maj fix certificates

.dockerignore

@@ -17,3 +17,5 @@ Procfile*
 celerybeat-schedule
 
 .venv/
+
+.certs/

.gitignore

@@ -80,3 +80,6 @@ celerybeat-schedule*
 data/wiki/_index/
 
 .python-version
+
+# Development certificates, generated by scripts/gen-certs
+.certs/

INSTALL.md

@@ -73,6 +73,37 @@ Start the webserver and the celery worker:
 uv run poe server
 ```
 
+The server listens on <https://localhost:5000>. Its certificate is generated by
+the bootstrap into `.certs/`, which is never versioned. Run `uv run poe certs`
+to create it again, or `./scripts/gen-certs --force` to renew it.
+
+If [mkcert](https://github.com/FiloSottile/mkcert) is installed, the certificate
+is signed by a local authority. Install that authority once so that browsers
+accept the certificate without warning:
+
+```console
+mkcert -install
+```
+
+This matters for SWITCH edu-ID authentication: the identity provider answers
+with an auto-submitted POST, and clicking through a browser warning loses it.
+
+### SWITCH edu-ID authentication
+
+SAML authentication is disabled until a service provider key pair is configured.
+The certificate identifies the instance to the identity providers, so it has to
+be registered in the SWITCH edu-ID resource registry: it cannot be generated
+locally. Provide the pair outside of the repository and reference it in
+`invenio.cfg`:
+
+```python
+SHIBBOLETH_SERVICE_PROVIDER_CERTIFICATE = "/path/to/sp-cert.pem"
+SHIBBOLETH_SERVICE_PROVIDER_PRIVATE_KEY = "/path/to/sp-key.pem"
+```
+
+Without them the application runs normally and no edu-ID button is offered on
+the login page.
+
 Start a Python shell:
 
 ```console

MANIFEST.in

@@ -43,7 +43,7 @@ prune docs/_build
 recursive-include _sources *.txt
 recursive-include _static *.css *.js *.png
 recursive-include data *.crt *.csv *.jpg *.json *.md *.png
-recursive-include docker *.cfg *.conf *.crt *.ini *.key *.pem *.sh
+recursive-include docker *.cfg *.conf *.ini *.sh
 recursive-include docs *.bat *.py *.rst *.txt Makefile
 recursive-include sonar *.babelrc *.eslintignore *.gitkeep *.json *.html *.js *.scss *.css *.png *.jpg *.svg *.po *.pot *.mo *.py *.txt *.woff *.woff2
 recursive-include tests *.doc *.json *.pdf *.py *.xml *.jpg *.csv

