feat: s3

Reviewed-on: #31
Reviewed-by: fauno <fauno@sutty.coop.ar>

.env.sample

@@ -57,3 +57,12 @@ COMPOSE_FILE="compose.yml"
 # Only present in config.json (no equivalent env var):
 # DOCUMENT_MAX_LENGTH=100000
 # CMD_ENABLE_UPLOADS=registered
+
+# S3 uploads
+#COMPOSE_FILE="$COMPOSE_FILE:compose.s3.yml"
+#CMD_S3_ACCESS_KEY_ID=
+#CMD_S3_REGION=garage
+#CMD_S3_BUCKET=$DOMAIN
+#CMD_S3_ENDPOINT=
+#CMD_S3_FOLDER=uploads
+#SECRET_S3_SECRET_ACCESS_KEY_VERSION=v1

MAINTENANCE.md

@@ -0,0 +1,32 @@
+# Hedgedoc Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a
+certain quality and consistency, that others can rely on.
+
+## Maintainer Responsibilities
+
+A recipe maintainer has the following responsibilities:
+
+- Respond to pull requests / issues within two weeks
+- Make image security updates within a week
+- Make image major updates every three months
+
+In order to fullfill these responsibilities a recipe maintainer:
+
+- Has to watch the repository (to get notifications)
+- Needs to make sure renovate is configured properly
+
+## Pull Requests
+
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+1. Watch the repository to always get updates
+2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
+3. Once the pull request gets merged you will be added to the [hedgedoc maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/hedgedoc-maintainers).
+4. Join the room [#cc-|-hedgedoc-maintenance:matrix.org](#cc-|-hedgedoc-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -5,8 +5,9 @@
 [Hedgedoc][hedegedoc] using Coöp Cloud ♥
 
 <!-- metadata -->
+* **Maintainer**: [@fauno](https://git.coopcloud.tech/fauno) , Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Category**: Apps
-* **Status**: 2, beta
+* **Status**: 3
 * **Image**: [`quay.io/hedgedoc/hedgedoc`](https://quay.io/hedgedoc/hedgedoc), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: Yes

abra.sh

@@ -1,3 +1,3 @@
-export ENTRYPOINT_CONF_VERSION=v13
+export ENTRYPOINT_CONF_VERSION=v14
 export CONFIG_JSON_VERSION=v1
 export PG_BACKUP_VERSION=v1

compose.s3.yml

@@ -0,0 +1,17 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      - CMD_S3_ACCESS_KEY_ID
+      - CMD_S3_REGION
+      - CMD_S3_BUCKET
+      - CMD_S3_ENDPOINT
+      - CMD_S3_FOLDER
+      - CMD_S3_PUBLIC_FILES=false
+    secrets:
+      - s3_secret_access_key
+secrets:
+  s3_secret_access_key:
+    external: true
+    name: ${STACK_NAME}_s3_secret_access_key_${SECRET_S3_SECRET_ACCESS_KEY_VERSION}

compose.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   app:
-    image: quay.io/hedgedoc/hedgedoc:1.10.8
+    image: quay.io/hedgedoc/hedgedoc:1.12.0
     environment:
       - CMD_USECDN=false
       - CMD_URL_ADDPORT=false
@@ -58,7 +58,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirecthostname.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirecthostname.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=3.0.10+1.10.8"
+        - "coop-cloud.${STACK_NAME}.version=3.2.0+1.12.0"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
     healthcheck:
       test: 'nodejs -e "http.get(''http://localhost:3000'', (res) => { console.log(''status: '', res.statusCode); if (res.statusCode == 200) { process.exit(0); } else { process.exit(1); } });"'

entrypoint.sh.tmpl

@@ -27,6 +27,7 @@ load_vars() {
   fi
   file_env "CMD_OAUTH2_CLIENT_SECRET"
   file_env "CMD_SESSION_SECRET"
+  file_env "CMD_S3_SECRET_ACCESS_KEY"
 }
 
 main() {

release/3.1.0+1.11.0

@@ -0,0 +1 @@
+Important CVE fixes

renovate.json

@@ -2,5 +2,6 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:base"
-  ]
+  ],
+  "reviewers": ["fauno","moritz","simon","carla"]
 }