Release/3.15.3

aleph.env.tmpl

@@ -71,6 +71,11 @@ ALEPH_OAUTH_SECRET=
 
 # To use an external ElasticSearch service:
 # ALEPH_ELASTICSEARCH_URI=
+# enable mtls for elasticsearch:
+# ELASTICSEARCH_TLS_CA_CERTS=/certs/ca.crt
+# ELASTICSEARCH_TLS_CLIENT_CERT=/certs/client.crt
+# ELASTICSEARCH_TLS_CLIENT_KEY=/certs/client.key
+# ELASTICSEARCH_TLS_VERIFY_CERTS=1
 
 # 'scroll' parameter used on ES scan() calls on xref operations
 # (how long a consistent view of the index should be maintained for scrolled search)

aleph/core.py

@@ -1,23 +1,25 @@
 import logging
-from urllib.parse import urljoin, urlencode
-from werkzeug.local import LocalProxy
-from werkzeug.middleware.profiler import ProfilerMiddleware
+from urllib.parse import urlencode, urljoin
+
+from banal import clean_dict
+from elasticsearch import Elasticsearch, TransportError
 from flask import Flask, request
 from flask import url_for as flask_url_for
-from flask_sqlalchemy import SQLAlchemy
-from flask_migrate import Migrate
-from flask_mail import Mail
-from flask_cors import CORS
 from flask_babel import Babel
+from flask_cors import CORS
+from flask_mail import Mail
+from flask_migrate import Migrate
+from flask_sqlalchemy import SQLAlchemy
 from flask_talisman import Talisman
 from followthemoney import set_model_locale
-from elasticsearch import Elasticsearch, TransportError
-from servicelayer.cache import get_redis
+from servicelayer import settings as sls
 from servicelayer.archive import init_archive
+from servicelayer.cache import get_redis
 from servicelayer.extensions import get_extensions
-from servicelayer.util import service_retries, backoff
-from servicelayer.logs import configure_logging, LOG_FORMAT_JSON
-from servicelayer import settings as sls
+from servicelayer.logs import LOG_FORMAT_JSON, configure_logging
+from servicelayer.util import backoff, service_retries
+from werkzeug.local import LocalProxy
+from werkzeug.middleware.profiler import ProfilerMiddleware
 
 from aleph import __version__ as aleph_version
 from aleph.settings import SETTINGS
@@ -137,17 +139,28 @@ def configure_alembic(config):
 def get_es():
     url = SETTINGS.ELASTICSEARCH_URL
     timeout = SETTINGS.ELASTICSEARCH_TIMEOUT
+    con_opts = clean_dict(
+        {
+            "ca_certs": SETTINGS.ELASTICSEARCH_TLS_CA_CERTS,
+            "verify_certs": SETTINGS.ELASTICSEARCH_TLS_VERIFY_CERTS,
+            "client_cert": SETTINGS.ELASTICSEARCH_TLS_CLIENT_CERT,
+            "client_key": SETTINGS.ELASTICSEARCH_TLS_CLIENT_KEY,
+        }
+    )
     for attempt in service_retries():
         try:
             if not hasattr(SETTINGS, "_es_instance"):
                 # When logging structured logs, use a custom transport to log
                 # all es queries and their response time
                 if sls.LOG_FORMAT == LOG_FORMAT_JSON:
                     es = Elasticsearch(
-                        url, transport_class=LoggingTransport, timeout=timeout
+                        url,
+                        transport_class=LoggingTransport,
+                        timeout=timeout,
+                        **con_opts,
                     )
                 else:
-                    es = Elasticsearch(url, timeout=timeout)
+                    es = Elasticsearch(url, timeout=timeout, **con_opts)
                 es.info()
                 SETTINGS._es_instance = es
             return SETTINGS._es_instance

aleph/settings.py

@@ -183,6 +183,12 @@ def __init__(self) -> None:
         self.ELASTICSEARCH_URL = env.get(
             "ALEPH_ELASTICSEARCH_URI", "http://localhost:9200"
         )
+        self.ELASTICSEARCH_TLS_CA_CERTS = env.get("ELASTICSEARCH_TLS_CA_CERTS")
+        self.ELASTICSEARCH_TLS_VERIFY_CERTS = env.to_bool(
+            "ELASTICSEARCH_TLS_VERIFY_CERTS"
+        )
+        self.ELASTICSEARCH_TLS_CLIENT_CERT = env.get("ELASTICSEARCH_TLS_CLIENT_CERT")
+        self.ELASTICSEARCH_TLS_CLIENT_KEY = env.get("ELASTICSEARCH_TLS_CLIENT_KEY")
         self.ELASTICSEARCH_TIMEOUT = env.to_int("ELASTICSEARCH_TIMEOUT", 60)
         self.XREF_SCROLL = env.get("ALEPH_XREF_SCROLL", "5m")
         self.XREF_SCROLL_SIZE = env.get("ALEPH_XREF_SCROLL_SIZE", "1000")

docs/src/options.json

@@ -13,7 +13,8 @@
     "defaultLanguageName": "English",
     "languages": {
       "es": "Español",
-      "pt": "Português"
+      "pt": "Português",
+      "fr": "Français"
     }
   },
   "header": {

docs/src/pages/developers/installation.mdx

@@ -381,6 +381,27 @@ Aleph is able to report issues to a [Sentry](https://www.sentry.io) instance. To
 
 You can set the [environment](https://docs.sentry.io/platforms/python/configuration/environments/) via the `SENTRY_ENVIRONMENT` setting.
 
+### Mutual TLS
+
+To provide an extra layer of security, it is possible to configure the services (postgres, redis and elasticsearch) to speak mutual TLS (mTLS) with each other. Managing client certificates for this matter requires some encryption knowledge and experience and is a seperate topic that can not be covered within this documentation.
+
+Once you have configured and deployed the services with TLS, the connection settings in the environment vars need to be adjusted:
+
+```
+# redis
+REDIS_URL="rediss://:<password>@redis:6379/0?ssl_certfile=/certs/redis.crt&ssl_keyfile=/certs/redis.key&ssl_ca_certs=/certs/ca.crt"
+
+# postgres
+ALEPH_DATABASE_URI="postgresql://<user>:<password>@postgres/aleph?sslmode=verify-full&sslrootcert=/certs/ca.crt&sslcert=/certs/postgres.crt&sslkey=/certs/postgres.key"
+
+# elasticsearch
+ALEPH_ELASTICSEARCH_URI=https://<user>:<password>@elasticsearch:9200
+ELASTICSEARCH_TLS_CA_CERTS=/certs/ca.crt
+ELASTICSEARCH_TLS_CLIENT_CERT=/certs/elastic.crt
+ELASTICSEARCH_TLS_CLIENT_KEY=/certs/elastic.key
+ELASTICSEARCH_TLS_VERIFY_CERTS=1
+```
+
 ## Troubleshooting
 
 Troubleshooting help can be found in the [Technical FAQ](/developers/technical-faq).

helm/charts/aleph/Chart.yaml

@@ -4,4 +4,3 @@ description: Helm chart for Aleph
 type: application
 version: 3.15.3
 appVersion: 3.15.3
-