Compare commits
4 Commits
0.3.0+v5.1.0
..
dev
| Author | SHA1 | Date | |
|---|---|---|---|
 knoflook
|
124e6825ff | ||
|
knoflook
|
44fae6db11 | ||
|
knoflook
|
5ce5e557a3 | ||
|
knoflook
|
3fbc6fb2a1 |
+24
-37
@@ -10,25 +10,18 @@ LETS_ENCRYPT_ENV=production
|
||||
##############################################################################
|
||||
# SECRETS
|
||||
##############################################################################
|
||||
# abbreviations are to fit abra 12 char secret recommendation
|
||||
# DJANGO_SECRET_KEY
|
||||
SECRET_DJANGO_SK_VERSION=v1
|
||||
# ODIC_RP_CLIENT_SECRET
|
||||
SECRET_OIDC_RPCS_VERSION=v1
|
||||
# DJANGO_SUPERUSER_PASSWORD
|
||||
SECRET_DJANGO_SP_VERSION=v1
|
||||
# MINIO_ROOT_PASSWORD
|
||||
SECRET_MINIO_RP_VERSION=v1
|
||||
# MINIO_ROOT_USER
|
||||
SECRET_MINIO_RU_VERSION=v1
|
||||
# COLLABORATION_SERVER_SECRET
|
||||
SECRET_COLLAB_SS_VERSION=v1
|
||||
# POSTGRES_PASSWORD
|
||||
SECRET_POSTGRES_P_VERSION=v1
|
||||
# Y_PROVIDER_API_KEY
|
||||
SECRET_Y_API_KEY_VERSION=v1
|
||||
# DJANGO_HOST_EMAIL_PASSWORD
|
||||
SECRET_EMAIL_PASS_VERSION=v1
|
||||
SECRET_MINIO_ROOT_PASSWORD_VERSION=v1
|
||||
SECRET_COLLABORATION_SERVER_SECRET_VERSION=v1
|
||||
SECRET_POSTGRES_PASSWORD_VERSION=v1
|
||||
SECRET_AWS_S3_SECRET_ACCESS_KEY_VERSION=v1
|
||||
SECRET_OIDC_RP_CLIENT_SECRET_VERSION=v1
|
||||
SECRET_DJANGO_SECRET_KEY_VERSION=v1
|
||||
SECRET_DJANGO_SUPERUSER_PASSWORD_VERSION=v1
|
||||
SECRET_DJANGO_EMAIL_HOST_PASSWORD_VERSION=v1
|
||||
|
||||
##############################################################################
|
||||
# BASIC SETTINGS
|
||||
##############################################################################
|
||||
|
||||
##############################################################################
|
||||
# EMAIL
|
||||
@@ -37,28 +30,28 @@ DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
|
||||
DJANGO_EMAIL_HOST="mail.example.com"
|
||||
DJANGO_EMAIL_LOGO_IMG="http://$DOMAIN/assets/logo-suite-numerique.png"
|
||||
DJANGO_EMAIL_PORT=1025
|
||||
DJANGO_EMAIL_USE_SSL=True
|
||||
DJANGO_EMAIL_USE_TLS=False
|
||||
DJANGO_EMAIL_FROM=mail@example.com
|
||||
|
||||
##############################################################################
|
||||
# SINGLE SIGN ON
|
||||
##############################################################################
|
||||
# NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README
|
||||
OIDC_REALM=yourkeycloakrealm
|
||||
AUTH_DOMAIN=yourkeycloakdomain
|
||||
OIDC_OP_JWKS_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
|
||||
OIDC_OP_AUTHORIZATION_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
|
||||
OIDC_OP_TOKEN_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
|
||||
OIDC_OP_USER_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
|
||||
OIDC_RP_CLIENT_ID=yourkeycloakclientid
|
||||
## Set those according to your needs
|
||||
OIDC_RP_CLIENT_ID=docs
|
||||
REALM_NAME=
|
||||
SSO_DOMAIN=
|
||||
|
||||
## These can probably be left as-is
|
||||
OIDC_OP_JWKS_ENDPOINT=https://${SSO_DOMAIN}/realms/${REALM_NAME}/protocol/openid-connect/certs
|
||||
OIDC_OP_AUTHORIZATION_ENDPOINT=https://${SSO_DOMAIN}/realms/${REALM_NAME}/protocol/openid-connect/auth
|
||||
OIDC_OP_TOKEN_ENDPOINT=https://${SSO_DOMAIN}/realms/${REALM_NAME}/protocol/openid-connect/token
|
||||
OIDC_OP_USER_ENDPOINT=https://${SSO_DOMAIN}/realms/${REALM_NAME}/protocol/openid-connect/userinfo
|
||||
OIDC_RP_SIGN_ALGO=RS256
|
||||
OIDC_RP_SCOPES="openid email"
|
||||
LOGIN_REDIRECT_URL=https://${DOMAIN}
|
||||
LOGIN_REDIRECT_URL_FAILURE=https://${DOMAIN}
|
||||
LOGOUT_REDIRECT_URL=https://${DOMAIN}
|
||||
OIDC_REDIRECT_ALLOWED_HOSTS='["https://auth.${DOMAIN}", "https://${DOMAIN}"]'
|
||||
OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
