feat: support both authentik and keycloak

.drone.yml

@@ -17,12 +17,11 @@ steps:
       DOMAIN: kimai.swarm-test.autonomic.zone
       STACK_NAME: kimai
       LETS_ENCRYPT_ENV: production
-      ENTRYPOINT_CONF_VERSION: v2
+      ENTRYPOINT_CONF_VERSION: v1
-      LOCAL_CONF_VERSION: v2
+      LOCAL_CONF_VERSION: v1
       SECRET_DB_PASSWORD_VERSION: v1
       SECRET_DB_ROOT_PASSWORD_VERSION: v1
       SECRET_ADMIN_PASSWORD_VERSION: v1
-      SECRET_SSO_CERT_VERSION: v1
 trigger:
   branch:
     - main
@@ -38,7 +37,7 @@ steps:
         from_secret: drone_abra-bot_token
       fork: true
       repositories:
-        - toolshed/auto-recipes-catalogue-json
+        - coop-cloud/auto-recipes-catalogue-json
 
 trigger:
   event: tag

.env.sample

@@ -5,17 +5,15 @@ DOMAIN=kimai.example.com
 #EXTRA_DOMAINS=', `www.kimai.example.com`'
 LETS_ENCRYPT_ENV=production
 
-ENABLE_BACKUPS=true
-
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_ADMIN_PASSWORD_VERSION=v1
-SECRET_SSO_CERT_VERSION=v1
 
-# SSO_ENABLED=1
+# SSO_ENABLED=0
-# SSO_PROVIDER_URL=https://authentik.example.com/
+## only set one of those depending on which SSO you're using
-# SSO_SAML_URL=https://authentik.example.com/application/saml/kimai/sso/binding/redirect/
+# SSO_AUTHENTIK=1
-# SSO_LOGOUT_URL=https://authentik.example.com/application/saml/kimai/slo/binding/redirect/
+# SSO_KEYCLOAK=0
-
+# SSO_PROVIDER_URL=https://sso.example.org/
-# MAILER_URL="smtp://<from>:<password>%3F@<mailserver>:587"
+# SSO_SAML_URL=https://sso.example.org/application/saml/<application-slug>/sso/binding/redirect/
-# MAILER_FROM="Kimai Notifications noreply@example.com"
+# SSO_LOGOUT_URL=https://sso.example.org/if/session-end/<application-slug>/
+# SSO_CERT="muchmuchbase64certificatefoobar=="

README.md

@@ -8,11 +8,11 @@ CoöpCloud [Kimai] ✊⏰
 * **Category**: Apps
 * **Status**: ?
 * **Image**: [`kimai/kimai2`](https://hub.docker.com/kimai/kimai2), 4, upstream
-* **Healthcheck**: Yes
+* **Healthcheck**: No
-* **Backups**: Yes
+* **Backups**: No
-* **Email**: Yes
+* **Email**: No
 * **Tests**: 2
-* **SSO**: Yes
+* **SSO**: No
 <!-- endmetadata -->
 
 Based on the recommended [`tobybatch/kimai2`] compose file.
@@ -23,14 +23,9 @@ Based on the recommended [`tobybatch/kimai2`] compose file.
 4. `abra app config YOURAPPDOMAIN` - be sure to change `$DOMAIN` to something that resolves to
    your Docker swarm box
 5. `abra app deploy YOURAPPDOMAIN`
-6. Retrieve the admin password and username with this command `abra app run <DOMAIN> cat /run/secrets/admin_password`
+6. `abra app run YOURAPPDOMAIN app create_admin`
 
 [Kimai]: https://www.kimai.org/
 [`tobybatch/kimai2`]: https://tobybatch.github.io/kimai2/docker-compose.html#docker-compose
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
 [`coop-cloud/traefik`]: https://git.autonomic.zone/coop-cloud/traefik
-
-## SSO
-
-To enable SSO, after running the blueprint in Authentik and before deploying Kimai, you need to add the Authentik Self-Signed-Certificate as secret in Kimai via the following command:
-`abra app cmd -l YOURAPPDOMAIN insert_authentik_certificate`

