Add OneLab Helm chart, Argo CD Application, and GitOps values for k3s

Made-with: Cursor
2026-03-20 10:15:15 +01:00
commit 52847814e0
102 changed files with 4476 additions and 0 deletions
--- a/app/backup.sh
+++ b/app/backup.sh
@@ -0,0 +1,3 @@
+
+#!/bin/bash
+ANSIBLE_LOG_PATH=./logs/ansible/$(date +%F)-ansible.log ansible-playbook ./installation/1.27.0/app/playbooks/backup.yml
--- a/app/configurations.yml
+++ b/app/configurations.yml
@@ -0,0 +1,154 @@
+---
+onelab:
+  domain: https://localhost
+  logs:
+ #  path: "/path/to/onelab/logs"
+    level: info
+  assets:
+ #  path: "/path/to/onelab/data"
+    purge: 1d
+  shared:
+    inputs:
+      path: "./data/shared/inputs"
+      archive_path: "./data/shared/archived"
+  security:
+    cors: '*'
+    auth:
+      token:
+        expiration: 5m
+        key: TokenAuthPlaceholder
+      password:
+        expiration: 90d
+        min_length: 8
+        prevent_reuse: 5
+      allow_list: []
+      block_list: []
+      authentifier: "email"
+    ratelimit:
+      ip:
+        max: 1000
+        duration: 1d
+      auth:
+        max: 5
+        duration: 5m
+        delay_after: 2
+        delay_ms: 1000
+    devices:
+        cors: '*'
+    monitoring:
+        token: TokenMonitoringPlaceholder
+  params:
+    session:
+      idle: 45m
+      remember_me: true
+    lab:
+      creation_policy: many
+    # compliance:
+    #   require_electronic_signature: true
+    #   execution_operator_restriction_policy: 'reviewed'
+    #   execution_admin_expert_restriction_policy: 'reviewed'
+    #   prevent_csv_import: true
+    #   prevent_manual_metadata_edit: true
+    # device_restart: true
+    signup: false
+    # Google Analytics
+    # ga: XXXXX   
+    # Intercom Andrew Alliance
+    intercom:
+      appid: zxvgsagz
+      secret: QUw2jEV8utIpe9DeYjOqBjhBY9VxjXddKUCISUNu
+    # Recaptcha Andrew Alliance
+    # recaptcha:
+    #  client: XXXXXXXXXXXX
+    #  secret: XXXXXXXXXXXX
+    #links:
+    #  terms: https://www.andrewalliance.com/onelab-service-agreement.pdf
+    #  privacy: https://www.andrewalliance.com/onelab-privacy-policy.pdf
+    #  cookies: https://www.andrewalliance.com/onelab-cookie-policy.pdf
+  mailer:
+    #
+    # SMTP
+    # smtp:
+    #   host: XXX    (optional)
+    #   port: XXX    (optional)
+    #   auth:    (optional)
+    #     user: XXX
+    #     pass: XXX
+    #     type: custom | login | oauth2    (optional)
+    #     method: XXX    (optional)
+    #   secure: true | false    (optional)
+    #
+    # Amazon SES
+    # ses:
+    #   accessKeyId: XXXX
+    #   secretAccessKey: XXXX
+    #
+    # MailGun
+    # mailgun:
+    #   auth:
+    #     api: XXXX
+    #     domain: XXXX
+    #
+    # Debug
+    # debug:
+    #   type: file | mail
+    #   path: XXXX
+    #   redirect: XXX@andrewalliance.com
+    #
+    noreply: no-reply@andrewalliance.com
+    queue:
+      scheduling: 15
+      maxsize: 50
+    error:
+      maxtries: 3
+      timeout: 60
+  ldap:
+    enabled: false
+    # timeout: 10
+    # encryption: plain | tls | start_tls
+    # policy: all | changes_only
+    # verify_certificates: true | false
+    # tls:
+    #  ca: file_path
+    #  cert: file_path
+    #  key: file_path
+    #  ciphers: string
+    #  ssl_version: string
+  services:
+    db:
+      # host: db
+      # Note: port 5432 is the standard port for postgres however a custom port can be used if 5432 is occupied already
+      # port: 5432
+      database: postgres
+      username: postgres
+      password: DBPasswordPlaceholder
+      schema: onelab
+      # replicas: 1
+    # redis:
+    #   host: redis
+    #   port: '6379'
+    #   replicas: 1
+    rabbit:
+      # url: rabbitmq
+      # port: 5671
+      token: TokenRabbitPlaceholder
+      # replicas: 1
+    api:
+      replicas: 2
+    # apidevice:
+    #   replicas: 1
+    # apirabbit:
+    #   replicas: 1
+    # devices:
+    #   replicas: 1
+    # experiments:
+    #   replicas: 1
+    # images:
+    #   replicas: 1
+    # manual:
+    #   replicas: 1
+    # website:
+    #   ssr: false
+    # ws:
+    #   replicas: 1
+
--- a/app/docker-compose.yml
+++ b/app/docker-compose.yml
@@ -0,0 +1,319 @@
+version: "3.3"
+services:
+  # If the database isn't accessed other than by services present in this file, remove port instruction.
+  # It exposes the database to the host system and if the server isn't secure, it exposes the database to attacks.
+  # That doesn't exclude the need to secure the servers on which the containers are run.
+  db:
+    image: hub.andrewalliance.com/releases/postgres:17.8
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD={{ onelab.services.db.password }}
+      - POSTGRES_DB=postgres
+{% if onelab.services.db.port is defined %}
+    ports:
+      - "{{ onelab.services.db.port }}:5432"
+{% endif %}
+    deploy:
+      replicas: {{ onelab.services.db.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == manager
+  redis:
+    image: hub.andrewalliance.com/releases/redis:7.4.7-alpine
+    deploy:
+      replicas: {{ onelab.services.db.redis.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == manager
+  rabbitmq:
+    image: hub.andrewalliance.com/releases/rabbitmq:3.13.7
+    hostname: "onelab"
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq/mnesia
+    configs:
+      - source: enable_plugins
+        target: /etc/rabbitmq/enabled_plugins
+      - source: rabbit.conf
+        target: /etc/rabbitmq/rabbitmq.conf
+      - source: advanced.conf
+        target: /etc/rabbitmq/advanced.conf
+      - source: definitions.json
+        target: /opt/definitions.json
+      - source: rabbit.crt
+        target: /etc/rabbitmq/ssl/rabbit.crt
+      - source: rabbit.key
+        target: /etc/rabbitmq/ssl/rabbit.key
+      - source: rabbit.fullchain.pem
+        target: /etc/rabbitmq/ssl/rabbit.fullchain.pem
+    ports:
+      - "5671:5671"
+    deploy:
+      replicas: {{ onelab.services.rabbit.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == manager
+  supervisor:
+    image: hub.andrewalliance.com/releases/onelab-supervisor-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  file-worker:
+    image: hub.andrewalliance.com/releases/onelab-file-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+      - {{ onelab.shared.inputs.path|default('./data/shared/inputs') }}:/shared-inputs
+      - {{ onelab.shared.inputs.archived_path|default('./data/shared/archived') }}:/shared-archived
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+  api:
+    image: hub.andrewalliance.com/releases/onelab-api:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.api.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  api-device:
+    image: hub.andrewalliance.com/releases/onelab-api-device:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.apidevice.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  api-rabbit:
+    image: hub.andrewalliance.com/releases/onelab-api-rabbit:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.apirabbit.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  devices-worker:
+    image: hub.andrewalliance.com/releases/onelab-devices-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.devices.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  experiments-worker:
+    image: hub.andrewalliance.com/releases/onelab-experiments-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.experiments.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  images-worker:
+    image: hub.andrewalliance.com/releases/onelab-images-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.images.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+
+{% if (onelab.ldap|default(false)) != false %}
+  ldap-worker:
+    image: hub.andrewalliance.com/releases/onelab-ldap-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+{% if onelab.ldap.tls.ca is defined %}
+      - source: ldap-ca.crt
+        target: /ldap/ca.crt
+{% endif %}
+{% if onelab.ldap.tls.key is defined %}
+      - source: ldap-private.key
+        target: /ldap/private.key
+{% endif %}
+{% if onelab.ldap.tls.cert is defined %}
+      - source: ldap-cert.crt
+        target: /ldap/cert.crt
+{% endif %}
+    deploy:
+      replicas: {{ onelab.services.ldap.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+{% endif %}
+{% if (onelab.mailer.smtp|default(false)) != false or (onelab.mailer.ses|default(false)) != false %}
+  mailer-worker:
+    image: hub.andrewalliance.com/releases/onelab-mailer-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.mailer.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+{% endif %}
+  manual-worker:
+    image: hub.andrewalliance.com/releases/onelab-manual-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.manual.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  websocket-worker:
+    image: hub.andrewalliance.com/releases/onelab-websocket-worker:1.27.0
+    volumes:
+      - {{ onelab.logs.path|default('./logs') }}:/logs
+    configs:
+      - source: configurations.yml
+        target: /conf/configurations.yml
+    deploy:
+      replicas: {{ onelab.services.ws.replicas|default('1') }}
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  static:
+    image: hub.andrewalliance.com/releases/onelab-static:1.27.0
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  main:
+    image: hub.andrewalliance.com/releases/onelab-main:1.27.0
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  designer:
+    image: hub.andrewalliance.com/releases/onelab-designer:1.27.0
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  runner:
+    image: hub.andrewalliance.com/releases/onelab-runner:1.27.0
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  website:
+    image: hub.andrewalliance.com/releases/onelab-website:1.27.0
+{% if (onelab.services.website.ssr|default(true)) != true %}
+    environment:
+      - RENDERING_MODE=no-ssr
+{% endif %}
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+  revproxy:
+    image: hub.andrewalliance.com/releases/nginx:1.29.5-alpine
+    ports:
+      - "8080:80"
+    volumes:
+      - {{ onelab.assets.path|default('./data') }}:/data
+    configs:
+      - source: nginx.conf
+        target: /etc/nginx/nginx.conf
+      - source: error-404.html
+        target: /data/error-404.html
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == {{ deploy_on|default('manager') }}
+volumes:
+  pgdata:
+    driver: local
+  rabbitmq_data:
+    driver: local
+configs:
+  configurations.yml:
+    file: ./configurations.yml
+  nginx.conf:
+    file: ./nginx/onelab.conf
+  error-404.html:
+    file: ./proxy/error-404.html
+  rabbit.crt:
+    file: ./rabbit/ssl/rabbit.crt
+  rabbit.key:
+    file: ./rabbit/ssl/rabbit.key
+  rabbit.fullchain.pem:
+    file: ./rabbit/ssl/rabbit.fullchain.pem
+  enable_plugins:
+    file: ./rabbit/enable_plugins
+  rabbit.conf:
+    file: ./rabbit/rabbit.conf
+  advanced.conf:
+    file: ./rabbit/advanced.conf
+  definitions.json:
+    file: ./rabbit/definitions.json
+{% if onelab.ldap.tls.ca is defined %}
+  ldap-ca.crt:
+    file: {{ onelab.ldap.tls.ca }}
+{% endif %}
+{% if onelab.ldap.tls.key is defined %}
+  ldap-private.key:
+    file: {{ onelab.ldap.tls.key }}
+{% endif %}
+{% if onelab.ldap.tls.cert is defined %}
+  ldap-cert.crt:
+    file: {{ onelab.ldap.tls.cert }}
+{% endif %}
--- a/app/nginx/onelab.conf
+++ b/app/nginx/onelab.conf
@@ -0,0 +1,337 @@
+
+worker_processes 4;
+
+events { worker_connections 1024; }
+
+http {
+  include /etc/nginx/mime.types;
+  
+  client_max_body_size 2m;
+
+  # don't send the nginx version number in error pages and Server header
+  server_tokens off;
+
+  sendfile on;
+
+  upstream website {
+    server website:4000;
+  }
+
+  upstream main {
+    server main:80;
+  }
+
+  upstream api {
+    server api:3000;
+  }
+
+  upstream api-device {
+    server api-device:3000;
+  }
+
+  upstream api-rabbit {
+    server api-rabbit:3000;
+  }
+
+  upstream designer {
+    server designer:80;
+  }
+
+  upstream runner {
+    server runner:80;
+  }
+
+  upstream static {
+    server static:80;
+  }
+
+  upstream websocket-worker {
+    server websocket-worker:3030;
+  }
+
+  # Restore the real client IP from the upstream reverse proxy
+  # Trust all RFC 1918 private ranges (covers any Docker network config)
+  set_real_ip_from  10.0.0.0/8;
+  set_real_ip_from  172.16.0.0/12;
+  set_real_ip_from  192.168.0.0/16;
+  real_ip_header    X-Real-IP;
+
+  limit_req_zone $binary_remote_addr zone=auth:10m rate=1r/s;
+  limit_req_zone $binary_remote_addr zone=website:10m rate=5r/s;
+  limit_req_zone $binary_remote_addr zone=global:10m rate=10r/s;
+
+  # redirect all http traffic to https
+  server {
+    listen 80 default_server;
+{% if (onelab.services.revproxy.ipv6|default(true)) != false %}
+    listen [::]:80 default_server;
+{% endif %}
+    server_name localhost;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_disable "MSIE [1-6]\.";
+
+    root /data/;
+
+    location ^~ /lab/ {
+      rewrite ^/lab/(.*?) /app/lab/$1 last;
+    }
+
+    location ^~ /assets/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        try_files $uri $uri/ /error-404.html =404;
+      }
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      try_files $uri $uri/ /error-404.html =404;
+    }
+
+    location ^~ /static/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://static;
+        proxy_redirect  off;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://static;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /sitemap.xml {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /robots.txt {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/ {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/auth/ {
+      # apply rate limiting
+      limit_req zone=auth burst=5 nodelay;
+  
+      proxy_pass http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    location ^~ /api/v1/firmwares {
+      limit_req zone=global burst=10 nodelay;
+    
+      client_max_body_size 600M;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/rmq/ {
+      proxy_pass  http://api-rabbit;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /device-api/ {
+      limit_req zone=global burst=10 nodelay;
+      client_max_body_size 600m;
+
+      proxy_pass  http://api-device;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/designer/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://designer;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://designer;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/runner/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://runner;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://runner;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /ws/ {
+      proxy_pass  http://websocket-worker;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+      
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+    
+    location ^~ /app/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://main;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://main;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    # Static assets for website (including /media/ subdirectory)
+     location ~* ^/.+\.(?:css|js|woff|woff2|ttf|eot|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {   
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://website;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Website SSR routes (rate limited)
+    location ~ ^/(library(/[^/]+)?|login(/(reset|change))?|signup)?$ {
+      limit_req zone=website burst=10 nodelay;
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://website;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Catch-all for junk requests
+    location /  {
+      try_files $uri $uri/ /error-404.html =404;
+    }
+  }
+}
--- a/app/playbooks/backup.yml
+++ b/app/playbooks/backup.yml
@@ -0,0 +1,11 @@
+---
+- name: Backing up OneLab (1.27.0)
+  hosts: localhost
+  gather_facts: yes
+  vars:
+    onelab_path: '../../../..'
