Update Devconf installation and docs

Use Devconf settings in the parameters.yml.dist, so devconf will work
out-of-the-box for development. Also remove the old StepupDeploy VM
parameters.yml. And update the readme to reflect the use of devconf.
Also updated the hostnames and keys to be able to use the devconf
Docker containers.

.github/workflows/run-cypress.yml

@@ -29,7 +29,7 @@ jobs:
               run: |
                 cd docker &&
                 ${DOCKER_COMPOSE} up -d --build &&
-                docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                     SYMFONY_ENV=ci composer install --prefer-dist -n -o --ignore-platform-reqs && \
                     ./app/console cache:clear --env=ci && \
                     cd theme && CYPRESS_INSTALL_BINARY=0 yarn install --frozen-lockfile && EB_THEME=skeune yarn build
@@ -38,13 +38,13 @@ jobs:
               if: always()
               run: |
                   cd docker && \
-                  docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                     EB_THEME=skeune ./theme/scripts/prepare-test.js
                   ' && \
                   docker compose exec -T cypress bash -c '
                     cd e2e && yarn install && cypress run --spec cypress/integration/skeune/**/*.spec.js,cypress/integration/shared/*.spec.js --browser=chrome --headless
                   ' && \
-                  docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                     EB_THEME=openconext ./theme/scripts/prepare-test.js
                   ' && \
                   docker compose exec -T cypress bash -c '

.github/workflows/test-integration.yml

@@ -29,15 +29,15 @@ jobs:
               run: |
                 cd docker &&
                 ${DOCKER_COMPOSE} up -d --build &&
-                docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                     SYMFONY_ENV=ci composer install --prefer-dist -n -o --ignore-platform-reqs && \
                     ./app/console cache:clear --env=ci && \
                     cd theme && CYPRESS_INSTALL_BINARY=0 yarn install --frozen-lockfile && EB_THEME=skeune yarn build
                 '
             - name: Run code quality tests
               if: always()
               run: |
-                  cd docker && docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  cd docker && docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                       echo -e "\nPHP Mess Detector\n" && \
                       ./vendor/bin/phpmd src text ci/qa-config/phpmd.xml --exclude */Tests/* && \
                       echo -e "\nPHP CodeSniffer\n" && \
@@ -52,7 +52,7 @@ jobs:
             - name: Run unit tests
               if: always()
               run: |
-                  cd docker && APP_ENV=ci docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  cd docker && APP_ENV=ci SYMFONY_ENV=ci docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                       echo -e "\nInstalling database fixtures...\n" && \
                       ./app/console doctrine:schema:drop --force --env=ci && \
                       ./app/console doctrine:schema:create --env=ci && \
@@ -70,7 +70,7 @@ jobs:
             - name: Run acceptance tests
               if: always()
               run: |
-                  cd docker && docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  cd docker && docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                       echo -e "\nInstalling database fixtures...\n" && \
                       ./app/console doctrine:schema:drop --force --env=ci && \
                       ./app/console doctrine:schema:create --env=ci && \
@@ -86,7 +86,7 @@ jobs:
             - name: Run linting tests
               if: always()
               run: |
-                  cd docker && docker compose exec -T --user www-data php-fpm.vm.openconext.org bash -c '
+                  cd docker && docker compose exec -T --user www-data engine.dev.openconext.local bash -c '
                       echo -e "\nTwig lint\n"  && \
                       app/console lint:twig theme/ && \
                       cd theme && \
@@ -98,7 +98,7 @@ jobs:
             - name: Show log on failure
               if: failure()
               run:  |
-                  cd docker && docker compose exec -T php-fpm.vm.openconext.org cat /opt/openconext/OpenConext-engineblock/app/logs/ci/ci.log
+                  cd docker && docker compose exec -T engine.dev.openconext.local cat /var/www/html/app/logs/ci/ci.log
             - name: Send notification on production build nightly build failure
               uses: sonots/slack-notice-action@v3
               with:

