From 03797a34dbe885678865018eef991d3f3e66d01b Mon Sep 17 00:00:00 2001 From: 3wc <3wc@doesthisthing.work> Date: Mon, 18 Nov 2024 15:59:07 -0500 Subject: [PATCH 01/10] Work towards custom CSS in volume --- abra.sh | 1 + compose.css-volume.yml | 21 +++++++++++++++++++++ entrypoint-css-volume.sh | 5 +++++ 3 files changed, 27 insertions(+) create mode 100644 compose.css-volume.yml create mode 100644 entrypoint-css-volume.sh diff --git a/abra.sh b/abra.sh index d8805ff..a614e3f 100644 --- a/abra.sh +++ b/abra.sh @@ -18,6 +18,7 @@ export HEDGEDOC_CONFIG_VERSION=v1 export MONITORING_CONFIG_VERSION=v2 export DB_ENTRYPOINT_VERSION=v1 export PG_BACKUP_VERSION=v2 +export ENTRYPOINT_CSS_VERSION=v1 customize() { if [ -z "$1" ] diff --git a/compose.css-volume.yml b/compose.css-volume.yml new file mode 100644 index 0000000..b2eaf47 --- /dev/null +++ b/compose.css-volume.yml @@ -0,0 +1,21 @@ +--- +version: "3.8" + +services: + app: + user: root + volumes: + - "custom_css:/css" + entrypoint: /docker-entrypoint.sh + configs: + - source: entrypoint_css + target: /docker-entrypoint.sh + mode: 0555 + +volumes: + custom_css: + +configs: + entrypoint_css: + name: ${STACK_NAME}_entrypoint_css_${ENTRYPOINT_CSS_VERSION} + file: entrypoint-css-volume.sh diff --git a/entrypoint-css-volume.sh b/entrypoint-css-volume.sh new file mode 100644 index 0000000..fa7897b --- /dev/null +++ b/entrypoint-css-volume.sh @@ -0,0 +1,5 @@ +#!/bin/sh + +cp -f /css/custom.css /web/dist/ + +su $(id -un 1000) -s /bin/bash -c 'dumb-init -- ak server' From fc846af1e3dbd6667547f9e9684fa2ad8c804793 Mon Sep 17 00:00:00 2001 From: knoflook Date: Tue, 3 Dec 2024 16:39:32 +0100 Subject: [PATCH 02/10] don't create a new volume --- compose.css-volume.yml | 2 -- entrypoint-css-volume.sh | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/compose.css-volume.yml b/compose.css-volume.yml index b2eaf47..ff9307f 100644 --- a/compose.css-volume.yml +++ b/compose.css-volume.yml @@ -4,8 +4,6 @@ version: "3.8" services: app: user: root - volumes: - - "custom_css:/css" entrypoint: /docker-entrypoint.sh configs: - source: entrypoint_css diff --git a/entrypoint-css-volume.sh b/entrypoint-css-volume.sh index fa7897b..cf0afce 100644 --- a/entrypoint-css-volume.sh +++ b/entrypoint-css-volume.sh @@ -1,5 +1,5 @@ #!/bin/sh -cp -f /css/custom.css /web/dist/ +cp -f /web/dist/assets/custom.css /web/dist/custom.css su $(id -un 1000) -s /bin/bash -c 'dumb-init -- ak server' From e2a8f2340f5769857a7797bd0ffd60869388fafa Mon Sep 17 00:00:00 2001 From: knoflook Date: Tue, 3 Dec 2024 17:06:22 +0100 Subject: [PATCH 03/10] update .env.sample and drop unused volume --- .env.sample | 8 +++++--- compose.css-volume.yml | 3 --- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/.env.sample b/.env.sample index 8cfd635..56c1781 100644 --- a/.env.sample +++ b/.env.sample @@ -47,9 +47,11 @@ SECRET_EMAIL_PASS_VERSION=v1 # EMAIL_SUBJECT="Account Recovery" # EMAIL_TOKEN_EXPIRY_MINUTES=30 -COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/" -COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/" -COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/" +## custom css and assets +#COMPOSE_FILE="$COMPOSE_FILE:compose.css-volume.yml" +#COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/" +#COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/" +#COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/" # Default CSS customisation # COMPOSE_FILE="$COMPOSE_FILE:compose.css.yml" diff --git a/compose.css-volume.yml b/compose.css-volume.yml index ff9307f..5e72a99 100644 --- a/compose.css-volume.yml +++ b/compose.css-volume.yml @@ -10,9 +10,6 @@ services: target: /docker-entrypoint.sh mode: 0555 -volumes: - custom_css: - configs: entrypoint_css: name: ${STACK_NAME}_entrypoint_css_${ENTRYPOINT_CSS_VERSION} From 40e613f861b3d016147bf1f16a22cc8b8e1ce180 Mon Sep 