+  
+  # Call from ./installation/latest/app/playbooks/backup.yml
+
+  tasks:
+    - include_tasks: ./tasks/backup-task.yml
--- a/app/playbooks/deploy.yml
+++ b/app/playbooks/deploy.yml
@@ -0,0 +1,18 @@
+---
+- name: Deploying OneLab (1.27.0)
+  hosts: localhost
+  vars:
+    onelab_path: '../../../../../onelab'
+  
+  # Call from ./installation/latest/app/playbooks/deploy.yml
+
+  tasks:
+    # Load configuration
+    - include_vars:
+        file: "{{ onelab_path }}/configurations.yml"
+
+    # Start proxy
+    - include_tasks: ./tasks/start-proxy.yml
+
+    # Start OneLab
+    - include_tasks: ./tasks/start-onelab.yml
--- a/app/playbooks/install-swarm.yml
+++ b/app/playbooks/install-swarm.yml
@@ -0,0 +1,25 @@
+---
+- name: Generate the command to join a node as swarm worker
+  hosts: localhost
+  gather_facts: yes
+
+  tasks:
+    - name: Determine Docker swarm status
+      shell: >
+        docker info | egrep 'Swarm: '
+      register: swarm_status
+      become: true
+
+    - name: Prepare the command to join a node as worker in this swarm
+      command: docker swarm join-token worker -q
+      become: true
+      when: "' Swarm: active' in swarm_status.stdout_lines"
+      register: worker_join_token
+
+    - set_fact:
+        run_on_worker: "sudo docker swarm join --token {{ worker_join_token.stdout }} {{ ansible_eth0.ipv4.address }}:2377"
+    
+    - debug: var=run_on_worker
+
+  
+
--- a/app/playbooks/install.yml
+++ b/app/playbooks/install.yml
@@ -0,0 +1,13 @@
+---
+- name: Installing OneLab (1.27.0)
+  hosts: localhost
+  gather_facts: yes
+  vars:
+    main_path: '../../..'
+    onelab_path: '../../../onelab'
+    installer_path: '../../../onelab-enterprise-installer-1.27.0'
+    
+  # Call from ./onelab-enterprise-installer-1.27.0/app/playbooks/install.yml
+
+  tasks:
+  - include_tasks: ./tasks/install-task.yml
--- a/app/playbooks/reconfigure.yml
+++ b/app/playbooks/reconfigure.yml
@@ -0,0 +1,15 @@
+---
+- name: Reconfiguring OneLab (1.27.0)
+  hosts: localhost
+  vars:
+    main_path: '../../../../..'
+    onelab_path: '../../../../../onelab'
+    
+  # Call from ./installation/latest/app/playbooks/reconfigure.yml
+
+  tasks:
+    # Load configuration
+    - include_vars: 
+        file: "{{ onelab_path }}/configurations.yml"
+
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/reconfigure-task.yml"
--- a/app/playbooks/stop.yml
+++ b/app/playbooks/stop.yml
@@ -0,0 +1,12 @@
+---
+- name: Stopping OneLab (1.27.0)
+  hosts: localhost
+  vars:
+    onelab_path: '../../../../../onelab'
+
+  # Call from ./installation/latest/app/playbooks/stop.yml
+
+  tasks:
+    - include_tasks: ./tasks/stop-onelab.yml
+
+    - include_tasks: ./tasks/stop-proxy.yml
--- a/app/playbooks/tasks/backup-task.yml
+++ b/app/playbooks/tasks/backup-task.yml
@@ -0,0 +1,37 @@
+---
+- name: Checking if OneLab is running
+  shell: docker stack ls | grep 'onelab' | grep -v 'onelab_proxy' | wc -l
+  become: true
+  register: backup_stack_count
+
+# Start DB if OneLab is not running
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/start-db-only.yml"
+  when: backup_stack_count.stdout == "0"
+
+- name:  Creating backup directory
+  file:
+    path: "{{ onelab_path }}/backups/{{ ansible_date_time.iso8601_basic_short }}_1.27.0"
+    state: directory
+  register: backup_path
+
+- name: Backing up files
+  shell:
+    tar --exclude='temp' -czvf {{ backup_path.path }}/onelab.tar.gz -C {{ onelab_path }} ./data ./installation ./nginx ./proxy ./rabbit ./ssl ./backup.sh ./configurations.yml ./docker-compose.yml ./reconfigure.sh ./start.sh ./stop.sh ./update.sh     
+  become: yes
+
+- name: Backing up database
+  shell:
+    docker exec -i $(docker ps --filter "name=onelab_db|onelab-db" -q) pg_dump -Upostgres -Fc > {{ backup_path.path }}/db.tar.gz
+  become: yes
+
+- name: Creating restore script files
+  copy:
+    src: "{{ onelab_path }}/installation/latest/resources/restore/{{ item }}"
+    dest: "{{ backup_path.path }}"
+  with_items:
+    - 'restore.yml'
+    - 'restore.sh'
+
+# Stop DB if OneLab was not running
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/stop-db-only.yml"
+  when: backup_stack_count.stdout == "0"
--- a/app/playbooks/tasks/check-offline-resources.yml
+++ b/app/playbooks/tasks/check-offline-resources.yml
@@ -0,0 +1,7 @@
+---
+# Check if Docker images are existing locally
+- name: Checking local Docker images bundle
+  stat:
+    path: "{{ main_path }}/onelab-images-1.27.0.tar.gz"
+    get_checksum: no
+  register: docker_images_tar
--- a/app/playbooks/tasks/check-requirements.yml
+++ b/app/playbooks/tasks/check-requirements.yml
@@ -0,0 +1,71 @@
+---
+- name: Checking internet connection
+  uri:
+    url: "https://hub.andrewalliance.com"
+  register: pingresult
+  until:
+    - pingresult.status == 200
+  retries: 3 # 3 * 5 seconds = 15s
+  delay: 5 # Every 5 seconds
+  when: (docker_images_tar is undefined) or (not docker_images_tar.stat.exists)
+
+- name: Getting current logged-in user
+  shell: whoami
+  register: login_user
+- debug: var=login_user.stdout
+
+# User running the process may have to enter their sudo password at this step
+
+- name: Checking if the logged-in user has sudo privileges
+  shell: sudo whoami
+  register: sudo_check
+  failed_when: sudo_check.stdout != "root"
+
+- name: Checking Ansible
+  debug: 
+    msg: "{{ item }}"
+  with_items:
+  - "{{ ansible_distribution }}"
+  - "{{ ansible_distribution_version }}"
+  - "{{ ansible_distribution_major_version }}"
+
+- name: Checking Docker version
+  shell: docker -v | cut -d ' ' -f 3 | cut -d ',' -f 1
+  become: true
+  register: docker_version
+- debug: var=docker_version.stdout
+
+# workaround: add a dumb failed condition to avoid any failure here as the service is maybe not installed/existing
+- name: Check if "docker compose" is available
+  shell: docker compose version
+  become: true
+  register: docker_compose_check
+  failed_when: "'FAILED' in docker_compose_check.stderr"
+
+- name: Set the compose command to "docker compose"
+  set_fact:
+    compose_command: "docker compose"
+  when: docker_compose_check.rc == 0
+
+- name: Fallback to "docker-compose" if "docker compose" is not available
+  set_fact:
+    compose_command: "docker-compose"
+  when: docker_compose_check.rc != 0
+
+- name: Checking Docker Compose version
+  shell: "{{ compose_command }} version"
+  become: true
+  register: compose_version_output
+- debug: var=compose_version_output.stdout
+
+- name: Checking tar pacakge
+  shell: tar --usage
+  become: true
+
+- name: Checking unzip pacakge
+  shell: unzip
+  become: true
+
+- name: Checking openssl package
+  shell: openssl
+  become: true
--- a/app/playbooks/tasks/check-ssl-files.yml
+++ b/app/playbooks/tasks/check-ssl-files.yml
@@ -0,0 +1,49 @@
+---
+# Check SSL files
+- name: Getting the list of Docker secrets
+  shell: docker secret ls | tail -n +2 | awk '{print $2}'
+  register: docker_secrets
+  become: true
+
+- name: Checking if dhparam.pem file exists in /onelab/ssl
+  stat:
+    path: "{{ onelab_path }}/ssl/dhparam.pem"
+  register: dhparam
+  failed_when: not dhparam.stat.exists
+
+- name: Checking if server.pem file exists in /onelab/ssl
+  stat:
+    path: "{{ onelab_path }}/ssl/server.pem"
+  register: serverpem
+  failed_when: not serverpem.stat.exists
+
+- name: Checking if server.key file exists in /onelab/ssl
+  stat:
+    path: "{{ onelab_path }}/ssl/server.key"
+  register: serverkey
+  failed_when: not serverkey.stat.exists
+
+- name: Checking if chain.pem file exists in /onelab/ssl
+  stat:
+    path: "{{ onelab_path }}/ssl/chain.pem"
+  register: chain
+  failed_when: not chain.stat.exists
+
+- name: Checking if certificate and key are matching (part 1/2)
+  shell: >
+    openssl rsa -noout -modulus -in {{ onelab_path }}/ssl/server.key | openssl md5
+  register: serverkey_modulus
+  become: true
+  when:
+    - "'ssl_passphrase' not in docker_secrets.stdout_lines"
+    - (onelab.deployment.skip_ssl is undefined) or (onelab.deployment.skip_ssl == false)
+
+- name: Checking if certificate and key are matching (part 2/2)
+  shell: >
+    openssl x509 -noout -modulus -in {{ onelab_path }}/ssl/server.pem | openssl md5
+  register: serverpem_modulus
+  failed_when: serverpem_modulus.stdout != serverkey_modulus.stdout
+  become: true
+  when:
+    - "'ssl_passphrase' not in docker_secrets.stdout_lines"
+    - (onelab.deployment.skip_ssl is undefined) or (onelab.deployment.skip_ssl == false)
--- a/app/playbooks/tasks/init-docker.yml
+++ b/app/playbooks/tasks/init-docker.yml
@@ -0,0 +1,21 @@
+---
+#
+# Configure Docker
+#
+
+- name: Ensuring Docker status
+  service:
+    name: "docker"
+    state: started
+  
+- name: Determining Docker swarm status
+  shell: >
+    docker info | egrep 'Swarm: '
+  register: swarm_status
+  become: true
+
+- name: Configuring Docker Swarm
+  shell: >
+    docker swarm init --advertise-addr "{{ ansible_default_ipv4.address }}"
+  when: "' Swarm: inactive' in swarm_status.stdout_lines"
+  become: true
--- a/app/playbooks/tasks/init-onelab.yml
+++ b/app/playbooks/tasks/init-onelab.yml
@@ -0,0 +1,119 @@
+---
+#
+# Start Installation
+#
+
+# Folders creation
+- name: Creating OneLab directory
+  file:
+    path: "{{ onelab_path }}"
+    state: directory
+    
+- name: Creating OneLab directory structure
+  file:
+    path: "{{ onelab_path }}/{{ item }}"
+    state: directory
+  with_items:
+    - 'backups'
+    - 'data'
+    - 'data/shared'
+    - 'data/shared/inputs'
+    - 'data/shared/archived'
+    - 'logs'
+    - 'installation'
+    - 'ssl'
+    - 'rabbit'
+
+- name: Creating directory for rabbit SSL certificates
+  file:
+    path: "{{ onelab_path }}/rabbit/ssl"
+    state: directory
+
+- name: Creating directory for Ansible logs
+  file:
+    path: "{{ onelab_path }}/logs/ansible"
+    state: directory
+
+# Copy version
+- name: Cleaning latest installation
+  ansible.builtin.file:
+    path: "{{ onelab_path }}/installation/latest"
+    state: absent
+
+- name: Copying current installation bundle
+  ansible.builtin.copy:
+    src: "{{ installer_path }}/"