|
||||
OIDC_REDIRECT_ALLOWED_HOSTS='["https://id.docs.coop", "https://${DOMAIN}"]'
|
||||
#OIDC_AUTH_REQUEST_EXTRA_PARAMS="{'acr_values'='eidas1'}"
|
||||
|
||||
##############################################################################
|
||||
# LOGGING
|
||||
@@ -66,9 +59,3 @@ OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
|
||||
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
|
||||
LOGGING_LEVEL_LOGGERS_ROOT=INFO
|
||||
LOGGING_LEVEL_LOGGERS_APP=INFO
|
||||
|
||||
##############################################################################
|
||||
# MIGRATIONS
|
||||
##############################################################################
|
||||
# Set to false to disable automatic migrations on backend startup
|
||||
# AUTO_MIGRATIONS=true
|
||||
|
||||
@@ -17,66 +17,15 @@
|
||||
|
||||
## Quick start
|
||||
|
||||
* Deploy Single Sign On (see [Authentication](#authentication) below)
|
||||
* `abra app new lasuite-docs --secrets`
|
||||
* `abra app config <app-name>`
|
||||
* `abra app deploy <app-name>`
|
||||
* `abra app cmd <app-name> backend migrate`
|
||||
* `abra app restart <app-name> minio-bootstrap` (Note: this will appear to fail, but probably worked! Check `abra app logs <app-name> minio-bootstrap`)
|
||||
|
||||
You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section).
|
||||
For more, see [`docs.coopcloud.tech`](https://docs.coopcloud.tech).
|
||||
|
||||
* Migrations run automatically on backend startup. To trigger manually: `abra app cmd <app-name> backend migrate`
|
||||
* Minio buckets are created automatically on first deploy. To manually trigger: `abra app cmd <app-name> minio minio_initialize`
|
||||
## Authentication
|
||||
|
||||
## Configure Authentication
|
||||
|
||||
lasuite-docs **requires** an OpenID Connect (OIDC) single sign-on provider; deployment has been tested with [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), which we recommend, or you could also try [Authentik](https://git.coopcloud.tech/coop-cloud/authentik), both of which are installable using Co-op Cloud.
|
||||
|
||||
Instructions for integrating keycloak with docs after deploying it, are below.
|
||||
|
||||
* In keycloak, create a realm (save the name of this realm, you will need it later)
|
||||
* Within that realm, create a client
|
||||
* during client creation, ensure:
|
||||
- Standard flow: True
|
||||
- Direct access grants: True
|
||||
- Authorization: True
|
||||
- Client authentication: True
|
||||
- PKCE method: none
|
||||
* Within the client tab, for your client, click on "Credentials". Click on the the copy button to copy "Client Secret" so you can insert this into your coop cloud deployment in the next step.
|
||||
* `abra app secret insert <app-name> oidc_rpcs v2 <yoursecret>`
|
||||
* `abra app config <app-name>` # set SECRET_OIDC_RPCS_VERSION=v2
|
||||
|
||||
* Now create a user for this client within keycloak. Within the Users tab, click "Add User". Any username and password works. Save this info.
|
||||
|
||||
You then additionally need to modify the config of docs to point to your keycloak deployment.
|
||||
|
||||
* `abra app config <app-name>`
|
||||
```
|
||||
OIDC_REALM=<the realm you configured in keycloak>
|
||||
AUTH_DOMAIN=<the domain of your keycloak instance>
|
||||
OIDC_RP_CLIENT_ID=<yourkeycloakclientid>
|
||||
```
|
||||
|
||||
then redeploy docs:
|
||||
`abra app deploy <app-name> --force`
|
||||
|
||||
at this point, when you go to your docs url, you shoud then be able to click "login" and login with the username and password for the user you created in keycloak.
|
||||
|
||||
you can make additional users in keycloak for this "client" and they will all be able to login to docs and collaborate.