17 00:00:00 2001 From: 3wc <3wc@doesthisthing.work> Date: Tue, 7 Jan 2025 10:15:53 -0500 Subject: [PATCH 04/10] Updates in response to PR feedback --- .env.sample | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.env.sample b/.env.sample index 56c1781..43ee9a7 100644 --- a/.env.sample +++ b/.env.sample @@ -47,11 +47,14 @@ SECRET_EMAIL_PASS_VERSION=v1 # EMAIL_SUBJECT="Account Recovery" # EMAIL_TOKEN_EXPIRY_MINUTES=30 -## custom css and assets +## assets +COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/" +COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/" +COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/" + +# store custom CSS in a css-volume #COMPOSE_FILE="$COMPOSE_FILE:compose.css-volume.yml" -#COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/" -#COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/" -#COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/" +# NOTE: this causes the authentik container to run as `root` initially; it uses `su` to drop privileges but technically could introduce a security risk. proceed with caution! # Default CSS customisation # COMPOSE_FILE="$COMPOSE_FILE:compose.css.yml" From d494d3ea5f2b876e89ca4a85283dc1c701a9df2e Mon Sep 17 00:00:00 2001 From: Cassowary Date: Wed, 8 Jan 2025 10:09:12 -0800 Subject: [PATCH 05/10] Update .drone.yml --- .drone.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.drone.yml b/.drone.yml index 22dfa43..753aedc 100644 --- a/.drone.yml +++ b/.drone.yml @@ -47,7 +47,7 @@ steps: from_secret: drone_abra-bot_token fork: true repositories: - - coop-cloud/auto-recipes-catalogue-json + - toolshed/auto-recipes-catalogue-json trigger: event: tag From 6abe8e67d4a9fe41a4e2116a7f489fce74b90746 Mon Sep 17 00:00:00 2001 From: Moritz Date: Tue, 14 Jan 2025 19:56:17 +0100 Subject: [PATCH 06/10] add set_extra_icons function --- .env.sample | 3 +-- abra.sh | 20 ++++++++++++++++++++ icons/help.svg | 8 ++++++++ icons/support.svg | 12 ++++++++++++ 4 files changed, 41 insertions(+), 2 deletions(-) create mode 100644 icons/help.svg create mode 100644 icons/support.svg diff --git a/.env.sample b/.env.sample index e4e4609..f7b279f 100644 --- a/.env.sample +++ b/.env.sample @@ -131,5 +131,4 @@ COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/" # APP_ICONS="$APP_ICONS hedgedoc:~/.abra/recipes/authentik/icons/hedgedoc.png" # APPLICATIONS='{"Calendar": "https://nextcloud.example.com/apps/calendar/", "BBB": "https://nextcloud.example.com/apps/bbb/"}' -# APP_ICONS="$APP_ICONS Calendar:~/.abra/recipes/authentik/icons/calendar.svg" -# APP_ICONS="$APP_ICONS BBB:~/.abra/recipes/authentik/icons/bbb.png" +# EXTRA_ICONS={"Calendar": "~/.abra/recipes/authentik/icons/calendar.svg", "BBB": "~/.abra/recipes/authentik/icons/bbb.png"} diff --git a/abra.sh b/abra.sh index ddcb3df..7233976 100644 --- a/abra.sh +++ b/abra.sh @@ -192,6 +192,10 @@ done } set_icons(){ +if [ -n "$1" ] +then +APP_ICONS="$1" +fi for icon in $APP_ICONS; do app=$(echo $icon | cut -d ":" -f1) file_path=$(eval echo $(echo $icon | cut -d ":" -f2)) @@ -202,6 +206,22 @@ for icon in $APP_ICONS; do done } +set_extra_icons(){ + if [ -z "$EXTRA_ICONS" ] + then + echo "Variable EXTRA_ICONS is not set" + exit 1 + fi + export EXTRA_ICONS + icon_key_values=$(python3 -c " +import json +import os +for key, value in json.loads(os.environ['EXTRA_ICONS']).items(): + print(f'{key}:{value}') +") + set_icons "$icon_key_values" +} + set_app_icon() { TOKEN=$(cat /run/secrets/admin_token) python -c """ diff --git a/icons/help.svg b/icons/help.svg new file mode 100644 index 0000000..c1bcccf --- /dev/null +++ b/icons/help.svg @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/icons/support.svg b/icons/support.svg new file mode 100644 index 0000000..e54440a --- /dev/null +++ b/icons/support.svg @@ -0,0 +1,12 @@ + + + + support + + + + + + + + \ No newline at end of file From fa854f64904042139b8a3d411676fe3f0732571a Mon Sep 17 00:00:00 2001 From: Moritz Date: Tue, 14 Jan 2025 20:06:27 +0100 Subject: [PATCH 07/10] fix add_applications --- abra.