feat(ops): sign readiness bundle

ansible/deploy_aw_server.yml

@@ -1608,6 +1608,61 @@
             mode: "0755"
           when: detmir_readiness_rust_binary.stat.exists | default(false)
 
+        - name: Создать private каталог DetMir readiness signing
+          ansible.builtin.file:
+            path: /etc/detmir-readiness
+            state: directory
+            owner: root
+            group: root
+            mode: "0700"
+
+        - name: Проверить private key DetMir readiness signing
+          ansible.builtin.stat:
+            path: /etc/detmir-readiness/signing-key.pem
+          register: detmir_readiness_signing_key
+
+        - name: Сгенерировать private key DetMir readiness signing
+          ansible.builtin.command:
+            argv:
+              - openssl
+              - genpkey
+              - -algorithm
+              - RSA
+              - -pkeyopt
+              - rsa_keygen_bits:3072
+              - -out
+              - /etc/detmir-readiness/signing-key.pem
+          when: not (detmir_readiness_signing_key.stat.exists | default(false))
+          no_log: true
+
+        - name: Зафиксировать права private key DetMir readiness signing
+          ansible.builtin.file:
+            path: /etc/detmir-readiness/signing-key.pem
+            owner: root
+            group: root
+            mode: "0600"
+
+        - name: Создать private env DetMir readiness
+          ansible.builtin.copy:
+            dest: /etc/detmir-readiness.env
+            content: ""
+            owner: root
+            group: root
+            mode: "0600"
+            force: false
+
+        - name: Настроить private env DetMir readiness signing
+          ansible.builtin.blockinfile:
+            path: /etc/detmir-readiness.env
+            marker: "# {mark} ANSIBLE MANAGED DETMIR READINESS"
+            block: |
+              DETMIR_READINESS_SIGNING_KEY=/etc/detmir-readiness/signing-key.pem
+              DETMIR_READINESS_REQUIRE_SIGNATURE=true
+              DETMIR_READINESS_RETENTION_DAYS={{ detmir_readiness_retention_days | default(30) }}
+            owner: root
+            group: root
+            mode: "0600"
+
         - name: Установить systemd service DetMir readiness bundle
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/detmir-readiness.service"

ansible/deploy_detmir_portal.yml

@@ -14,6 +14,7 @@
     detmir_portal_one_c_url: "{{ detmir_portal_one_c_url_override | default('http://' + detmir_portal_one_c_host + ':8710', true) }}"
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
     detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
+    detmir_portal_readiness_bundle_dir: "{{ detmir_portal_readiness_bundle_dir_override | default('/var/lib/activitywatch/health/readiness-bundle', true) }}"
 
   tasks:
     - name: Check local detmir-portal binary
@@ -55,6 +56,7 @@
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/detmir-portal/evidence
+          DETMIR_PORTAL_READINESS_BUNDLE_DIR={{ detmir_portal_readiness_bundle_dir }}
           DETMIR_PORTAL_EVIDENCE_LIMIT=30
           DETMIR_PORTAL_EVIDENCE_MAX_BYTES=8388608
 
@@ -235,6 +237,7 @@
           DETMIR_PORTAL_STATE_DIR=/var/lib/activitywatch/dlp-evidence
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/activitywatch/dlp-evidence
+          DETMIR_PORTAL_READINESS_BUNDLE_DIR=/var/lib/activitywatch/health/readiness-bundle
           DETMIR_PORTAL_EVIDENCE_LIMIT=30
           DETMIR_PORTAL_EVIDENCE_MAX_BYTES=8388608
           DETMIR_PORTAL_EVIDENCE_UPLOAD_TOKEN={{ detmir_evidence_upload_token_slurp.content | b64decode | trim }}

ansible/templates/proxmox-web-gateway.conf.j2

@@ -268,6 +268,13 @@ server {
         proxy_redirect off;
     }
 
+    location ^~ /portal/api/readiness {
+        proxy_set_header Authorization "";
+        proxy_set_header X-Remote-User $remote_user;
+        proxy_pass http://192.0.2.13:8721/api/readiness;
+        proxy_redirect off;
+    }
+
     location /portal/ {
         proxy_set_header Authorization "";
         proxy_set_header X-Remote-User $remote_user;