Unverified Commit 9828322f authored by Guillermo Sanz López's avatar Guillermo Sanz López Committed by GitHub
Browse files

Merge pull request #7 from Telefonica/update-release1 

Update release1
parents 16bfa3fc 891a78ca

build_and_push.sh

0 → 100755
+71 −0
Original line number Diff line number Diff line 
#!/bin/bash



set -e  # Detener la ejecución si ocurre un error



# Función para manejar errores

handle_error() {

    echo "Error en el script. Línea: $1"

    exit 1

}



# Capturar errores y llamar a la función handle_error

trap 'handle_error $LINENO' ERR



# Obtener la última versión desde ECR usando AWS CLI

LAST_VERSION=$(aws ecr-public describe-image-tags --repository-name opencapif/backoffice-backend --region us-east-1 --query 'imageTagDetails[*].imageTag' --output text | grep -Eo 'v3.1.[0-9]+' | sed 's/v3.1.//' | sort -n | tail -1)



if [ -z "$LAST_VERSION" ]; then

    echo "No se pudo obtener la última versión desde ECR. Verifica si el repositorio o las imágenes existen."

    exit 1

fi



# Incrementar la versión

NEW_VERSION=$((LAST_VERSION + 1))

echo "Nueva versión: v3.1.$NEW_VERSION"



# Establecer la plataforma y construir la imagen Docker

echo "Construyendo la imagen Docker..."

DOCKER_DEFAULT_PLATFORM=linux/amd64 docker-compose build || { echo "Error en la construcción de la imagen Docker."; exit 1; }



# Pedir al usuario el ARN de MFA

read -p "Introduce el ID de cuenta de AWS (ej. 230672794366): " AWS_ACCOUNT_ID

read -p "Introduce el nombre del dispositivo MFA (ej. google_authenticator_phone): " MFA_DEVICE



MFA_ARN="arn:aws:iam::$AWS_ACCOUNT_ID:mfa/$MFA_DEVICE"



# Autenticación MFA con AWS para obtener un token temporal

read -p "Introduce el código MFA de 6 dígitos: " MFA_CODE



# Obtener un token temporal usando MFA

echo "Autenticando con AWS usando MFA..."

TEMP_CREDS=$(aws sts get-session-token --serial-number "$MFA_ARN" --token-code "$MFA_CODE" --output json)



if [ -z "$TEMP_CREDS" ]; then

    echo "Error: No se pudo obtener el token temporal de AWS. Verifica el código MFA."

    exit 1

fi



# Exportar credenciales temporales

export AWS_ACCESS_KEY_ID=$(echo "$TEMP_CREDS" | jq -r '.Credentials.AccessKeyId')

export AWS_SECRET_ACCESS_KEY=$(echo "$TEMP_CREDS" | jq -r '.Credentials.SecretAccessKey')

export AWS_SESSION_TOKEN=$(echo "$TEMP_CREDS" | jq -r '.Credentials.SessionToken')



# Autenticar Docker con Amazon ECR Public

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/o2v4a8t6 || { echo "Error en la autenticación con Docker."; exit 1; }



# Taggear la imagen con la nueva versión

echo "Etiquetando la imagen Docker..."

docker tag pesp_capif_backoffice_backend-backoffice_microservice public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION || { echo "Error al etiquetar la imagen Docker."; exit 1; }



# Push de la imagen con la nueva versión

echo "Pushing la nueva imagen a ECR..."

docker push public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION || { echo "Error al hacer push de la imagen Docker."; exit 1; }



# Mostrar la nueva versión

echo "Nueva imagen subida correctamente: public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION"



# Mostrar la nueva versión

echo "Nueva imagen subida correctamente: public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION"



# Tag a desplegar

echo "Backend tag a desplegar: v3.1.$NEW_VERSION"
 
 No newline at end of file

capif_backend/Dockerfile

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,9 @@ RUN mkdir -p /usr/src/app 
WORKDIR /usr/src/app



COPY requirements.txt /usr/src/app/requirements.txt

COPY backoffice_service/certs2/ca_root.crt /etc/ssl/certs/

COPY backoffice_service/certs2/superadmin.crt /etc/ssl/certs/

COPY backoffice_service/certs2/superadmin.key /etc/ssl/private/



RUN apk add -U --no-cache gcc build-base linux-headers ca-certificates libffi-dev libressl-dev libxslt-dev