|
||||
|
||||
## Configure E-Mail
|
||||
|
||||
Using `abra app config <app-name>` you need to set the following for your smtp server:
|
||||
|
||||
```
|
||||
DJANGO_EMAIL_HOST="yourmailserver.com"
|
||||
DJANGO_EMAIL_PORT=1025
|
||||
DJANGO_EMAIL_FROM=noreply@example.com
|
||||
```
|
||||
|
||||
You then need to insert the password for your smtp server as a secret:
|
||||
|
||||
* `abra app secret insert <app-name> email_pass v2 <youremailpass>`
|
||||
* `abra app config <app-name>` # set SECRET_EMAIL_PASS_VERSION=v2
|
||||
|
||||
Then redeploy the app, and automated e-mail sending should work:
|
||||
|
||||
`abra app deploy <app-name> --force`
|
||||
Docs **requires** an OpenID Connect (OIDC) single sign-on provider; we recommend [Authentik](https://git.coopcloud.tech/coop-cloud/authentik) or [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), both of which are installable using Co-op Cloud.
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
[ -f /run/secrets/postgres_p ] && export DB_PASSWORD="$(cat /run/secrets/postgres_p)"
|
||||
[ -f /run/secrets/django_sk ] && export DJANGO_SECRET_KEY="$(cat /run/secrets/django_sk)"
|
||||
[ -f /run/secrets/minio_rp ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/minio_rp)"
|
||||
[ -f /run/secrets/minio_ru ] && export AWS_S3_ACCESS_KEY_ID="$(cat /run/secrets/minio_ru)"
|
||||
[ -f /run/secrets/django_sp ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_sp)"
|
||||
[ -f /run/secrets/oidc_rpcs ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rpcs)"
|
||||
[ -f /run/secrets/collab_ss ] && export COLLABORATION_SERVER_SECRET="$(cat /run/secrets/collab_ss)"
|
||||
[ -f /run/secrets/y_api_key ] && export Y_PROVIDER_API_KEY="$(cat /run/secrets/y_api_key)"
|
||||
[ -f /run/secrets/email_pass ] && export DJANGO_EMAIL_HOST_PASSWORD="$(cat /run/secrets/email_pass)"
|
||||
|
||||
# if not in "env" mode, then execute the original entrypoint and command
|
||||
if [ ! "$1" = "-e" ]; then
|
||||
exec "$@"
|
||||
fi
|
||||
@@ -1,20 +1,18 @@
|
||||
# Set any config versions here
|
||||
# Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
|
||||
export ABRA_ENTRYPOINT_VERSION=v5
|
||||
export NGINX_CONF_VERSION=v3
|
||||
export NGINX_CONF_VERSION=v2
|
||||
export PG_BACKUP_VERSION=v3
|
||||
export MINIO_INITIALIZE_VERSION=v1
|
||||
export MIGRATE_VERSION=v1
|
||||
|
||||
environment() {
|
||||
# this exports all the secrets as environment variables
|
||||
source /abra-entrypoint.sh -e
|
||||
}
|
||||
export MINIO_ENTRYPOINT_VERSION=v1
|
||||
export MINIO_BOOTSTRAP_ENTRYPOINT_VERSION=v8
|
||||
export YPROVIDER_ENTRYPOINT_VERSION=v1
|
||||
export BACKEND_ENTRYPOINT_VERSION=v1
|
||||
export CELERY_ENTRYPOINT_VERSION=v1
|
||||
|
||||
# environment() {
|
||||
# # TODO: Add file_env here
|
||||
# }
|
||||
|
||||
migrate() {
|
||||
/migrate.sh
|
||||
}
|
||||
|
||||
minio_initialize() {
|
||||
/minio-initialize.sh
|
||||
python manage.py migrate --noinput
|
||||
}
|
||||
|
||||
+120
-166
@@ -1,14 +1,13 @@
|
||||
|
||||
|
||||
---
|
||||
|
||||
# NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/
|
||||
|
||||
x-common-env: &common-env
|
||||
DJANGO_CONFIGURATION: Production
|
||||
DJANGO_ALLOWED_HOSTS: "*"
|
||||
# DJANGO_SECRET_KEY supplied via secrets
|
||||
DJANGO_SECRET_KEY_FILE: /run/secrets/django_secret_key
|
||||
DJANGO_SETTINGS_MODULE: impress.settings
|
||||
# DJANGO_SUPERUSER_PASSWORD supplied via secrets
|
||||
DJANGO_SUPERUSER_PASSWORD_FILE: /run/secrets/django_superuser_password
|
||||
# Logging
|
||||
# Set to DEBUG level for dev only
|
||||
LOGGING_LEVEL_HANDLERS_CONSOLE:
|
||||
@@ -22,17 +21,14 @@ x-common-env: &common-env
|
||||
DJANGO_EMAIL_LOGO_IMG:
|