+    dest: "{{ onelab_path }}/installation/{{ item }}"
+    directory_mode: no
+    remote_src: yes
+  with_items:
+    - 'latest'
+    - '1.27.0'
+
+# Copy files
+- name: Copying applicative files
+  copy:
+    src: "{{ onelab_path }}/installation/latest/app/{{ item }}"
+    dest: "{{ onelab_path }}/"
+    directory_mode: yes
+    remote_src: yes
+  with_items:
+    - 'nginx'
+    - 'proxy'
+    - 'rabbit'
+
+- name: Copying routine scripts
+  copy:
+    src: "{{ onelab_path }}/installation/latest/app/{{ item }}.sh"
+    dest: "{{ onelab_path }}/"
+    directory_mode: yes
+    remote_src: yes
+  with_items:
+    - 'start'
+    - 'stop'
+    - 'reconfigure'
+    - 'backup'
+    - 'update'
+
+
+- name: Initializing custom config proxy files
+  file:
+    path: "{{ onelab_path }}/proxy/{{ item }}"
+    state: touch
+  with_items:
+    - 'custom-http.conf'
+    - 'custom-server.conf'
+  when: not is_update
+
+# Initialize configurations.yml file
+- name: Initializing configurations.yml file
+  copy:
+    src: "{{ onelab_path }}/installation/latest/app/configurations.yml"
+    dest: "{{ onelab_path }}/configurations.yml"
+    remote_src: yes
+  when: not is_update
+
+- name: Initializing unique Password and Tokens
+  ansible.builtin.replace:
+    path: "{{ onelab_path }}/configurations.yml"
+    regexp: '{{ item.placeholder }}'
+    replace: '{{ item.value }}'
+  with_items:
+    - { placeholder: DBPasswordPlaceholder, value: '{{ lookup("password", "/dev/null length=16 chars=ascii_letters,digits") }}' }
+    - { placeholder: TokenAuthPlaceholder, value: '{{ lookup("password", "/dev/null length=32 chars=ascii_letters,digits") }}' }
+    - { placeholder: TokenRabbitPlaceholder, value: '{{ lookup("password", "/dev/null length=32 chars=ascii_letters,digits") }}' }
+    - { placeholder: TokenMonitoringPlaceholder, value: '{{ lookup("password", "/dev/null length=32 chars=ascii_letters,digits") }}' }
+  when: not is_update
+
+- name: Initializing Rabbit SSL certificate
+  shell: |
+    openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout {{ onelab_path }}/rabbit/ssl/rabbit.key -out {{ onelab_path }}/rabbit/ssl/rabbit.crt  -subj "/C=CH/ST=Geneva/L=Geneva/O=Andrew Alliance/OU=OneLab/CN=andrewalliance.com"
+    cat {{ onelab_path }}/rabbit/ssl/rabbit.crt > {{ onelab_path }}/rabbit/ssl/rabbit.fullchain.pem
+  become: true
+  when: not is_update
+
+- name: Initializing DH Param
+  shell: |
+    openssl dhparam -out {{ onelab_path }}/ssl/dhparam.pem 2048
+  become: true
+  when: not is_update
--- a/app/playbooks/tasks/init-service.yml
+++ b/app/playbooks/tasks/init-service.yml
@@ -0,0 +1,33 @@
+---
+#
+# Create onelab.service
+#
+- name: Check ansible-playbook bin
+  shell: whereis ansible-playbook | cut -d ' ' -f 2
+  register: ansiblebin_result
+  become: true
+
+# workaround: add a dumb failed condition to avoid any failure here as the service is maybe not installed/existing
+- name: Check onelab.service
+  shell: |
+    systemctl disable onelab.service
+    rm /etc/systemd/system/onelab.service
+  register: command_result
+  failed_when: "'FAILED' in command_result.stderr"
+  become: true
+
+# playbook_dir will be /home/ubuntu/onelab/test/onelab-enterprise-installer-release-1.13.0/app/playbooks for install.sh
+# but will be /home/ubuntu/onelab/test/onelab/installation/latest/app/playbooks/ for update.sh
+- debug: var=playbook_dir
+
+- name: Creating onelab.service
+  ansible.builtin.template:
+    src: "{{ installer_path }}/resources/services/onelab.service"
+    dest: "/etc/systemd/system/onelab.service"
+  become: true
+
+- name: Configuring onelab.service
+  shell: |
+    systemctl daemon-reload
+    systemctl enable onelab.service
+  become: true
--- a/app/playbooks/tasks/install-task.yml
+++ b/app/playbooks/tasks/install-task.yml
@@ -0,0 +1,81 @@
+---
+#
+# Offline-resources-check
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/check-offline-resources.yml"
+#
+# Pre-check
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/check-requirements.yml"
+#
+# Configure Docker
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/init-docker.yml"
+
+  
+- name: Loading Docker images
+  debug:
+    msg:
+    - "Loading images could take few minutes, please do not interrupt"
+  when: (docker_images_tar is defined) and (docker_images_tar.stat.exists)
+
+- name: Loading OneLab images from the tar file
+  shell:
+    docker load --input {{ main_path }}/onelab-images-1.27.0.tar.gz
+  become: true
+  when: (docker_images_tar is defined) and (docker_images_tar.stat.exists)
+
+
+#
+# Check if we are running a fresh installation or an update on an existing installation
+#
+- name: Checking if OneLab is already installed
+  stat:
+    path: "{{ onelab_path }}/docker-compose.yml"
+  register: onelab_result
+
+#
+# Pre-migration task
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/pre-update.yml"
+  when: onelab_result.stat.exists
+
+#
+# Install OneLab
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/init-onelab.yml"
+  vars:
+    is_update: "{{ onelab_result.stat.exists|bool }}"
+
+#
+# Init Service
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/init-service.yml"
+
+# Checking Docker volumes
+
+- name: Checking if RabbitMQ exists
+  shell: docker volume ls
+  become: true
+  register: list_volumes
+
+
+# Cleaning cache
+- name: Cleaning RabbitMQ cache
+  shell: docker volume rm onelab_rabbitmq_data
+  become: true
+  when: "'onelab_rabbitmq_data' in list_volumes.stdout"
+
+#
+# Reconfigure
+#
+- include_vars:
+    file: "{{ onelab_path }}/configurations.yml"
+    
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/update-conf-files.yml"
+
+#
+# Post-migration task
+#
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/post-update.yml"
+  when: onelab_result.stat.exists
--- a/app/playbooks/tasks/manage-images.yml
+++ b/app/playbooks/tasks/manage-images.yml
@@ -0,0 +1,40 @@
+- name: Connecting to Docker Hub
+  shell: >
+    docker login -u {{ onelab.docker.login.user|default('public') }} -p {{ onelab.docker.login.password|default('Andrew01..Release') }} hub.andrewalliance.com
+  become: true
+  when: (docker_images_tar is undefined) or (not docker_images_tar.stat.exists)
+
+- name: Checking current OneLab images
+  shell: >
+    {% raw %}
+    docker image ls --format '{{.ID}} {{.Repository}}:{{.Tag}}' |
+    egrep 'onelab-' |
+    egrep -v '1.27.0' |
+    awk '{ print $1 }'
+    {% endraw %}
+  register: onelab_old_images
+  become: true
+
+- name: Pruning OneLab old images
+  shell:
+    docker rmi {{ item }}
+  become: true
+  loop: "{{ onelab_old_images.stdout_lines }}"
+
+- name: Gathering OneLab images
+  shell: >
+    cat {{ onelab_path }}/docker-compose.yml | egrep 'image: ' | awk '{ print $2 }'
+  register: onelab_images
+  become: true
+  when: (docker_images_tar is undefined) or (not docker_images_tar.stat.exists)
+
+- name: Pulling OneLab images
+  shell: >
+    docker image pull {{ item }}
+  become: true
+  register: pullimages
+  loop: "{{ onelab_images.stdout_lines }}"
+  until: pullimages is not failed
+  retries: 10
+  delay: 5
+  when: (docker_images_tar is undefined) or (not docker_images_tar.stat.exists)
--- a/app/playbooks/tasks/post-db-migration.yml
+++ b/app/playbooks/tasks/post-db-migration.yml
@@ -0,0 +1,28 @@
+---
+
+- name: Pull new postgres image
+  shell: |
+    docker image pull hub.andrewalliance.com/releases/postgres:17.8
+  become: true
+  when: (docker_images_tar is undefined) or (not docker_images_tar.stat.exists)
+
+- name: Cleaning database
+  shell: >
+    docker volume rm onelab_pgdata
+  become: true
+
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/start-db-only.yml"
+
+- name: Restoring & Migrating database
+  shell: |
+    docker exec -i $(docker ps --filter "name=onelab_db|onelab-db" -q) pg_restore -Upostgres -dpostgres -v -Fc  < {{ onelab_path }}/db-migration-postgres.tar.gz
+    rm {{ onelab_path }}/db-migration-postgres.tar.gz
+  become: true
+
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/stop-db-only.yml"
+
+- name: Removing lock file
+  shell: >
+    rm {{ onelab_path }}/.lock_db_migration
+  become: true
+
--- a/app/playbooks/tasks/post-update.yml
+++ b/app/playbooks/tasks/post-update.yml
@@ -0,0 +1,21 @@
+---
+  #
+  # Specfic update tasks for version
+  #
+
+
+  #
+  # Migrate SSL structure (1.12.0 -> 1.13.0)
+  #
+  - include_tasks: "{{ installer_path }}/app/playbooks/tasks/ssl-cert-migration.yml"
+
+  #
+  # Postgres13 post-migration
+  #
+  - name: Checking if database has to be migrated
+    stat:
+      path: "{{ onelab_path }}/.lock_db_migration"
+    register: onelab_lock_db_result
+
+  - include_tasks: "{{ installer_path }}/app/playbooks/tasks/post-db-migration.yml"
+    when: onelab_lock_db_result.stat.exists
--- a/app/playbooks/tasks/pre-db-migration.yml
+++ b/app/playbooks/tasks/pre-db-migration.yml
@@ -0,0 +1,14 @@
+---
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/start-db-only.yml"
+
+- name: Backing up database
+  shell:
+    docker exec -i $(docker ps --filter "name=onelab_db|onelab-db" -q) pg_dump -Upostgres -Fc > {{ onelab_path }}/db-migration-postgres.tar.gz
+  become: yes
+
+- include_tasks: "{{ installer_path }}/app/playbooks/tasks/stop-db-only.yml"
+
+- name: Creating lock file
+  shell: >
+    touch {{ onelab_path }}/.lock_db_migration
+  become: true
--- a/app/playbooks/tasks/pre-update.yml
+++ b/app/playbooks/tasks/pre-update.yml
@@ -0,0 +1,12 @@
+---
+  - name: Checking current database
+    shell: >
+      cat {{ onelab_path }}/docker-compose.yml | egrep 'image: postgres' | awk '{ print $2 }'
+    register: onelab_db
+    become: true
+
+  #
+  # Postgres pre-migration
+  #
+  - include_tasks: "{{ installer_path }}/app/playbooks/tasks/pre-db-migration.yml"
+    when: onelab_db.stdout != 'hub.andrewalliance.com/releases/postgres:17.8'
--- a/app/playbooks/tasks/reconfigure-task.yml
+++ b/app/playbooks/tasks/reconfigure-task.yml
@@ -0,0 +1,17 @@
+---
+# Evaluate Docker images bundle
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/check-offline-resources.yml"
+  when: (policy | default('')) != "no-pull" and (onelab.docker.policy | default('')) != "no-pull"
