Split and clean up of tp_wizard

.env.example

@@ -0,0 +1,60 @@
+# Copy this file to .env and adjust it before running Docker Compose.
+#
+# Usage:
+#   cp .env.example .env
+#   $EDITOR .env
+#   docker compose up -d
+
+# PostgreSQL connection used by the Trustpoint containers.
+# Development default: admin / testing321
+# Use a long, randomly generated password outside local testing:
+#   openssl rand -base64 32
+POSTGRES_DB=trustpoint_db
+DATABASE_USER=admin
+DATABASE_PASSWORD=testing321
+DATABASE_HOST=postgres
+DATABASE_PORT=5432
+
+# TLS Server Certificate Configuration
+# Comma-separated lists of addresses/names where Trustpoint is reachable.
+# These are used for:
+# - Subject Alternative Names (SANs) in the TLS certificate
+# - Django ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS
+# At least one value must be specified for production deployments.
+TP_TLS_IPV4_ADDRESSES=127.0.0.1
+TP_TLS_IPV6_ADDRESSES=::1
+TP_TLS_DNS_NAMES=localhost
+
+# HTTP and HTTPS ports for external access
+# Only include non-standard ports in CSRF_TRUSTED_ORIGINS (default: 80 for HTTP, 443 for HTTPS)
+# TP_HTTP_PORT=80
+# TP_HTTPS_PORT=443
+
+# Optional mail settings. Leave EMAIL_HOST empty to use Django's console backend.
+# DEFAULT_FROM_EMAIL=no-reply@trustpoint.de
+# EMAIL_HOST=
+# EMAIL_PORT=587
+# EMAIL_USE_TLS=
+# EMAIL_USE_SSL=
+# EMAIL_HOST_USER=
+# EMAIL_HOST_PASSWORD=
+# EMAIL_TIMEOUT=10
+
+# ========================================================================
+# Auto-Setup Configuration (Skip Setup Wizard)
+# ========================================================================
+# If TP_AUTO_SETUP=true, Trustpoint will automatically configure itself
+# from environment variables, bypassing the interactive setup wizard.
+
+# Enable automatic setup from environment variables (true/false)
+# TP_AUTO_SETUP=false
+
+# Superuser credentials (REQUIRED if TP_AUTO_SETUP=true)
+# TP_ADMIN_USERNAME=admin
+# TP_ADMIN_PASSWORD=testing321
+
+# Inject demo data for testing (true/false)
+# TP_INJECT_DEMO_DATA=false
+
+# Note: When auto-setup is enabled, the TLS certificate will be automatically
+# generated using the TP_TLS_* variables specified above.

.github/workflows/backup-restore.yml

@@ -17,6 +17,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      - name: Setup .env file
+        run: cp .env.example .env
+
       - name: Build and start PostgreSQL
         run: |
           docker build -t trustpointproject/postgres:latest -f docker/db/Dockerfile .

.github/workflows/docker-test-compose.yml

@@ -15,6 +15,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Setup .env file
+        run: cp .env.example .env
+
       # Step: Run Docker Compose to start services.
       # Uses the hoverkraft-tech/compose-action to manage Docker Compose commands.
       # "compose-file": path to the docker-compose file.

.github/workflows/r_200_feature_test.yml

@@ -19,6 +19,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+
+      - name: Setup .env file
+        run: cp .env.example .env
 
       # Build and start Docker containers with docker-compose
       - name: Build and start Docker containers

.github/workflows/zap.yml

@@ -20,6 +20,9 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v7
 
+      - name: Setup .env file
+        run: cp .env.example .env
+
       - name: Start Trustpoint via docker-compose
         run: |
           docker compose -f docker-compose.yml up -d

.gitignore

@@ -195,3 +195,5 @@ tests/client/*
 
 node_modules/
 workflow2Folder/
+
+.env

docker-compose.softhsm.yml

@@ -5,53 +5,67 @@ services:
       dockerfile: docker/trustpoint/Dockerfile
     image: trustpointproject/trustpoint:latest
     container_name: trustpoint
+    restart: unless-stopped
     ports:
-      - "80:80"
-      - "443:443"
+      - "${TP_HTTP_PORT:-80}:80"
+      - "${TP_HTTPS_PORT:-443}:443"
     depends_on:
-      postgres:
-        condition: service_started
       softhsm:
         condition: service_healthy
     volumes:
       - ./trustpoint/settings:/var/www/html/trustpoint/trustpoint/settings
     environment:
-      POSTGRES_DB: "trustpoint_db"
-      POSTGRES_USER_FILE: /run/secrets/db_user
-      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
-      DATABASE_HOST: "postgres"
-      DATABASE_PORT: "5432"
+      POSTGRES_DB: "${POSTGRES_DB:-trustpoint_db}"
+      DATABASE_USER_FILE: /run/secrets/db_user
+      DATABASE_PASSWORD_FILE: /run/secrets/db_password
+      DATABASE_HOST: "${DATABASE_HOST:-postgres}"
+      DATABASE_PORT: "${DATABASE_PORT:-5432}"
       HSM_PIN_FILE: /run/secrets/hsm_pin
       HSM_SO_PIN_FILE: /run/secrets/hsm_so_pin
     secrets:
       - db_user
       - db_password
       - hsm_pin
       - hsm_so_pin
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsk --max-time 5 https://localhost/ > /dev/null"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
 
   postgres:
     build:
       context: .
       dockerfile: docker/db/Dockerfile
     image: trustpointproject/postgres:latest
     container_name: postgres
+    restart: unless-stopped
     ports:
-      - "5432:5432"
+      # Bind to loopback only – PostgreSQL must not be reachable from the network.
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql
     environment:
       POSTGRES_USER_FILE: /run/secrets/db_user
       POSTGRES_PASSWORD_FILE: /run/secrets/db_password
-      POSTGRES_DB: "trustpoint_db"
+      POSTGRES_DB: "${POSTGRES_DB:-trustpoint_db}"
     secrets:
       - db_user
       - db_password
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -p 5432"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
 
