Configure signing key for OpenID Connect

diff --git a/cookbooks/web/recipes/rails.rb b/cookbooks/web/recipes/rails.rb
index 921ac3c6bf4ec15a8b8812c997aee96e1138d573..c5130a91a37571696659a396ec9ea14bc9415561 100644 (file)
--- a/cookbooks/web/recipes/rails.rb
+++ b/cookbooks/web/recipes/rails.rb
@@ -148,6 +148,7 @@ rails_port "www.openstreetmap.org" do
   signup_ip_max_burst 48
   signup_email_per_day 1
   signup_email_max_burst 2
   signup_ip_max_burst 48
   signup_email_per_day 1
   signup_email_max_burst 2

+  doorkeeper_signing_key web_passwords["openid_connect_key"].join("\n")

   # Requests to modify the imagery blacklist should come from the DWG only
   imagery_blacklist [
     # Current Google imagery URLs have google or googleapis in the domain
   # Requests to modify the imagery blacklist should come from the DWG only
   imagery_blacklist [
     # Current Google imagery URLs have google or googleapis in the domain

diff --git a/cookbooks/web/resources/rails_port.rb b/cookbooks/web/resources/rails_port.rb
index cf1f1a6b91dd06c770d20eff98c7da773325cb7d..60c9cbbec122c049d33d94783d0289d68f56e789 100644 (file)
--- a/cookbooks/web/resources/rails_port.rb
+++ b/cookbooks/web/resources/rails_port.rb
@@ -91,6 +91,7 @@ property :signup_ip_per_day, Integer
 property :signup_ip_max_burst, Integer
 property :signup_email_per_day, Integer
 property :signup_email_max_burst, Integer
 property :signup_ip_max_burst, Integer
 property :signup_email_per_day, Integer
 property :signup_email_max_burst, Integer

+property :doorkeeper_signing_key, String

 
 action :create do
   package %W[
 
 action :create do
   package %W[


@@ -346,7 +347,8 @@ action :create do
     "signup_ip_per_day",
     "signup_ip_max_burst",
     "signup_email_per_day",
     "signup_ip_per_day",
     "signup_ip_max_burst",
     "signup_email_per_day",

-    "signup_email_max_burst"
+    "signup_email_max_burst",
+    "doorkeeper_signing_key"

   ).compact.merge(
     "server_protocol" => "https",
     "server_url" => new_resource.site,
   ).compact.merge(
     "server_protocol" => "https",
     "server_url" => new_resource.site,