RUN pip3 install --upgrade --no-cache-dir -r requirements.txt
@@ -12,6 +15,9 @@ RUN apk add jq 
RUN apk add curl

RUN apk add redis



# Copiar el script generate_certs.py

COPY backoffice_service/generate_certs.py /usr/src/app/generate_certs.py



COPY . /usr/src/app



EXPOSE 8080

capif_backend/backoffice_service/__main__.py

+20 −13
Original line number Diff line number Diff line
@@ -16,7 +16,10 @@ from flask_cors import CORS 
# Create Flask app

app = Flask(__name__)



CORS(app) # habilita CORS para todas las rutas en la aplicación

# Configurar CORS para todas las rutas

CORS(app, resources={r"/api/*": {"origins": "http://localhost:3001"}})



#CORS(app) # habilita CORS para todas las rutas en la aplicación



# Register blueprints (routes)

# other option modify URL ->  app.register_blueprint(backoffice_routes, url_prefix="/resources")
@@ -65,12 +68,20 @@ csr_request = dump_certificate_request(FILETYPE_PEM, req) 
# Get private key

private_key = dump_privatekey(FILETYPE_PEM, key)



print(f"Using Vault token: {os.getenv('VAULT_TOKEN')}")



# Get ca.cert from vault

config = Config().get_config() # get configuration from config.py

url = 'http://{}:{}/v1/secret/data/ca'.format(os.getenv('VAULT_HOSTNAME'), os.getenv('VAULT_PORT'))   # http://vault:8200/v1/secret/data/ca

headers = {'X-Vault-Token': os.getenv('VAULT_TOKEN')}

response = requests.request("GET", url, headers=headers, verify = False)



# Imprimir el contenido completo de la respuesta para inspección

print("Response from Vault (ca.cert request):")

print(response)



ca_cert = json.loads(response.text)["data"]["data"]["ca"]



# print ("CA CERT URL: ", url)

# print ("VAULT_HOSTNAME", os.get_environ('VAULT_HOSTNAME'))

# print ("VAULT_PORT", os.get_environ('VAULT_PORT'))
@@ -78,7 +89,7 @@ ca_cert = json.loads(response.text)["data"]["data"]["ca"] 
# Request Vault a CA certificate to backoffice application

url = 'http://{}:{}/v1/pki_int/sign/my-ca'.format(os.getenv('VAULT_HOSTNAME'), os.getenv('VAULT_PORT'))  # http://vault:8200/v1/pki_int/sign/my-ca



headers = {'X-Vault-Token': os.getenv('VAULT_TOKEN')}  # token = dev-only-token

headers = {'X-Vault-Token': os.getenv('VAULT_TOKEN')}  # token = dev-only-token -> for dev environment

data = {

    'format':'pem_bundle',

    'ttl': '43000h',
@@ -88,18 +99,22 @@ data = { 
response = requests.request("POST", url, headers=headers, data=data, verify = False)

backoffice_cert = json.loads(response.text)['data']['certificate']





# Ensure the certs directory exists

os.makedirs('newcerts', exist_ok=True)



# Save ca_cert

ca_file = open('./backoffice_service/certs/ca.crt', 'wb+')

ca_file = open('newcerts/ca_root.crt', 'wb+')

ca_file.write(bytes(ca_cert, 'utf-8'))

ca_file.close()



# Save private_key 

private_key_file = open("./backoffice_service/certs/backoffice_vault_private_key.key", 'wb+')

private_key_file = open("newcerts/superadmin.key", 'wb+')

private_key_file.write(private_key)

private_key_file.close()



# Save backoffice_cert

certification_file = open('./backoffice_service/certs/backoffice_vault_cert.crt', 'wb+')

certification_file = open('newcerts/superadmin.crt', 'wb+')

certification_file.write(bytes(backoffice_cert, 'utf-8'))

certification_file.close()
@@ -108,13 +123,5 @@ certification_file.close() 
#----------------------------------------



# the applicacions starts here in every interface and port 8080

# ssl -> contains backoffice_cert.crt and backoffice_key.key

if __name__ == "__main__":

    app.run(debug=True, host='0.0.0.0', port=8080)
 






