Ocis should not have default secrets

[IljaN]

Description

To have a seamless first run experience we currently hard-code shared-secrets in to different services as default values:

https://github.com/owncloud/ocis-reva/blob/master/pkg/flagset/gateway.go#L79
https://github.com/search?q=org%3Aowncloud+Pive-Fumkiu4&type=Code

When running ocis server a admin who forgets to change this variable will use an insecure default configuration.

Proposal to fix this would be to create an "ocis init" command which for example could generate an .env file and required certificates and defaults. This would also remove all the default handling from the services and bundle it in to one place.

Additionally ocis init could abstract away the knowledge of how to set the same parameter across every single service. For example IDP/Issuer configuration could be configured once and the generated .env file or config would reflect the setting for every single service.

User Stories

• As a software vendor i want to prevent insecure ocis deployments

Value

Acceptance Criteria

• Ocis has empty default secrets
• Ocis refuses to start with empty secrets
• Ocis provides understandable error messages and a hint what to do next

Definition of ready

[ ] everybody needs to understand the value written in the user story
[ ] acceptance criteria has to be defined
[ ] all dependencies of the user story need to be identified
[ ] feature should be seen from an end user perspective
[ ] user story has to be estimated
[ ] story points need to be less then 20

Definition of done

• Functional requirements
  [ ] functionality described in the user story works
  [ ] acceptance criteria are fulfilled
• Quality
  [ ] codre review happened
  [ ] CI is green
  [ ] critical code received unit tests by the developer
  [ ] automated tests passed (if automated tests are not available, this test needs to be created and passed
• Non-functional requirements
  [ ] no sonar cloud issues

[wkloucek]

currently only covered by documentation: https://owncloud.dev/ocis/deployment/#secure-an-ocis-instance