Dependency Track module

[gsanchietti]

Create a NethServer 8 Module for Dependency Track with Traefik Integration.
The module will be published inside the NethForge repository.

1. Why:
   Managing software supply chain security is critical for modern infrastructure. Dependency Track is a powerful tool for tracking software components and identifying vulnerabilities via SBOMs (Software Bill of Materials). However, deploying and managing it on NethServer 8 is currently complex and requires manual steps.

2. Purpose:
   The purpose of this feature is to simplify and automate the deployment and management of Dependency-Track on NethServer 8. By providing a dedicated module, administrators can easily set up Dependency-Track with secure access, integrated with NethServer’s Traefik reverse proxy and Let's Encrypt for SSL, all managed from the Web UI.

Proposed solution

Develop a NethServer 8 module that:

• Deploys Dependency-Track (API server, frontend, PostgreSQL, Trivy) as Podman containers.
• Integrates Dependency-Track with Traefik to serve the frontend and API via a user-defined virtual host on HTTPS (port 443).
  • Frontend served at the root path (https://<virtualhost>/)
  • API served at /api (https://<virtualhost>/api)
• Provides a simple Cockpit UI with:
  • Virtual host input field (e.g., dependencytrack.gs.nethserver.net)
  • Toggle for Let's Encrypt automatic certificate generation
  • Display of default credentials (admin/admin)
• Manages Podman networks, persistent volumes, environment variables, and secure credentials.
• Handles container lifecycle (start, stop, update) gracefully, ensuring correct startup order and dependencies.
• Optionally generates systemd unit files for persistent and managed container operation.
• Includes clear post-deployment instructions for first login, API key creation, and security best practices.

See also

• Requirements analysis for a full description and a working docker compose example

[gsanchietti]

Tested the version merged on main branch.
The module works well, and it's is also possible to update the SBOMs using APIs.
Trivy and Dependency Track dashboards are updating regularly.

Minor things that require a fix:

• Backend: LDAP integration is not working, DT UI does not show users from LDAP server
• UI: LDAP domain label, should be something like User domain
• UI: the user domain is mandatory even if it does not work: I'd make it optional

If the LDAP integration is too hard to implement, we can just drop the feature.