README.md

@@ -42,7 +42,7 @@ Finally, when not in an environment with the debug flag enabled, you need to cle
 $ php72 ./app/console cache:clear --env=prod
 ```
 
-To setup the required tooling on the VM, the following steps might be useful:
+To setup the required tooling on the container, the following steps might be useful:
 
     cd /opt/openconext/OpenConext-engineblock/theme
     sudo curl --silent --location https://rpm.nodesource.com/setup_11.x | sudo bash -
@@ -82,12 +82,12 @@ it is only regularly tested with RedHat Enterprise Linux and CentOS._
 
 ## Installation
 
-_**Note**: you are highly encouraged to use [OpenConext-Deploy][op-dep] to deploy OpenConext installations._
+_**Note**: you are highly encouraged to use [OpenConext-Devconf][op-dev] to deploy OpenConext installations._
 
 If you are reading this then you've probably already installed a copy of EngineBlock somewhere on the destination server,
 if not, then that would be step 1 for the installation.
 
-If you do not use [OpenConext-Deploy][op-dep] and have an installed copy and your server meets all the requirements
+If you do not use [OpenConext-Devconf][op-dev] and have an installed copy and your server meets all the requirements
 above, then please follow the steps below to start your installation.
 
 ### First, create an empty database
@@ -143,11 +143,11 @@ It should also serve both the `engine.yourdomain.example` and `engine-api.yourdo
 Make sure the `ENGINEBLOCK_ENV` is set, and that the `SYMFONY_ENV` is set, this can be mapped from `ENGINEBLOCK_ENV` as:
 
 | `ENGINEBLOCK_ENV` | `SYMFONY_ENV` |
-| --- | --- |
-| production | prod |
-| acceptance | acc |
-| test | test |
-| vm | dev |
+|-------------------| --- |
+| production        | prod |
+| acceptance        | acc |
+| test              | test |
+| dev               | dev |
 
 **EXAMPLE**
 
@@ -254,7 +254,7 @@ Also, the following documentation can be found in the [docs][docs] directory:
 [notice]: NOTICE.txt
 [upgrading]: UPGRADING.md
 [comp]: https://getcomposer.org/
-[op-dep]: https://github.com/OpenConext/OpenConext-deploy
+[op-dev]: https://github.com/OpenConext/OpenConext-devconf
 [manage]: https://github.com/OpenConext/OpenConext-manage
 [eb-wiki-theme-development]: https://github.com/OpenConext/OpenConext-engineblock/wiki/Development-Guidelines#theme-development
 [wiki]: https://github.com/OpenConext/OpenConext-engineblock/wiki

app/AppKernel.php

@@ -60,17 +60,19 @@ public function registerContainerConfiguration(LoaderInterface $loader)
 
     public function getCacheDir()
     {
-        // In the dev & test environments use a folder outside the shared filesystem. This greatly improves cache clear
-        // and warmup time.
-        if ($this->getEnvironment() === 'dev' || $this->getEnvironment() === 'test') {
-            return sprintf('/tmp/engineblock/cache/%s', $this->getEnvironment());
-        }
-
         return $this->rootDir . '/cache/' . $this->environment;
     }
 
     public function getLogDir()
     {
         return $this->rootDir . '/logs/' . $this->environment;
     }
+
+    public function getProjectDir()
+    {
+        // This is needed to define the project dir without composer.json
+        // @see: https://symfony.com/doc/current/reference/configuration/kernel.html#configuration-kernel-project-directory
+        return \dirname(__DIR__);
+    }
+
 }

app/config/config_ci.yml

@@ -10,15 +10,15 @@ doctrine:
                 driver:   pdo_mysql         # This must be PDO until all database interaction runs through doctrine
                 server_version: 5.5
                 dbname:   "%database.dbname%"
-                host:     "db.vm.openconext.org"
+                host:     "mariadb"
                 port:     "%database.port%"
                 user:     "%database.user%"
                 password: "%database.password%"
             engineblock_test:
                 driver:   pdo_mysql         # This must be PDO until all database interaction runs through doctrine
                 server_version: 5.5
                 dbname:   "%database.test.dbname%"
-                host:     "db-test.vm.openconext.org"
+                host:     "mariadb"
                 port:     "%database.test.port%"
                 user:     "%database.test.user%"
                 password: "%database.test.password%"

app/config/functional_testing.yml.dist

@@ -5,4 +5,4 @@ parameters:
     # Where must we store the writable state of the Mock IdP and Mock SP?
     idp_fixture_file: '/tmp/eb-fixtures/db/idp.states.php.serialized'
     sp_fixture_file: '/tmp/eb-fixtures/db/sp.states.php.serialized'
-    stepup.sfo.override_engine_entityid: 'https://engine.vm.openconext.com/new/stepup/metadata'