data/idp_certificates/eduid.crt

@@ -1,17 +1,21 @@
-MIIDDDCCAfSgAwIBAgIVALoCDnpVfF76D6WKc9mDL9jtreW1MA0GCSqGSIb3DQEB 
-CwUAMBMxETAPBgNVBAMMCGVkdWlkLmNoMB4XDTE4MDExNzEyMDg0OFoXDTIxMDEx 
-NzEyMDg0OFowEzERMA8GA1UEAwwIZWR1aWQuY2gwggEiMA0GCSqGSIb3DQEBAQUA 
-A4IBDwAwggEKAoIBAQCbkUjiqUSI7m8LCNeIW/A3V+frMWd+DPvHzpEwIXLvzDPX 
-ts6lCGzI3Yo6lNkF7VMUh6mxEXegu3t8AbaOsfrroFijIxMdQ4Pq3Z/Ps2ssa0KA 
-xkcpHnWP011la1TN7hsxq07Xsat++CHVescJ8zk7Qd+uZmmfW5Kfj5KQhOPoQBMU 
-LVtak/Kjeolo4Ur1fwHtu8gvTvwrBVMy0wYMeylBmLL73dKYFO2mZLs5lP0FKXTb 
-mAUPF+WfkOckuExYvetWxLDyiDaxs5j3/KqJsDSiPQq1oGZkqvPfC4NzfCUTsuW5 
-RdPierusXpnR4Wd8gj3feS4d6fGrt0arFUYkiyjFAgMBAAGjVzBVMB0GA1UdDgQW 
-BBR5UYvm41G9T4lRYQnVBamV5QQ2czA0BgNVHREELTArgghlZHVpZC5jaIYfaHR0 
-cHM6Ly9lZHVpZC5jaC9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEA 
-OHXDaEWgKwegR4pBMqSw4KmPNCn06Jf5cZ3sVCHKtDGhiVz9JwevujDVo94pcGPJ 
-XyJdvCn9gCRpheWJIYv94L3Do/eh7/jwWSp93+5vJdbVvE9EcMbooRO2fSIWZg6y 
-KVavIKLrItH9fUaY8mE1YSTzpAyj/bYHGZzGhd+23gaKZSMU2Oyjc8FwTWjDcZLC 
-+iUG7QOeK1rigVuP/HWqnawRfV5PQNCumhwvLTfgwj2d7hksXIimdfzUtQ1khGTo 
-mbpfFePiqKvBj5O5CmwuD3ccg0zFI1TQHUSussK/tOGz54MAyKG8M1txL/aTC92e 
-Sa95LKJp5+2fy/XNy2hBAg==
+MIID6jCCAlKgAwIBAgIUQYBVlHR1BTuCRvxNID/1YViWvXswDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAxMIZWR1aWQuY2gwHhcNMjMxMTAxMTAwMDA0WhcNMzMxMjE4
+MTAwMDA0WjATMREwDwYDVQQDEwhlZHVpZC5jaDCCAaIwDQYJKoZIhvcNAQEBBQAD
+ggGPADCCAYoCggGBAJ7otyXaPNpqa2T4sIw3D+G9qdns5fGWYPyKkqkbSwM/xcWY
+86JTyG4bNaI9za1mVmX/+JZ3rNjmihHh1pNc8Y4U3sroX4YmpHme7U0o5QzgpXgt
+g23NyWGSTKJG4Z4LhoPXvBvcwhTE2wRbcIiiHQExXrmntq6QXafum2eSy0wuQcsd
+y+jiJX1shyDC29Epf1ObglfbUYS1GkfBaV9QfsKDbEBWixdALTpubcxmEHONdmNn
+8wrr2IPkVod+pBgLGaacRHKt/O7aw3R5FlAOw8KANJMU9MDrp7yhH3HzQPMyc5E8
+HNIbh284NY3etkj0rDtI8Py2DRjMkZeUdkqyCmrskwd0aUXKTOjBT0u3TD4hayuI
+UUx7w3Fb3MaEWY16mFVrlw5/6AsRIiFQGbxXwXV41oTxiSBGAYBoux27Db5j6H3X
+EseKamk5oH8z/4HqhtzCA5oMCYkwWpf2NXwJks6T378bSw0VSklQXcoBcwPjByyr
+ZVHpV+8bOzJdbEfRHQIDAQABozYwNDATBgNVHREEDDAKgghlZHVpZC5jaDAdBgNV
+HQ4EFgQUUXM4hK0yc1TiLRbbgkfB6FZ6jyowDQYJKoZIhvcNAQELBQADggGBAJN1
+C/JIa4hfpb7HwdSGQ/fnxRV+m/V1wp5LEZKEd/P1eIjb3ETkUL4wP90a+B22ndJI
+F46FqmRwu1KtVufCQE1ptYJ7JqmQEg5v1rHKMzV8CYEIZm9Wlb/dto15TAs/CkQS
+Hyzpaeg4cNpruGtiIPUB1q01UM8NEWWU9vgrvwJjj3j3/mJPN6FWtPtZDCnIojED
+V3QaeXzxQhPn5UsJuCjWX2Y81AQdVjSkbKAxyy9BWIRV2Ib6FWBZzVQwbjFADZKT
+iIortzAVYCrJHHU/c5enI19U6Y8/+xzu97w3STiQLgvlUUhNNgmaYMKYtRWSrqW1
+aaSIQ4tiylNLEb0QdoG03mDZ60WUsRF87ZrlTYU+vMNj3d4dsF70mLK+0IEyKud2
+r/76LQg8AEF6ESX8i3n6IGG3Tt1zeBbVZ4zNtFjvzmef7CYyLsu5MP1QBGI4QLV1
+9rBn+6JszkavM972cTuZTVZ1BU2/g/4ZSq85+XoKRmA2GH+Wega5gX63BIOnAQ==

