logic.jps

type: update
jpsVersion: 6.1.1
name: SSL/TLS Encrypted Connection
id: postgres-ssl
targetEditions: any
logo: /images/postgres-ssl-logo.svg
description: Enforce DB Connection to use SSL/TLS. Certificate folder /var/lib/jelastic/keys/SSL-TLS
baseUrl: https://raw.githubusercontent.com/jelastic-jps/postgres-ssl-addon/main

targetNodes:
  nodeType:
    - postgresql
    - postgres11
    - postgres12
    - postgres13
    - postgres14
    - postgres15
    - pgpool2
    - pgpool2-4

globals:
  pgConfig: /var/lib/pgsql/data/postgresql.conf
  pgSslConfig: /var/lib/pgsql/data/pg_ssl.conf
  pgHbaConfig: /var/lib/pgsql/data/pg_hba.conf
  pgpoolConfig: /etc/pgpool-II/pgpool.conf
  certFolder: /var/lib/jelastic/keys/SSL-TLS
  keyPass: ${fn.password}

onInstall:
  - checkApplication
  - getMasterId
  - env.control.AddContainerEnvVars[${targetNodes.nodeGroup}]:
      vars: {"KEY_PASS":"${globals.keyPass}"}
  - cmd[${targetNodes.nodeGroup}]: |-
      mkdir -p /var/lib/jelastic/keys/SSL-TLS/server/
      [ -f "${globals.pgSslConfig}" ] || wget -O ${globals.pgSslConfig} ${baseUrl}/scripts/pg_ssl.conf?_r=${fn.random};
      chown 700:700 ${globals.pgSslConfig};
      wget -O /usr/local/sbin/copyCert ${baseUrl}/scripts/copyCert?_r=${fn.random};
      chmod +x /usr/local/sbin/copyCert
    user: root
  - turnOnSSLForNodes:
      nodesToEnableSSL: ${globals.masterId}
  - if (nodes.${targetNodes.nodeGroup}.length > 1):
      - cmd[${globals.masterId}]: copyCert getCert ${globals.certFolder}/server/root.crt
      - setGlobals:
          rootCaCert: ${response.out}
      - cmd[${globals.masterId}]: copyCert getCert ${globals.certFolder}/server/root.key
      - setGlobals:
          rootCaKey: ${response.out}
      - uploadCertsAndKeys:
          newNodes: ${targetNodes.nodeGroup}
      - cmd[${targetNodes.nodeGroup}]: |-
          chown 700:700 ${globals.certFolder}/*
        user: root
      - turnOnSSLForNodes:
          nodesToEnableSSL: ${targetNodes.nodeGroup}

onUninstall:
  - disableSSL

onAfterRedeployContainer[${targetNodes.nodeGroup}]:
  - if (!${event.params.useExistingVolumes:true}):
     - turnOnSSLForNodes:
         nodesToEnableSSL: ${targetNodes.nodeGroup}
  
onBeforeServiceScaleOut[${targetNodes.nodeGroup}]:
  - if ('${event.params.nodeGroup}'.indexOf('sqldb') > -1):
    - cmd[${targetNodes.nodeGroup}]: |-
        sed -ci -e 's/^[[:space:]]*ssl[[:space:]]*=[[:space:]]*on/ssl = off/' ${globals.pgConfig}
      
onAfterServiceScaleOut[${targetNodes.nodeGroup}]:
  - cmd[${targetNodes.nodeGroup}]: |-
      mkdir -p /var/lib/jelastic/keys/SSL-TLS/server/
      wget -O /usr/local/sbin/copyCert ${baseUrl}/scripts/copyCert?_r=${fn.random};
      chmod +x /usr/local/sbin/copyCert
      grep -q  "${globals.certFolder}" /etc/jelastic/redeploy.conf || echo "${globals.certFolder}" >> /etc/jelastic/redeploy.conf
    user: root
  - getMasterId
  - cmd[${globals.masterId}]: copyCert getCert ${globals.certFolder}/server/root.crt
  - setGlobals:
      rootCaCert: ${response.out}
  - cmd[${globals.masterId}]: copyCert getCert ${globals.certFolder}/server/root.key
  - setGlobals:
      rootCaKey: ${response.out}
  - uploadCertsAndKeys:
      newNodes: ${event.response.nodes.join(id,)}
  - addCertsForNewNodes
  - if ('${event.params.nodeGroup}'.indexOf('sqldb') > -1):
    - cmd[${targetNodes.nodeGroup}]: |-
        sed -ci -e "s/^ssl = off/ssl = on/" ${globals.pgConfig}
  - fixCertOwnPerm
  - if ('${event.params.nodeGroup}'.indexOf('sqldb') > -1):
    - cmd[${targetNodes.nodeGroup}]: jem service restart