# NOS LO FUMAMOS -> SSL 

# if __name__ == "__main__":

#     app.run(debug=True, host='0.0.0.0', port=8080, ssl_context=(

#         "/usr/src/app/backoffice_service/certs/backoffice_cert.crt", "/usr/src/app/backoffice_service/certs/backoffice_key.key"))

capif_backend/backoffice_service/certs2/ca_root.crt

0 → 100755
+38 −0
Original line number Diff line number Diff line 
-----BEGIN CERTIFICATE-----

MIIDIzCCAgugAwIBAgIUX2cjyWmnwj/KqEuH+Vj0ux4SuJQwDQYJKoZIhvcNAQEL

BQAwEDEOMAwGA1UEAxMFY2FwaWYwHhcNMjQwNzE1MTAyODA3WhcNMzQwNzEzMTAy

ODM2WjAQMQ4wDAYDVQQDEwVjYXBpZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC

AQoCggEBAOCj0VPfjdsZZlalkKlupmVgkhGOr7wDD/JYlLXU4EpUwDmPJpq8Mcot

lYocp4+aJuC5Ga12QeEE0Q8Wn6rHfSQKqGQB7HU3Ai/EePMlus1+DC1/llUgBAoe

cRpEhyAAcqHmoSYuRK/QQd1ibJEg02+pzojlboJMuXCTAdLbS4iyMCCP8mUDaBtD

R1M+wthXd1ATQ4a2US6ZQ6syWjgj7mjGu6fGxDS/avX9Fruq3+CX9jKXbWKVX+P4

r/NUIvjdObrCuJvpscv/8FRPs83HHzgGnoAaW4Fvfg3871JDCB/mFkt7ifbIkJSj

AK6iLxlTvtX74+qWVo1FPDFek0rgT0ECAwEAAaN1MHMwDgYDVR0PAQH/BAQDAgEG

MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHsxOm3VnHUZO+VOExyuF9Uf60/Z