||||
DJANGO_EMAIL_PORT:
|
||||
DJANGO_EMAIL_HOST_USER:
|
||||
# DJANGO_EMAIL_HOST_PASSWORD supplied via secret
|
||||
DJANGO_EMAIL_USE_SSL:
|
||||
DJANGO_EMAIL_USE_TLS:
|
||||
DJANGO_EMAIL_FROM:
|
||||
DJANGO_EMAIL_HOST_PASSWORD_FILE: /run/secrets/django_email_host_password
|
||||
# Backend url
|
||||
IMPRESS_BASE_URL: "https://${DOMAIN}"
|
||||
# Media
|
||||
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
|
||||
AWS_S3_ENDPOINT_URL: http://minio:9000
|
||||
# AWS_S3_ACCESS_KEY_ID supplied via secret (this is same MINIO_ROOT_USER)
|
||||
# AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as MINIO_ROOT_PASSWORD)
|
||||
AWS_S3_ACCESS_KEY_ID: user
|
||||
AWS_S3_SECRET_ACCESS_KEY_FILE: /run/secrets/aws_s3_secret_access_key
|
||||
MEDIA_BASE_URL: https://${DOMAIN}
|
||||
AWS_STORAGE_BUCKET_NAME: docs-media-storage
|
||||
# OIDC - settings from .env, see .env.sample
|
||||
@@ -41,7 +37,7 @@ x-common-env: &common-env
|
||||
OIDC_OP_TOKEN_ENDPOINT:
|
||||
OIDC_OP_USER_ENDPOINT:
|
||||
OIDC_RP_CLIENT_ID:
|
||||
# OIDC_RP_CLIENT_SECRET supplied via secrets
|
||||
OIDC_RP_CLIENT_SECRET_FILE: /run/secrets/oidc_rp_client_secret
|
||||
OIDC_RP_SIGN_ALGO:
|
||||
OIDC_RP_SCOPES:
|
||||
LOGIN_REDIRECT_URL:
|
||||
@@ -51,8 +47,8 @@ x-common-env: &common-env
|
||||
OIDC_AUTH_REQUEST_EXTRA_PARAMS:
|
||||
# AI
|
||||
AI_FEATURE_ENABLED: "false"
|
||||
OPENAI_SDK_BASE_URL: https://openaiendpoint.com
|
||||
OPENAI_SDK_API_KEY: password
|
||||
AI_BASE_URL: https://openaiendpoint.com
|
||||
AI_API_KEY: password
|
||||
AI_MODEL: llama
|
||||
# Collaboration
|
||||
COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
|
||||
@@ -61,38 +57,33 @@ x-postgres-env: &postgres-env
|
||||
# Postgresql db container configuration
|
||||
POSTGRES_DB: docs
|
||||
POSTGRES_USER: docs
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_p
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
|
||||
# App database configuration
|
||||
DB_HOST: db
|
||||
DB_NAME: docs
|
||||
DB_USER: docs
|
||||
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
||||
DB_PORT: 5432
|
||||
# DB_PASSWORD supplied via secrets (this is same as POSTGRES_PASSWORD)
|
||||
|
||||
x-yprovider-env: &yprovider-env
|
||||
COLLABORATION_LOGGING: "true"
|
||||
# Y_PROVIDER_API_KEY supplied via secrets
|
||||
Y_PROVIDER_API_KEY: foobar
|
||||
COLLABORATION_API_URL: http://y-provider:4444/api/
|
||||
COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
|
||||
# COLLABORATION_SERVER_SECRET supplied via secrets
|
||||
COLLABORATION_SERVER_SECRET_FILE: /run/secrets/collaboration_server_secret
|
||||
COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
|
||||
COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/
|
||||
|
||||
x-minio-env: &minio-env
|
||||
MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
|
||||
MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp
|
||||
|
||||
services:
|
||||
app:
|
||||
image: lasuite/impress-frontend:v5.1.0
|
||||
image: lasuite/impress-frontend:v3.6.0
|
||||
networks:
|
||||
- backend
|
||||
- backend
|
||||
deploy:
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
|
||||
- "coop-cloud.${STACK_NAME}.version=0.3.0+v5.1.0"
|
||||
user: "${DOCKER_USER:-1000}"
|
||||
- "coop-cloud.${STACK_NAME}.version=0.3.0+v3.6.0"
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8080"]
|
||||
interval: 15s
|
||||
@@ -101,91 +92,53 @@ services:
|
||||
start_period: 10s
|
||||
|
||||
backend:
|
||||
image: lasuite/impress-backend:v5.1.0
|
||||
image: lasuite/impress-backend:v3.6.0
|
||||
networks:
|
||||
- backend
|
||||
- backend
|
||||
environment:
|
||||
<<: [*common-env, *postgres-env, *yprovider-env]
|
||||
AUTO_MIGRATIONS: "${AUTO_MIGRATIONS:-true}"