onAfterResetServicePassword[${targetNodes.nodeGroup}]:
  - if ('${event.params.nodeGroup}'.indexOf('sqldb') > -1):
    - if (nodes.pgpool):
      - getPswd
      - setWebadminPasswordOnPgPool

onAfterClone:
  - script: return {result:0, jps:MANIFEST};
  - install [${settings.nodeGroups}]:
      envName: ${event.response.env.envName}
      jps: ${response.jps}
      settings:
        nodeGroups: ${settings.nodeGroups}
        envName: ${settings.envName}

buttons:
  - confirmText: Do you want to reissue the SSL certificates (root, server and client) and keys (root, server and client)? Service restart will be done.
    loadingText: Reissuing all certificates and keys...
    action: reGenerateCerts
    caption: Renew all certs
    successText: All the certificates and keys are reissued successfully
  - confirmText: Do you want to reissue the SSL certificates and key (only server, root and client are not renewed)? Service restart will be done.
    loadingText: Reissuing the certificates...
    action: reGenerateServerCerts
    caption: Renew server certs
    successText: Server certificates and keys are reissued successfully
  - confirmText: Do you want to reissue the SSL certificates and key (only client, root and server are not renewed)? Service restart will be done. (Client certificate term of validity is 1 year)
    loadingText: Reissuing the certificates...
    action: reGenerateClientCerts
    caption: Renew client certs
    successText: Client certificates and keys are reissued successfully

actions:
  getMasterId:
    - forEach(nodes.${targetNodes.nodeGroup}):
      - cmd[${@i.id}]: |- 
          source /.jelenv;  
          echo ${MASTER_ID};
      - setGlobals:
          masterId: ${response.out}

  uploadCertsAndKeys:
    - cmd[${this.newNodes}]: |-
        copyCert uploadCert ${globals.certFolder}/root.key '${globals.rootCaKey}'
        copyCert uploadCert ${globals.certFolder}/root.crt '${globals.rootCaCert}'
      user: root

  reGenerateCerts:
    - forEach(nodes.${targetNodes.nodeGroup}):
      - cmd[${@i.id}]: jem service stop 
    - cmd[${targetNodes.nodeGroup}]: |-
        rm -rf ${globals.certFolder}/*;
      user: root
    - generateCerts:
        affectedNodes: ${targetNodes.nodeGroup}
    - forEach(nodes.${targetNodes.nodeGroup}):
      - cmd[${@i.id}]: jem service start

  reGenerateServerCerts:
    - forEach(nodes.${targetNodes.nodeGroup}):
      - cmd[${@i.id}]: jem service stop
        user: root
    - updateUtils
    - cmd[${targetNodes.nodeGroup}]: |-
        mv ${globals.certFolder}/server/root.* ${globals.certFolder}/;
        rm -f ${globals.certFolder}/server/server.*
        selfcertgen webadmin ${env.domain} ${targetNodes.nodeGroup};
        source /etc/jelastic/metainf.conf;
        if [ "x$COMPUTE_TYPE" == "xpostgres" ] ; then
            mv -f ${globals.certFolder}/client/client.* ${globals.certFolder}/;
        else
            rm -f ${globals.certFolder}/client.*;
        fi
      user: root
    - moveCertsToDirs:
        affectedNodes: ${targetNodes.nodeGroup}
    - cmd[${@i.id}]: jem service start
      user: root