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/abra.sh b/abra.sh index 7233976..e61cd95 100644 --- a/abra.sh +++ b/abra.sh @@ -159,11 +159,13 @@ print(f'{blueprint.name} enabled: {blueprint.enabled}') } add_applications(){ +export APPLICATIONS /manage.py shell -c """ import json -if '$APPLICATIONS' == '': +import os +if os.environ['APPLICATIONS'] == '': exit() -applications = json.loads('$APPLICATIONS') +applications = json.loads(os.environ['APPLICATIONS']) for name, url in applications.items(): print(f'Add {name}: {url}') app = Application.objects.filter(name=name).first() From bc62831e58a2c7521db14b9601727216292d19e9 Mon Sep 17 00:00:00 2001 From: Moritz Date: Thu, 16 Jan 2025 17:33:14 +0100 Subject: [PATCH 08/10] fix blueprints: add redirect_uris --- abra.sh | 22 +++++++++++----------- compose.matrix.yml | 1 + hedgedoc.yaml.tmpl | 5 ++++- kimai.yaml.tmpl | 2 +- matrix.yaml.tmpl | 3 +++ monitoring.yaml.tmpl | 3 +++ nextcloud.yaml.tmpl | 3 +++ outline.yaml.tmpl | 5 ++++- rallly.yaml.tmpl | 3 +++ vikunja.yaml.tmpl | 3 +++ wekan.yaml.tmpl | 3 +++ wordpress.yaml.tmpl | 3 +++ 12 files changed, 42 insertions(+), 14 deletions(-) diff --git a/abra.sh b/abra.sh index e61cd95..2687a5c 100644 --- a/abra.sh +++ b/abra.sh @@ -5,17 +5,17 @@ export FLOW_INVALIDATION_VERSION=v2 export FLOW_RECOVERY_VERSION=v1 export FLOW_TRANSLATION_VERSION=v3 export SYSTEM_BRAND_VERSION=v4 -export NEXTCLOUD_CONFIG_VERSION=v2 -export WORDPRESS_CONFIG_VERSION=v3 -export MATRIX_CONFIG_VERSION=v2 -export WEKAN_CONFIG_VERSION=v4 -export VIKUNJA_CONFIG_VERSION=v2 -export OUTLINE_CONFIG_VERSION=v3 -export KIMAI_CONFIG_VERSION=v2 -export ZAMMAD_CONFIG_VERSION=v3 -export RALLLY_CONFIG_VERSION=v3 -export HEDGEDOC_CONFIG_VERSION=v2 -export MONITORING_CONFIG_VERSION=v3 +export NEXTCLOUD_CONFIG_VERSION=v3 +export WORDPRESS_CONFIG_VERSION=v4 +export MATRIX_CONFIG_VERSION=v3 +export WEKAN_CONFIG_VERSION=v5 +export VIKUNJA_CONFIG_VERSION=v3 +export OUTLINE_CONFIG_VERSION=v4 +export KIMAI_CONFIG_VERSION=v3 +export ZAMMAD_CONFIG_VERSION=v4 +export RALLLY_CONFIG_VERSION=v4 +export HEDGEDOC_CONFIG_VERSION=v3 +export MONITORING_CONFIG_VERSION=v4 export DB_ENTRYPOINT_VERSION=v1 export PG_BACKUP_VERSION=v2 export ENTRYPOINT_CSS_VERSION=v1 diff --git a/compose.matrix.yml b/compose.matrix.yml index 79233b1..dd2075f 100644 --- a/compose.matrix.yml +++ b/compose.matrix.yml @@ -12,6 +12,7 @@ services: - matrix_secret environment: - ELEMENT_DOMAIN + - MATRIX_DOMAIN configs: - source: matrix target: /blueprints/matrix.yaml diff --git a/hedgedoc.yaml.tmpl b/hedgedoc.yaml.tmpl index eafa124..10b6007 100644 --- a/hedgedoc.yaml.tmpl +++ b/hedgedoc.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "HEDGEDOC_DOMAIN" }}/auth/oauth2/callback name: Hedgedoc property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] @@ -32,7 +35,7 @@ entries: state: present - attrs: - meta_launch_url: https://{{ env "HEDGEDOC_DOMAIN" }} + meta_launch_url: https://{{ env "HEDGEDOC_DOMAIN" }}/auth/oauth2 open_in_new_tab: true policy_engine_mode: any provider: !KeyOf hedgedoc_provider diff --git a/kimai.yaml.tmpl b/kimai.yaml.tmpl index ccc016d..844e852 100644 --- a/kimai.yaml.tmpl +++ b/kimai.yaml.tmpl @@ -37,7 +37,7 @@ entries: state: present - attrs: - meta_launch_url: https://{{ env "KIMAI_DOMAIN" }} + meta_launch_url: https://{{ env "KIMAI_DOMAIN" }}/auth/saml/login open_in_new_tab: true policy_engine_mode: any provider: !KeyOf kimai_provider diff --git a/matrix.yaml.tmpl b/matrix.yaml.tmpl index aa4e2ae..1d6717e 100644 --- a/matrix.yaml.tmpl +++ b/matrix.