+
+# Update conf files
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/update-conf-files.yml"
+
+# Check SSL files
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/check-ssl-files.yml"
+
+# Rotate Rabbit SSL files
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/rotate-ssl-files-for-rabbit.yml"
+
+# Connect to Docker and pull images, and clean up old images
+- include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/manage-images.yml"
+  when: (policy | default('')) != "no-pull" and (onelab.docker.policy | default('')) != "no-pull"
--- a/app/playbooks/tasks/rotate-ssl-files-for-rabbit.yml
+++ b/app/playbooks/tasks/rotate-ssl-files-for-rabbit.yml
@@ -0,0 +1,8 @@
+---
+# Check SSL files
+- name: Rotate Rabbit SSL certificate
+  shell: |
+    openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout {{ onelab_path }}/rabbit/ssl/rabbit.key -out {{ onelab_path }}/rabbit/ssl/rabbit.crt  -subj "/C=CH/ST=Geneva/L=Geneva/O=Andrew Alliance/OU=OneLab/CN=andrewalliance.com"
+    cat {{ onelab_path }}/rabbit/ssl/rabbit.crt > {{ onelab_path }}/rabbit/ssl/rabbit.fullchain.pem
+  become: true
+  
--- a/app/playbooks/tasks/ssl-cert-migration.yml
+++ b/app/playbooks/tasks/ssl-cert-migration.yml
@@ -0,0 +1,18 @@
+---
+
+- name: Checking if fullchain.pem file exists in /onelab/ssl
+  stat:
+    path: "{{ onelab_path }}/ssl/fullchain.pem"
+  register: fullchain
+
+- name: Migrating legacy SSL structure to the new one
+  shell: |
+    cp {{ onelab_path }}/ssl/fullchain.pem  {{ onelab_path }}/ssl/server.pem
+    cp {{ onelab_path }}/ssl/fullchain.pem  {{ onelab_path }}/ssl/chain.pem
+    rm {{ onelab_path }}/ssl/server.crt
+    rm {{ onelab_path }}/ssl/fullchain.pem
+  when: fullchain.stat.exists
+  register: command_result
+  failed_when: "'FAILED' in command_result.stderr"
+  become: true
+
--- a/app/playbooks/tasks/start-db-only.yml
+++ b/app/playbooks/tasks/start-db-only.yml
@@ -0,0 +1,23 @@
+---
+# workaround: add a dumb failed condition to avoid any failure here as the service is maybe not installed/existing
+- name: Check if "docker compose" is available
+  shell: docker compose version
+  become: true
+  register: docker_compose_check
+  failed_when: "'FAILED' in docker_compose_check.stderr"
+
+- name: Set the compose command to "docker compose"
+  set_fact:
+    compose_command: "docker compose"
+  when: docker_compose_check.rc == 0
+
+- name: Fallback to "docker-compose" if "docker compose" is not available
+  set_fact:
+    compose_command: "docker-compose"
+  when: docker_compose_check.rc != 0
+  
+- name: Starting database service
+  shell: |
+    {{ compose_command }} -f {{ onelab_path }}/docker-compose.yml up -d db
+    sleep 30
+  become: true
--- a/app/playbooks/tasks/start-onelab.yml
+++ b/app/playbooks/tasks/start-onelab.yml
@@ -0,0 +1,19 @@
+---
+- name: Starting OneLab
+  shell: >
+    docker stack deploy onelab --compose-file {{ onelab_path }}/docker-compose.yml --with-registry-auth  --prune
+  become: true
+
+- name: Checking OneLab health status (could take up to 5min to be alive)
+  uri:
+    url: "{{ onelab.domain }}/api/status?token={{ onelab.security.monitoring.token }}"
+    return_content: yes
+    validate_certs: no
+  register: json_response
+  until:
+    - json_response.status == 200
+    - (json_response is defined) and (json_response.content|length > 0)
+    - json_response.content is search('status')
+    - "(json_response.content | from_json).status == 'running'"
+  retries: 60 # 60 * 10 seconds = 10m
+  delay: 10 # Every 10 seconds
--- a/app/playbooks/tasks/start-proxy.yml
+++ b/app/playbooks/tasks/start-proxy.yml
@@ -0,0 +1,6 @@
+---
+- name: Starting Proxy
+  shell: |
+    docker stack deploy onelab_proxy --compose-file {{ onelab_path }}/proxy/docker-compose.yml
+    sleep 10
+  become: true
--- a/app/playbooks/tasks/stop-db-only.yml
+++ b/app/playbooks/tasks/stop-db-only.yml
@@ -0,0 +1,6 @@
+---
+- name: Stopping database service
+  shell: |
+    {{ compose_command }} -f {{ onelab_path }}/docker-compose.yml down
+    sleep 30
+  become: true
--- a/app/playbooks/tasks/stop-onelab.yml
+++ b/app/playbooks/tasks/stop-onelab.yml
@@ -0,0 +1,6 @@
+---
+- name: Stopping OneLab
+  shell: |
+    docker stack rm onelab
+    sleep 30
+  become: true
--- a/app/playbooks/tasks/stop-proxy.yml
+++ b/app/playbooks/tasks/stop-proxy.yml
@@ -0,0 +1,6 @@
+---
+- name: Stopping Proxy
+  shell: |
+    docker stack rm onelab_proxy
+    sleep 20
+  become: true
--- a/app/playbooks/tasks/update-conf-files.yml
+++ b/app/playbooks/tasks/update-conf-files.yml
@@ -0,0 +1,24 @@
+---
+- name: Loading Docker Swarm configuration
+  shell: >
+    docker node ls | grep "Ready" | wc -l
+  register: nodecount
+  become: true
+
+- set_fact:
+    deploy_on: "{{ 'manager' if (nodecount.stdout == '1') else 'worker' }}"
+
+- name: Getting the list of Docker secrets
+  shell: docker secret ls | tail -n +2 | awk '{print $2}'
+  register: docker_secrets
+  become: true
+
+- name: Reconfiguring files
+  ansible.builtin.template:
+    src: "{{ onelab_path }}/installation/latest/app/{{ item }}"
+    dest: "{{ onelab_path }}/{{ item }}"
+  with_items:
+    - 'docker-compose.yml'
+    - 'nginx/onelab.conf'
+    - 'proxy/proxy.conf'
+    - 'proxy/docker-compose.yml'
--- a/app/playbooks/uninstall.yml
+++ b/app/playbooks/uninstall.yml
@@ -0,0 +1,53 @@
+---
+- name: Uninstalling OneLab (1.27.0) 
+  hosts: localhost
+  vars_prompt:
+    - name: "userchoice"
+      prompt: "Do you want to uninstall OneLab and remove all the data? Type: yes/no"
+      private: no
+
+  # Call from ./installation/latest/app/playbooks/uninstall.yml
+
+  tasks:
+  
+    - name: Aborting the uninstall process
+      fail:
+        msg: Aborting the uninstall process
+      when: userchoice != "yes"
+
+    # Stop OneLab if OneLab is running
+    - name: Checking if OneLab is running
+      shell: docker stack ls | grep 'onelab' | wc -l
+      become: true
+      register: stack_count
+
+    - include_tasks: ./tasks/stop-onelab.yml
+      when: stack_count.stdout != "0"
+    - include_tasks: ./tasks/stop-proxy.yml
+      when: stack_count.stdout != "0"
+
+    # Remove Docker volumes (onelab_pgdata, onelab_rabbitmq_data)
+    - name: Removing Docker data
+      shell: |
+        docker volume rm onelab_pgdata -f
+        docker volume rm onelab_rabbitmq_data -f
+      become: true
+
+    # Remove Docker images
+    - name: Checking current OneLab images
+      shell: >
+        docker image ls | egrep 'onelab-' | egrep -v '1.27.0' | awk '{ print $3}'
+      register: onelab_old_images
+      become: true
+
+    - name: Pruning OneLab old images
+      shell:
+        docker rmi {{ item }}
+      become: true
+      loop: "{{ onelab_old_images.stdout_lines }}"
+
+    # Remove Docker login credentials
+    - name: Removing Docker login credentials
+      shell: |
+        docker logout hub.andrewalliance.com
+      become: true
--- a/app/playbooks/update.yml
+++ b/app/playbooks/update.yml
@@ -0,0 +1,115 @@
+# This playbook updates the OneLab Enterprise to latest version or a chosen version in one step
+---
+- name: Updating OneLab
+  hosts: localhost
+  gather_facts: yes
+  vars:
+    main_path: '../../../../..'
+    onelab_path: '../../../../../onelab'
+  
+  vars_prompt:
+    - name: "userchoice"
+      prompt: "Confirm OneLab update: yes/no"
+      private: no       
+
+  tasks:
+
+    # Choice to proceed or stop the update process
+    - name: Aborting the update process
+      fail:
+        msg: Aborting the update process
+      when: userchoice != "yes"
+
+    # Gather latest version information
+    - name: Fetching OneLab latest version details from the repository
+      uri:
+        url: "https://hub.andrewalliance.com/enterprise/version.json"
+        return_content: yes
+        validate_certs: no
+      register: latest_version
+      become: true
+      when:  version is undefined
+    - set_fact:
+        latest: "{{ (latest_version.content | from_json).version }}"
+      when:  version is undefined
+
+    - name: Checking OneLab current version
+      fail:
+        msg: OneLab is already up-to-date (1.27.0)
+      when: (version is undefined) and (latest == "1.27.0")
+
+    - name: Starting OneLab update to {{ version | default(latest) }}
+      debug:
+        msg: Version {{ version | default(latest) }}
+
+    # Remove installer bundles if it exists already, then download & unzip
+    - name: Removing the bundle if it already exists
+      file:
+        state: absent
+        path: "{{ item }}"
+      with_items:
+        - "{{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}"
+        - "{{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}.zip"
+      become: true
+
+    - name: Downloading the installer bundle
+      shell: wget --no-check-certificate https://hub.andrewalliance.com/enterprise/onelab-enterprise-installer-{{ version | default(latest)}}.zip -P {{ main_path }}
+      become: true
+      
+    - name: Unzip the installer bundle
+      shell: unzip {{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}.zip -d {{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}
+      become: true
+
+    - name: Checking if OneLab is running
+      shell: docker stack ls | grep 'onelab' | wc -l
+      become: true
+      register: stack_count
+
+    # Stop OneLab (unkown version) if OneLab is running
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/stop-onelab.yml"
+      when: stack_count.stdout != "0"
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/stop-proxy.yml"
+      when: stack_count.stdout != "0"
+
+    # Start Proxy (maintenance page) if OneLab was running
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/start-proxy.yml"
+      when: stack_count.stdout != "0"
+
+    # Perform OneLab backup
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/backup-task.yml"
+
+    # Perform OneLab update
+    - include_tasks: "{{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}/app/playbooks/tasks/install-task.yml"
+      vars:
+        main_path: '../../../../..'