  reGenerateClientCerts:
    - if ('${targetNodes.nodeGroup}'.indexOf('pgpool') > -1):
        stopEvent:
          type: warning
          message: Generation of client SSL/TLS certificates is not supported for Pgpool-II nodes. 
    - forEach(nodes.${targetNodes.nodeGroup}):
      - cmd[${@i.id}]: jem service stop
        user: root
    - cmd[${targetNodes.nodeGroup}]: |-
        mv -f ${globals.certFolder}/server/* ${globals.certFolder}/;
    - generateCerts:
        affectedNodes: ${targetNodes.nodeGroup}
    - cmd[${@i.id}]: jem service start
      user: root

  moveCertsToDirs:
    - cmd[${this.affectedNodes}]: |-
        rm -rf ${globals.certFolder}/client; mkdir -p ${globals.certFolder}/client;
        rm -rf ${globals.certFolder}/server; mkdir -p ${globals.certFolder}/server;
        chown -R 700:700 ${globals.certFolder}/*
        rm -f ${globals.certFolder}/client.csr ${globals.certFolder}/server.csr ${globals.certFolder}/client-req.pem ${globals.certFolder}/server-req.pem
        rm -f ${globals.certFolder}/{server.srl,client.csr}
        for i in root.crt root.key server.crt server.key root.srl
        do
            [ -f ${globals.certFolder}/${i} ] && mv -f ${globals.certFolder}/${i} ${globals.certFolder}/server/${i}
        done
        for i in client.crt client.key
        do
            [ -f ${globals.certFolder}/${i} ] && mv -f ${globals.certFolder}/${i} ${globals.certFolder}/client/${i}
        done
        ln -sfT ${globals.certFolder}/server/root.crt ${globals.certFolder}/client/root.crt
      user: root

  checkApplication:
    - if ('${targetNodes.nodeGroup}'.indexOf('sqldb') > -1):
      - checkAppVersion:
          masternode: ${targetNodes.nodeGroup}
      - if (response.out == "Non-supported"):
        - stopEvent:
            type: warning
            message: Database version is not supported.

  generateCerts:
    - updateUtils
    - cmd[${this.affectedNodes}]: |-

        [ -f /usr/local/sbin/selfcertgen ] && rm -f /usr/local/sbin/selfcertgen;
        [ -f /usr/local/sbin/copyCert ] && rm -f /usr/local/sbin/copyCert;
        wget -O /usr/local/sbin/selfcertgen ${baseUrl}/scripts/selfcertgen?_r=${fn.random};
        wget -O /usr/local/sbin/copyCert ${baseUrl}/scripts/copyCert?_r=${fn.random};
        chmod +x /usr/local/sbin/selfcertgen /usr/local/sbin/copyCert
        selfcertgen webadmin ${env.domain} ${targetNodes.nodeGroup};
        chown -R 700:700 ${globals.certFolder} /usr/local/sbin/selfcertgen; chmod 600 ${globals.certFolder}/*
      user: root
    - moveCertsToDirs:
        affectedNodes: ${this.affectedNodes}
      
  getPswd:
    - if ('${targetNodes.nodeGroup}'.indexOf('sqldb') > -1):
      - getPostgresPasswd:
          masternode: ${targetNodes.nodeGroup}
      - setGlobals: 
          pswd: ${response.out}

  setWebadminPasswordOnPgPool:
    - if (nodes.pgpool):
      - cmd[pgpool]: |-
          [ -f ~/.pgpoolkey ] || echo 'defaultpgpoolkey' > ~/.pgpoolkey; chmod 600 ~/.pgpoolkey
          pg_enc -m -f /etc/pgpool-II/pgpool.conf -u webadmin ${globals.pswd}