data/idp_certificates/eduidtest.crt

@@ -1,17 +1,22 @@
-MIIDIDCCAgigAwIBAgIVANt+in4DKHpdPEdzf7EKsoI+xrUyMA0GCSqGSIb3DQEB
-CwUAMBgxFjAUBgNVBAMMDXRlc3QuZWR1aWQuY2gwHhcNMTcxMDMxMDgyNTQzWhcN
-MjAxMDMxMDgyNTQzWjAYMRYwFAYDVQQDDA10ZXN0LmVkdWlkLmNoMIIBIjANBgkq
-hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAobHkbul8u6SEpc4C3/fkkwGYcthsFQC+
-ILWKrK7D2Mnt/OdZrkFrNVCaDi6dl/T6tN8ESrpCxqG9jUxlgxHr0L2LlN2ilqiB
-FkY1zM/OkJa2WarQZ9dkP4dfjLdp2T17MkPZvTCMoHqzyK7WvFCGAa5JxXubKmh+
-KjuNzGA/4Y3Vm+Y8Qs/wbpHeMXVk+Oeke6Qnqs1JfMXIWGD81AYbUjHaBIhF1J5u
-8iJe0zTJ8MSuPdMOLEY/4KSWKtT0HM/LRAH4iRKdq+B3Cl+WZGKgd864GQ1HkxHZ
-1xx7H1TisWzUIyeeuO1n6MNa9+kcLal2p2C7q+wuC8BWLDXlut+VxwIDAQABo2Ew
-XzAdBgNVHQ4EFgQUfGdP74lJsTJldXc4hVRkM5KX6oEwPgYDVR0RBDcwNYINdGVz
-dC5lZHVpZC5jaIYkaHR0cHM6Ly90ZXN0LmVkdWlkLmNoL2lkcC9zaGliYm9sZXRo
-MA0GCSqGSIb3DQEBCwUAA4IBAQCUBMahAkFjp+9B5fMjqM6ZCj/zC7UgM2DBBxm4
-YQaSSfjNGz1YC0fVDpoH1qVf0m9Ig7tI4QOAipzlwrKgCbB++KTxsXQBtfw2EBbg
-hfNphXCU0b855FUirnJWN+T2t3APq68dII3KkRPQ8uSq7JN7Ccm38RzmbQ9gt1RR
-4IVqHf/TstovqXC1sf/bDM9IBqvsZyD/043i1uwOQyiuZyOUS5J15BnKmo2N0NLz
-9E5IDu+3NpnlwBcqCaXPZhYSoTGZJfPE8MPzlP3tDoElEK07dOzyOF8mlnioqd0q
-OKNguza3bi3RRsZUlDAJHSGHm+Fc3QLUPCDLZc0+OKcQbThC
+MIIEETCCAnmgAwIBAgIUPdBt/Z2aCedplRF6Qy/8E7lPPY8wDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNdGVzdC5lZHVpZC5jaDAeFw0yMzA5MTMwNjIyMjNaFw0z
+MzA5MTAwNjIyMjNaMBgxFjAUBgNVBAMMDXRlc3QuZWR1aWQuY2gwggGiMA0GCSqG
+SIb3DQEBAQUAA4IBjwAwggGKAoIBgQCbv+wTgRUGXCKCpoiJR0cdR5ik8DZtytWi
+t06KA9oAgY2bdfMVgRKqUoALQkOoEeZg7pOzuvN6PgKKikKWUbMZozYEpKr6GAxL
+VY5ZBieWQkI/wr40YZhU8tnwpU/IIekXzNziG8jkGflbWBpQ2cUN9GQ8/RwkDj0u
+HeiivW4pgVHM4i9uFA8ZZnJ1XBBPyCUKTjsg94M8MTrfBe1XPzkjpYtP6czF5oJj
+LAyylKWBGnuR4BHdgisKSYQPS4qg8s7S4VQA0Xa0CpBGIyopnhDBUDP23S9pVt1R
+SbvV1tB4rnpyPHEmiW/vR4/pFBm+jv6YLCrMOt7UFNeLtaoA5XbXw53bBUh8Lde3
+FP8QvoPE6rj1XY7LluY0Sb4JvHjJaX9kG4Fmjknx7fm0QR2FXVcoU1utxt0R1rlr
+ov1GN3P1fhy6ADU9pwd7XXcDaIjJyeTkbld2YJs3iS/ZhD9PoJGJrPwdC9eFL5jf
+ao8RwuR1y4Gshou32XG6Os5o0r0wjrECAwEAAaNTMFEwHQYDVR0OBBYEFGAAmC/z
+8UQCszlkME/KHZvOgNW5MB8GA1UdIwQYMBaAFGAAmC/z8UQCszlkME/KHZvOgNW5
+MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGBAARtn9tUlkxwxecP
+J0zhI58SzpdcoE1+Qo9qF+sWIdzIAZ8ev8LBHfHhpXjOBlQQv8hIhs8U9hTJx1c+
+Jq94ftTSQ96FTZ9BmDaw7iQmorDSZeMxss6RXROF0ORJJ9kdAhTyMJj3zAfPlB4/
+32WbFlS9AtZdEfLdHNEmlxKtWFnaNasYFUh8oMpkaXnVToAp0H0qpZbzfwpI85/4
+S1zwwM62v+JyanUWX8BUSlB7L5cBa+6BRiUMkr0OFk0Vx9nM1GOkEfHttSdq7OnW
+0QeMdXYo417/DsCDxrD9A/SH1a+w3odYmbjl9lFr83wS8nApZtWG+7matS4CqI6a
+QjPRt0yZKQqc3vA5qvGWjQAITaNXlLVIRtTDP2Qs3cU0UUA0vqYX/CkLnGHCppqd
+GHLxP3n9LluZJs+OmArbgdifGm+7xgZMbmuAnoDCsTxNoSYqxHgU9vuETyjXTkFC
+2Wy9XopqcmwoW7fP44EShC4kp6sHgl+u2Ms+kjHGVhkvt+fyLw==

