Browse Source

Drone, OIDC, smtpauth

main
3wc 2 months ago
parent
commit
1ddb432f16
  1. 19
      .drone.yml
  2. 8
      .env.sample
  3. 1
      .gitignore
  4. 2
      abra.sh
  5. 23
      compose.oidc.yml
  6. 19
      compose.smtpauth.yml
  7. 79
      compose.yml
  8. 44
      entrypoint-app.sh
  9. 44
      entrypoint-backend.sh

19
.drone.yml

@ -0,0 +1,19 @@
---
kind: pipeline
name: deploy to swarm-test.autonomic.zone
steps:
- name: deployment
image: decentral1se/stack-ssh-deploy:latest
settings:
host: swarm-test.autonomic.zone
stack: ${REPO_NAME_SNAKE}
purge: true
deploy_key:
from_secret: drone_ssh_swarm_test
environment:
DOMAIN: ${REPO_NAME_KEBAB}.swarm-test.autonomic.zone
STACK_NAME: ${REPO_NAME_SNAKE}
LETS_ENCRYPT_ENV: production
trigger:
branch:
- main

8
.env.sample

@ -33,3 +33,11 @@ PENPOT_SMTP_DEFAULT_REPLY_TO=penpot@example.com
#PENPOT_SMTP_PASSWORD=password
#PENPOT_SMTP_TLS=true
#PENPOT_SMTP_SSL=false
SECRET_DB_PASSWORD_VERSION=v1
SECRET_SMTP_PASSWORD_VERSION=v1
#PENPOT_OIDC_BASE_URI=
#PENPOT_OIDC_CLIENT_ID=
#PENPOT_OIDC_CLIENT_SECRET=
#SECRET_OIDC_CLIENT_SECRET_VERSION=v1

1
.gitignore

@ -0,0 +1 @@
/.envrc

2
abra.sh

@ -0,0 +1,2 @@
export APP_ENTRYPOINT_CONF_VERSION=v1
export BACKEND_ENTRYPOINT_CONF_VERSION=v3

23
compose.oidc.yml

@ -0,0 +1,23 @@
---
version: "3.8"
services:
app:
environment:
# - PENPOT_OIDC_CLIENT_ID
- PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
penpot-backend:
environment:
# - PENPOT_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
# - PENPOT_OIDC_CLIENT_ID
# - PENPOT_OIDC_BASE_URI
# - PENPOT_OIDC_CLIENT_SECRET=cdbafaf5-eec7-424d-8449-4393481cba2a
- PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
- PENPOT_GITHUB_CLIENT_SECRET=a4faabb76fb5e1916328498af202fe85a81873fd
secrets:
- oidc_client_secret
secrets:
oidc_client_secret:
external: true
name: ${STACK_NAME}_oidc_client_secret_${SECRET_OIDC_CLIENT_SECRET_VERSION}

19
compose.smtpauth.yml

@ -0,0 +1,19 @@
---
version: "3.8"
services:
app:
environment:
- PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
secrets:
- smtp_password
penpot-backend:
environment:
- PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
secrets:
- smtp_password
secrets:
smtp_password:
external: true
name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}

79
compose.yml

@ -1,7 +1,27 @@
version: "3.8"
x-environment:
&default-env
- PENPOT_PUBLIC_URI=https://{domain}
- PENPOT_DATABASE_URI=postgresql://postgres/penpot
- PENPOT_DATABASE_USERNAME=penpot
- PENPOT_DATABASE_PASSWORD_FILE=/run/secrets/db_password
- PENPOT_REDIS_URI=redis://redis/0
- PENPOT_STORAGE_BACKEND
- PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
- PENPOT_TELEMETRY_ENABLED
- PENPOT_SMTP_ENABLED
- PENPOT_SMTP_DEFAULT_FROM
- PENPOT_SMTP_DEFAULT_REPLY_TO
- PENPOT_SMTP_HOST
- PENPOT_SMTP_PORT
- PENPOT_SMTP_USERNAME
- PENPOT_SMTP_TLS
- PENPOT_SMTP_SSL
services:
app:
image: "penpotapp/frontend:1.6.5-alpha"
image: "penpotapp/frontend:1.7.1-alpha"
networks:
- proxy
- backend
@ -10,6 +30,14 @@ services:
depends_on:
- penpot-backend
- penpot-exporter
environment: *default-env
entrypoint: /entrypoint.override.sh
secrets:
- db_password
configs:
- source: app_entrypoint
target: /entrypoint.override.sh
mode: 0555
deploy:
restart_policy:
condition: on-failure
@ -25,30 +53,20 @@ services:
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
- coop-cloud.${STACK_NAME}.app.version=1.4.0-alpha-5d926f43
penpot-backend:
image: "penpotapp/backend:1.6.5-alpha"
image: "penpotapp/backend:1.7.1-alpha"
volumes:
- penpot_assets:/opt/data
depends_on:
- postgres
- redis
environment:
- PENPOT_PUBLIC_URI=https://{domain}
- PENPOT_DATABASE_URI=postgresql://postgres/penpot
- PENPOT_DATABASE_USERNAME=penpot
- PENPOT_DATABASE_PASSWORD=penpot
- PENPOT_REDIS_URI=redis://redis/0
- PENPOT_STORAGE_BACKEND=${PENPOT_STORAGE_BACKEND}
- PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
- PENPOT_TELEMETRY_ENABLED=${PENPOT_TELEMETRY_ENABLED}
- PENPOT_SMTP_ENABLED=${PENPOT_SMTP_ENABLED}
- PENPOT_SMTP_DEFAULT_FROM=${PENPOT_SMTP_DEFAULT_FROM}
- PENPOT_SMTP_DEFAULT_REPLY_TO=${PENPOT_SMTP_DEFAULT_REPLY_TO}
- PENPOT_SMTP_HOST=${PENPOT_SMTP_HOST}
- PENPOT_SMTP_PORT=${PENPOT_SMTP_PORT}
- PENPOT_SMTP_USERNAME=${PENPOT_SMTP_USERNAME}
- PENPOT_SMTP_PASSWORD=${PENPOT_SMTP_PASSWORD}
- PENPOT_SMTP_TLS=${PENPOT_SMTP_TLS}
- PENPOT_SMTP_SSL=${PENPOT_SMTP_SSL}
environment: *default-env
secrets:
- db_password
configs:
- source: backend_entrypoint
target: /docker-entrypoint.sh
mode: 0555
entrypoint: /docker-entrypoint.sh
networks:
- backend
# FIXME 3wc: this is only required for email
@ -57,7 +75,7 @@ services:
labels:
- coop-cloud.${STACK_NAME}.penpot-backend.version=1.4.0-alpha-
penpot-exporter:
image: "penpotapp/exporter:1.6.5-alpha"
image: "penpotapp/exporter:1.7.1-alpha"
environment:
# Don't touch it; this uses internal docker network to
# communicate with the frontend.
@ -70,11 +88,13 @@ services:
postgres:
image: "postgres:13"
stop_signal: SIGINT
secrets:
- db_password
environment:
- POSTGRES_INITDB_ARGS=--data-checksums
- POSTGRES_DB=penpot
- POSTGRES_USER=penpot
- POSTGRES_PASSWORD=penpot
- POSTGRES_PASSWORD_FILE=/run/secrets/db_password
volumes:
- postgres:/var/lib/postgresql/data
networks:
@ -89,10 +109,25 @@ services:
deploy:
labels:
- coop-cloud.${STACK_NAME}.redis.version=6-e10f55f9
networks:
proxy:
external: true
backend:
volumes:
postgres:
penpot_assets:
configs:
app_entrypoint:
name: ${STACK_NAME}_app_entrypoint_${APP_ENTRYPOINT_CONF_VERSION}
file: entrypoint-app.sh
backend_entrypoint:
name: ${STACK_NAME}_backend_entrypoint_${BACKEND_ENTRYPOINT_CONF_VERSION}
file: entrypoint-backend.sh
secrets:
db_password:
external: true
name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}

44
entrypoint-app.sh

@ -0,0 +1,44 @@
#!/usr/bin/env bash
file_env() {
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
local var="$1"
local fileVar="${var}_FILE"
local def="${2:-}"
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
exit 1
fi
local val="$def"
if [ "${!var:-}" ]; then
val="${!var}"
elif [ "${!fileVar:-}" ]; then
val="$(< "${!fileVar}")"
fi
export "$var"="$val"
unset "$fileVar"
}
load_vars() {
file_env "PENPOT_DATABASE_PASSWORD"
file_env "PENPOT_SMTP_PASSWORD"
file_env "PENPOT_LDAP_BIND_PASSWORD"
file_env "PENPOT_GOOGLE_CLIENT_SECRET"
file_env "PENPOT_GITHUB_CLIENT_SECRET"
file_env "PENPOT_GITLAB_CLIENT_SECRET"
file_env "PENPOT_OIDC_CLIENT_SECRET"
}
main() {
set -eu
load_vars
}
main
# 3wc: upstream ENTRYPOINT
# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.frontend
/docker-entrypoint.sh nginx -g "daemon off;"

44
entrypoint-backend.sh

@ -0,0 +1,44 @@
#!/usr/bin/env bash
file_env() {
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
local var="$1"
local fileVar="${var}_FILE"
local def="${2:-}"
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
exit 1
fi
local val="$def"
if [ "${!var:-}" ]; then
val="${!var}"
elif [ "${!fileVar:-}" ]; then
val="$(< "${!fileVar}")"
fi
export "$var"="$val"
unset "$fileVar"
}
load_vars() {
file_env "PENPOT_DATABASE_PASSWORD"
file_env "PENPOT_SMTP_PASSWORD"
file_env "PENPOT_LDAP_BIND_PASSWORD"
file_env "PENPOT_GOOGLE_CLIENT_SECRET"
file_env "PENPOT_GITHUB_CLIENT_SECRET"
file_env "PENPOT_GITLAB_CLIENT_SECRET"
file_env "PENPOT_OIDC_CLIENT_SECRET"
}
main() {
set -eu
load_vars
}
main
# 3wc: upstream ENTRYPOINT
# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.backend
./run.sh
Loading…
Cancel
Save