abra.sh

@@ -1,13 +1,7 @@
-export ENTRYPOINT_CONF_VERSION=v2
+export ENTRYPOINT_CONF_VERSION=v1
 export LOCAL_CONF_VERSION=v3
 
 create_admin () {
     export DATABASE_URL="$DATABASE_TYPE://$DATABASE_USER:$(cat /run/secrets/db_password)@$DATABASE_HOST/$DATABASE_NAME"
-    /opt/kimai/bin/console kimai:create-user admin admin@example.org ROLE_SUPER_ADMIN 
+    /opt/kimai/bin/console kimai:create-user admin admin@example.org ROLE_SUPER_ADMIN
-}
-
-insert_authentik_certificate() {
-    SSO_PROVIDER_DOMAIN=$(echo $SSO_PROVIDER_URL | cut -d '/' -f 3)
-    CERT=$(abra app cmd -T $SSO_PROVIDER_DOMAIN worker get_certificate Kimai)
-    abra app secret insert $APP_NAME sso_cert v1 $CERT
 }

alaconnect.yml

@@ -1,8 +0,0 @@
-authentik:
-    uncomment:
-        - SSO_ENABLED
-        - SSO_PROVIDER_URL
-        - SSO_SAML_URL
-        - SSO_LOGOUT_URL
-    secret_hooks:
-        - insert_authentik_certificate

compose.yml

@@ -1,7 +1,7 @@
 version: '3.8'
 services:
   app:
-    image: kimai/kimai2:apache-2.34.0
+    image: kimai/kimai2:apache-1.29.1-prod
     environment:
       - APP_ENV=prod
       - TRUSTED_HOSTS=localhost,traefik,${DOMAIN},127.0.0.1
@@ -10,16 +10,17 @@ services:
       - ADMINPASS_FILE=/run/secrets/admin_password
       - DATABASE_TYPE=mysql
       - DATABASE_HOST=db
-      - DATABASE_NAME=kimai?charset=utf8mb4&serverVersion=5.7
+      - DATABASE_NAME=kimai
       - DATABASE_USER=kimai
       - DATABASE_PASSWORD_FILE=/run/secrets/db_password
       - DOMAIN
       - SSO_ENABLED
+      - SSO_KEYCLOAK
+      - SSO_AUTHENTIK
       - SSO_PROVIDER_URL
       - SSO_SAML_URL
       - SSO_LOGOUT_URL
-      - MAILER_URL
+      - SSO_CERT
-      - MAILER_FROM
     volumes:
       - kimai_public:/opt/kimai/public
       - kimai_var:/opt/kimai/var
@@ -35,16 +36,16 @@ services:
     secrets:
       - db_password
       - admin_password
-      - sso_cert
     depends_on:
       - db
+    #entrypoint: ['tail', '-f', '/dev/null']
     entrypoint: /docker-entrypoint.sh
-    healthcheck:
+    #healthcheck:
-     test: curl -s -o /dev/null http://localhost:8001 || exit 1
+    #  test: curl -s -o /dev/null http://localhost:8001 || exit 1
-     interval: 30s
+    #  interval: 20s
-     start_period: 3m
+    #  start_period: 10s
-     timeout: 10s
+    #  timeout: 10s
-     retries: 10
+    #  retries: 3
     deploy:
       restart_policy:
         condition: on-failure
@@ -58,8 +59,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
-        - "coop-cloud.${STACK_NAME}.version=1.4.0+apache-2.34.0"
+        - "coop-cloud.${STACK_NAME}.version=0.3.0+apache-1.29.1-prod"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
   db:
     image: mysql:5.7
     environment:
@@ -75,25 +75,24 @@ services:
       - db_password
       - db_root_password
     command: --default-storage-engine innodb
-    healthcheck:
+    #healthcheck:
-      test: ["CMD-SHELL", 'mysqladmin -p"$$(cat /run/secrets/db_root_password)"  ping -h localhost']
+    #  test: mysqladmin -pchangemeplease ping -h localhost
-      interval: 30s
+    #  interval: 20s
-      timeout: 10s
+    #  start_period: 10s
-      retries: 10
+    #  timeout: 10s
-      start_period: 1m
+    #  retries: 3
+
     deploy:
       labels:
-        backupbot.backup: "${ENABLE_BACKUPS:-true}"
+        - backupbot.backup="true"
-        backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" kimai > /var/lib/mysql/backup.sql'
+        - backupbot.backup.pre-hook='mkdir -p /tmp/backup/ && mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" kimai > /tmp/backup/backup.sql'
-        backupbot.backup.volumes.mariadb.path: "backup.sql"
+        - backupbot.backup.post-hook="rm -rf /tmp/backup"
-        backupbot.restore.post-hook: 'mysql -u root -p"$$(cat /run/secrets/db_root_password)" kimai < /var/lib/mysql/backup.sql'
+        - backupbot.backup.path="/tmp/backup/"
 