MB8GA1UdIwQYMBaAFHsxOm3VnHUZO+VOExyuF9Uf60/ZMBAGA1UdEQQJMAeCBWNh

cGlmMA0GCSqGSIb3DQEBCwUAA4IBAQATDUhwcnOCQpKq76oFwnm1UFINaWoL/Mzk

Utmbb8jaSphJ92LUXo360UDSJxCJXcD7BUjtM8pBV9Qis/hwdGhNyTcWHEmH+tLz

8t88DJZ7UdHFvLrNl0eeGSgAvnjnDtbCtc/Xd7l8vzFyUxMJN4XjaAhCjxfivTFJ

hRq3zqa8TtV3MPg0BM5hFfSq7xzP97Qh832ECxuhQcNhLoSBqWnElul7VUKWNG29

Qw9TeQcan20I1u90udYVNnu7sZJULGJs2G95/QXBeuDZ05BwJn8wKfoGFpil5bqC

qHpF/XFAnmi9SqOwcRch1jPcHWFn5ES+bsLjdQ6iFL/KnU/AuIf3

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

MIIDKDCCAhCgAwIBAgIUKR3BsqrmgDuYswJ5/6DAkK4/jaIwDQYJKoZIhvcNAQEL

BQAwEDEOMAwGA1UEAxMFY2FwaWYwHhcNMjQwNzE1MTAyODA3WhcNMjkwNzE0MTAy

ODM3WjAnMSUwIwYDVQQDExxjYXBpZiBJbnRlcm1lZGlhdGUgQXV0aG9yaXR5MIIB

IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweE+WHeVTssYMTJTzfwLek6v

bhsMEHixDJZ6ppwfRBmWTye/IlBaIFZ0fxLVje/YJY00S3LD6daVNBZQfE9VWnR7

MY+jia6Cpm6v0izORWlD/OIkCdVUVwOeSeoi4UZ6m8B+GCKpFGJ6CDpfu7TpnLrt

H1YwENpmXaSkQnZ2yS4UCi18CVRQkseFGDLsdgJHtNkaGCSSqn5Q44NQw4KsO0la

F1Ucex2B+D92hQPHcbq0aU5ttSOhLPC8VvjT1p9/mM6seFDRzg0T2fwYdkk4Nqg4

AMonv/ecG+Pz5agfOUxTV4q4uzIHI3crei9eX2v2SGq1JWIcoy1hei0qmLsxFQID

AQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E

FgQUKXBWgmxyHGjUKoSxTDwsqGP7EqQwHwYDVR0jBBgwFoAUezE6bdWcdRk75U4T

HK4X1R/rT9kwDQYJKoZIhvcNAQELBQADggEBAKyxiOEiWGgIhLHjvethLwapExpd

QoIM4+O29sfihaK+JbyMTw4H2urfrrRJ690g0GLWstcwIuQUhIc11FYb2KLGbxcr

9BGPexpTP2xxwHa1jSB0QBb4R6FFWo/L0jz1V8oMtxL8VSbL0Szhg65W4jygrBCH

AqCy3dGp5fh6YTHTRg13c46FbRlnAfXlIA7q7lI+hglqBNyFY1Xr55dCYHsWuh7C

Au9S8m8PCVFwk9QiblwVH2z8toP88rRmrVlWkS7R/q6SN1KvvnMjxPTDn3SJEUNV

UwOHEJVN+zmssoktGpuoHT9HDuIMdTiGKSrsjQKFHNOm5S/H8QzUoL14MQo=

-----END CERTIFICATE-----

capif_backend/backoffice_service/certs2/superadmin.crt

0 → 100755
+58 −0
Original line number Diff line number Diff line 
-----BEGIN CERTIFICATE-----

MIIDVDCCAjygAwIBAgIUbIkPswMGW8cZQdxh6stX262UqsAwDQYJKoZIhvcNAQEL

BQAwJzElMCMGA1UEAxMcY2FwaWYgSW50ZXJtZWRpYXRlIEF1dGhvcml0eTAeFw0y

NDA3MTUxMDMwMzJaFw0yNTAxMTAxNDMxMDJaMBUxEzARBgNVBAMTCnN1cGVyYWRt

aW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+hcd4qp0j53uLMhw1

rYTWCP24YZh9vxOFVeDM8w+UgknrPsyYu789GjzHmu3q7s98cHMqjb/rh2jHcaoS

WD1BX4+dyr2VtCNVSOjjFRDfbH3qzecN6erHbrf9AAqH+gEgIl7jRTJW21y5zB3r

xRJ19TiNifQCqVkCFREjUuHPaws4KbciFQsmXqAq8SHze/6lIvv2uf845coyKJr2

fNlxS4wpU2iRLOp2lckBae6wteww5pkJDD5SQiqafaCghy1ehgVw6C5upLixkS/h

ooyUGi9F5tJUbghepUJP+Uk0KUwYV2av0BDYin1vHCbPrH7lRSRqenkdlqCX5pgu

KKV9AgMBAAGjgYkwgYYwDgYDVR0PAQH/BAQDAgOoMB0GA1UdJQQWMBQGCCsGAQUF

BwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUwS/SAEPJlRtfouwTiiaoG2rBcUowHwYD

