update readme instructions

.drone.yml

@@ -13,46 +13,48 @@ steps:
         from_secret: drone_ssh_swarm_test
       networks:
         - proxy
-      environment:
-        - DOMAIN=liberaforms.swarm-test.autonomic.zone
-        - STACK_NAME=liberaforms
-        - LETS_ENCRYPT_ENV=production
-        - ENABLE_LDAP=False
-        - FLASK_DEBUG=False
-        - FLASK_CONFIG=production
-        - DB_HOST=db
-        - DB_USER=liberaforms
-        - DB_PASSWORD_FILE=/run/secrets/db_password
-        - DB_NAME=liberaforms
-        - BASE_URL=https://${DOMAIN}
-        - ROOT_USER=${ADMIN_USER}
-        - TMP_DIR=/tmp
-        - SECRET_KEY_FILE=/run/secrets/secret_key
-        - CRYPTO_KEY_FILE=/run/secrets/crypto_key
-        - SESSION_TYPE=filesystem
-        - LOG_LEVEL=INFO
-        - LOG_DIR=/app/logs
-        - GUNICORN_WORKERS=${GUNICORN_WORKERS:-3}
-        - SECRET_SECRET_KEY_VERSION=v1
-        - SECRET_DB_PASSWORD_VERSION=v1
-        - SECRET_CRYPTO_KEY_VERSION=v1
-        - ENTRYPOINT_VERSION=v2
-        - NGINX_CONFIG_VERSION=v1
-        - TYPE=liberaforms
-        - ADMIN_USER='you@example.com'
-        - DEFAULT_LANGUAGE='en'
-        - E2EE_MODE=ENABLED_BY_DEFAULT
-        - TOKEN_EXPIRATION=604800
-        - DEFAULT_TIMEZONE="America/New_York"
-        - ENABLE_RSS_FEED=True
-        - ENABLE_PROMETHEUS_METRICS=False
-        - ENABLE_UPLOADS=True
-        - ENABLE_REMOTE_STORAGE=False
-        - TOTAL_UPLOADS_LIMIT="1 GB"
-        - DEFAULT_USER_UPLOADS_LIMIT="50 MB"
-        - MAX_MEDIA_SIZE=512000
-        - MAX_ATTACHMENT_SIZE=1572864
-
+        - internal
+      compose: "compose.yml"
+    environment:
+      DOMAIN: liberaforms.swarm-test.autonomic.zone
+      STACK_NAME: liberaforms
+      LETS_ENCRYPT_ENV: production
+      ENABLE_LDAP: False
+      FLASK_DEBUG: False
+      FLASK_CONFIG: production
+      DB_HOST: db
+      DB_USER: liberaforms
+      DB_PASSWORD_FILE: /run/secrets/db_password
+      DB_NAME: liberaforms
+      BASE_URL: https://${DOMAIN}
+      ROOT_USER: ${ADMIN_USER}
+      TMP_DIR: /tmp
+      SECRET_KEY_FILE: /run/secrets/secret_key
+      CRYPTO_KEY_FILE: /run/secrets/crypto_key
+      SESSION_TYPE: filesystem
+      LOG_LEVEL: INFO
+      LOG_DIR: /app/logs
+      GUNICORN_WORKERS: ${GUNICORN_WORKERS:-3}
+      SECRET_SECRET_KEY_VERSION: v1
+      SECRET_DB_PASSWORD_VERSION: v1
+      SECRET_CRYPTO_KEY_VERSION: v1
+      ENTRYPOINT_VERSION: v2
+      NGINX_CONFIG_VERSION: v1
+      PG_BACKUP_VERSION: v1
+      TYPE: liberaforms
+      ADMIN_USER: you@example.com
+      DEFAULT_LANGUAGE: en
+      E2EE_MODE: ENABLED_BY_DEFAULT
+      TOKEN_EXPIRATION: 604800
+      DEFAULT_TIMEZONE: America/New_York
+      ENABLE_RSS_FEED: True
+      ENABLE_PROMETHEUS_METRICS: False
+      ENABLE_UPLOADS: True
+      ENABLE_REMOTE_STORAGE: False
+      TOTAL_UPLOADS_LIMIT: 1 GB
+      DEFAULT_USER_UPLOADS_LIMIT: 50 MB
+      MAX_MEDIA_SIZE: 512000
+      MAX_ATTACHMENT_SIZE: 1572864
 trigger:
   branch:
     - main

.env.sample

@@ -1,42 +1,52 @@
 TYPE=liberaforms
-
 DOMAIN=liberaforms.example.com
-
 LETS_ENCRYPT_ENV=production
 
-SECRET_SECRET_KEY_VERSION = v1
-SECRET_DB_PASSWORD_VERSION = v1
-SECRET_CRYPTO_KEY_VERSION= v1
-
-ADMIN_USER = 'you@example.com'
-DEFAULT_LANGUAGE = 'en' # Options: en, eu, es, ca, cs, de, fr, gl, ru, ta
-E2EE_MODE=ENABLED_BY_DEFAULT # Options: AVAILABLE, DISABLED, REQUIRED, ENABLED_BY_DEFAULT
-TOKEN_EXPIRATION = 604800 # Maximum valid age (in seconds) for password resets, invitations, etc.
+#==============================================================================
+# SECRETS
+#==============================================================================
+SECRET_SECRET_KEY_VERSION=v1
+SECRET_DB_PASSWORD_VERSION=v1
+SECRET_CRYPTO_KEY_VERSION=v1
 
+#==============================================================================
+# ADMINISTRATION
+#==============================================================================
+ADMIN_USER='you@example.com'
+DEFAULT_LANGUAGE='en'
 DEFAULT_TIMEZONE="America/New_York"
 ENABLE_RSS_FEED=True
 
-ENABLE_PROMETHEUS_METRICS=False
-#GUNICORN_WORKERS= # Advanced option based on the specs of your server, defaults to 3
-
-#ALERT_MAILS = ["your_email_address", "another_email_address"] # Optional. Recieve Internal Server 500 errors. Good for debugging.
-
-###############
-### Uploads ###
-###############
+#==============================================================================
+# SECURITY
+#==============================================================================
+E2EE_MODE=ENABLED_BY_DEFAULT
+TOKEN_EXPIRATION=604800  # 7 days in seconds
 
+#==============================================================================
+# FILE UPLOADS
+#==============================================================================
 ENABLE_UPLOADS=True
-ENABLE_REMOTE_STORAGE=False
-TOTAL_UPLOADS_LIMIT="1 GB" # site-wide limit
+TOTAL_UPLOADS_LIMIT="1 GB"
 DEFAULT_USER_UPLOADS_LIMIT="50 MB"
-MAX_MEDIA_SIZE=512000 # In Bytes
-MAX_ATTACHMENT_SIZE=1572864 # In Bytes
+MAX_MEDIA_SIZE=512000      # 500 KB
+MAX_ATTACHMENT_SIZE=1572864  # 1.5 MB
 
-###############
-#### LDAP #####
-###############
+#==============================================================================
+# PERFORMANCE & MONITORING
+#==============================================================================
+ENABLE_PROMETHEUS_METRICS=False
+#GUNICORN_WORKERS=        # Default: 3 
 
-#LDAP_SERVER: ldap://localhost
+#==============================================================================
+# NOTIFICATIONS
+#==============================================================================
+#ALERT_MAILS=["your_email_address", "another_email_address"]
+
+#==============================================================================
+# LDAP
+#==============================================================================
+#LDAP_SERVER=ldap://localhost
 #LDAP_BIND_ACCOUNT="cn=nobody,dc=example,dc=com"
 #LDAP_USER_DN_LIST=["uid=%uid,ou=users,o=company,dc=example,dc=com"]
 #LDAP_SEARCH_BASE_DN="o=company,dc=example,dc=com"

README.md

@@ -4,22 +4,26 @@
 
 <!-- metadata -->
 
-* **Category**: Apps
-* **Status**: wip
-* **Image**: [`liberaforms`](https://fung.uy/mycosystems/-/packages/container/liberaforms/), 1
-* **Healthcheck**: Yes
-* **Backups**: No
-* **Email**: 1
-* **Tests**: No
-* **SSO**: 3
+- **Category**: Apps
+- **Status**: 5
+- **Image**: [`liberaforms`](https://fung.uy/mycosystems/-/packages/container/liberaforms/), 1
+- **Healthcheck**: Yes
+- **Backups**: Yes
+- **Email**: 1
+- **Tests**: Yes
+- **SSO**: 3
 
 <!-- endmetadata -->
 
 ## Quick start
 
-* `abra app new liberaforms --secrets`
-* `abra app config <domain-name>`
-* `abra app deploy <domain-name>`
-* Create tables `abra app cmd <domain-name> app setup_db` more info in [liberaforms docs](https://gitlab.com/liberaforms/liberaforms/-/blob/main/docs/docker.md?ref_type=heads#create-the-database)
+- `abra app new liberaforms --secrets`
+- Set an admin email address `abra app config <domain-name>`
+- `abra app deploy <domain-name>`
+- Create tables `abra app cmd <domain-name> forms setup_db` more info in [liberaforms docs](https://gitlab.com/liberaforms/liberaforms/-/blob/main/docs/docker.md?ref_type=heads#create-the-database)
+
+## Admin account setup
+
+Once liberaforms is deployed, go to the login screen by clicking the text in the top right. Next, click "forgot password" now you can fill in the email you set as your admin email and you will be prompted to set a password.
 
 For more, see [`docs.liberaforms.org`](https://docs.liberaforms.org/).

abra.sh

@@ -2,6 +2,7 @@
 
 export ENTRYPOINT_VERSION=v2
 export NGINX_CONFIG_VERSION=v1
+export PG_BACKUP_VERSION=v1
 
 file_env() {
     local var="$1"

compose.yml

@@ -40,6 +40,12 @@ services:
         target: /custom-entrypoint.sh
     entrypoint: /custom-entrypoint.sh
     command: "/usr/bin/supervisord -n"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests; print(requests.get('http://localhost:5000/').status_code)"]
+      timeout: 45s
+      interval: 10s
+      retries: 10
+      start_period: 1m
     environment:
       - ENABLE_LDAP=False
       - FLASK_DEBUG=False
@@ -64,7 +70,7 @@ services:
       - ENABLE_UPLOADS
       - TOTAL_UPLOADS_LIMIT
       - DEFAULT_USER_UPLOADS_LIMIT
-      - ENABLE_REMOTE_STORAGE
+      - ENABLE_REMOTE_STORAGE=False
       - MAX_MEDIA_SIZE
       - MAX_ATTACHMENT_SIZE
       - ENABLE_PROMETHEUS_METRICS
@@ -79,6 +85,12 @@ services:
       - LDAP_MAIL_ATTRIB
       - LDAP_RECOVER_PASSWD_URL
       - E2EE_MODE
+    deploy:
+      labels:
+        backupbot.backup: "true"
+        backupbot.backup.volumes.uploads: "true"
+        backupbot.backup.volumes.log: "false"
+        backupbot.backup.volumes.static: "false"
     volumes:
       - uploads:/app/uploads
       - log:/app/logs
@@ -92,6 +104,10 @@ services:
 
   db:
     image: postgres:17
+    configs:
+        - source: pg_backup
+          target: /pg_backup.sh
+          mode: 0555
     healthcheck:
       test: [ "CMD", "pg_isready", "-q", "-d", "postgres", "-U", "liberaforms" ]
       timeout: 45s
@@ -101,6 +117,11 @@ services:
       POSTGRES_USER: liberaforms
       POSTGRES_DB: liberaforms
       POSTGRES_PASSWORD_FILE: /run/secrets/db_password
+    deploy:
+      labels:
+        backupbot.backup.pre-hook: "/pg_backup.sh backup"
+        backupbot.backup.volumes.db.path: "backup.sql"
+        backupbot.restore.post-hook: '/pg_backup.sh restore'
     volumes:
       - db:/var/lib/postgresql/data
     secrets:
@@ -139,3 +160,6 @@ configs:
   nginx_conf:
     name: ${STACK_NAME}_nginx_conf_${NGINX_CONFIG_VERSION}
     file: nginx.conf
+  pg_backup:
+    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
+    file: pg_backup.sh

pg_backup.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+BACKUP_FILE='/var/lib/postgresql/data/backup.sql'
+
+function backup {
+  export PGPASSWORD=$(cat /run/secrets/db_password)
+  pg_dump -U ${POSTGRES_USER} ${POSTGRES_DB} > $BACKUP_FILE
+}
+
+function restore {
+    cd /var/lib/postgresql/data/
+    restore_config(){
+        # Restore allowed connections
+        cat pg_hba.conf.bak > pg_hba.conf
+        su postgres -c 'pg_ctl reload'
+    }
+    # Don't allow any other connections than local
+    cp pg_hba.conf pg_hba.conf.bak
+    echo "local all all trust" > pg_hba.conf
+    su postgres -c 'pg_ctl reload'
+    trap restore_config EXIT INT TERM
+
+    # Recreate Database
+    psql -U ${POSTGRES_USER} -d postgres -c "DROP DATABASE ${POSTGRES_DB} WITH (FORCE);" 
+    createdb -U ${POSTGRES_USER} ${POSTGRES_DB}
+    psql -U ${POSTGRES_USER} -d ${POSTGRES_DB} -1 -f $BACKUP_FILE
+
+    trap - EXIT INT TERM
+    restore_config
+}
+
+$@

release/0.4.2+4.0.0

@@ -0,0 +1 @@
+This release adds a proper healthcheck to the Liberaforms service and Backupbot labels for liberaforms uploads and Postgres.

release/0.4.3+4.0.0

@@ -0,0 +1 @@
+minor patch, no breaking changes expected.