Drone, OIDC, smtpauth

.drone.yml

@@ -0,0 +1,19 @@
+---
+kind: pipeline
+name: deploy to swarm-test.autonomic.zone
+steps:
+  - name: deployment
+    image: decentral1se/stack-ssh-deploy:latest
+    settings:
+      host: swarm-test.autonomic.zone
+      stack: ${REPO_NAME_SNAKE}
+      purge: true
+      deploy_key:
+        from_secret: drone_ssh_swarm_test
+    environment:
+      DOMAIN: ${REPO_NAME_KEBAB}.swarm-test.autonomic.zone
+      STACK_NAME: ${REPO_NAME_SNAKE}
+      LETS_ENCRYPT_ENV: production
+trigger:
+  branch:
+    - main

.env.sample

@@ -33,3 +33,11 @@ PENPOT_SMTP_DEFAULT_REPLY_TO=penpot@example.com
 #PENPOT_SMTP_PASSWORD=password
 #PENPOT_SMTP_TLS=true
 #PENPOT_SMTP_SSL=false
+
+SECRET_DB_PASSWORD_VERSION=v1
+SECRET_SMTP_PASSWORD_VERSION=v1
+
+#PENPOT_OIDC_BASE_URI=
+#PENPOT_OIDC_CLIENT_ID=
+#PENPOT_OIDC_CLIENT_SECRET=
+#SECRET_OIDC_CLIENT_SECRET_VERSION=v1

.gitignore

@@ -0,0 +1 @@
+/.envrc

abra.sh

@@ -0,0 +1,2 @@
+export APP_ENTRYPOINT_CONF_VERSION=v1
+export BACKEND_ENTRYPOINT_CONF_VERSION=v3

compose.oidc.yml

@@ -0,0 +1,23 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      # - PENPOT_OIDC_CLIENT_ID
+      - PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
+  penpot-backend:
+    environment:
+      # - PENPOT_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
+      # - PENPOT_OIDC_CLIENT_ID
+      # - PENPOT_OIDC_BASE_URI
+      # - PENPOT_OIDC_CLIENT_SECRET=cdbafaf5-eec7-424d-8449-4393481cba2a
+      - PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
+      - PENPOT_GITHUB_CLIENT_SECRET=a4faabb76fb5e1916328498af202fe85a81873fd
+    secrets:
+      - oidc_client_secret
+
+secrets:
+  oidc_client_secret:
+    external: true
+    name: ${STACK_NAME}_oidc_client_secret_${SECRET_OIDC_CLIENT_SECRET_VERSION}

compose.smtpauth.yml

@@ -0,0 +1,19 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
+    secrets:
+      - smtp_password
+  penpot-backend:
+    environment:
+      - PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
+    secrets:
+      - smtp_password
+
+secrets:
+  smtp_password:
+    external: true
+    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}