|
||||
secrets:
|
||||
- collaboration_server_secret
|
||||
- postgres_password
|
||||
- aws_s3_secret_access_key
|
||||
- oidc_rp_client_secret
|
||||
- django_secret_key
|
||||
- django_superuser_password
|
||||
- django_email_host_password
|
||||
healthcheck:
|
||||
test: ["CMD", "/abra-entrypoint.sh", "python", "manage.py", "check"]
|
||||
test: ["CMD", "python", "manage.py", "check"]
|
||||
interval: 15s
|
||||
timeout: 30s
|
||||
retries: 20
|
||||
start_period: 10s
|
||||
user: "${DOCKER_USER:-1000}"
|
||||
command: ["gunicorn", "-c", "/usr/local/etc/gunicorn/impress.py", "impress.wsgi:application"]
|
||||
entrypoint: >
|
||||
sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
|
||||
configs:
|
||||
- source: abra_entrypoint
|
||||
target: /abra-entrypoint.sh
|
||||
mode: 0555
|
||||
- source: migrate
|
||||
target: /migrate.sh
|
||||
mode: 0555
|
||||
secrets:
|
||||
- django_sk
|
||||
- django_sp
|
||||
- oidc_rpcs
|
||||
- collab_ss
|
||||
- minio_rp
|
||||
- minio_ru
|
||||
- postgres_p
|
||||
- y_api_key
|
||||
- email_pass
|
||||
|
||||
celery:
|
||||
image: lasuite/impress-backend:v5.1.0
|
||||
image: lasuite/impress-backend:v3.6.0
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
test: ["CMD", "celery", "-A", "impress.celery_app", "inspect", "ping", "--timeout", "5"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
user: "${DOCKER_USER:-1000}"
|
||||
- backend
|
||||
command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
|
||||
environment:
|
||||
<<: [*common-env, *postgres-env, *yprovider-env]
|
||||
entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
|
||||
configs:
|
||||
- source: abra_entrypoint
|
||||
target: /abra-entrypoint.sh
|
||||
mode: 0555
|
||||
secrets:
|
||||
- django_sk
|
||||
- django_sp
|
||||
- oidc_rpcs
|
||||
- collab_ss
|
||||
- minio_rp
|
||||
- postgres_p
|
||||
- y_api_key
|
||||
- email_pass
|
||||
|
||||
|
||||
- collaboration_server_secret
|
||||
- django_superuser_password
|
||||
- postgres_password
|
||||
- aws_s3_secret_access_key
|
||||
- oidc_rp_client_secret
|
||||
- django_secret_key
|
||||
- django_email_host_password
|
||||
|
||||
y-provider:
|
||||
image: lasuite/impress-y-provider:v5.1.0
|
||||
image: lasuite/impress-y-provider:v3.6.0
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
# y-provider returns 403 on unauthenticated requests; wget exit 4 = network error (server down), anything else = server is responding
|
||||
test: ["CMD-SHELL", "wget -qO /dev/null http://localhost:4444/ 2>/dev/null; test $$? -ne 4"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
environment: *yprovider-env
|
||||
user: "${DOCKER_USER:-1000}"
|
||||
entrypoint: >
|
||||
sh -c "export Y_PROVIDER_API_KEY=\"$$(cat /run/secrets/y_api_key)\" && exec /usr/local/bin/entrypoint \"$$@\"" --
|
||||
command: ["yarn", "start"]
|
||||
- backend
|
||||
secrets:
|
||||
- y_api_key
|
||||
- collaboration_server_secret
|
||||
environment: *yprovider-env
|
||||
# NOTE: healthcheck - `wget` is available in the container, but `wget http://localhost:4444` gives a 403
|
||||
|
||||
db:
|
||||
image: pgautoupgrade/pgautoupgrade:18-debian
|
||||
image: postgres:16
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
@@ -195,9 +148,11 @@ services:
|
||||
retries: 300
|
||||
environment:
|
||||
<<: *postgres-env
|
||||
PGDATA: /var/lib/postgresql/data/pgdata
|
||||
PGDATA: var/lib/postgresql/data/pgdata
|
||||
volumes:
|
||||
- postgres:/var/lib/postgresql/data/pgdata
|
||||
secrets:
|
||||
- postgres_password
|
||||
deploy:
|
||||
labels:
|
||||
backupbot.backup: "${ENABLE_BACKUPS:-true}"
|
||||
@@ -208,68 +163,58 @@ services:
|
||||
- source: pg_backup
|
