chore: Pin mc-iam-manager and mc-web-console 0.7.2, sync bundled config copies, automate Let's Encrypt renewal

README.md

@@ -324,44 +324,39 @@ When you switch from Mode A (self-signed cert) to Mode B (Let's Encrypt) using t
 
 ## TLS Certificate Auto-Renewal (Mode B)
 
-When running in Mode B (Let's Encrypt), certbot renews the certificate automatically via `systemd certbot.timer` (twice daily). The certificate is renewed 30 days before expiry.
+Let's Encrypt certificates are valid for 90 days. The certificate is stored in the container volume `conf/docker/container-volume/mc-iam-manager/certs` (mounted into `mc-iam-manager-nginx`), **not** in the host's `/etc/letsencrypt`, so a host certbot or `certbot.timer` does not renew it.
 
-### Webroot setup (required once after installation)
+`conf/docker/scripts/renew-cert.sh` renews it with the certbot container:
+- `mc-iam-manager-nginx` running → **webroot** (nginx keeps serving `/.well-known/acme-challenge/`, no downtime), then `nginx -s reload`
+- `mc-iam-manager-nginx` not running → **standalone** (certbot binds port 80)
 
-Mode B uses the **webroot** authenticator so nginx keeps running during renewal. If your installation used the `standalone` authenticator (older setup), switch it once:
+Port 80 must be reachable from the internet for the HTTP-01 challenge.
 
-```shell
-sudo certbot certonly \
-  --webroot \
-  -w <mc-admin-cli-path>/conf/docker/container-volume/certbot/www \
-  -d <your-domain> \
-  --force-renewal
-```
+### Automatic renewal (cron)
+
+`installAll.sh -m prod` registers `/etc/cron.d/mcmp-cert-renew` (twice daily; certbot renews only within 30 days of expiry). Log: `/var/log/mcmp-cert-renew.log`.
 
-Verify the renewal config was updated:
+For installations made before this was added, register it once:
 
 ```shell
-sudo grep "authenticator" /etc/letsencrypt/renewal/<your-domain>.conf
-# Expected: authenticator = webroot
+sudo conf/docker/scripts/renew-cert.sh --install-cron
 ```
 
-### Deploy hook — nginx reload after renewal
-
-After renewal, the new certificate must be loaded into the running nginx container. Install the deploy hook once:
+### Manual renewal / verification
 
 ```shell
-sudo cp conf/docker/scripts/certbot-deploy-hook.sh \
-     /etc/letsencrypt/renewal-hooks/deploy/reload-nginx-docker.sh
-sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx-docker.sh
+sudo conf/docker/scripts/renew-cert.sh --dry-run        # Expected: "all simulated renewals succeeded"
+sudo conf/docker/scripts/renew-cert.sh --force-renewal  # renew now (e.g. certificate already expired)
 ```
 
-### Verify auto-renewal
+Check the served certificate:
 
 ```shell
-sudo certbot renew --dry-run
-# Expected: "all simulated renewals succeeded"
+echo | openssl s_client -connect <your-domain>:443 -servername <your-domain> 2>/dev/null | openssl x509 -noout -dates
 ```
 
+> If you previously installed `certbot-deploy-hook.sh` or a host `certbot` for this domain, remove them — they do not touch the certificate nginx uses.
+
 ---
 
 ## Firewall Port Information

README_kr.md

@@ -267,44 +267,39 @@ Mode A(자체 서명 인증서) → Mode B(Let's Encrypt)로 같은 도메인을
 
 ## TLS 인증서 자동갱신 (Mode B)
 
-Mode B(Let's Encrypt) 실행 시 certbot이 `systemd certbot.timer`를 통해 하루 2회 자동갱신을 시도합니다. 만료 30일 전부터 갱신이 시작됩니다.
+Let's Encrypt 인증서의 유효기간은 90일입니다. 인증서는 호스트의 `/etc/letsencrypt`가 **아니라** 컨테이너 볼륨 `conf/docker/container-volume/mc-iam-manager/certs`(`mc-iam-manager-nginx`에 마운트)에 저장되므로, 호스트 certbot이나 `certbot.timer`로는 갱신되지 않습니다.
 
-### Webroot 방식 전환 (최초 1회 필요)
+`conf/docker/scripts/renew-cert.sh`가 certbot 컨테이너로 갱신합니다:
+- `mc-iam-manager-nginx` 실행 중 → **webroot** 방식(nginx가 `/.well-known/acme-challenge/`를 계속 서빙, 중단 없음) 후 `nginx -s reload`
+- `mc-iam-manager-nginx` 미실행 → **standalone** 방식(certbot이 80 포트 사용)
 
-Mode B는 갱신 중에도 nginx가 계속 실행될 수 있도록 **webroot** 인증 방식을 사용합니다. 기존 `standalone` 방식으로 설치된 경우 아래 명령으로 한 번 전환해야 합니다:
+HTTP-01 검증을 위해 80 포트가 인터넷에서 접근 가능해야 합니다.
 