compose.yml

@@ -1,7 +1,27 @@
 version: "3.8"
+
+x-environment:
+  &default-env
+  - PENPOT_PUBLIC_URI=https://{domain}
+  - PENPOT_DATABASE_URI=postgresql://postgres/penpot
+  - PENPOT_DATABASE_USERNAME=penpot
+  - PENPOT_DATABASE_PASSWORD_FILE=/run/secrets/db_password
+  - PENPOT_REDIS_URI=redis://redis/0
+  - PENPOT_STORAGE_BACKEND
+  - PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
+  - PENPOT_TELEMETRY_ENABLED
+  - PENPOT_SMTP_ENABLED
+  - PENPOT_SMTP_DEFAULT_FROM
+  - PENPOT_SMTP_DEFAULT_REPLY_TO
+  - PENPOT_SMTP_HOST
+  - PENPOT_SMTP_PORT
+  - PENPOT_SMTP_USERNAME
+  - PENPOT_SMTP_TLS
+  - PENPOT_SMTP_SSL
+
 services:
   app:
-    image: "penpotapp/frontend:1.6.5-alpha"
+    image: "penpotapp/frontend:1.7.1-alpha"
     networks:
       - proxy
       - backend
@@ -10,6 +30,14 @@ services:
     depends_on:
       - penpot-backend
       - penpot-exporter
+    environment: *default-env
+    entrypoint: /entrypoint.override.sh
+    secrets:
+      - db_password
+    configs:
+      - source: app_entrypoint
+        target: /entrypoint.override.sh
+        mode: 0555
     deploy:
       restart_policy:
         condition: on-failure
@@ -25,30 +53,20 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - coop-cloud.${STACK_NAME}.app.version=1.4.0-alpha-5d926f43
   penpot-backend:
-    image: "penpotapp/backend:1.6.5-alpha"
+    image: "penpotapp/backend:1.7.1-alpha"
     volumes:
       - penpot_assets:/opt/data
     depends_on:
       - postgres
       - redis
-    environment:
+    environment: *default-env
-      - PENPOT_PUBLIC_URI=https://{domain}
+    secrets:
-      - PENPOT_DATABASE_URI=postgresql://postgres/penpot
+      - db_password
-      - PENPOT_DATABASE_USERNAME=penpot
+    configs:
-      - PENPOT_DATABASE_PASSWORD=penpot
+      - source: backend_entrypoint
-      - PENPOT_REDIS_URI=redis://redis/0
+        target: /docker-entrypoint.sh
-      - PENPOT_STORAGE_BACKEND=${PENPOT_STORAGE_BACKEND}
+        mode: 0555
-      - PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
+    entrypoint: /docker-entrypoint.sh
-      - PENPOT_TELEMETRY_ENABLED=${PENPOT_TELEMETRY_ENABLED}
-      - PENPOT_SMTP_ENABLED=${PENPOT_SMTP_ENABLED}
-      - PENPOT_SMTP_DEFAULT_FROM=${PENPOT_SMTP_DEFAULT_FROM}
-      - PENPOT_SMTP_DEFAULT_REPLY_TO=${PENPOT_SMTP_DEFAULT_REPLY_TO}
-      - PENPOT_SMTP_HOST=${PENPOT_SMTP_HOST}
-      - PENPOT_SMTP_PORT=${PENPOT_SMTP_PORT}
-      - PENPOT_SMTP_USERNAME=${PENPOT_SMTP_USERNAME}
-      - PENPOT_SMTP_PASSWORD=${PENPOT_SMTP_PASSWORD}
-      - PENPOT_SMTP_TLS=${PENPOT_SMTP_TLS}
-      - PENPOT_SMTP_SSL=${PENPOT_SMTP_SSL}
     networks:
       - backend
       # FIXME 3wc: this is only required for email
@@ -57,7 +75,7 @@ services:
       labels:
         - coop-cloud.${STACK_NAME}.penpot-backend.version=1.4.0-alpha-
   penpot-exporter:
-    image: "penpotapp/exporter:1.6.5-alpha"
+    image: "penpotapp/exporter:1.7.1-alpha"
     environment:
       # Don't touch it; this uses internal docker network to
       # communicate with the frontend.
@@ -70,11 +88,13 @@ services:
   postgres:
     image: "postgres:13"
     stop_signal: SIGINT
+    secrets:
+      - db_password
     environment:
       - POSTGRES_INITDB_ARGS=--data-checksums
       - POSTGRES_DB=penpot
       - POSTGRES_USER=penpot
-      - POSTGRES_PASSWORD=penpot
+      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
     volumes:
       - postgres:/var/lib/postgresql/data
     networks:
@@ -89,10 +109,25 @@ services:
     deploy:
       labels:
         - coop-cloud.${STACK_NAME}.redis.version=6-e10f55f9
+
 networks:
   proxy:
     external: true
   backend:
+
 volumes:
   postgres:
   penpot_assets:
+
+configs:
+  app_entrypoint:
+    name: ${STACK_NAME}_app_entrypoint_${APP_ENTRYPOINT_CONF_VERSION}
+    file: entrypoint-app.sh
+  backend_entrypoint:
+    name: ${STACK_NAME}_backend_entrypoint_${BACKEND_ENTRYPOINT_CONF_VERSION}
+    file: entrypoint-backend.sh
+
+secrets:
+  db_password:
+    external: true
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}

entrypoint-app.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+file_env() {
+	# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
+	# 	https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	export "$var"="$val"
+	unset "$fileVar"
+}
+
+load_vars() {
+	file_env "PENPOT_DATABASE_PASSWORD"
+	file_env "PENPOT_SMTP_PASSWORD"
+	file_env "PENPOT_LDAP_BIND_PASSWORD"
+	file_env "PENPOT_GOOGLE_CLIENT_SECRET"
+	file_env "PENPOT_GITHUB_CLIENT_SECRET"
+	file_env "PENPOT_GITLAB_CLIENT_SECRET"
+	file_env "PENPOT_OIDC_CLIENT_SECRET"
+}
+
+main() {
+	set -eu
+
+	load_vars
+}
+
+main
+
+# 3wc: upstream ENTRYPOINT
+# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.frontend
+/docker-entrypoint.sh nginx -g "daemon off;"

entrypoint-backend.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+file_env() {
+	# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
+	# 	https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	export "$var"="$val"
+	unset "$fileVar"
+}
+
+load_vars() {
+	file_env "PENPOT_DATABASE_PASSWORD"
+	file_env "PENPOT_SMTP_PASSWORD"
+	file_env "PENPOT_LDAP_BIND_PASSWORD"
+	file_env "PENPOT_GOOGLE_CLIENT_SECRET"
+	file_env "PENPOT_GITHUB_CLIENT_SECRET"
+	file_env "PENPOT_GITLAB_CLIENT_SECRET"
+	file_env "PENPOT_OIDC_CLIENT_SECRET"
+}
+
+main() {
+	set -eu
+
+	load_vars
+}
+
+main
+
+# 3wc: upstream ENTRYPOINT
+# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.backend
+./run.sh