||||
target: /pg_backup.sh
|
||||
mode: 0555
|
||||
secrets:
|
||||
- postgres_p
|
||||
|
||||
redis:
|
||||
image: redis:8.2.6
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
image: redis:8
|
||||
networks:
|
||||
- backend
|
||||
- backend
|
||||
|
||||
minio-bootstrap:
|
||||
# NOTE: Not started by default, only run with a manual `abra app restart` / `docker service scale`
|
||||
image: minio/mc:RELEASE.2025-08-13T08-35-41Z
|
||||
environment:
|
||||
- MINIO_ROOT_USER=minio
|
||||
- MINIO_ROOT_PASSWORD_FILE=/run/secrets/minio_root_password
|
||||
networks:
|
||||
- backend
|
||||
secrets:
|
||||
- minio_root_password
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: none
|
||||
|
||||
minio:
|
||||
image: minio/minio:RELEASE.2025-05-24T17-08-30Z
|
||||
environment: *minio-env
|
||||
image: minio/minio:RELEASE.2025-09-07T16-13-09Z
|
||||
environment:
|
||||
- MINIO_ROOT_USER=minio
|
||||
- MINIO_ROOT_PASSWORD_FILE=/run/secrets/minio_root_password
|
||||
secrets:
|
||||
- minio_root_password
|
||||
healthcheck:
|
||||
test: ["CMD", "mc", "ready", "local"]
|
||||
interval: 1s
|
||||
timeout: 20s
|
||||
retries: 300
|
||||
entrypoint: ""
|
||||
networks:
|
||||
- backend
|
||||
- backend
|
||||
command: minio server /data
|
||||
entrypoint: >
|
||||
sh -c "/minio-initialize.sh & exec /usr/bin/docker-entrypoint.sh \"$$@\"" --
|
||||
volumes:
|
||||
- minio:/data
|
||||
deploy:
|
||||
labels:
|
||||
backupbot.backup: "${ENABLE_BACKUPS:-true}"
|
||||
entrypoint: /abra-entrypoint.sh
|
||||
configs:
|
||||
- source: abra_entrypoint
|
||||
target: /abra-entrypoint.sh
|
||||
mode: 0555
|
||||
- source: minio_initialize
|
||||
target: /minio-initialize.sh
|
||||
mode: 0555
|
||||
secrets:
|
||||
- minio_rp
|
||||
- minio_ru
|
||||
|
||||
web:
|
||||
image: nginx:1.30.0
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8083"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
image: nginx:1.29
|
||||
configs:
|
||||
- source: nginx_conf
|
||||
target: /etc/nginx/conf.d/default.conf
|
||||
networks:
|
||||
proxy:
|
||||
backend:
|
||||
depends_on:
|
||||
- backend
|
||||
- app
|
||||
environment:
|
||||
- STACK_NAME
|
||||
deploy:
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
@@ -292,46 +237,55 @@ volumes:
|
||||
configs:
|
||||
nginx_conf:
|
||||
name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
|
||||
file: nginx.conf.tmpl
|
||||
template_driver: golang
|
||||
file: nginx.conf
|
||||
pg_backup:
|
||||
name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
|
||||
file: pg_backup.sh
|
||||
abra_entrypoint:
|
||||
name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION}
|
||||
file: abra-entrypoint.sh
|
||||
minio_initialize:
|
||||
name: ${STACK_NAME}_minio_initialize_${MINIO_INITIALIZE_VERSION}
|
||||
file: minio-initialize.sh
|
||||
migrate:
|
||||
name: ${STACK_NAME}_migrate_${MIGRATE_VERSION}
|
||||
file: migrate.sh
|
||||
minio_entrypoint:
|
||||
name: ${STACK_NAME}_minio_entrypoint_${MINIO_ENTRYPOINT_VERSION}
|
||||
file: entrypoint-minio.sh.tmpl
|
||||
template_driver: golang
|
||||
minio_bootstrap_entrypoint:
|
||||
name: ${STACK_NAME}_minio_bootstrap_entrypoint_${MINIO_BOOTSTRAP_ENTRYPOINT_VERSION}
|
||||
file: entrypoint-minio-bootstrap.sh.tmpl
|
||||
template_driver: golang
|
||||
yprovider_entrypoint:
|
||||
name: ${STACK_NAME}_yprovider_entrypoint_${YPROVIDER_ENTRYPOINT_VERSION}
|
||||
file: entrypoint-yprovider.sh.tmpl
|
||||
template_driver: golang
|
||||
backend_entrypoint:
|
||||
name: ${STACK_NAME}_backend_entrypoint_${BACKEND_ENTRYPOINT_VERSION}
|
||||
file: entrypoint-backend.sh.tmpl
|
||||
template_driver: golang
|
||||
celery_entrypoint:
|
||||