 volumes:
   kimai_var:
   kimai_public:
   mariadb:
-
-
 secrets:
   db_password:
     external: true
@@ -104,16 +103,10 @@ secrets:
   admin_password:
     external: true
     name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
-  sso_cert:
-    external: true
-    name: ${STACK_NAME}_sso_cert_${SECRET_SSO_CERT_VERSION}
-
 networks:
   proxy:
     external: true
   internal:
-
-
 configs:
   entrypoint_conf:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_CONF_VERSION}

entrypoint.sh.tmpl

@@ -38,8 +38,8 @@ export DATABASE_URL="$DATABASE_TYPE://$DATABASE_USER:$DATABASE_PASSWORD@$DATABAS
 
 if [ ! "${1-}" == "-e" ]; then
 	# 3wc: upstream ENTRYPOINT
-	# https://github.com/kimai/kimai/blob/main/Dockerfile#L278
+	# https://github.com/tobybatch/kimai2/blob/main/Dockerfile#L226
-	/entrypoint.sh
+	/startup.sh
 fi
 
 set +eu

local.yaml.tmpl

@@ -3,16 +3,27 @@ kimai:
   saml:
     activate: true
     title: Login with SAML
+    {{ if eq (env "SSO_AUTHENTIK") "1" }}
     mapping:
       - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, kimai: email }
       - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, kimai: alias }
     roles:
-      resetOnLogin: true
       attribute: http://schemas.xmlsoap.org/claims/Group
+      resetOnLogin: true
+      attribute: Roles
       mapping:
-      # Insert your roles here (ROLE_USER is added automatically)
+        - { saml: admin.group, kimai: ROLE_ADMIN }
-        - { saml: admin.group, kimai: ROLE_SUPER_ADMIN }
+    {{ else if eq (env "SSO_KEYCLOAK") "1" }}
-        - { saml: "authentik Admins", kimai: ROLE_SUPER_ADMIN }
+    mapping:
+      - { saml: $Email, kimai: email }
+      - { saml: $FirstName $LastName, kimai: alias }
+    roles:
+      resetOnLogin: true
+      attribute: Roles
+      mapping:
+        - { saml: Admins, kimai: ROLE_ADMIN }
+        - { saml: Management, kimai: ROLE_TEAMLEAD }
+    {{ end }}
     connection:
       # You SAML provider
       # Your Authentik instance, replace https://authentik.company with your authentik URL
@@ -21,11 +32,12 @@ kimai:
         singleSignOnService:
           url: "{{ env "SSO_SAML_URL" }}"
           binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+        # the "single logout" feature was not yet tested, if you want to help, please let me know!
         singleLogoutService:
           url: "{{ env "SSO_LOGOUT_URL" }}"
           binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
         # Signing certificate from *Advanced protocol settings*
-        x509cert: "{{ secret "sso_cert" }}"
+        x509cert: "{{ env "SSO_CERT" }}"
       # Service Provider Data that we are deploying.
       # Your Kimai instance, replace https://kimai.dev.local-it.cloud with your Kimai URL
       sp:

release/0.3.0+apache-debian-1.29.1-prod

@@ -0,0 +1,5 @@
+If you have SSO enabled this upgrade will break unless you add
+`SSO_KEYCLOAK=1` or `SSO_AUTHENTIK=1` in your env file for kimai!
+This allows us to support both SSO methods
+
+knoflook @ kotec.pl

release/1.0.0+apache-2.15.0-prod

@@ -1 +0,0 @@
-Make sure to have have a working backup before upgrading!