   softhsm:
     build:
       context: .
       dockerfile: docker/softhsm/Dockerfile
     container_name: softhsm
+    restart: unless-stopped
     ports:
       - "5657:5657"
     healthcheck:

docker-compose.yml

@@ -5,50 +5,66 @@ services:
       dockerfile: docker/trustpoint/Dockerfile
     image: trustpointproject/trustpoint:latest
     container_name: trustpoint
+    restart: unless-stopped
     ports:
-      - "80:80"
-      - "443:443"
-    depends_on:
-      - postgres
+      - "${TP_HTTP_PORT:-80}:80"
+      - "${TP_HTTPS_PORT:-443}:443"
+    env_file:
+      - .env
     environment:
-      POSTGRES_DB: "trustpoint_db"
-      DATABASE_USER: "admin"
-      DATABASE_PASSWORD: "testing321"
-      DATABASE_HOST: "postgres"
-      DATABASE_PORT: "5432"
-      TP_URLS: ${TP_URLS}
+      POSTGRES_DB: "${POSTGRES_DB:-trustpoint_db}"
+      DATABASE_USER: "${DATABASE_USER:-admin}"
+      DATABASE_PASSWORD: "${DATABASE_PASSWORD:-testing321}"
+      DATABASE_HOST: "${DATABASE_HOST:-postgres}"
+      DATABASE_PORT: "${DATABASE_PORT:-5432}"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsk --max-time 5 https://localhost/ > /dev/null"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
 
   trustpoint-worker:
     build:
       context: .
       dockerfile: docker/trustpoint/Dockerfile
     image: trustpointproject/trustpoint:latest
+    restart: on-failure
     depends_on:
-      - postgres
-      - trustpoint
+      trustpoint:
+        condition: service_healthy
+    env_file:
+      - .env
     environment:
-      POSTGRES_DB: "trustpoint_db"
-      DATABASE_USER: "admin"
-      DATABASE_PASSWORD: "testing321"
-      DATABASE_HOST: "postgres"
-      DATABASE_PORT: "5432"
+      POSTGRES_DB: "${POSTGRES_DB:-trustpoint_db}"
+      DATABASE_USER: "${DATABASE_USER:-admin}"
+      DATABASE_PASSWORD: "${DATABASE_PASSWORD:-testing321}"
+      DATABASE_HOST: "${DATABASE_HOST:-postgres}"
+      DATABASE_PORT: "${DATABASE_PORT:-5432}"
       TRUSTPOINT_SERVICE_ROLE: "worker"
-    restart: on-failure
 
   postgres:
     build:
       context: .
       dockerfile: docker/db/Dockerfile
     image: trustpointproject/postgres:latest
     container_name: postgres
+    restart: unless-stopped
     ports:
-      - "5432:5432"
+      # Bind to loopback only – PostgreSQL must not be reachable from the network.
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql
     environment:
-      POSTGRES_USER: "admin"
-      POSTGRES_PASSWORD: "testing321"
-      POSTGRES_DB: "trustpoint_db"
+      POSTGRES_USER: "${DATABASE_USER:-admin}"
+      POSTGRES_PASSWORD: "${DATABASE_PASSWORD:-testing321}"
+      POSTGRES_DB: "${POSTGRES_DB:-trustpoint_db}"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -p 5432"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
 
 volumes:
-  postgres_data:
+  postgres_data:

docker/trustpoint/wizard/update_tls.sh

@@ -26,7 +26,13 @@ mkdir -p "$NGINX_TLS_DIR"
 log INFO "Move TLS Server credentials into $NGINX_TLS_DIR"
 
 # Copies the TLS-Server credentials into the nginx TLS directory.
-if ! mv /var/www/html/trustpoint/docker/trustpoint/nginx/tls/* "$NGINX_TLS_DIR"
+shopt -s nullglob
+TLS_FILES=(/var/www/html/trustpoint/docker/trustpoint/nginx/tls/*)
+shopt -u nullglob
+
+if [ ${#TLS_FILES[@]} -eq 0 ]; then
+    log INFO "No staged TLS files found; keeping existing nginx TLS files"
+elif ! mv "${TLS_FILES[@]}" "$NGINX_TLS_DIR"
 then
     log ERROR "Failed to copy Trustpoint TLS files to $NGINX_TLS_DIR."
     exit 5

docker/trustpoint/wizard/update_tls_nginx.sh

@@ -39,7 +39,13 @@ mkdir -p "$NGINX_TLS_DIR"
 log INFO "Move TLS Server credentials into $NGINX_TLS_DIR"
 
 # Copies the TLS-Server credentials into the nginx TLS directory.
-if ! mv /var/www/html/trustpoint/docker/trustpoint/nginx/tls/* "$NGINX_TLS_DIR"
+shopt -s nullglob
+TLS_FILES=(/var/www/html/trustpoint/docker/trustpoint/nginx/tls/*)
+shopt -u nullglob
+
+if [ ${#TLS_FILES[@]} -eq 0 ]; then
+    log INFO "No staged TLS files found; keeping existing nginx TLS files"
+elif ! mv "${TLS_FILES[@]}" "$NGINX_TLS_DIR"
 then
     log ERROR "Failed to copy Trustpoint TLS files to $NGINX_TLS_DIR."
     exit 3
@@ -75,4 +81,4 @@ else
 fi
 log INFO "TLS certificate update for nginx completed successfully"
 
-exit 0
+exit 0