name: ${STACK_NAME}_celery_entrypoint_${CELERY_ENTRYPOINT_VERSION}
|
||||
file: entrypoint-celery.sh.tmpl
|
||||
template_driver: golang
|
||||
|
||||
|
||||
|
||||
secrets:
|
||||
django_sk:
|
||||
external: true
|
||||
name: ${STACK_NAME}_django_sk_${SECRET_DJANGO_SK_VERSION}
|
||||
oidc_rpcs:
|
||||
external: true
|
||||
name: ${STACK_NAME}_oidc_rpcs_${SECRET_OIDC_RPCS_VERSION}
|
||||
django_sp:
|
||||
external: true
|
||||
name: ${STACK_NAME}_django_sp_${SECRET_DJANGO_SP_VERSION}
|
||||
postgres_p:
|
||||
external: true
|
||||
name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
|
||||
collab_ss:
|
||||
external: true
|
||||
name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION}
|
||||
minio_rp:
|
||||
external: true
|
||||
name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
|
||||
minio_ru:
|
||||
external: true
|
||||
name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RP_VERSION}
|
||||
y_api_key:
|
||||
external: true
|
||||
name: ${STACK_NAME}_y_api_key_${SECRET_Y_API_KEY_VERSION}
|
||||
email_pass:
|
||||
external: true
|
||||
name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}
|
||||
minio_root_password:
|
||||
name: ${STACK_NAME}_minio_root_password_${SECRET_MINIO_ROOT_PASSWORD_VERSION}
|
||||
external: true
|
||||
collaboration_server_secret:
|
||||
name: ${STACK_NAME}_collaboration_server_secret_${SECRET_COLLABORATION_SERVER_SECRET_VERSION}
|
||||
external: true
|
||||
postgres_password:
|
||||
name: ${STACK_NAME}_postgres_password_${SECRET_POSTGRES_PASSWORD_VERSION}
|
||||
external: true
|
||||
aws_s3_secret_access_key:
|
||||
name: ${STACK_NAME}_aws_s3_secret_access_key_${SECRET_AWS_S3_SECRET_ACCESS_KEY_VERSION}
|
||||
external: true
|
||||
oidc_rp_client_secret:
|
||||
name: ${STACK_NAME}_oidc_rp_client_secret_${SECRET_OIDC_RP_CLIENT_SECRET_VERSION}
|
||||
external: true
|
||||
django_secret_key:
|
||||
name: ${STACK_NAME}_django_secret_key_${SECRET_DJANGO_SECRET_KEY_VERSION}
|
||||
external: true
|
||||
django_superuser_password:
|
||||
name: ${STACK_NAME}_django_superuser_password_${SECRET_DJANGO_SUPERUSER_PASSWORD_VERSION}
|
||||
external: true
|
||||
django_email_host_password:
|
||||
name: ${STACK_NAME}_django_email_host_passsword_${SECRET_DJANGO_EMAIL_HOST_PASSWORD_VERSION}
|
||||
external: true
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "COLLABORATION_SERVER_SECRET"
|
||||
file_env "POSTGRES_PASSWORD"
|
||||
file_env "AWS_S3_SECRET_ACCESS_KEY"
|
||||
file_env "OIDC_RP_CLIENT_SECRET"
|
||||
file_env "DJANGO_SECRET_KEY"
|
||||
file_env "DJANGO_EMAIL_HOST_PASSWORD"
|
||||
file_env "DJANGO_SUPERUSER_PASSWORD"
|
||||
}
|
||||
|
||||
set -eu
|
||||
load_vars
|
||||
|
||||
set +eu
|
||||
|
||||
/usr/local/bin/entrypoint
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "COLLABORATION_SERVER_SECRET"
|
||||
file_env "POSTGRES_PASSWORD"
|
||||
file_env "AWS_S3_SECRET_ACCESS_KEY"
|
||||
file_env "OIDC_RP_CLIENT_SECRET"
|
||||
file_env "DJANGO_SECRET_KEY"
|
||||
file_env "DJANGO_EMAIL_HOST_PASSWORD"
|
||||
file_env "DJANGO_SUPERUSER_PASSWORD"
|
||||
}
|
||||
|
||||
set -eu
|
||||
load_vars
|
||||
|
||||
set +eu
|
||||
|
||||
celery -A impress.celery_app worker -l INFO
|
||||
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "MINIO_ROOT_PASSWORD"
|
||||
}
|
||||
|
||||
set -eu
|
||||
|
||||
load_vars
|
||||
|
||||
set +eu
|
||||
set -x
|
||||
|
||||
/usr/bin/mc alias set docs http://minio:9000 $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD --api S3v4
|
||||
/usr/bin/mc mb --ignore-existing docs/docs-media-storage
|
||||
/usr/bin/mc mb version enable docs/docs-media-storage
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,34 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "MINIO_ROOT_PASSWORD"