  enableSSL:
    - if ('${targetNodes.nodeGroup}'.indexOf('sqldb') > -1):
      - getPswd
      - if (nodes.pgpool):
        - setWebadminPasswordOnPgPool
    - cmd[${this.affectedNodes}]: |-
        echo "/var/lib/jelastic/keys/SSL-TLS" >> /etc/jelastic/redeploy.conf
        source /etc/jelastic/metainf.conf
        if [ "x$COMPUTE_TYPE" == "xpostgres" ] ; then
            if ! grep -q 'scram-sha-256' /var/lib/jelastic/overrides/postgres-passwd.lib; then
                wget ${baseUrl}/scripts/postgres-passwd.lib -O /var/lib/jelastic/overrides/postgres-passwd.lib
                if [ -f /usr/local/sbin/jcm ]; then 
                    jem passwd set -p ${globals.pswd}
                else 
                    true
                fi
            fi
            [ -f "${globals.pgSslConfig}" ] || wget -O ${globals.pgSslConfig} ${baseUrl}/scripts/pg_ssl.conf?_r=${fn.random};
            echo "include '/var/lib/pgsql/data/pg_ssl.conf'" >> ${globals.pgConfig}
            chown 700:700 ${globals.pgSslConfig};
            for i in ssl ssl_ciphers ssl_cert_file ssl_ca_file ssl_key_file
            do
                sed -ci -e "s/^[[:space:]]*#[[:space:]]*${i}[[:space:]]*=/${i} =/" ${globals.pgSslConfig}
            done
            if grep -q '^ssl_cert_file' ${globals.pgSslConfig}; then 
                sed -ci -e "s|ssl_cert_file.*|ssl_cert_file = '/var/lib/jelastic/keys/SSL-TLS/server/server.crt'|" ${globals.pgSslConfig};
            else 
                echo "ssl_cert_file = '/var/lib/jelastic/keys/SSL-TLS/server/server.crt'" >> ${globals.pgSslConfig};
            fi
            if grep -q '^ssl_ca_file' ${globals.pgSslConfig}; then 
                sed -ci -e "s|ssl_ca_file.*|ssl_ca_file = '/var/lib/jelastic/keys/SSL-TLS/server/root.crt'|" ${globals.pgSslConfig};             
            else 
                echo "ssl_ca_file = '/var/lib/jelastic/keys/SSL-TLS/server/root.crt'" >> ${globals.pgSslConfig};
            fi
            if grep -q '^ssl_key_file' ${globals.pgSslConfig}; then
                sed -ci -e "s|ssl_key_file.*|ssl_key_file = '/var/lib/jelastic/keys/SSL-TLS/server/server.key'|" ${globals.pgSslConfig};
            else 
                echo "ssl_key_file = '/var/lib/jelastic/keys/SSL-TLS/server/server.key'" >> ${globals.pgSslConfig};
            fi
            for i in ssl ssl_prefer_server_cipher
            do
                sed -ci -e "s/^${i}[[:space:]]*=[[:space:]]*off/${i} = on/" ${globals.pgSslConfig} 
            done
            sed -ci -e "s/host[[:space:]]*all[[:space:]]*all[[:space:]]*0.0.0.0\/0[[:space:]]*\(md5\|scram-sha-256\)[[:space:]]*/hostssl    all    all    0.0.0.0\/0    scram-sha-256/" ${globals.pgHbaConfig}
        else
            sed -ci -e "s/^[[:space:]]*#[[:space:]]*ssl[[:space:]]*=.*/ssl = on/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*ssl[[:space:]]*=.*/ssl = on/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*#[[:space:]]*enable_pool_hba[[:space:]]*=.*/enable_pool_hba = on/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*enable_pool_hba[[:space:]]*=.*/enable_pool_hba = on/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*#[[:space:]]*pool_passwd[[:space:]]*=/pool_passwd  =/" ${globals.pgpoolConfig}
            sed -ci -e "s|^[[:space:]]*#[[:space:]]*ssl_key[[:space:]]*=.*|ssl_key = '/var/lib/jelastic/keys/SSL-TLS/server/server.key'|" ${globals.pgpoolConfig}
            sed -ci -e "s|^[[:space:]]*#[[:space:]]*ssl_cert[[:space:]]*=.*|ssl_cert = '/var/lib/jelastic/keys/SSL-TLS/server/server.crt'|" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*host[[:space:]]*all[[:space:]]*all[[:space:]]*0.0.0.0\/0[[:space:]]*\(md5\|scram-sha-256\)[[:space:]]*/hostssl    all    all    0.0.0.0\/0    scram-sha-256/" /etc/pgpool-II/pool_hba.conf
        fi
        jem service restart
      user: root
  
