients/$s-public.pem.tmp /kopano/ssl/clients/$s-public.pem
+	done
+
+	cp /kopano/easypki/internalca/certs/internalca.crt /kopano/ssl/ca.pem.tmp
+	mv /kopano/ssl/ca.pem.tmp /kopano/ssl/ca.pem
 fi
 
-/gencerts.sh
+# Konnect - create encryption key if not already present
+enckey="/kopano/ssl/konnectd-encryption.key"
+if [ ! -f $enckey ]; then
+	echo "creating new encryption key"
+	openssl rand -out $enckey.tmp 32
+	mv $enckey.tmp $enckey
+fi
+
+# Konnect - create token signing key if not already present
+signkey="/kopano/ssl/konnectd-tokens-signing-key.pem"
+if [ ! -f $signkey ]; then
+	echo "creating new token signing key"
+	openssl genpkey -algorithm RSA -out $signkey.tmp -pkeyopt rsa_keygen_bits:4096
+	mv $signkey.tmp $signkey
+fi
+
+# Kapi
+secretkey="/kopano/ssl/kapid-pubs-secret.key"
+if [ ! -f $secretkey ]; then
+	openssl rand -out $secretkey.tmp -hex 64
+	mv $secretkey.tmp $secretkey
+fi
+
+ls -l /kopano/ssl/*.pem
+ls -l /kopano/ssl/*.key