VR0jBBgwFoAUKXBWgmxyHGjUKoSxTDwsqGP7EqQwFQYDVR0RBA4wDIIKc3VwZXJh

ZG1pbjANBgkqhkiG9w0BAQsFAAOCAQEAhG6knz/1UsEr2s4aLm6lhONUoMtZ5JSw

JUrTKZqqlygH/UoRoWIan7jFcwIJDpCB3p2KYuavyK37hT8v7GLri2NYXUgw9rqN

fioEY3jDzrxRf+tjeYSxisFhF4TSQMQaUSZh7oTI/TUI3ivNTqpB6UpH989BRp7N

IgF7Ox480Hbddl3ip/kkfFbtz9ba97v6xH1IY8Ic0U8DeFFFXK5SPfmnh6bAUQHg

c/ZpW7OluBI7cgpY/wPGe8/qn8EXS/voRWSgAB+lh6tUljlZ2RLXQAx5MhRzW46O

rRaAQMD2/L6JW8RemKLEVj7gzeEV15HxSKrRpqrePobbbUYUwtvq7w==

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

MIIDKDCCAhCgAwIBAgIUKR3BsqrmgDuYswJ5/6DAkK4/jaIwDQYJKoZIhvcNAQEL

BQAwEDEOMAwGA1UEAxMFY2FwaWYwHhcNMjQwNzE1MTAyODA3WhcNMjkwNzE0MTAy

ODM3WjAnMSUwIwYDVQQDExxjYXBpZiBJbnRlcm1lZGlhdGUgQXV0aG9yaXR5MIIB

IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweE+WHeVTssYMTJTzfwLek6v

bhsMEHixDJZ6ppwfRBmWTye/IlBaIFZ0fxLVje/YJY00S3LD6daVNBZQfE9VWnR7

MY+jia6Cpm6v0izORWlD/OIkCdVUVwOeSeoi4UZ6m8B+GCKpFGJ6CDpfu7TpnLrt

H1YwENpmXaSkQnZ2yS4UCi18CVRQkseFGDLsdgJHtNkaGCSSqn5Q44NQw4KsO0la

F1Ucex2B+D92hQPHcbq0aU5ttSOhLPC8VvjT1p9/mM6seFDRzg0T2fwYdkk4Nqg4

AMonv/ecG+Pz5agfOUxTV4q4uzIHI3crei9eX2v2SGq1JWIcoy1hei0qmLsxFQID

AQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E

FgQUKXBWgmxyHGjUKoSxTDwsqGP7EqQwHwYDVR0jBBgwFoAUezE6bdWcdRk75U4T

HK4X1R/rT9kwDQYJKoZIhvcNAQELBQADggEBAKyxiOEiWGgIhLHjvethLwapExpd

QoIM4+O29sfihaK+JbyMTw4H2urfrrRJ690g0GLWstcwIuQUhIc11FYb2KLGbxcr

9BGPexpTP2xxwHa1jSB0QBb4R6FFWo/L0jz1V8oMtxL8VSbL0Szhg65W4jygrBCH

AqCy3dGp5fh6YTHTRg13c46FbRlnAfXlIA7q7lI+hglqBNyFY1Xr55dCYHsWuh7C

Au9S8m8PCVFwk9QiblwVH2z8toP88rRmrVlWkS7R/q6SN1KvvnMjxPTDn3SJEUNV

UwOHEJVN+zmssoktGpuoHT9HDuIMdTiGKSrsjQKFHNOm5S/H8QzUoL14MQo=

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

MIIDIzCCAgugAwIBAgIUX2cjyWmnwj/KqEuH+Vj0ux4SuJQwDQYJKoZIhvcNAQEL

BQAwEDEOMAwGA1UEAxMFY2FwaWYwHhcNMjQwNzE1MTAyODA3WhcNMzQwNzEzMTAy

ODM2WjAQMQ4wDAYDVQQDEwVjYXBpZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC

AQoCggEBAOCj0VPfjdsZZlalkKlupmVgkhGOr7wDD/JYlLXU4EpUwDmPJpq8Mcot

lYocp4+aJuC5Ga12QeEE0Q8Wn6rHfSQKqGQB7HU3Ai/EePMlus1+DC1/llUgBAoe

cRpEhyAAcqHmoSYuRK/QQd1ibJEg02+pzojlboJMuXCTAdLbS4iyMCCP8mUDaBtD

R1M+wthXd1ATQ4a2US6ZQ6syWjgj7mjGu6fGxDS/avX9Fruq3+CX9jKXbWKVX+P4

r/NUIvjdObrCuJvpscv/8FRPs83HHzgGnoAaW4Fvfg3871JDCB/mFkt7ifbIkJSj

AK6iLxlTvtX74+qWVo1FPDFek0rgT0ECAwEAAaN1MHMwDgYDVR0PAQH/BAQDAgEG

MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHsxOm3VnHUZO+VOExyuF9Uf60/Z

MB8GA1UdIwQYMBaAFHsxOm3VnHUZO+VOExyuF9Uf60/ZMBAGA1UdEQQJMAeCBWNh

cGlmMA0GCSqGSIb3DQEBCwUAA4IBAQATDUhwcnOCQpKq76oFwnm1UFINaWoL/Mzk

Utmbb8jaSphJ92LUXo360UDSJxCJXcD7BUjtM8pBV9Qis/hwdGhNyTcWHEmH+tLz

8t88DJZ7UdHFvLrNl0eeGSgAvnjnDtbCtc/Xd7l8vzFyUxMJN4XjaAhCjxfivTFJ

hRq3zqa8TtV3MPg0BM5hFfSq7xzP97Qh832ECxuhQcNhLoSBqWnElul7VUKWNG29

Qw9TeQcan20I1u90udYVNnu7sZJULGJs2G95/QXBeuDZ05BwJn8wKfoGFpil5bqC

qHpF/XFAnmi9SqOwcRch1jPcHWFn5ES+bsLjdQ6iFL/KnU/AuIf3

-----END CERTIFICATE-----
 
 No newline at end of file