  disableSSL:
    - cmd[${targetNodes.nodeGroup}]: |-
        jem service stop
        if [ -e ${globals.pgConfig} ]; then
            sed -ci -e 's/^[[:space:]]*ssl[[:space:]]*=[[:space:]]*on/ssl = off/' ${globals.pgSslConfig}
        fi
        if [ -e ${globals.pgHbaConfig} ]; then
            sed -ci -e "s|hostssl|host|" ${globals.pgHbaConfig}
        fi
        if [ -e ${globals.pgpoolConfig} ]; then
            sed -ci -e "s/^[[:space:]]*ssl[[:space:]]*=.*/ssl = off/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*enable_pool_hba[[:space:]]*=.*/enable_pool_hba = off/" ${globals.pgpoolConfig}
            sed -ci -e "s/^[[:space:]]*pool_passwd[[:space:]]*=/#pool_passwd  =/" ${globals.pgpoolConfig}
            sed -ci -e "s|^[[:space:]]*ssl_key[[:space:]]*=|#ssl_key =|" ${globals.pgpoolConfig}
            sed -ci -e "s|^[[:space:]]*ssl_cert[[:space:]]*=|#ssl_cert =|" ${globals.pgpoolConfig}
            sed -ci -e "s|hostssl|host|" ${globals.pgpoolConfig}
        fi
        for i in client.crt client.key root.crt
        do
            rm -f /var/lib/jelastic/keys/SSL-TLS/client/${i}
        done
        for i in root.crt root.srl server.crt server.key
        do
            rm -f /var/lib/jelastic/keys/SSL-TLS/server/${i}
        done
        sed -ci -e '/\/var\/lib\/jelastic\/keys\/SSL-TLS/d' /etc/jelastic/redeploy.conf
        for i in client server
        do
            if [ -z "$(ls -A /var/lib/jelastic/keys/SSL-TLS/${i})" ]; then
                rm -rf /var/lib/jelastic/keys/SSL-TLS/${i}
            fi
        done
        jem service start
      user: root

  addCertsForNewNodes:
    - turnOnSSLForNodes:
        nodesToEnableSSL: ${event.response.nodes.join(id,)}

  checkAppVersion:
    - cmd[${this.masternode}]: |-
        source /etc/jelastic/metainf.conf
        if [ "x$COMPUTE_TYPE" == "xpostgres" ] ; then
            wget -O /root/check_app_new.sh ${baseUrl}/scripts/check_app.sh?_r=${fn.random} && \
            mv /root/check_app_new.sh /root/check_app.sh && \
            bash /root/check_app.sh;
        fi
      user: root
      
  getPostgresPasswd:
    - cmd[${this.masternode}]: |-
        source /etc/jelastic/metainf.conf
        if [ "x$COMPUTE_TYPE" == "xpostgres" ] ; then
            if [ -f /usr/local/sbin/jcm ]; then
                jcm getPswd
            else
                true
            fi
        fi

  fixCertOwnPerm:
    - cmd[${targetNodes.nodeGroup}]: |-
        chown -R postgres:postgres /var/lib/jelastic/keys/SSL-TLS
      user: root
        
  turnOnSSLForNodes:
    - generateCerts: 
        affectedNodes: ${this.nodesToEnableSSL}
    - enableSSL:
        affectedNodes: ${this.nodesToEnableSSL}

  updateUtils:
    - cmd[${targetNodes.nodeGroup}]: |-
        wget -O /usr/local/sbin/selfcertgen_new ${baseUrl}/scripts/selfcertgen?_r=${fn.random} && \
        wget -O /usr/local/sbin/copyCert_new ${baseUrl}/scripts/copyCert?_r=${fn.random} && \
        mv -f /usr/local/sbin/selfcertgen_new /usr/local/sbin/selfcertgen && \
        mv -f /usr/local/sbin/copyCert_new /usr/local/sbin/copyCert && \
        chmod +x /usr/local/sbin/selfcertgen /usr/local/sbin/copyCert && \
        chown -R 700:700 /usr/local/sbin/selfcertgen
      user: root