+        onelab_path: '../../../../../onelab'
+        installer_path: '../../../../../onelab-enterprise-installer-{{ version | default(latest)}}'
+
+    # Load configuration
+    - include_vars: 
+        file: "{{ onelab_path }}/configurations.yml"
+
+    # Perform reconfiguration
+    # Use dynamic path (variable) to force dynamic loading of this new task
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/reconfigure-task.yml"
+
+    # Remove installer bundles 
+    - name: Removing the installer
+      file:
+        state: absent
+        path: "{{ item }}"
+      with_items:
+        - "{{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}"
+        - "{{ main_path }}/onelab-enterprise-installer-{{ version | default(latest)}}.zip"
+      become: true
+
+    # Stop Proxy (maintenance page) if OneLab was running
+    # Use dynamic path (variable) to force dynamic loading of this new task
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/stop-proxy.yml"
+      when: stack_count.stdout != "0"
+
+    # Start OneLab if OneLab was running
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/start-proxy.yml"
+      when: stack_count.stdout != "0"
+    - include_tasks: "{{ onelab_path }}/installation/latest/app/playbooks/tasks/start-onelab.yml"
+      when: stack_count.stdout != "0"
--- a/app/proxy/docker-compose.yml
+++ b/app/proxy/docker-compose.yml
@@ -0,0 +1,47 @@
+version: "3.2"
+services:
+    proxy:
+        image: hub.andrewalliance.com/releases/nginx:1.29.5-alpine
+        ports:
+            - target: 80
+              published: 80
+              protocol: tcp
+              mode: host
+            - target: 443
+              published: 443
+              protocol: tcp
+              mode: host
+        volumes:
+            - ./../ssl:/etc/nginx/ssl
+            - ./not-supported.html:/usr/onelab/not-supported.html
+            - ./error-404.html:/usr/onelab/error-404.html
+            - ./proxy.conf:/etc/nginx/nginx.conf
+            - ./custom-http.conf:/etc/nginx/custom-http.conf
+            - ./custom-server.conf:/etc/nginx/custom-server.conf
+        extra_hosts:
+            - "host.docker.internal:host-gateway"
+        deploy:
+          replicas: 1
+          placement:
+            constraints:
+              - node.role == manager
+{% if docker_secrets is defined and "ssl_passphrase" in docker_secrets.stdout_lines %}
+        secrets:
+          - ssl_passphrase
+{% endif %}
+    maintenance:
+        image: hub.andrewalliance.com/releases/nginx:1.29.5-alpine
+        volumes:
+            - ./maintenance.html:/usr/onelab/index.html
+            - ./maintenance.conf:/etc/nginx/conf.d/default.conf
+        deploy:
+          replicas: 1
+          placement:
+            constraints:
+              - node.role == manager
+{% if docker_secrets is defined and "ssl_passphrase" in docker_secrets.stdout_lines %}
+secrets:
+  ssl_passphrase:
+    external: true
+{% endif %}
+
--- a/app/proxy/error-404.html
+++ b/app/proxy/error-404.html
@@ -0,0 +1,98 @@
+<!doctype html>
+<html lang="en">
+
+<head>
+  <meta charset="utf-8">
+  <title>OneLab - Page Not Found</title>
+  <meta name="description" content="The page you are looking for does not exist or has been moved.">
+  <meta name="robots" content="noindex, nofollow">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <link href="https://fonts.googleapis.com/css?family=Open+Sans&display=swap" rel="stylesheet">
+  <style>
+    body {
+      font-family: "Open Sans", sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    }
+
+    .page {
+      position: absolute;
+      top: 0;
+      bottom: 0;
+      left: 0;
+      right: 0;
+      text-align: center;
+      padding: 128px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+    }
+
+    .content {
+      width: 360px;
+      max-width: 90%;
+    }
+
+    .main {
+      font-size: 32px;
+      font-weight: 600;
+      margin-top: 64px;
+      font-stretch: normal;
+      font-style: normal;
+      line-height: normal;
+      letter-spacing: normal;
+      text-align: center;
+      color: #4a4a4a;
+    }
+
+    .code {
+      margin-top: 8px;
+      font-size: 13px;
+      letter-spacing: 2px;
+      color: #888;
+      text-transform: uppercase;
+    }
+
+    .sub {
+      margin-top: 24px;
+      font-size: 15px;
+      line-height: 1.47;
+      color: #4a4a4a;
+    }
+
+    a.login-btn {
+      display: inline-block;
+      margin-top: 32px;
+      padding: 12px 28px;
+      border-radius: 1000px;
+      background: #6cb644;
+      color: #fff;
+      text-decoration: none;
+      font-weight: 600;
+      box-shadow: 0 2px 4px rgba(0, 0, 0, .15);
+      font-size: 15px;
+    }
+
+    a.login-btn:hover,
+    a.login-btn:focus {
+      background: #3a8611;
+    }
+  </style>
+</head>
+
+<body>
+  <div class="page" role="main" aria-labelledby="title">
+    <div class="content">
+      <div class="img">
+        <img
+          src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALsAAAAvCAQAAAARbnO0AAAABGdBTUEAALGPC/xhBQAAC7VJREFUeNrtW3l0FdUdHgIkCAiyb1ZEkH1TREQRBVzqgrIVkCMFpbREPEKAIgoRxIWlilatuIRzEMUcN5YgtYYeEFRA+b47bxKeiX0algAqYFDZpDVMzyx3Zt7+XhJSqLn3n7yZO3f57u/+7vdboii/suLrIgYZlZ3O2Ait2EuvoVQVb+Eb0M2adWb6xxSWQqemXpDUZ3oKrxJzkMUc/pPZfJZ3a00rHxz1RjxtVD58bsEeSOMpq3/OTHyxF2A+vren5VSexiZxXeXCjkx79KJzC3bUxi9W/2JOohMazyOhkHvA/7toUgV7Av0/bva+x988gcb+VL4UHXK7FvuurII9gSv1Mt5eeH4i+rwasz3wHuZLYrjvSq0rBjCDH3kk/qjvsirYK24qizx6fGGgXsjba/mFA/0BXBQTrsZqT7bz100A2Mais9Y1v5lerSJh9zf0dUGf/GYxxl0ZCru/oeiRdwlqVxianTiw+Lz4APThaXsqJ8UdEe/nesh1Nmad58sx+Nqo3KAoHMzNLLHblFLDQ9EoFLsji/ud/r7Da2rP8sMeqIdMao54/ISPOVJP4TP2DJ8Ih31XLTGBW/GD/fsXbhXTEoArThFzzFUF0Dje7myTks5R0dpodQhnSTc5Q0yynxzi1giX8H70Ce1nVy0uczbZy5VeDDYwkoUdQ3gwwgwCKLD/eiUM9q9xOML9dUC9tTygF5+H/9gjxqa+am9nkitiXhTtZYdYHwZ7NPZzRL3Y20deA3wWtfV6L/DJwS4mGSZKzJmEwx6tZSkeKDvsu2rh33ZPs2LL+hNS4oIhiiBRWXbLU/Ke9sLO0/RhJefyBXzsebrKc3FXx4fO881iNDuhLQcjy5H+BWWDHQMkV4bOEm7gEj7O91DgPVWRYWcpduJtzOez2Iif3JWIEeXQ7DPNcQv8DWM3s9UDP4/b4c1yYuKWUNi5w6tQ1FtxSC5Mu9BZ8ANO68lB5+16y7JjKTomD3sgDcUOkFmo7+n3aqgxYf/Ey8tEE77lvPmhoFE5WFhb9AukxWu0x57Y3+J1l9fAmdYfQmAv0lNCjv1Yp+0YqfX4nf3kqbA5PGTPYVnysPN+RxgmhRHj6pIKhMPOVeEcSs4DOhedafL4sz3UIwns47+DDV8H9i/DLQFnOxfb4wyW3D+cqqG+rZsPSSiSgF2e1g8izvjNUNhj8XY9xbFS9sRxo1yv3umuA/041DWQeBWHuSyOvcQI9+yIHvid6eNyfDAL44JeU2pLZsSDXVH4j2AJxnPSyaB1CK/40t7QzsnBXni+1OuRLehw2MN5exCc10h5Vy+Na3IVWhYOlpoj7LLA5WKLxYmW5rtHzF8H8y4x8ZpmEQ3RWaHfHujNBHSWPM6jE4BdOhvetr9eE9f5YCz2xuRgR0fJunfVKr+0m0TZ5kQcGJVMt/EqW9HEUUxTvd8jU1H0GjjpPfPSrsFShe/ZLw6G6uewJdzngNMzAdhfsPt91/69JRHYpeWQKOyir/3d7ihzTlLa3btODI+KQwuHI40xFKQ8b/yT4duSQGOGobSkMcZ5JgbSSHxawThHhkfE8cP7QpeYFOw5dtu93Bq9ikHJwc5OFSvtgTRpnYgbYow6zwCeG1DTHGOGKeGfWBYu0o0eCFsBjTNZWr6lgMQInDDQEi2Vgkbmn6ZNF8uX4iGLi8oCO160235Yka6wQD3nUPepCGnH5c4qYwb9fK3YyWVCaOHr4uoKranWVa/u+p7QzTUE8xqwu7VZCh5zhspxm4eAfp0TNSlxDYFkYBfDHbPs0or0QDp27/sVIe2OJ/ZAZBddBRatDvY62jU3knUlRssTAR33RTgBCcBeeL5zoeSHO8kwJNgXkgSBnOoIzT0R3q6NytuzI2zSGKev58tByW8W98bygXp9gj86Ax5khssz9Wq8ius8l96rERVPArB7jRF8hm5B3v6JPMVSPFQW2IvPwzeO33OJ14OodZAkNqK061zHdkH9LHS8Tics+lcm0C0G9308V4sF4A085vVVEFiNlcjFt0E8Y1WwnzA52P2p/NTjDVnJybiJQznbdddyfCjsLOHD0apWxx7pt673hfv4FmdzKl/mFscpFd0nc4qbsRRTOJvZHheDyUnKVvx1HdtmXmKhqC7SZIlC7U5zXqi+Sw52RfE39wRMIngJPZdUZnyy6R5kZoQ7k8vqgUzEcIxpUkrxnZJ4oGCBV+aDpr0tUu5AsrCbLDei2cSD4l7vpiYHu6KIu5xwhbcWoTAq7HsjrZXHxIRyhjnGmsx9U1LRKtFEPIhN3uOJYmS5gY3ywm75M7CGRz0KbTOm5DWIwmQShF0xiPBCBlz1AYFxeo1YBNLfUMzxqhbswVMJXYVxKUr+b8oaI2kr+opB7B477UCvodUxaqRQmD/VehfZBepPRUfRX/Rnu8hSgZrW17FqJIqnXaj2xgCtjSTCgTSrrT/VNYiCn/jrsjtuE/0tr0lVOUeLnsJRYprWpgqJSi2WEuNRrUMVFpVWAvUcTjW/Co3KUzHVHUZ1XxUalVg41MwkXeNe4lWlkiQ+NK8u/l7Ni5vNpOgpvvZn9aXW7Zw74DgeH1K1J44nf4Q4kj7kcVE013IFHvNR3PF/CLthciTbr3opDovOqMkPwtMqfrWwq735OrZzlRiOExbs6MM3uA0r2Uux0i+mYBO34U31TiOygnfsBd6Mt7Gd2RzMtYalymViBJZjO9dxaAgUt2ON6U6YEO7JRm3Mx0Z8iBnGSeBU/tn+5losN0J1HMhsbsNyJ6ugJjOwHhvFo8aYYpo7FlbnN+N4gke4lmvZXVFwEZbyU67isLPv7h3FI5iu9lZv5bvQDdjFcO7GEFwk7sDXor+icDI3oI+vi/g9Bxt+bJw0Fzkd33Aie6l3YiN04xrhPpAj2UtM4jGjpdfXgyI0zm/GHer1YY6InXxG66B1xWvGdhY0wlcYZ8bnvzHyCMQEfCluEa05EntEDzPauR3rcZOxKXzZME/kNikKS7U2ojUy+YXoK/qiPjriW6SrF6vXYHt5MhvPQPGnsgS3eZWMnoJv0c9eyGB8oihcwuddD4gFu785jhvypFj/82TDrl5jw/xoqAsMT6GIO2Qan+f5LJknqaeg0IiI+rrgkLgFOw3XqVYHP0op53jmmJknuU4SU81w2L1KBuudjJ6W+CF51XgmFUxPlgTrdrZjKV/nCqPiHRzXq+U3Qy6K+boYa0zdgh23UXP6CId9eLB+xXL6OJc+w8OHtt44EnP4uTUWV3CXxUHEHdCx3FJ2OOG8zeE+ReFHMr1PGuPRYWcJ18mvcdwb0fqfF197nPDEuY/72ouW+EUMUq+W1ZItf3NxF1ZT86dasIu+KI4OO4ZAeKDphx+NWJC4CzvRllu9iobZfMkdy9fKorE8ys8NvY5uPMZr5VvjLOB9/jFIRS5z0wjDYN+HdLfvhP6fqPI8ZigwUmkUywn6s6HboXK2LbWtvTFBPQWHzdS5k6aOLZRSK3rEhl0M4m5ra8VonpJZkfa7sfjK8rbr1Yx7xLDzcEBrY8ipmVdVhHRHQFqYmSf/skLg/rpGDgJncou8JSzYMURm8vAVrLaFpq5FDs4m0ng592M1ZnAxAzxtwK725H7mMINLjKvVlL43kC5GI4uaXkNeqVpXFBB4FeuNTCqTc0SB3Z/KLcgV9zIDecjCV8HeOa7gPvEoZvEjrgqkaV35nbjCAAoqppsn5RDf4lQ8x91W8hL+imI+gUz6jXilvyH3IRfTuchIKzRhb8FjeBHp2oV5DSC4gzPxGAqkIJ1NwNfnRC7iVF8rPmxlDeQ14EQs4HgrToLaHIZM/oUTDVVR0EguIZDGgbyHA3k7d5kAZsi4CjoGh4H16hyG+cww5FNcFxrDEYM4VzyIAZb0y+xDXysxxxhPa4p0LODdbshFXMGZnCvDjOoFvJ+Leb/WFI9Y50D0EE9iljGKXkOMFk9y8lml18tXRGsriR/dUFjlb6s8vn8PdqIIe6HKfzOoKomW/wIUYeDeIwVFgwAAAABJRU5ErkJggg=="
+          alt="OneLab logo">
+      </div>
+      <div class="main" id="title">Page not found</div>
+      <div class="code">Error 404</div>
+      <div class="sub">The page you requested doesn’t exist, was removed, or is temporarily unavailable. You can return
+        to the application by logging in again.</div>
+      <a href="/login" class="login-btn" aria-label="Go to login page">Go to Home page</a>
+    </div>
+  </div>
+</body>
+
+</html>