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "MATRIX_DOMAIN" }}/_synapse/client/oidc/callback name: Matrix property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/monitoring.yaml.tmpl b/monitoring.yaml.tmpl index 7c1942b..3c88d6a 100644 --- a/monitoring.yaml.tmpl +++ b/monitoring.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "MONITORING_DOMAIN" }}/login/generic_oauth name: Monitoring property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/nextcloud.yaml.tmpl b/nextcloud.yaml.tmpl index af62a9e..33bdb68 100644 --- a/nextcloud.yaml.tmpl +++ b/nextcloud.yaml.tmpl @@ -28,6 +28,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "NEXTCLOUD_DOMAIN" }}/apps/sociallogin/custom_oidc/authentik name: Nextcloud property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/outline.yaml.tmpl b/outline.yaml.tmpl index ec72b2e..a388a16 100644 --- a/outline.yaml.tmpl +++ b/outline.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "OUTLINE_DOMAIN" }}/auth/oidc.callback name: Outline property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] @@ -32,7 +35,7 @@ entries: state: present - attrs: - meta_launch_url: https://{{ env "OUTLINE_DOMAIN" }} + meta_launch_url: https://{{ env "OUTLINE_DOMAIN" }}/auth/oidc open_in_new_tab: true policy_engine_mode: any provider: !KeyOf outline_provider diff --git a/rallly.yaml.tmpl b/rallly.yaml.tmpl index 8e26c40..a1a649a 100644 --- a/rallly.yaml.tmpl +++ b/rallly.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "RALLLY_DOMAIN" }}/api/auth/callback/oidc name: Rallly property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/vikunja.yaml.tmpl b/vikunja.yaml.tmpl index ab7af08..5267035 100644 --- a/vikunja.yaml.tmpl +++ b/vikunja.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "VIKUNJA_DOMAIN" }}/auth/openid/authentik name: Vikunja property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/wekan.yaml.tmpl b/wekan.yaml.tmpl index a9549f8..a2c70de 100644 --- a/wekan.yaml.tmpl +++ b/wekan.yaml.tmpl @@ -33,6 +33,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "WEKAN_DOMAIN" }}/_oauth/oidc name: Wekan property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] diff --git a/wordpress.yaml.tmpl b/wordpress.yaml.tmpl index 7624908..91c8c2c 100644 --- a/wordpress.yaml.tmpl +++ b/wordpress.yaml.tmpl @@ -16,6 +16,9 @@ entries: client_type: confidential include_claims_in_id_token: true issuer_mode: per_provider + redirect_uris: + - matching_mode: strict + url: https://{{ env "WORDPRESS_DOMAIN" }}/openid-connect-authorize name: Wordpress property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]] From 5df1f34cd76e52239b932e71a5a50947e6e6316d Mon Sep 17 00:00:00 2001 From: Moritz Date: Mon, 20 Jan 2025 21:04:46 +0100 Subject: [PATCH 09/10] UX: rename matrix to element --- matrix.yaml.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/matrix.yaml.tmpl b/matrix.yaml.tmpl index 1d6717e..d5195d6 100644 --- a/matrix.yaml.tmpl +++ b/matrix.yaml.tmpl @@ -39,10 +39,10 @@ entries: open_in_new_tab: true policy_engine_mode: any provider: !KeyOf matrix_provider - slug: matrix + name: Element conditions: [] id: matrix_application identifiers: - name: Matrix + slug: matrix model: authentik_core.application state: present From d0c924a864178868ae6a02a4cbec528369bbbe43 Mon Sep 17 00:00:00 2001 From: Moritz Date: Mon, 20 Jan 2025 21:32:38 +0100 Subject: [PATCH 10/10] chore: publish 6.11.1+2024.10.5 release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 391365f..0f08c9e 100644 --- a/compose.yml +++ b/compose.yml @@ -72,7 +72,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.customFrameOptionsValue=SAMEORIGIN" - "traefik.http.middlewares.${STACK_NAME}-frameOptions.headers.contentSecurityPolicy=frame-ancestors ${X_FRAME_OPTIONS_ALLOW_FROM}" - - "coop-cloud.${STACK_NAME}.version=6.11.0+2024.10.5" + - "coop-cloud.${STACK_NAME}.version=6.11.1+2024.10.5" - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}" worker: