moved IMAGE_VERSION in extra compose-file

Reviewed-on: #2

.env.sample

@@ -1,27 +1,54 @@
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_ADMIN_PASSWORD_VERSION=v1
 SECRET_SIGNING_SECRET_VERSION=v1
-SECRET_SMTP_PASSWORD_VERSION=v1
 
 TYPE=directus
 
 DOMAIN=directus.example.com
 
-#IMAGE_VERSION=11.13.1
-
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.directus.example.com`'
 
 LETS_ENCRYPT_ENV=production
 
+COMPOSE_FILE="compose.yml"
+
 ENABLE_BACKUPS=true
 
 ADMIN_EMAIL=mail@example.com
 
 # if you don't use smtp, sendmail is used
-# EMAIL_TRANSPORT=smtp
-#EMAIL_FROM=noreply@example.com
+# COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
+# SECRET_SMTP_PASSWORD_VERSION=v1
+# EMAIL_FROM=noreply@example.com
 # EMAIL_SMTP_USER=
 # EMAIL_SMTP_HOST=mailhost.com
 # EMAIL_SMTP_PORT=465
-# EMAIL_SMTP_SECURE=true
+# EMAIL_SMTP_SECURE=true
+
+
+## SSO (via OpenId)
+ 
+# Details about env-vars, the once below are necessary, others can be used as well: 
+# https://directus.io/docs/configuration/auth-sso#openid-connect
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.oidc.yml"
+#SECRET_OIDC_SECRET_VERSION=v1
+
+#AUTH_DISABLE_DEFAULT="false"
+#AUTH_SSO_LABEL="Single-Sign On"
+#AUTH_SSO_CLIENT_ID="<your-client-id>"
+#AUTH_SSO_ISSUER_URL="<your-.wellknown-issuer-url"
+#AUTH_SSO_ALLOW_PUBLIC_REGISTRATION="true"
+#AUTH_SSO_DEFAULT_ROLE_ID="<UUID-of-a-user-role>"
+#AUTH_SSO_SYNC_USER_INFO="true"
+#AUTH_SSO_SCOPE="openid profile email"
+#AUTH_SSO_ROLE_MAPPING='json:{"sso_role1": "directus-role-uuid","sso_role2": "directus-role-uuid"}'
+
+# https://directus.io/docs/configuration/auth-sso
+# if you need more/other provider(s), consult docs on how to override compose.yml:
+# https://docs.coopcloud.tech/operators/handbook/#how-can-i-modifyoverride-the-composeyml-file
+
+## Custom Image Version
+# COMPOSE_FILE="$COMPOSE_FILE:compose.customversion.yml"
+# IMAGE_VERSION=11.13.1

README.md

@@ -1,26 +1,78 @@
 # directus
 
-> Directus is a (headless) CMS / backend system for managing data and creating APIs.
+> Directus is an open-source headless CMS & API for managing agnostic content.
 
 <!-- metadata -->
 
+* **Maintainer**: [@val](https://git.coopcloud.tech/val)
+* **Status**: `testing`
 * **Category**: Apps
-* **Status**: 0
 * **Image**: [`directus`](https://hub.docker.com/r/directus), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: Yes
-* **Email**: No
+* **Email**: Yes
 * **Tests**: No
-* **SSO**: No
+* **SSO**: Yes
 
 <!-- endmetadata -->
 
 ## Quick start
 
 * `abra app new directus`
-* `abra app secret insert <app-name> smtp_password v1 <your-smtp-password>`
 * `abra app secret generate <app-name> --all`
 * `abra app config <app-name>`
 * `abra app deploy <app-name>`
 
 For more, see [`docs.coopcloud.tech`](https://docs.coopcloud.tech).
+
+
+## Additional configs
+
+### smtp
+By default `sendmail` is configured. To use SMTP uncomment the respective section in your .env-file and insert the smtp-secret:
+* `abra app secret insert <app-name> smtp_password v1 <your-smtp-password>`
+
+By this you make usage of [compose.smtp.yml](compose.smtp.yml)
+
+### sso (oidc)
+The config of one oidc-provider is prepared. Just uncomment an fill in the respective part in .env-file. By this you make usage of [compose.oidc.yml](compose.oidc.yml). If you need further providers, consider [adding a custom compose-file](https://docs.coopcloud.tech/operators/handbook/#how-can-i-modifyoverride-the-composeyml-file) containing the necessary env-vars as indicated in the directus' docs.
+
+
+### using the directus' cli for templates
+In [abra.sh](abra.sh) you find some commands you can run with `abra app cmd` for usage of directus' cli (e.g.) for exporting and importing a schema / template / data ...
+
+
+### setting custom .env-vars / secrets
+Automation in directus is a mighty tool to customize your CMS. If you need to pass a custom env-var or secret, you can do so by [adding a custom compose-file](https://docs.coopcloud.tech/operators/handbook/#how-can-i-modifyoverride-the-composeyml-file).
+
+This is a working example. Make sure you add all your env-vars, that you want to be able to access in flows to the comma separated env-var `FLOWS_ENV_ALLOW_LIST` like explained [here](https://directus.io/docs/configuration/flows).
+
+`directus.compose.customenv.yml`
+```
+services:
+  app:
+    environment:
+      FLOWS_ENV_ALLOW_LIST: "API_USER,API_TOKEN"
+      API_USER: "MyApiUser" 
+      API_TOKEN_FILE: /run/secrets/api_token
+
+    secrets:
+      - api_token
+      
+
+secrets:
+  api_token:
+    name: ${STACK_NAME}_oidc_secret_${SECRET_API_TOKEN_VERSION}
+    external: true
+```
+
+in your `env-file` you would add:
+
+```
+# custom secrets
+COMPOSE_FILE="compose.yml:../../servers/<yourserver>/directus.compose.customenv.yml"
+
+SECRET_API_TOKEN_VERSION=v1
+```
+
+and then redeploy: `abra app deploy -f <app-name>`

abra.sh

@@ -1,6 +1,6 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export DIRECTUS_ENTRYPOINT_VERSION=v3
+export DIRECTUS_ENTRYPOINT_VERSION=v5
 export PG_BACKUP_VERSION=v1
 
 # essentially a wrapper for directus-template-cli apply:

compose.customversion.yml

@@ -0,0 +1,3 @@
+services:
+  app:
+    image: directus/directus:${IMAGE_VERSION}

compose.oidc.yml

@@ -0,0 +1,31 @@
+---
+services:
+  app:
+    environment:
+      AUTH_PROVIDERS: "sso"
+      AUTH_DISABLE_DEFAULT: "${AUTH_DISABLE_DEFAULT:-false}"
+      AUTH_SSO_DRIVER: "openid"
+      AUTH_SSO_CLIENT_ID: ${AUTH_SSO_CLIENT_ID}
+      AUTH_SSO_CLIENT_SECRET_FILE: /run/secrets/oidc_secret
+      AUTH_SSO_ISSUER_URL: ${AUTH_SSO_ISSUER_URL}
+      AUTH_SSO_SCOPE: ${AUTH_SSO_SCOPE:-"openid profile email"}
+      AUTH_SSO_IDENTIFIER_KEY: ${AUTH_SSO_IDENTIFIER_KEY}
+      AUTH_SSO_ALLOW_PUBLIC_REGISTRATION: ${AUTH_SSO_ALLOW_PUBLIC_REGISTRATION:-false}
+      AUTH_SSO_REQUIRE_VERIFIED_EMAIL: ${AUTH_SSO_REQUIRE_VERIFIED_EMAIL:-false}
+      AUTH_SSO_DEFAULT_ROLE_ID: ${AUTH_SSO_DEFAULT_ROLE_ID}
+      AUTH_SSO_SYNC_USER_INFO: ${AUTH_SSO_SYNC_USER_INFO:-true}
+      AUTH_SSO_ROLE_MAPPING: ${AUTH_SSO_ROLE_MAPPING}
+      AUTH_SSO_GROUP_CLAIM_NAME: ${AUTH_SSO_GROUP_CLAIM_NAME:-groups}
+      AUTH_SSO_ICON: ${AUTH_SSO_ICON:-account_circle}
+      AUTH_SSO_LABEL: ${AUTH_SSO_LABEL:-"Single Sign On"}
+      AUTH_SSO_PARAMS: ${AUTH_SSO_PARAMS:-{}}
+      AUTH_SSO_REDIRECT_ALLOW_LIST: ${AUTH_SSO_REDIRECT_ALLOW_LIST}
+
+    secrets:
+      - oidc_secret
+      
+secrets:
+  oidc_secret:
+    name: ${STACK_NAME}_oidc_secret_${SECRET_OIDC_SECRET_VERSION}
+    external: true
+

compose.smtp.yml

@@ -0,0 +1,20 @@
+---
+services:
+  app:
+    environment:
+      EMAIL_TRANSPORT: "smtp"
+      EMAIL_FROM: ${EMAIL_FROM}
+      EMAIL_SMTP_USER: ${EMAIL_SMTP_USER}
+      EMAIL_SMTP_HOST: ${EMAIL_SMTP_HOST}
+      EMAIL_SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
+      EMAIL_SMTP_SECURE: ${EMAIL_SMTP_SECURE:-true}
+      EMAIL_SMTP_PASSWORD_FILE: /run/secrets/smtp_password
+
+    secrets:
+      - smtp_password
+
+secrets:
+  smtp_password:
+    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
+    external: true
+

compose.yml

@@ -1,7 +1,7 @@
 ---
 services:
   app:
-    image: directus/directus:${IMAGE_VERSION:-11}
+    image: directus/directus:11.16.1
 
     environment:
       DB_CLIENT: pg
@@ -24,13 +24,6 @@ services:
 
       PUBLIC_URL: https://${DOMAIN}
 
-      EMAIL_TRANSPORT: ${EMAIL_TRANSPORT}
-      EMAIL_FROM: ${EMAIL_FROM}
-      EMAIL_SMTP_USER: ${EMAIL_SMTP_USER}
-      EMAIL_SMTP_HOST: ${EMAIL_SMTP_HOST}
-      EMAIL_SMTP_PORT: ${EMAIL_SMTP_PORT}
-      EMAIL_SMTP_SECURE: ${EMAIL_SMTP_SECURE}
-
     networks:
       - proxy
       - internal
@@ -54,7 +47,6 @@ services:
       - db_password
       - admin_password
       - signing_secret
-      - smtp_password
       
     deploy:
       restart_policy:
@@ -70,7 +62,7 @@ services:
         ## Redirect HTTP to HTTPS
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
-        - "coop-cloud.${STACK_NAME}.version=0.3.0+11"
+        - "coop-cloud.${STACK_NAME}.version=0.5.0+11.15.1"
 
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://0.0.0.0:8055/server/health | grep -q '\"status\":\"ok\"'"]
@@ -143,9 +135,6 @@ secrets:
   signing_secret:
     name: ${STACK_NAME}_signing_secret_${SECRET_SIGNING_SECRET_VERSION}
     external: true
-  smtp_password:
-    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
-    external: true
 
 configs:
   directus_entrypoint:

entrypoint.sh

@@ -14,15 +14,16 @@ load_secret() {
         fi
         export "$env_var"="$value"
     else
-        echo >&2 "error: $secret_file does not exist"
-        exit 1
+        echo >&2 "[info] didn't set $env_var because $secret_file does not exist. If you don't use the secret or it is no secret at all you can safely ignore this message."
     fi
 }
 
-load_secret "DB_PASSWORD" "/run/secrets/db_password"
-load_secret "ADMIN_PASSWORD" "/run/secrets/admin_password"
-load_secret "SIGNING_SECRET" "/run/secrets/signing_secret"
-load_secret "EMAIL_SMTP_PASSWORD" "/run/secrets/smtp_password"
+# load every env-var that ends on _FILE
+for var in $(env | grep "_FILE="); do
+    key=$(echo "$var" | sed 's/_FILE=.*//')
+    value=$(echo "$var" | sed 's/.*_FILE=//')
+    load_secret "$key" "$value"
+done
 
 # upstream has no entrypoint https://github.com/directus/directus/blob/main/Dockerfile
 node cli.js bootstrap && pm2-runtime start ecosystem.config.cjs

release/0.3.1+11

@@ -0,0 +1 @@
+added example env for sso

release/0.4.0+11

@@ -0,0 +1 @@
+compare release notes of 0.3.0 – some recipe upgrading issues

release/0.4.1+11

@@ -0,0 +1 @@
+syntax error in oidc compose when using role_mapping

release/0.5.0+11.15.1

@@ -0,0 +1,2 @@
+switched to fixed image versions as there seem to be breaking changes in minor versions.
+added docs on SSO, SMTP, directus-cli, custom env-vars for flows, so check out README.md if you need these.

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}