--- a/app/proxy/maintenance.conf
+++ b/app/proxy/maintenance.conf
@@ -0,0 +1,9 @@
+
+server {
+  listen 80;
+  location / {
+    root /usr/onelab;
+    index index.html index.htm;
+    try_files $uri $uri/ /index.html =404;
+  }
+}
--- a/app/proxy/maintenance.html
+++ b/app/proxy/maintenance.html
--- a/app/proxy/not-supported.html
+++ b/app/proxy/not-supported.html
@@ -0,0 +1,82 @@
+<!doctype html>
+
+<html lang="en">
+
+<head>
+  <meta charset="utf-8">
+
+  <title>OneLab - Browser not supported</title>
+  <meta name="description" content="Your browser is not supported">
+
+  <meta charset="UTF-8">
+  <meta http-equiv="refresh" content="30">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+
+  <link href="https://fonts.googleapis.com/css?family=Open+Sans&display=swap" rel="stylesheet">
+
+  <style>
+    body {
+      font-family: "Open Sans", sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    }
+
+    .page {
+      position: absolute;
+      top: 0;
+      bottom: 0;
+      left: 0;
+      right: 0;
+      text-align: center;
+      padding: 128px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+    }
+
+    .content {
+      width: 320px;
+    }
+
+    .main {
+      font-size: 32px;
+      font-weight: 600;
+      margin-top: 64px;
+      font-stretch: normal;
+      font-style: normal;
+      line-height: normal;
+      letter-spacing: normal;
+      text-align: center;
+      color: #4a4a4a;
+    }
+
+    .sub {
+      margin-top: 32px;
+      font-size: 15px;
+      font-weight: normal;
+      font-stretch: normal;
+      font-style: normal;
+      line-height: 1.47;
+      letter-spacing: normal;
+      text-align: center;
+      color: #4a4a4a;
+    }
+  </style>
+
+</head>
+
+<body>
+  <div class="page">
+    <div class="content">
+      <div class="img">
+        <img
+          src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALsAAAAvCAQAAAARbnO0AAAABGdBTUEAALGPC/xhBQAAC7VJREFUeNrtW3l0FdUdHgIkCAiyb1ZEkH1TREQRBVzqgrIVkCMFpbREPEKAIgoRxIWlilatuIRzEMUcN5YgtYYeEFRA+b47bxKeiX0algAqYFDZpDVMzyx3Zt7+XhJSqLn3n7yZO3f57u/+7vdboii/suLrIgYZlZ3O2Ait2EuvoVQVb+Eb0M2adWb6xxSWQqemXpDUZ3oKrxJzkMUc/pPZfJZ3a00rHxz1RjxtVD58bsEeSOMpq3/OTHyxF2A+vren5VSexiZxXeXCjkx79KJzC3bUxi9W/2JOohMazyOhkHvA/7toUgV7Av0/bva+x988gcb+VL4UHXK7FvuurII9gSv1Mt5eeH4i+rwasz3wHuZLYrjvSq0rBjCDH3kk/qjvsirYK24qizx6fGGgXsjba/mFA/0BXBQTrsZqT7bz100A2Mais9Y1v5lerSJh9zf0dUGf/GYxxl0ZCru/oeiRdwlqVxianTiw+Lz4APThaXsqJ8UdEe/nesh1Nmad58sx+Nqo3KAoHMzNLLHblFLDQ9EoFLsji/ud/r7Da2rP8sMeqIdMao54/ISPOVJP4TP2DJ8Ih31XLTGBW/GD/fsXbhXTEoArThFzzFUF0Dje7myTks5R0dpodQhnSTc5Q0yynxzi1giX8H70Ce1nVy0uczbZy5VeDDYwkoUdQ3gwwgwCKLD/eiUM9q9xOML9dUC9tTygF5+H/9gjxqa+am9nkitiXhTtZYdYHwZ7NPZzRL3Y20deA3wWtfV6L/DJwS4mGSZKzJmEwx6tZSkeKDvsu2rh33ZPs2LL+hNS4oIhiiBRWXbLU/Ke9sLO0/RhJefyBXzsebrKc3FXx4fO881iNDuhLQcjy5H+BWWDHQMkV4bOEm7gEj7O91DgPVWRYWcpduJtzOez2Iif3JWIEeXQ7DPNcQv8DWM3s9UDP4/b4c1yYuKWUNi5w6tQ1FtxSC5Mu9BZ8ANO68lB5+16y7JjKTomD3sgDcUOkFmo7+n3aqgxYf/Ey8tEE77lvPmhoFE5WFhb9AukxWu0x57Y3+J1l9fAmdYfQmAv0lNCjv1Yp+0YqfX4nf3kqbA5PGTPYVnysPN+RxgmhRHj6pIKhMPOVeEcSs4DOhedafL4sz3UIwns47+DDV8H9i/DLQFnOxfb4wyW3D+cqqG+rZsPSSiSgF2e1g8izvjNUNhj8XY9xbFS9sRxo1yv3umuA/041DWQeBWHuSyOvcQI9+yIHvid6eNyfDAL44JeU2pLZsSDXVH4j2AJxnPSyaB1CK/40t7QzsnBXni+1OuRLehw2MN5exCc10h5Vy+Na3IVWhYOlpoj7LLA5WKLxYmW5rtHzF8H8y4x8ZpmEQ3RWaHfHujNBHSWPM6jE4BdOhvetr9eE9f5YCz2xuRgR0fJunfVKr+0m0TZ5kQcGJVMt/EqW9HEUUxTvd8jU1H0GjjpPfPSrsFShe/ZLw6G6uewJdzngNMzAdhfsPt91/69JRHYpeWQKOyir/3d7ihzTlLa3btODI+KQwuHI40xFKQ8b/yT4duSQGOGobSkMcZ5JgbSSHxawThHhkfE8cP7QpeYFOw5dtu93Bq9ikHJwc5OFSvtgTRpnYgbYow6zwCeG1DTHGOGKeGfWBYu0o0eCFsBjTNZWr6lgMQInDDQEi2Vgkbmn6ZNF8uX4iGLi8oCO160235Yka6wQD3nUPepCGnH5c4qYwb9fK3YyWVCaOHr4uoKranWVa/u+p7QzTUE8xqwu7VZCh5zhspxm4eAfp0TNSlxDYFkYBfDHbPs0or0QDp27/sVIe2OJ/ZAZBddBRatDvY62jU3knUlRssTAR33RTgBCcBeeL5zoeSHO8kwJNgXkgSBnOoIzT0R3q6NytuzI2zSGKev58tByW8W98bygXp9gj86Ax5khssz9Wq8ius8l96rERVPArB7jRF8hm5B3v6JPMVSPFQW2IvPwzeO33OJ14OodZAkNqK061zHdkH9LHS8Tics+lcm0C0G9308V4sF4A085vVVEFiNlcjFt0E8Y1WwnzA52P2p/NTjDVnJybiJQznbdddyfCjsLOHD0apWxx7pt673hfv4FmdzKl/mFscpFd0nc4qbsRRTOJvZHheDyUnKVvx1HdtmXmKhqC7SZIlC7U5zXqi+Sw52RfE39wRMIngJPZdUZnyy6R5kZoQ7k8vqgUzEcIxpUkrxnZJ4oGCBV+aDpr0tUu5AsrCbLDei2cSD4l7vpiYHu6KIu5xwhbcWoTAq7HsjrZXHxIRyhjnGmsx9U1LRKtFEPIhN3uOJYmS5gY3ywm75M7CGRz0KbTOm5DWIwmQShF0xiPBCBlz1AYFxeo1YBNLfUMzxqhbswVMJXYVxKUr+b8oaI2kr+opB7B477UCvodUxaqRQmD/VehfZBepPRUfRX/Rnu8hSgZrW17FqJIqnXaj2xgCtjSTCgTSrrT/VNYiCn/jrsjtuE/0tr0lVOUeLnsJRYprWpgqJSi2WEuNRrUMVFpVWAvUcTjW/Co3KUzHVHUZ1XxUalVg41MwkXeNe4lWlkiQ+NK8u/l7Ni5vNpOgpvvZn9aXW7Zw74DgeH1K1J44nf4Q4kj7kcVE013IFHvNR3PF/CLthciTbr3opDovOqMkPwtMqfrWwq735OrZzlRiOExbs6MM3uA0r2Uux0i+mYBO34U31TiOygnfsBd6Mt7Gd2RzMtYalymViBJZjO9dxaAgUt2ON6U6YEO7JRm3Mx0Z8iBnGSeBU/tn+5losN0J1HMhsbsNyJ6ugJjOwHhvFo8aYYpo7FlbnN+N4gke4lmvZXVFwEZbyU67isLPv7h3FI5iu9lZv5bvQDdjFcO7GEFwk7sDXor+icDI3oI+vi/g9Bxt+bJw0Fzkd33Aie6l3YiN04xrhPpAj2UtM4jGjpdfXgyI0zm/GHer1YY6InXxG66B1xWvGdhY0wlcYZ8bnvzHyCMQEfCluEa05EntEDzPauR3rcZOxKXzZME/kNikKS7U2ojUy+YXoK/qiPjriW6SrF6vXYHt5MhvPQPGnsgS3eZWMnoJv0c9eyGB8oihcwuddD4gFu785jhvypFj/82TDrl5jw/xoqAsMT6GIO2Qan+f5LJknqaeg0IiI+rrgkLgFOw3XqVYHP0op53jmmJknuU4SU81w2L1KBuudjJ6W+CF51XgmFUxPlgTrdrZjKV/nCqPiHRzXq+U3Qy6K+boYa0zdgh23UXP6CId9eLB+xXL6OJc+w8OHtt44EnP4uTUWV3CXxUHEHdCx3FJ2OOG8zeE+ReFHMr1PGuPRYWcJ18mvcdwb0fqfF197nPDEuY/72ouW+EUMUq+W1ZItf3NxF1ZT86dasIu+KI4OO4ZAeKDphx+NWJC4CzvRllu9iobZfMkdy9fKorE8ys8NvY5uPMZr5VvjLOB9/jFIRS5z0wjDYN+HdLfvhP6fqPI8ZigwUmkUywn6s6HboXK2LbWtvTFBPQWHzdS5k6aOLZRSK3rEhl0M4m5ra8VonpJZkfa7sfjK8rbr1Yx7xLDzcEBrY8ipmVdVhHRHQFqYmSf/skLg/rpGDgJncou8JSzYMURm8vAVrLaFpq5FDs4m0ng592M1ZnAxAzxtwK725H7mMINLjKvVlL43kC5GI4uaXkNeqVpXFBB4FeuNTCqTc0SB3Z/KLcgV9zIDecjCV8HeOa7gPvEoZvEjrgqkaV35nbjCAAoqppsn5RDf4lQ8x91W8hL+imI+gUz6jXilvyH3IRfTuchIKzRhb8FjeBHp2oV5DSC4gzPxGAqkIJ1NwNfnRC7iVF8rPmxlDeQ14EQs4HgrToLaHIZM/oUTDVVR0EguIZDGgbyHA3k7d5kAZsi4CjoGh4H16hyG+cww5FNcFxrDEYM4VzyIAZb0y+xDXysxxxhPa4p0LODdbshFXMGZnCvDjOoFvJ+Leb/WFI9Y50D0EE9iljGKXkOMFk9y8lml18tXRGsriR/dUFjlb6s8vn8PdqIIe6HKfzOoKomW/wIUYeDeIwVFgwAAAABJRU5ErkJggg=="
+          alt="OneLab logo">
+      </div>
+      <div class="main">Your browser is not supported</div>
+      <div class="sub">OneLab works better on <a olLink href="https://www.google.com/chrome/">Chrome</a>, <a olLink
+          href="https://www.mozilla.org/en-US/firefox/new/">Firefox</a> and <a olLink
+          href="https://www.microsoft.com/en-us/windows/microsoft-edge">Microsoft Edge</a></div>
+    </div>
+  </div>
+</body>
+
+</html>
--- a/app/proxy/proxy.conf
+++ b/app/proxy/proxy.conf
@@ -0,0 +1,174 @@
+# Load the headers-more module
+load_module /etc/nginx/modules/ngx_http_headers_more_filter_module.so;
+
+worker_processes 4;
+
+events { worker_connections 1024; }
+
+http {
+  server_names_hash_bucket_size 128;
+  include /etc/nginx/mime.types;
+
+  types {
+    image/svg+xml   svg svgz;
+  }
+
+  client_max_body_size 600m;
+
+  # don't send the nginx version number in error pages and Server header
+  server_tokens off;
+  more_set_headers 'Server: OneLab';
+
+  sendfile on;
+
+  resolver 8.8.8.8;
+
+  limit_req_zone $binary_remote_addr zone=proxy_global:10m rate=50r/s;
+
+  upstream onelab {
+    server host.docker.internal:8080;
+    server maintenance:80 backup;
+  }
+
+  # redirect all http traffic to https
+  server {
+    listen 80 default_server;
+{% if (onelab.services.revproxy.ipv6|default(true)) != false %}
+    listen [::]:80 default_server;
+{% endif %}
+    server_name {{ onelab.domain[8:] }};
+    return 301 https://$host$request_uri;
+  }
+
+  include /etc/nginx/custom-http.conf;
+
+  server {
+    listen 443 ssl default_server;
+{% if (onelab.services.revproxy.ipv6|default(true)) != false %}
+    listen [::]:443 ssl default_server;
+{% endif %}
+    http2 on;
+    server_name {{ onelab.domain[8:] }};
+
+    ssl_certificate /etc/nginx/ssl/server.pem;
+    ssl_certificate_key /etc/nginx/ssl/server.key;
+{% if docker_secrets is defined and "ssl_passphrase" in docker_secrets.stdout_lines %}
+    ssl_password_file /run/secrets/ssl_passphrase;
+{% endif %}
+    # ssl_client_certificate /etc/nginx/ssl/ca.crt;
+    # ssl_verify_client      off;
+
+    # enable session resumption to improve https performance
+    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+    # enables server-side protection from BEAST attacks
+    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
+    ssl_prefer_server_ciphers on;
+    # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
+    ssl_protocols TLSv1.2 TLSv1.3;
+    # ciphers chosen for forward secrecy and compatibility
+    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
+    ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
+    ssl_ecdh_curve X25519:P-384:P-256;
+
+    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
+    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
+    resolver 8.8.8.8 8.8.4.4;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
+
+    # read more here http://tautt.com/best-nginx-configuration-for-security/
+    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
+    # also https://hstspreload.org/
+    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
+
+    # config to don't allow the browser to render the page inside an frame or iframe
+    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
+    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
+    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
+    add_header X-Frame-Options SAMEORIGIN;
+
+    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
+    # to disable content-type sniffing on some browsers.
+    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+    # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
+    # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
+    # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
+    add_header X-Content-Type-Options nosniff;
+
+    # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
+    # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
+    # this particular website if it was disabled by the user.
+    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+    add_header X-XSS-Protection "1; mode=block";
+
+    # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
+    # you can tell the browser that it can only download content from the domains you explicitly allow
+    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
+    # https://www.owasp.org/index.php/Content_Security_Policy
+    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
+    # directives for css and js(if you have inline css or js, you will need to keep it too).
+    # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://app.intercom.io  https://widget.intercom.io  https://js.intercomcdn.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; img-src * data:; media-src *; style-src 'self' 'unsafe-inline' https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; font-src 'self' https://*.intercomcdn.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; frame-src *; connect-src 'self' https://*.intercom.io wss://*.intercom.io https://*.intercomcdn.com https://*.intercomcdn.eu https://*.intercomusercontent.com https://*.intercom-messenger.com  wss://*.intercom-messenger.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; object-src 'none'";
+
+    add_header Referrer-Policy "same-origin";
+
+    add_header Permissions-Policy "accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(self), usb=()";
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_disable "MSIE [1-6]\.";
+
+    root /usr/onelab/;
+
+    include /etc/nginx/custom-server.conf;
+
+    location /not-supported {
+      index not-supported.html not-supported.htm;
+      try_files $uri $uri/ /not-supported.html =404;
+    }
+
+    location /error-404 {
+      index error-404.html error-404.htm;
+      try_files $uri $uri/ /error-404.html =404;
+    }
+
+    # Also used as workaround for a Docker swarm issue 
+    # https://github.com/moby/moby/issues/25526
+    # Redirect to HTTP, but assume that we will be on the same server
+    location / {
+      limit_req zone=proxy_global burst=50 nodelay;
+
+      if ($http_user_agent ~* '(MSIE 11.0|MSIE 10.0|MSIE 9.0|MSIE 8.0|MSIE 7.0|MSIE 6.0)') {
+        return 301 https://$host/not-supported;
+      }
+
+      proxy_pass  http://onelab;
+      proxy_next_upstream error;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+      proxy_set_header  X-Forwarded-Proto $scheme;
+
+      # WebSocket support
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+  }
+}
+
--- a/app/rabbit/advanced.conf
+++ b/app/rabbit/advanced.conf
@@ -0,0 +1,5 @@
+[
+ {rabbit, [
+  {tcp_listeners, []}
+  ]}
+].
--- a/app/rabbit/definitions.json
+++ b/app/rabbit/definitions.json
@@ -0,0 +1,20 @@
+{
+    "rabbit_version": "3.6.5",
+    "users": [
+    ],
+    "vhosts": [
+        {
+            "name": "devices"
+        },
+        {
+            "name": "internal"
+        }
+    ],
+    "permissions": [
+      ],
+    "parameters": [],
+    "policies": [],
+    "queues": [],
+    "exchanges": [],
+    "bindings": []
+}
--- a/app/rabbit/enable_plugins
+++ b/app/rabbit/enable_plugins
@@ -0,0 +1 @@
+[rabbitmq_auth_backend_http, rabbitmq_auth_backend_cache, rabbitmq_management, rabbitmq_event_exchange].
--- a/app/rabbit/rabbit.conf
+++ b/app/rabbit/rabbit.conf
@@ -0,0 +1,54 @@
+# Auth server config
+
+auth_backends.1             = cache
+
+auth_cache.cached_backend   = http
+auth_cache.cache_ttl        = 5000
+
+auth_http.user_path         = http://revproxy/api/v1/rmq/user
+auth_http.vhost_path        = http://revproxy/api/v1/rmq/vhost
+auth_http.resource_path     = http://revproxy/api/v1/rmq/resource
+auth_http.topic_path        = http://revproxy/api/v1/rmq/topic
+
+listeners.ssl.default = 5671
+
+# generated with "cat server.crt server.key > server.pem"
+# fullchain
+ssl_options.cacertfile = /etc/rabbitmq/ssl/rabbit.fullchain.pem 
+
+ssl_options.certfile   = /etc/rabbitmq/ssl/rabbit.crt
+ssl_options.keyfile    = /etc/rabbitmq/ssl/rabbit.key
+
+# not very secure
+ssl_options.verify     = verify_peer
+ssl_options.fail_if_no_peer_cert = false
+
+# for TLS version and cipher
+ssl_options.versions.1 = tlsv1.2
+
+# these MUST be disabled if TLSv1.3 is used
+ssl_options.honor_cipher_order   = true
+ssl_options.honor_ecc_order      = true
+
+# These are highly recommended for TLSv1.2 but cannot be used
+# with TLSv1.3. If TLSv1.3 is enabled, these lines MUST be removed.
+ssl_options.client_renegotiation = false
+ssl_options.secure_renegotiate   = true
+
+ssl_options.ciphers.1  = ECDHE-ECDSA-AES256-GCM-SHA384
+ssl_options.ciphers.2  = ECDHE-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.3  = ECDH-ECDSA-AES256-GCM-SHA384
+ssl_options.ciphers.4  = ECDH-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.5  = DHE-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.6  = DHE-DSS-AES256-GCM-SHA384
+ssl_options.ciphers.7  = ECDHE-ECDSA-AES128-GCM-SHA256
+ssl_options.ciphers.8  = ECDHE-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.9  = ECDH-ECDSA-AES128-GCM-SHA256
+ssl_options.ciphers.10 = ECDH-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.11 = DHE-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.12 = DHE-DSS-AES128-GCM-SHA256
+
+management.load_definitions = /opt/definitions.json
+
+# For connection events
+event_exchange.vhost = devices
--- a/app/rabbit/ssl/rabbit.crt
+++ b/app/rabbit/ssl/rabbit.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwTCCAqmgAwIBAgIJANBW7LFskUGkMA0GCSqGSIb3DQEBCwUAMHcxCzAJBgNV
+BAYTAkNIMQ8wDQYDVQQIDAZHZW5ldmExDzANBgNVBAcMBkdlbmV2YTEYMBYGA1UE
+CgwPQW5kcmV3IEFsbGlhbmNlMQ8wDQYDVQQLDAZPbmVMYWIxGzAZBgNVBAMMEmFu
+ZHJld2FsbGlhbmNlLmNvbTAeFw0xOTA5MzAxNTE5NDJaFw0zOTA5MjUxNTE5NDJa
+MHcxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIDAZHZW5ldmExDzANBgNVBAcMBkdlbmV2
+YTEYMBYGA1UECgwPQW5kcmV3IEFsbGlhbmNlMQ8wDQYDVQQLDAZPbmVMYWIxGzAZ
+BgNVBAMMEmFuZHJld2FsbGlhbmNlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMxODu2ql2+397wUYVRjuNppa2+nLZwSvzsnyfG5RwmQX/Q3V9sy
+17RluFW42WLFv5TfS/soRILbShyHmYJL9iGfsa1nkg9XAs681ebHESrGP9jZZ25x
+alg97IaVI6rQcUN/7WrB183sAokL4AinY2Zh+wOt9LQWsovKO3TB3Oetxw3AImqX
+onuzTZkzlbJ0KTHGpn8dZ/xjGMvkd1ByjKLQ/gb630vZOJErjcLEWji20fWhwA5S
+7vhGy4dqivEpLrnEjd2njclADphOxYoHr2rN11n7ASl1+Lu5HhCAFNoeaDi+rliu
+pupKcbFYCPLIpTq2yw81BOkKn0fPMn5C+m0CAwEAAaNQME4wHQYDVR0OBBYEFGYz
+XZCPfN8IfCDjPVS0NUcK+c6zMB8GA1UdIwQYMBaAFGYzXZCPfN8IfCDjPVS0NUcK
+c6zMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAABxoVD1aZ8NJU2+
+cL8lMFfrrQEg3vSNzYWuI78OHixGYDF3NPARFL6m20hLusxtmtsM+OsWios58RoO
+0b9unY3ce0S/567LFpBZgKvo7hdEwDBY2cuX5p8snWfucn4j8KZhebtz4kvcSPOH
+VTWtgfobKxcryiM8pYA8uRzu/WQKr2q92oYliiOoUg6ZQEWhBCqXzcHJ7D32UcuW
+fHfZCp48D9LqfSXALNOHyXWaLXRIiQHBuWMhBI57tgbPA4m2hHN8c8y1rc0cSNGt
+Og8tQoRlj9PRM3WMMrdGuG4TvBe3y5666wo1ZLErfyCbM4/sIPHdrp1cCXFDyyVj
+nKZ2gjE=
+-----END CERTIFICATE-----
--- a/app/rabbit/ssl/rabbit.fullchain.pem
+++ b/app/rabbit/ssl/rabbit.fullchain.pem
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIDwTCCAqmgAwIBAgIJANBW7LFskUGkMA0GCSqGSIb3DQEBCwUAMHcxCzAJBgNV
+BAYTAkNIMQ8wDQYDVQQIDAZHZW5ldmExDzANBgNVBAcMBkdlbmV2YTEYMBYGA1UE
+CgwPQW5kcmV3IEFsbGlhbmNlMQ8wDQYDVQQLDAZPbmVMYWIxGzAZBgNVBAMMEmFu
+ZHJld2FsbGlhbmNlLmNvbTAeFw0xOTA5MzAxNTE5NDJaFw0zOTA5MjUxNTE5NDJa
+MHcxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIDAZHZW5ldmExDzANBgNVBAcMBkdlbmV2
+YTEYMBYGA1UECgwPQW5kcmV3IEFsbGlhbmNlMQ8wDQYDVQQLDAZPbmVMYWIxGzAZ
+BgNVBAMMEmFuZHJld2FsbGlhbmNlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMxODu2ql2+397wUYVRjuNppa2+nLZwSvzsnyfG5RwmQX/Q3V9sy
+17RluFW42WLFv5TfS/soRILbShyHmYJL9iGfsa1nkg9XAs681ebHESrGP9jZZ25x
+alg97IaVI6rQcUN/7WrB183sAokL4AinY2Zh+wOt9LQWsovKO3TB3Oetxw3AImqX
+onuzTZkzlbJ0KTHGpn8dZ/xjGMvkd1ByjKLQ/gb630vZOJErjcLEWji20fWhwA5S
+7vhGy4dqivEpLrnEjd2njclADphOxYoHr2rN11n7ASl1+Lu5HhCAFNoeaDi+rliu
+pupKcbFYCPLIpTq2yw81BOkKn0fPMn5C+m0CAwEAAaNQME4wHQYDVR0OBBYEFGYz
+XZCPfN8IfCDjPVS0NUcK+c6zMB8GA1UdIwQYMBaAFGYzXZCPfN8IfCDjPVS0NUcK
+c6zMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAABxoVD1aZ8NJU2+
+cL8lMFfrrQEg3vSNzYWuI78OHixGYDF3NPARFL6m20hLusxtmtsM+OsWios58RoO
+0b9unY3ce0S/567LFpBZgKvo7hdEwDBY2cuX5p8snWfucn4j8KZhebtz4kvcSPOH
+VTWtgfobKxcryiM8pYA8uRzu/WQKr2q92oYliiOoUg6ZQEWhBCqXzcHJ7D32UcuW
+fHfZCp48D9LqfSXALNOHyXWaLXRIiQHBuWMhBI57tgbPA4m2hHN8c8y1rc0cSNGt
+Og8tQoRlj9PRM3WMMrdGuG4TvBe3y5666wo1ZLErfyCbM4/sIPHdrp1cCXFDyyVj
+nKZ2gjE=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDMTg7tqpdvt/e8
+FGFUY7jaaWtvpy2cEr87J8nxuUcJkF/0N1fbMte0ZbhVuNlixb+U30v7KESC20oc
+h5mCS/Yhn7GtZ5IPVwLOvNXmxxEqxj/Y2WducWpYPeyGlSOq0HFDf+1qwdfN7AKJ
+C+AIp2NmYfsDrfS0FrKLyjt0wdznrccNwCJql6J7s02ZM5WydCkxxqZ/HWf8YxjL
+5HdQcoyi0P4G+t9L2TiRK43CxFo4ttH1ocAOUu74RsuHaorxKS65xI3dp43JQA6Y
+TsWKB69qzddZ+wEpdfi7uR4QgBTaHmg4vq5YrqbqSnGxWAjyyKU6tssPNQTpCp9H
+zzJ+QvptAgMBAAECggEBAMNTqcAeBdSgvTBLB9bH1Ja0jSvdWKTL45qp6s+5BKqn
+JqX1N4DxNftZ+Qezx9pAF288oYcJM58sCsoF9oT1HOd+pz+TMriJxrxjG9oc3lPX
+4HjxOYsE0dh1s6nj8oq/6FnRd+pGU42jo7Tk7pc3ebgL2xHkgXyf6qntejShmBLC
+gbXM86sPp1GYFNrVh6JveL8UBQzsXnY1u8tm4J2xA47+UvF0uPV5b7xzblplqycv
+K/cijsqiaBhDZR71Nj7/HnHqcJqs4pYjnNplkfJ5fjkifJh8xZcX0vdJnc7hgC/x
+BLFuMVLUSXoWtBmajVoJaD/46b0pFTEeGmXs6h3TMj0CgYEA+26WRyiyDGl3wgYJ
+dm9ITuwBZQo1HiA8wGgAEqyM8BcxNh7zGhYTBKPUYJtuJsUZcFCAbXlD5nIDOYeR
+bODqEgtN6RQPtQHU4My1gtd8Aaa2IlVD+GVYFSldpcud0pswbiE0xA3GcknGM3hf
+Jh/7pDEYoN0DkSgyVwL5+d/irVcCgYEA0ARIZC/NyhHC17FGXF5qIG45b+pyvpAE
+ytjRHZ09WPErONnD29Q7dhNaYqi6ZtLS1XuG7GVo5VnV+xdr75e93sQuyXzAKnx
+f1zn+qEDDY/K0qPeh96sHxJjwE6Ha5mO/kL7mx1yV9QEPHTNEynZMM1n2ahgv0kW
+LM3vymDdN9sCgYAxCrX3NUHdV+kLCEBqQHR7KF9xRNdtg941rVNuUQfAgNWRd+H1
+EZ8uBYKUQVzv5Pv8Q0d5kvCij1R/sSi1cv1U/a15q/cQWEYcfvFcjwlaDRlzguwa
+FDJlFkd04k1rWefNY162avVtL2Sgf3cXqZ9cvFLQdauPcaa4ABWgHoJJSwKBgQCF
+3JuxTUoC5Vcbcosy2dc1s3jm2lqo4wkxkQQ6hHhTibaBA33I4vuTc4StjHe2GSdk
+/ZFS5P7E3Fo6rHLFq551aA6mQI+WN8afDWyDTqYmTghZcPa9PMBK5oymrmJbDeCF
+IxnDAjoY5ukq9ocZ8+4+h5By8vX/YssQXh4XgCobzQKBgDMgav9ABc0idoE8sQ0g
+bnPI/QX+bRhm+yYUQM/zB0h/CRuUC44ZP7dssST7c4L/OirYiZQEtXnHdxZ2DmV3
+v/5MNbLnx+1z75KLwtg4f24BRB6p26/YxN1Wtudu7QwSSjffGRcUucbS5X3//Fjb
+3YIcbL9y2FZJHQFybilFQJgu
+-----END PRIVATE KEY-----
--- a/app/rabbit/ssl/rabbit.key
+++ b/app/rabbit/ssl/rabbit.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDMTg7tqpdvt/e8
+FGFUY7jaaWtvpy2cEr87J8nxuUcJkF/0N1fbMte0ZbhVuNlixb+U30v7KESC20oc
+h5mCS/Yhn7GtZ5IPVwLOvNXmxxEqxj/Y2WducWpYPeyGlSOq0HFDf+1qwdfN7AKJ
+C+AIp2NmYfsDrfS0FrKLyjt0wdznrccNwCJql6J7s02ZM5WydCkxxqZ/HWf8YxjL
+5HdQcoyi0P4G+t9L2TiRK43CxFo4ttH1ocAOUu74RsuHaorxKS65xI3dp43JQA6Y
+TsWKB69qzddZ+wEpdfi7uR4QgBTaHmg4vq5YrqbqSnGxWAjyyKU6tssPNQTpCp9H
+zzJ+QvptAgMBAAECggEBAMNTqcAeBdSgvTBLB9bH1Ja0jSvdWKTL45qp6s+5BKqn
+JqX1N4DxNftZ+Qezx9pAF288oYcJM58sCsoF9oT1HOd+pz+TMriJxrxjG9oc3lPX
+4HjxOYsE0dh1s6nj8oq/6FnRd+pGU42jo7Tk7pc3ebgL2xHkgXyf6qntejShmBLC
+gbXM86sPp1GYFNrVh6JveL8UBQzsXnY1u8tm4J2xA47+UvF0uPV5b7xzblplqycv
+K/cijsqiaBhDZR71Nj7/HnHqcJqs4pYjnNplkfJ5fjkifJh8xZcX0vdJnc7hgC/x
+BLFuMVLUSXoWtBmajVoJaD/46b0pFTEeGmXs6h3TMj0CgYEA+26WRyiyDGl3wgYJ
+dm9ITuwBZQo1HiA8wGgAEqyM8BcxNh7zGhYTBKPUYJtuJsUZcFCAbXlD5nIDOYeR
+bODqEgtN6RQPtQHU4My1gtd8Aaa2IlVD+GVYFSldpcud0pswbiE0xA3GcknGM3hf
+Jh/7pDEYoN0DkSgyVwL5+d/irVcCgYEA0ARIZC/NyhHC17FGXF5qIG45b+pyvpAE
+ytjRHZ09WPErONnD29Q7dhNaYqi6ZtLS1XuG7GVo5VnV+xdr75e93sQuyXzAKnx
+f1zn+qEDDY/K0qPeh96sHxJjwE6Ha5mO/kL7mx1yV9QEPHTNEynZMM1n2ahgv0kW
+LM3vymDdN9sCgYAxCrX3NUHdV+kLCEBqQHR7KF9xRNdtg941rVNuUQfAgNWRd+H1
+EZ8uBYKUQVzv5Pv8Q0d5kvCij1R/sSi1cv1U/a15q/cQWEYcfvFcjwlaDRlzguwa
+FDJlFkd04k1rWefNY162avVtL2Sgf3cXqZ9cvFLQdauPcaa4ABWgHoJJSwKBgQCF
+3JuxTUoC5Vcbcosy2dc1s3jm2lqo4wkxkQQ6hHhTibaBA33I4vuTc4StjHe2GSdk
+/ZFS5P7E3Fo6rHLFq551aA6mQI+WN8afDWyDTqYmTghZcPa9PMBK5oymrmJbDeCF
+IxnDAjoY5ukq9ocZ8+4+h5By8vX/YssQXh4XgCobzQKBgDMgav9ABc0idoE8sQ0g
+bnPI/QX+bRhm+yYUQM/zB0h/CRuUC44ZP7dssST7c4L/OirYiZQEtXnHdxZ2DmV3
+v/5MNbLnx+1z75KLwtg4f24BRB6p26/YxN1Wtudu7QwSSjffGRcUucbS5X3//Fjb
+3YIcbL9y2FZJHQFybilFQJgu
+-----END PRIVATE KEY-----
--- a/app/reconfigure.sh
+++ b/app/reconfigure.sh
@@ -0,0 +1,21 @@
+
+#!/bin/bash
+# Usage: ./reconfigure.sh [--no-pull]
+
+onelab_no_pull=""
+
+for arg in "$@"; do
+  if [[ "$arg" == "--no-pull" ]]; then
+    onelab_no_pull="no-pull"
+  fi
+done
+
+LOG_PATH="./logs/ansible/$(date +%F)-ansible.log"
+PLAYBOOK="./installation/1.27.0/app/playbooks/reconfigure.yml"
+EXTRA_VARS=()
+
+if [[ -n "$onelab_no_pull" ]]; then
+  EXTRA_VARS+=("-e" "policy=$onelab_no_pull")
+fi
+
+ANSIBLE_LOG_PATH="$LOG_PATH" ansible-playbook "$PLAYBOOK" "${EXTRA_VARS[@]}"
--- a/app/start.sh
+++ b/app/start.sh
@@ -0,0 +1,3 @@
+
+#!/bin/bash
+ANSIBLE_LOG_PATH=./logs/ansible/$(date +%F)-ansible.log ansible-playbook ./installation/latest/app/playbooks/deploy.yml
--- a/app/stop.sh
+++ b/app/stop.sh
@@ -0,0 +1,3 @@
+
+#!/bin/bash
+ANSIBLE_LOG_PATH=./logs/ansible/$(date +%F)-ansible.log ansible-playbook ./installation/latest/app/playbooks/stop.yml
--- a/app/uninstall.sh
+++ b/app/uninstall.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+ansible-playbook ./installation/1.27.0/app/playbooks/uninstall.yml
--- a/app/update.sh
+++ b/app/update.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Usage: ./update.sh [version] [--force]
+
+onelab_version=""
+onelab_force_update=""
+
+for arg in "$@"; do
+  if [[ "$arg" == "--force" ]]; then
+    onelab_force_update="--force"
+  else
+    onelab_version="$arg"
+  fi
+done
+
+LOG_PATH="./logs/ansible/$(date +%F)-ansible.log"
+PLAYBOOK="./installation/1.27.0/app/playbooks/update.yml"
+EXTRA_VARS=()
+
+if [[ -n "$onelab_version" ]]; then
+  EXTRA_VARS+=("-e" "version=$onelab_version")
+fi
+if [[ -n "$onelab_force_update" ]]; then
+  EXTRA_VARS+=("-e" "userchoice=yes")
+fi
+
+ANSIBLE_LOG_PATH="$LOG_PATH" ansible-playbook "$PLAYBOOK" "${EXTRA_VARS[@]}"
				`@@ -0,0 +1 @@`
				`[rabbitmq_auth_backend_http, rabbitmq_auth_backend_cache, rabbitmq_management, rabbitmq_event_exchange].`