|
||||
}
|
||||
|
||||
set -eu
|
||||
|
||||
load_vars
|
||||
|
||||
set +eu
|
||||
|
||||
minio server data
|
||||
@@ -0,0 +1,33 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "COLLABORATION_SERVER_SECRET"
|
||||
}
|
||||
|
||||
set -eu
|
||||
load_vars
|
||||
|
||||
set +eu
|
||||
|
||||
/usr/local/bin/entrypoint
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# Load secrets into environment
|
||||
source /abra-entrypoint.sh -e
|
||||
|
||||
# Wait for database to be ready (up to 30 seconds)
|
||||
i=0
|
||||
while ! python manage.py check --database default 2>/dev/null; do
|
||||
i=$((i+1))
|
||||
if [ "$i" -ge 30 ]; then
|
||||
echo "migrate: timed out waiting for database" >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Idempotent: skip if no pending migrations
|
||||
if python manage.py migrate --check > /dev/null 2>&1; then
|
||||
echo "migrate: no pending migrations, skipping"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "migrate: applying pending migrations..."
|
||||
python manage.py migrate --noinput
|
||||
echo "migrate: done"
|
||||
@@ -1,29 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# Wait for minio to be ready (up to 60 seconds)
|
||||
i=0
|
||||
while ! mc ready local 2>/dev/null; do
|
||||
i=$((i+1))
|
||||
if [ "$i" -ge 60 ]; then
|
||||
echo "minio-initialize: timed out waiting for minio to be ready" >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
MINIO_ROOT_USER="$(cat /run/secrets/minio_ru)"
|
||||
MINIO_ROOT_PASSWORD="$(cat /run/secrets/minio_rp)"
|
||||
|
||||
mc alias set docs http://localhost:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
|
||||
|
||||
# Idempotent: skip if bucket already exists
|
||||
if mc ls docs/docs-media-storage > /dev/null 2>&1; then
|
||||
echo "minio-initialize: bucket 'docs-media-storage' already exists, skipping"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "minio-initialize: creating bucket 'docs-media-storage'..."
|
||||
mc mb docs/docs-media-storage
|
||||
mc version enable docs/docs-media-storage
|
||||
echo "minio-initialize: done"
|
||||
@@ -1,9 +1,9 @@
|
||||
upstream docs_backend {
|
||||
server {{ env "STACK_NAME" }}_backend:8000 fail_timeout=0;
|
||||
server backend:8000 fail_timeout=0;
|
||||
}
|
||||
|
||||
upstream docs_frontend {
|
||||
server {{ env "STACK_NAME" }}_app:8080 fail_timeout=0;
|
||||
server app:8080 fail_timeout=0;
|
||||
}
|
||||
|
||||
server {
|
||||
+3
-2
@@ -5,12 +5,13 @@ set -e
|
||||
BACKUP_FILE='/var/lib/postgresql/data/pgdata/backup.sql'
|
||||
|
||||
function backup {
|
||||
export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)
|
||||
# export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)
|
||||
export PGPASSWORD="$POSTGRES_PASSWORD"
|
||||
pg_dump -U ${POSTGRES_USER} ${POSTGRES_DB} > $BACKUP_FILE
|
||||
}
|
||||
|
||||
function restore {
|
||||
cd /var/lib/postgresql/data/pgdata/
|
||||
cd /var/lib/postgresql/data/
|
||||
restore_config(){
|
||||
# Restore allowed connections
|
||||
cat pg_hba.conf.bak > pg_hba.conf
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
after upgrading to this version, its necessary to run the data migration again, via:
|
||||
|
||||
`abra app cmd <app-name> backend migrate`
|
||||
|
||||
this release updates to a new version that fixes a security vulnerability,
|
||||
in addition to adding new features
|
||||
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
upgraded to v4.5.0, and also switched from postgres:16 to pgautoupgrade/pgautoupgrade:18-bookworm
|
||||
for automatic major version upgrades
|
||||
|
||||
no actions by operator should be necessary
|
||||
Reference in New Issue
Block a user