-```shell
-sudo certbot certonly \
-  --webroot \
-  -w <mc-admin-cli 경로>/conf/docker/container-volume/certbot/www \
-  -d <your-domain> \
-  --force-renewal
-```
+### 자동갱신 (cron)
+
+`installAll.sh -m prod`가 `/etc/cron.d/mcmp-cert-renew`(하루 2회, 만료 30일 이내일 때만 실제 갱신)를 등록합니다. 로그: `/var/log/mcmp-cert-renew.log`
 
-전환 확인:
+이 기능 추가 이전에 설치한 환경은 한 번 등록합니다:
 
 ```shell
-sudo grep "authenticator" /etc/letsencrypt/renewal/<your-domain>.conf
-# 기대값: authenticator = webroot
+sudo conf/docker/scripts/renew-cert.sh --install-cron
 ```
 
-### Deploy Hook — 갱신 후 nginx 자동 reload
-
-인증서 갱신 후 nginx 컨테이너에 새 인증서를 즉시 적용하기 위한 deploy hook을 한 번 설치합니다:
+### 수동 갱신 / 검증
 
 ```shell
-sudo cp conf/docker/scripts/certbot-deploy-hook.sh \
-     /etc/letsencrypt/renewal-hooks/deploy/reload-nginx-docker.sh
-sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx-docker.sh
+sudo conf/docker/scripts/renew-cert.sh --dry-run        # 기대값: "all simulated renewals succeeded"
+sudo conf/docker/scripts/renew-cert.sh --force-renewal  # 즉시 갱신 (예: 이미 만료된 경우)
 ```
 
-### 자동갱신 검증
+적용된 인증서 확인:
 
 ```shell
-sudo certbot renew --dry-run
-# 기대값: "all simulated renewals succeeded"
+echo | openssl s_client -connect <your-domain>:443 -servername <your-domain> 2>/dev/null | openssl x509 -noout -dates
 ```
 
+> 이전 안내에 따라 `certbot-deploy-hook.sh`나 호스트 `certbot`을 이 도메인용으로 설치했다면 제거하세요. nginx가 사용하는 인증서에는 영향을 주지 않습니다.
+
 ---
 
 ## 방화벽 포트 정보

bin/installAll.sh

@@ -467,6 +467,12 @@ case $IAM_MODE in
                 echo "✓ Certificate generation completed."
                 # Reclaim ownership of volume directories created by the certbot container (runs as root)
                 sudo chown -R "$USER:$USER" ../conf/docker/container-volume
+                # Register automatic renewal (the certificate is valid for 90 days)
+                if sudo ../conf/docker/scripts/renew-cert.sh --install-cron; then
+                    echo "✓ Certificate auto-renewal registered (/etc/cron.d/mcmp-cert-renew)."
+                else
+                    echo "⚠ Failed to register certificate auto-renewal. Run manually: sudo ../conf/docker/scripts/renew-cert.sh --install-cron"
+                fi
             else
                 echo "❌ Error occurred during certificate generation."
                 exit 1

conf/api.yaml

@@ -11,7 +11,7 @@ services:
       password:
 
   mc-iam-manager:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-iam-manager:5000
     auth:
       type: bearer
@@ -25,7 +25,7 @@ services:
       password: spider
 
   mc-web-console:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-web-console:3000
     auth:
       type: bearer

conf/docker/api.yaml

@@ -11,7 +11,7 @@ services:
       password:
 
   mc-iam-manager:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-iam-manager:5000
     auth:
       type: bearer
@@ -25,7 +25,7 @@ services:
       password: spider
 
   mc-web-console:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-web-console:3000
     auth:
       type: bearer

conf/docker/conf/mc-iam-manager/permission.yaml

@@ -29,6 +29,7 @@ permissions:
       - connections
       - clouddrivers
       - cspaccounts
+      - cspdefinitions
       - cloudresources
       - serverspecs
       - serverimages

conf/docker/conf/mc-web-console/api/conf/api.yaml

@@ -11,7 +11,7 @@ services:
       password:
 
   mc-iam-manager:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-iam-manager:5000
     auth:
       type: bearer
@@ -25,7 +25,7 @@ services:
       password: default
 
   mc-web-console:
-    version: 0.7.1
+    version: 0.7.2
     baseurl: http://mc-web-console-api:3000
     auth:
       type: bearer
@@ -946,6 +946,10 @@ serviceActions:
       method: get
       resourcePath: /api/auth/temp-credential-csps
       description: 임시 자격 증명을 지원하는 CSP 목록 조회
+    GetTemporaryCredentials:
+      method: post
+      resourcePath: /api/workspaces/temporary-credentials
+      description: "로그인 사용자의 워크스페이스 역할에 매핑된 CSP Role로 CSP 임시 자격 증명 발급. body: {workspaceId, cspType, region, authMethod?}"
     Appendresourcepermissionpolicesbyoperationid:
       method: put
       resourcePath: /api/permission/framewrok/{framework}/operationid/{operationid}/append
@@ -1118,6 +1122,10 @@ serviceActions:
       method: put
       resourcePath: /api/users/me/password
       description: 사용자 본인 비밀번호 변경
+    GetMyWorkspaceRoles:
+      method: get
+      resourcePath: /api/users/me/workspace-roles
+      description: 로그인 사용자 본인의 워크스페이스별 역할 목록
     Createorganization:
       method: post
       resourcePath: /api/organizations

conf/docker/conf/mc-web-console/api/conf/webconsole_menu_resources.yaml

@@ -120,6 +120,14 @@ menus:
     priority: 4
     menunumber: 1205
 
+  - id: cspdefinitions
+    parentid: cloudsps
+    displayname: CSP Definitions
+    restype: menu
+    isaction: true
+    priority: 6
+    menunumber: 1207
+
   - id: cspaccounts
     parentid: cloudsps
     displayname: CSP Accounts

conf/docker/docker-compose.cert.yaml

@@ -1,7 +1,8 @@
 services:
 
-  # Certbot (for certificate issuance and renewal)
-  # This container is run once on demand.
+  # Certbot (initial certificate issuance)
+  # Run once by installAll.sh -m prod before the stack starts, so it uses standalone mode.
+  # Renewal is handled by scripts/renew-cert.sh (cron), which switches to webroot while nginx is running.
   mcmp-certbot:
     image: certbot/certbot:latest
     container_name: mcmp-certbot
@@ -10,6 +11,8 @@ services:
     volumes:
       # Stores Certbot config and issued certificates (read/write access required)
       - ./container-volume/mc-iam-manager/certs:/etc/letsencrypt
+      # Same webroot that mc-iam-manager-nginx serves for /.well-known/acme-challenge/
+      - ./container-volume/certbot/www:/var/www/certbot
     environment:
       MC_IAM_MANAGER_PUBLIC_DOMAIN: ${MC_IAM_MANAGER_PUBLIC_DOMAIN}
       MC_IAM_MANAGER_CERT_EMAIL: ${MC_IAM_MANAGER_CERT_EMAIL}

conf/docker/docker-compose.mini.yaml

@@ -221,7 +221,7 @@ services:
 
   mc-iam-manager:
     container_name: mc-iam-manager
-    image: cloudbaristaorg/mc-iam-manager:0.7.1
+    image: cloudbaristaorg/mc-iam-manager:0.7.2
     restart: unless-stopped
     networks:
       - mc-iam-manager-network
@@ -389,7 +389,7 @@ services:
             exec docker-entrypoint.sh postgres"
 
   mc-web-console-api:
-    image: cloudbaristaorg/mc-web-console-api:0.7.1
+    image: cloudbaristaorg/mc-web-console-api:0.7.2
     pull_policy: always
     container_name: mc-web-console-api
     platform: linux/amd64
@@ -438,7 +438,7 @@ services:
       <<: *default-health-check
 
   mc-web-console-front:
-    image: cloudbaristaorg/mc-web-console-front:0.7.1
+    image: cloudbaristaorg/mc-web-console-front:0.7.2
     pull_policy: always
     container_name: mc-web-console-front
     platform: linux/amd64

conf/docker/docker-compose.yaml

@@ -278,7 +278,7 @@ services:
 
   mc-iam-manager:
     container_name: mc-iam-manager
-    image: cloudbaristaorg/mc-iam-manager:0.7.1
+    image: cloudbaristaorg/mc-iam-manager:0.7.2
     restart: unless-stopped
     networks:
       - mc-iam-manager-network
@@ -1187,7 +1187,7 @@ services:
             exec docker-entrypoint.sh postgres"
 
   mc-web-console-api:
-    image: cloudbaristaorg/mc-web-console-api:0.7.1
+    image: cloudbaristaorg/mc-web-console-api:0.7.2
     pull_policy: always
     container_name: mc-web-console-api
     platform: linux/amd64
@@ -1231,7 +1231,7 @@ services:
       <<: *default-health-check
 
   mc-web-console-front:
-    image: cloudbaristaorg/mc-web-console-front:0.7.1
+    image: cloudbaristaorg/mc-web-console-front:0.7.2
     pull_policy: always
     container_name: mc-web-console-front
     platform: linux/amd64