docker/haproxy/Dockerfile

@@ -1,7 +1,20 @@
 # SPDX-FileCopyrightText: Fondation RERO+
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
+# Self signed certificate generated at build time, so that no private key is
+# versioned. Built in a separate stage because the haproxy image ships no
+# openssl command. In production the external certificate is provided by the
+# deployment, through Let's Encrypt.
+FROM alpine:3 AS certificate
+RUN apk add --no-cache openssl \
+    && openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
+       -keyout /cert.key -out /cert.crt \
+       -subj "/CN=localhost" \
+       -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
+    && cat /cert.crt /cert.key > /cert.pem
+
 FROM haproxy:1.8
 RUN mkdir -p /usr/local/var/lib/haproxy/
 COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
-COPY haproxy_cert.pem /usr/local/etc/cert.pem
+# HAProxy expects the certificate and its key concatenated in a single file.
+COPY --from=certificate /cert.pem /usr/local/etc/cert.pem

docker/haproxy/haproxy.cfg

@@ -41,6 +41,12 @@ frontend in-stats
   stats uri /
   stats hide-version
 
+# "ssl verify none" is deliberate on both backends: this configuration only
+# serves the local demonstration stack, where the frontend certificate is a self
+# signed one generated when its image is built. The link stays inside the docker
+# network, so it is encrypted but not authenticated. Any deployment where this
+# link crosses a machine boundary should sign the frontend certificate with an
+# internal authority and switch to "verify required ca-file ...".
 backend ssl_app
   balance leastconn
   http-check disable-on-404

docker/nginx/Dockerfile

@@ -5,5 +5,11 @@ FROM nginx
 
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY conf.d/* /etc/nginx/conf.d/
-COPY test.key /etc/ssl/private/test.key
-COPY test.crt /etc/ssl/certs/test.crt
+
+# Self signed certificate generated at build time, so that no private key is
+# versioned. It is only used for the connection from the load balancer, which
+# does not verify it.
+RUN openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
+    -keyout /etc/ssl/private/test.key -out /etc/ssl/certs/test.crt \
+    -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,DNS:frontend,IP:127.0.0.1"