+    stepup.sfo.override_engine_entityid: 'https://engine.dev.openconext.local/new/stepup/metadata'

app/config/parameters.yml.dist

@@ -11,11 +11,11 @@ parameters:
     ## from the Host header will be used) or set to match the domain
     ## setting. For example:
     ##
-    ##    domain = vm.openconext.org
-    ##    hostname = engine.vm.openconext.org
-    domain: vm.openconext.org
+    ##    domain = dev.openconext.local
+    ##    hostname = engine.dev.openconext.local
+    domain: dev.openconext.local
     ## Set a fixed hostname for OpenConext EngineBlock to use.
-    hostname: engine.vm.openconext.org
+    hostname: engine.dev.openconext.local
 
     ## Configure trusted proxies to use their X-Forwarded-For header.
     trusted_proxies:
@@ -43,8 +43,8 @@ parameters:
     ## or requests (when it acts as an SP) it uses these X.509 certs.
     encryption_keys:
         default:
-            publicFile: /etc/openconext/engineblock.crt
-            privateFile: /etc/openconext/engineblock.pem
+            publicFile: /config/engine/engineblock.crt
+            privateFile: /config/engine/engineblock.pem
 
     ## List of signature methods explicitly forbidden by EngineBlock.
     forbidden_signature_methods: {  }
@@ -73,7 +73,7 @@ parameters:
 
     ## EngineBlock API credentials
     ## The API user config, allows for configuration of multiple different users
-    api.users.metadataPush.username: serviceregistry
+    api.users.metadataPush.username: manage
     api.users.metadataPush.password: secret
     api.users.profile.username: profile
     api.users.profile.password: secret
@@ -84,7 +84,7 @@ parameters:
     ## PDP SETTINGS
     ##########################################################################################
     ## Location of PDP
-    pdp.host: 'https://pdp.vm.openconext.org'
+    pdp.host: 'https://pdp.dev.openconext.local'
 
     ## PDP uses basic auth
     pdp.username: pdp_admin
@@ -96,7 +96,7 @@ parameters:
     ## ATTRIBUTE AGGREGATION SETTINGS
     ##########################################################################################
     ## Location of AA
-    attribute_aggregation.base_url: 'https://aa.vm.openconext.org/aa/api/internal/attribute/aggregation'
+    attribute_aggregation.base_url: 'https://aa.dev.openconext.local/internal/attribute/aggregation'
     attribute_aggregation.username: eb
     attribute_aggregation.password: secret
 
@@ -119,12 +119,12 @@ parameters:
     ##########################################################################################
     ## DATABASE SETTINGS
     ##########################################################################################
-    database.host: localhost
+    database.host: mariadb
     database.port: '3306'
     database.user: ebrw
     database.password: secret
     database.dbname: eb
-    database.test.host: localhost
+    database.test.host: mariadb
     database.test.port: '3306'
     database.test.user: eb_testrw
     database.test.password: secret
@@ -138,13 +138,13 @@ parameters:
     ## Minimum execution time in milliseconds when a received response is deemed invalid (default: 5000 ms)
     minimum_execution_time_on_invalid_received_response: 5000
     ## The value for guest qualifier. Can be overridden for specific environments
-    addgueststatus_guestqualifier: 'urn:collab:org:vm.openconext.org'
+    addgueststatus_guestqualifier: 'urn:collab:org:dev.openconext.local'
 
     ## Language cookie settings
     ## The value for the domain is also used for clearing SSO Notification cookies if the feature is enabled
     cookie.path: /
     cookie.secure: true
-    cookie.locale.domain: .vm.openconext.org
+    cookie.locale.domain: .dev.openconext.local
     cookie.locale.expiry: 5184000
     cookie.locale.http_only: false
     cookie.locale.secure: true
@@ -157,7 +157,7 @@ parameters:
     view_default_logo_height: 96
     # when set, will show a ribbon top-right to visually distinguish this install from other
     # environments in your constellation (e.g. "test", "qa"), with the given ribbon color in
-    # env_ribbon_color. You can choose from colors: crimson,darkorchid,orange,hotpink,khaki.
+    # env_ribbon_color. You can choose from colors: crimson,orange,hotpink,khaki.
     env_name: ""
     env_ribbon_color: ""
 
@@ -178,7 +178,7 @@ parameters:
 
     ## Toggle the default IdP quick link banner on the WAYF.
     wayf.display_default_idp_banner_on_wayf: true
-    wayf.default_idp_entity_id: https://default-idp.vm.openconext.org
+    wayf.default_idp_entity_id: https://default-idp.dev.openconext.local
 
     ## Toggle display & content of global site notice
     global.site_notice.show: false
@@ -221,7 +221,7 @@ parameters:
     feature_api_metadata_api: true
