cisoas related changes

global/overlay/etc/puppet/cosmos-rules.yaml

@@ -174,6 +174,7 @@ cisoas-sto4-prod-1.sunet.se:
 cisoas-sto4-test-1.sunet.se:
   autoupdate:
   sunet::dockerhost2:
+  net::cisoassistant_test:
 
 ni-sto1-test-1.sunet.se:
   autoupdate:

global/overlay/etc/puppet/modules/net/files/cisoassistant/docker-compose.yml

@@ -1,50 +0,0 @@
-services:
-  always-https:
-    container_name: always-https
-    image: docker.sunet.se/always-https
-    restart: always
-    ports:
-      - 80:80
-    environment:
-      - ACME_URL=http://acme-c.sunet.se/
-
-  backend:
-    container_name: backend
-    image: ghcr.io/intuitem/ciso-assistant-enterprise-backend:latest
-    restart: always
-    environment:
-      - ALLOWED_HOSTS=backend,cisoas.sunet.se
-      - CISO_ASSISTANT_URL=https://cisoas.sunet.se:8443
-      - DJANGO_DEBUG=True
-      - AUTH_TOKEN_TTL=7200
-    volumes:
-      - ./db:/code/db
-      - /etc/dehydrated/certs/cisoas-sto4-prod-1.sunet.se:/certs
-
-  frontend:
-    container_name: frontend
-    restart: always
-    environment:
-      - PUBLIC_BACKEND_API_URL=http://backend:8000/api
-      - PROTOCOL_HEADER=x-forwarded-proto
-      - HOST_HEADER=x-forwarded-host
-
-    image: ghcr.io/intuitem/ciso-assistant-enterprise-frontend:latest
-    depends_on:
-      - backend
-    volumes:
-      - /etc/dehydrated/certs/cisoas-sto4-prod-1.sunet.se:/certs
-
-  caddy:
-    container_name: caddy
-    image: caddy:2.8.4
-    depends_on:
-      - frontend
-    restart: always
-    ports:
-      - 8443:8443
-      - 9443:9443
-    volumes:
-      - ./caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-      - /etc/dehydrated/certs/cisoas-sto4-prod-1.sunet.se:/certs

global/overlay/etc/puppet/modules/net/files/cisoassistant/sunet-cisoas.service

@@ -1,18 +0,0 @@
-[Unit]
-Description=Jenkins CI application
-After=docker.service
-BindsTo=docker.service
-Conflicts=shutdown.target reboot.target halt.target
-
-[Service]
-TimeoutStartSec=0
-TimeoutStopSec=30
-Restart=always
-RestartSec=10
-SyslogIdentifier=sunet-jenkins
-WorkingDirectory=/opt/cisoas/ciso-assistant-community/enterprise
-ExecStart=/usr/local/bin/docker-compose up -d 
-ExecStop=/usr/local/bin/docker-compose stop
-
-[Install]
-WantedBy=multi-user.target

global/overlay/etc/puppet/modules/net/manifests/cisoassistant_test.pp

@@ -0,0 +1,49 @@
+class net::cisoassistant_test {
+  $nftables_rules = {
+    'allow_access_to_cisoassistant' => {
+      from  => 'any',
+      port  => 443,
+      to    => 'any',
+      proto => 'tcp',
+    },
+    'allow_access_to_cisoassistant_api' => {
+      from  => 'any',
+      port  => 9443,
+      to    => 'any',
+      proto => 'tcp',
+    },
+    'allow_access_to_always_https_acme_c' => {
+      from  => 'any',
+      port  => 80,
+      to    => 'any',
+      proto => 'tcp',
+    },
+  }
+  $nftables_rules.each |$name, $params| {
+    sunet::nftables::allow { $name:
+      * => $params,
+    }
+  }
+
+  ensure_resource('file','/opt/cisoas', { ensure => directory } )
+  ensure_resource('file','/opt/cisoas/compose', { ensure => directory } )
+
+  sunet::docker_compose {'cisoas':
+      service_name => 'cisoas',
+      description  => 'CISO Assistant',
+      compose_dir  => '/opt/cisoas/compose',
+      content => template('net/cisoassistant/docker-compose.yml.erb'),
+    }
+  }
+  file { '/opt/cisoas/update-cisoas-enterprise.sh':
+    mode    => '0744',
+    owner   => 'root',
+    group   => 'root',
+    content => file('net/cisoassistant/update-cisoas-enterprise.sh'),
+  }
+  sunet::scriptherder::cronjob { 'Upgrade cisoassistant images':
+    cmd         => '/opt/cisoas/update-cisoas-enterprise.sh',
+    weekday     => 'Saturday',
+    ok_criteria => ['exit_status=0', 'max_age=10d'],
+  }
+}

global/overlay/etc/puppet/modules/net/templates/cisoassistant/docker-compose.yml.erb

@@ -0,0 +1,12 @@
+---
+services:
+
+  always-https:
+    image: docker.sunet.se/always-https:latest
+    restart: always
+    network_mode: host
+    ports:
+      - 80:80
+    environment:
+      - ACME_URL=http://acme-c.sunet.se/
+