Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Nextcloud Certificates in ExApps for OAuth2 and Self-Signed Certificate Use Cases #411

Open
bigcat88 opened this issue Oct 3, 2024 · 0 comments
Assignees
Labels
docker Docker Engine API enhancement New feature or request pending

Comments

@bigcat88
Copy link
Member

bigcat88 commented Oct 3, 2024

Description:

We need to add support for Nextcloud certificates so that they appear in ExApps(our applications in Docker containers managed by AppAPI) when they are imported into Nextcloud.

This is especially important for those cases when ExApp uses OAuth2 or the deployment occurs on a server where Nextcloud has a self-signed certificate.

In the current implementation, this is not possible, because when the certificate is imported into the NC viaocc, it does not automatically propagate to ExApps.

Solution:

  1. When creating a container we must copy the current certificates from the cloud to the container
  2. When a certificate is imported to the cloud, AppAPI should automatically copy it to each ExApp
  3. AppAPI will also run a command inside the ExApp containers to rebuild the certificates, such as update-ca-certificates (or the equivalent command depending on the OS used in the container)

Algorithm for step 1:

1. we start container with `sleep infinite` as entry point
2. upload certs
3. executing `update-ca-certificates` 
4. stop container
5. start container as usual

Algorithm for step 2 almost the same, except we also doing full application disabling and starting.


Note that AppAPI cannot automatically restart the containers, as we cannot know the application’s current state (it could be processing important tasks). Therefore, automatic restarts would be too disruptive.

OCC Command Addition:

To address this, we will introduce the following OCC command in AppAPI:

  • occ app_api:restart --daemon_id=(optional) --app_id=(optional)

This command can be used to restart (i.e., stop and start) ExApp applications by either daemon_id or app_id, or restart all ExApps if neither option is specified.
After importing a certificate, the administrator can use this command to manually restart ExApps to reload certificates if needed.

To implement restart action we first need to do implement this: #410

@bigcat88 bigcat88 added Question for Meeting To discuss with engenieers enhancement New feature or request pending docker Docker Engine API and removed Question for Meeting To discuss with engenieers labels Oct 3, 2024
@bigcat88 bigcat88 self-assigned this Oct 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docker Docker Engine API enhancement New feature or request pending
Projects
None yet
Development

No branches or pull requests

1 participant