<?xml version="1.0" encoding="utf-8"?>
<!-- devrait posséder un numéro supérieur à **-sso-client.xml -->

<creole>

    <files>
        <service>ead-server</service>
        <service_access service='ead_server'>
            <port service_accesslist='ead_server'>4201</port>
            <port service_accesslist='ead_server'>4202</port>
        </service_access>
        <service_restriction service='ead_server'>
            <ip interface='eth0' netmask='netmask_frontend_ead_distant_eth0' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_frontend_ead_distant_eth0</ip>
            <ip interface='eth1' netmask='netmask_frontend_ead_distant_eth1' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_frontend_ead_distant_eth1</ip>
            <ip interface='eth2' netmask='netmask_frontend_ead_distant_eth2' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_frontend_ead_distant_eth2</ip>
            <ip interface='eth3' netmask='netmask_frontend_ead_distant_eth3' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_frontend_ead_distant_eth3</ip>
            <ip interface='eth4' netmask='netmask_frontend_ead_distant_eth4' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_frontend_ead_distant_eth4</ip>
        </service_restriction>
        <service servicelist='ead_web'>ead-web</service>
        <service_access service='ead_web'>
            <port>4200</port>
            <port port_type='SymLinkOption'>port_ead_reverseproxy</port>
        </service_access>
        <service_restriction service='ead_web'>
            <ip interface='eth0' netmask='netmask_admin_eth0' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_admin_eth0</ip>
            <ip interface='eth1' netmask='netmask_admin_eth1' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_admin_eth1</ip>
            <ip interface='eth2' netmask='netmask_admin_eth2' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_admin_eth2</ip>
            <ip interface='eth3' netmask='netmask_admin_eth3' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_admin_eth3</ip>
            <ip interface='eth4' netmask='netmask_admin_eth4' netmask_type='SymLinkOption' ip_type='SymLinkOption'>ip_admin_eth4</ip>
        </service_restriction>
        <file name="/var/lib/eole/config/ead.cfg"/>
    </files>

    <variables>
        <family name='services'>
            <variable name='activer_ead_web' type='oui/non' description="Activer l'interface web de l'EAD" mode="expert">
                <value>oui</value>
            </variable>
            <variable name='acces_distant_backend_ead' type='oui/non' description="Autoriser l'utilisation du backend EAD par des frontend EAD distants"/>
        </family>
        <family name='ead-web' mode='expert' icon='gear'>
            <variable name='activer_ead_reverseproxy' type='oui/non' description="Activer l'interface web de l'EAD sur un second port">
                <value>non</value>
            </variable>
            <variable name='port_ead_reverseproxy' type='port' description="Port d'accès EAD personnalisé">
                <value>4203</value>
            </variable>
        </family>
        <family name='eole sso'>
            <variable name='ead_sso' type='oui/non' description="Utiliser l'authentification SSO pour l'EAD" mode='expert'>
                <value>oui</value>
            </variable>
        </family>
    </variables>

    <constraints>
        <auto name='calc_multi_condition' target='acces_distant_backend_ead'>
            <param>non</param>
            <param type='eole' name='condition_0'>frontend_ead_distant_eth0</param>
            <param type='eole' name='condition_1' hidden='False'>frontend_ead_distant_eth1</param>
            <param type='eole' name='condition_2' hidden='False'>frontend_ead_distant_eth2</param>
            <param type='eole' name='condition_3' hidden='False'>frontend_ead_distant_eth3</param>
            <param type='eole' name='condition_4' hidden='False'>frontend_ead_distant_eth4</param>
            <param name='match'>non</param>
            <param name='mismatch'>oui</param>
        </auto>
        <condition name='disabled_if_in' source='activer_ead_web'>
            <param>non</param>
            <target type='servicelist'>ead_web</target>
            <target type='family'>ead-web</target>
        </condition>
        <condition name='disabled_if_in' source='activer_firewall'>
            <param>non</param>
            <target type='variable'>acces_distant_backend_ead</target>
        </condition>
        <condition name='disabled_if_in' source='acces_distant_backend_ead'>
            <param>non</param>
            <target type='service_accesslist'>ead_server</target>
        </condition>
        <condition name='disabled_if_in' source='activer_ead_reverseproxy'>
            <param>non</param>
            <target type='variable'>port_ead_reverseproxy</target>
        </condition>
        <condition name='disabled_if_in' source='activer_sso' fallback='True'>
            <param>non</param>
            <target type='variable'>ead_sso</target>
        </condition>
        <check name="valid_differ" target="port_ead_reverseproxy">
            <param>4200</param>
        </check>
    </constraints>

    <help>
        <family name='ead-web'>Paramétrage avancé de l'interface web EAD</family>
        <variable name='acces_distant_backend_ead'>Ouverture des ports 4201 et 4202 pour permettre à un frontend EAD distant d'utiliser le backend EAD de ce serveur</variable>
        <variable name='activer_ead_web'>L'EAD est une interface simplifiée de gestion du serveur</variable>
        <variable name='activer_ead_reverseproxy'>Ce second port peut, par exemple, permettre d'accéder à l'interface depuis l'extérieur si un proxy inverse est utilisé</variable>
    </help>

</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