     feature_api_deprovision: true
     feature_run_all_manipulations_prior_to_consent: false
-    feature_block_user_on_violation: true
+    feature_block_user_on_violation: false
     feature_enable_consent: true
     feature_stepup_sfo_override_engine_entityid: false
     feature_enable_idp_initiated_flow: true
@@ -230,40 +230,42 @@ parameters:
     ## PROFILE SETTINGS
     ##########################################################################################
     ## Location of Profile
-    profile_base_url: 'https://profile.vm.openconext.org'
+    profile_base_url: 'https://profile.dev.openconext.local'
 
     ##########################################################################################
     ## SFO SETTINGS
     ##########################################################################################
     ## This PCRE regex is used to blacklist incoming AuthnContextClassRef attributes on. If an empty string is used
     ## the validation is skipped. The validator will throw an exception if the used regex is invalid.
-    stepup.authn_context_class_ref_blacklist_regex: '/http:\/\/vm\.openconext\.org\/assurance\/loa[1-3]/'
+    stepup.authn_context_class_ref_blacklist_regex: '/http:\/\/dev\.openconext\.local\/assurance\/loa[1-3]/'
     ## The loa mapping from the internal used LoA's to the Stepup Gateway LOA's.
     ## Specification of the mapping: stepup.loa.mapping.[int 1|2|3].[string engineblock|gateway]
     ## The integer after the mapping field indicates the LoA level (1, 2 or 3 are supported).
     ## The engineblock or gateway keys specify the LoAs identifier as will be carried in the AuthnContextClassRef of an assertion.
     stepup.loa.mapping:
         10:
-            engineblock: 'http://vm.openconext.org/assurance/loa1'
-            gateway: 'http://stepup.vm.openconext.org/assurance/loa1'
+            engineblock: 'http://dev.openconext.local/assurance/loa1'
+            gateway: 'http://dev.openconext.local/assurance/loa1'
         15:
-            engineblock: 'http://vm.openconext.org/assurance/loa1_5'
-            gateway: 'http://stepup.vm.openconext.org/assurance/loa1_5'
+            engineblock: 'http://dev.openconext.local/assurance/loa1_5'
+            gateway: 'http://dev.openconext.local/assurance/loa1_5'
         20:
-            engineblock: 'http://vm.openconext.org/assurance/loa2'
-            gateway: 'http://stepup.vm.openconext.org/assurance/loa2'
+            engineblock: 'http://dev.openconext.local/assurance/loa2'
+            gateway: 'http://dev.openconext.local/assurance/loa2'
         30:
-            engineblock: 'http://vm.openconext.org/assurance/loa3'
-            gateway: 'http://stepup.vm.openconext.org/assurance/loa3'
+            engineblock: 'http://dev.openconext.local/assurance/loa3'
+            gateway: 'http://dev.openconext.local/assurance/loa3'
     ## The fallback LoA to return when the Stepup authentication fails but is not required
-    stepup.loa.loa1: 'http://vm.openconext.org/assurance/loa1'
+    stepup.loa.loa1: 'http://dev.openconext.local/assurance/loa1'
     ## The EntityId (metadata URL) used in the callout to the SFO endpoint of the configured Stepup Gateway
-    stepup.gateway.sfo.entity_id: 'https://gateway.stepup.vm.openconext.org/second-factor-only/metadata'
+    stepup.gateway.sfo.entity_id: 'https://gateway.dev.openconext.local/second-factor-only/metadata'
     ## The single sign-on endpoint used for Stepup Gateway SFO callouts
-    stepup.gateway.sfo.sso_location: 'https://gateway.stepup.vm.openconext.org/second-factor-only/single-sign-on'
+    stepup.gateway.sfo.sso_location: 'https://gateway.dev.openconext.local/second-factor-only/single-sign-on'
     ## The public key from the Stepup Gateway IdP
-    stepup.gateway.sfo.key_file: /etc/openconext/engineblock.crt
-    stepup.sfo.override_engine_entityid: 'https://engine.vm.openconext.com/new/stepup/metadata'
+    stepup.gateway.sfo.key_file: /config/engine/engineblock.crt
+    ## You can override the default entityID used by Engineblock for its callout to stepup gateway.
+    ## You also need to enable the feature toggle feature_stepup_sfo_override_engine_entityid above.
+    stepup.sfo.override_engine_entityid: "https://engine.dev.openconext.local/new/stepup/metadata"
 
     ##########################################################################################
     ## THEME SETTINGS
@@ -303,4 +305,3 @@ parameters:
     # used in the authentication log record. The attributeName will be searched in the response attributes and if present
     # the log data will be enriched. The values of the response attributes are the final values after ARP and Attribute Manipulation.
     auth.log.attributes: []
-