fix postgres backup (#30)

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [x] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Info for release notes:

> Up until now the backups only worked sporadically, as they used the database volume and not the dump due to wring path. Upgrading to this version will start produce reliable backups. Older backups cannot be restored with backup bot anymore, and should be copied manually. (In case there is a working one)

Reviewed-on: coop-cloud/loomio#30
Reviewed-by: Jackie Makdah <jackiemak22@proton.me>
Co-authored-by: stevensting <stefan@klasse-methode.it>
Co-committed-by: stevensting <stefan@klasse-methode.it>

.drone.yml

@@ -22,6 +22,7 @@ steps:
       SECRET_SECRET_COOKIE_TOKEN_VERSION: v1
       SECRET_DB_PASSWORD_VERSION: v1
       SECRET_SMTP_PASSWORD_VERSION: v1
+      SECRET_OAUTH_APP_SECRET_VERSION: v1
 trigger:
   branch:
     - main

.env.sample

@@ -90,3 +90,17 @@ SECRET_DB_PASSWORD_VERSION=v1
 # THEME_ACCENT_COLOR=rgb(0,188,212)
 # THEME_TEXT_ON_PRIMARY_COLOR=rgb(255,255,255)
 # THEME_TEXT_ON_ACCENT_COLOR=rgb(255,255,255)
+
+# env variables needed to enable OAuth2 authentication  
+# COMPOSE_FILE="$COMPOSE_FILE:compose.oauth.yml"
+# OAUTH_ENABLED=1
+# OAUTH_AUTH_URL=
+# OAUTH_TOKEN_URL=
+# OAUTH_PROFILE_URL=
+# OAUTH_SCOPE=
+# OAUTH_APP_KEY=
+# OAUTH_ATTR_UID=
+# OAUTH_ATTR_NAME=
+# OAUTH_ATTR_EMAIL=
+# OAUTH_LOGIN_PROVIDER_NAME=
+# SECRET_OAUTH_APP_SECRET_VERSION=v1

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+---
+name: "Loomio pull request template"
+about: "Loomio pull request template"
+---
+
+<!-- 
+Thank you for doing recipe maintenance work!
+Please mark all checklist items which are relevant for your changes.
+Please remove the checklist items which are not relevant for your changes.
+Feel free to remove this comment.
+-->
+
+* [ ] I have deployed and tested my changes
+* [ ] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
+* [ ] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
+* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

MAINTENANCE.md

@@ -0,0 +1,32 @@
+# Loomio Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a
+certain quality and consistency, that others can rely on.
+
+## Maintainer Responsibilities
+
+A recipe maintainer has the following responsibilities:
+
+- Respond to pull requests / issues within a week
+- Make image security updates within a day
+- Make image patch / minor updates within a week
+- Make image major updates within a month
+
+In order to fullfill these responsibilities a recipe maintainer:
+
+- Has to watch the repository (to get notifications)
+- Needs to make sure renovate is configured properly
+
+## Pull Requests
+
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+1. Watch the repository to always get updates
+2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
+3. Once the pull request gets merged you will be added to the [loomio maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/loomio-maintainers).

README.md

@@ -3,6 +3,7 @@
 "Loomio is a collaborative decision-making tool that makes it easy for anyone to participate in decisions which affect them. To find out more, visit Loomio.org."
 
 <!-- metadata -->
+* **Maintainer**: [@jmakdah2](https://git.coopcloud.tech/jmakdah2)[@moosemower](https://git.coopcloud.tech/moosemower)
 * **Category**: Apps
 * **Status**: 3, work-in-progress
 * **Image**: [`loomio/*`](https://hub.docker.com/r/loomio), 4, upstream

abra.sh

@@ -1,4 +1,5 @@
-export LOOMIO_ENTRYPOINT_VERSION=v6
+export LOOMIO_ENTRYPOINT_VERSION=v8
+export PG_BACKUP_VERSION=v1
 
 # cannot be integrated into entrypoint.sh as it requires the operator to create a user first
 function make_last_user_admin()
@@ -13,4 +14,4 @@ function set_new_db_password()
     echo "setting new password for db user..."
 	psql -U $POSTGRES_USER -c "ALTER USER $POSTGRES_USER PASSWORD '$(cat /run/secrets/db_password)';"
     echo "done"
-}
+}

compose.oauth.yml

@@ -0,0 +1,31 @@
+version: "3.8"
+
+x-oauth-env: &oauth-env
+  OAUTH_AUTH_URL:
+  OAUTH_TOKEN_URL:
+  OAUTH_PROFILE_URL:
+  OAUTH_SCOPE:
+  OAUTH_APP_KEY:
+  OAUTH_APP_SECRET_FILE: /run/secrets/oauth_app_secret
+  OAUTH_ATTR_UID:
+  OAUTH_ATTR_NAME:
+  OAUTH_ATTR_EMAIL:
+  OAUTH_LOGIN_PROVIDER_NAME:
+  OAUTH_ENABLED: 
+
+services:
+  app:
+    environment: 
+      *oauth-env
+    secrets:
+      - oauth_app_secret
+  worker:
+    environment: 
+      *oauth-env
+    secrets:
+      - oauth_app_secret
+
+secrets:
+  oauth_app_secret:
+    name: ${STACK_NAME}_oauth_app_secret_${SECRET_OAUTH_APP_SECRET_VERSION}
+    external: true

compose.yml

@@ -32,7 +32,7 @@ x-environment: &default-env
 
 services:
   app:
-    image: loomio/loomio:v3.0.0
+    image: loomio/loomio:v3.0.20
     configs:
       - source: entrypoint
         target: /entrypoint.sh
@@ -70,7 +70,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=5.0.0+v3.0.0"
+        - "coop-cloud.${STACK_NAME}.version=5.2.0+v3.0.20"
         - "backupbot.backup:=${ENABLE_BACKUPS:-true}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}"
         - "traefik.http.middlewares.${STACK_NAME}.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
@@ -115,12 +115,14 @@ services:
       PGDATA: /pgdata
     deploy:
       labels:
-        backupbot.backup: "${ENABLE_BACKUPS:-true}"
-        backupbot.backup.pre-hook: sh -c 'pg_dump -U "$$POSTGRES_USER" -Fc "$$POSTGRES_DB" | gzip > "/postgres.dump.gz"'
-        backupbot.backup.path: "/postgres.dump.gz"
-        backupbot.backup.post-hook: "rm -f /postgres.dump.gz"
-        backupbot.restore: "true"
-        backupbot.restore.post-hook: sh -c 'gzip -d /postgres.dump.gz && pg_restore --clean -U "$$POSTGRES_USER" --dbname="$$POSTGRES_DB" < /postgres.dump && rm -f /postgres.dump'
+        backupbot.backup: ${ENABLE_BACKUPS:-true}
+        backupbot.backup.volumes.pgdata.path: "backup.sql"
+        backupbot.backup.pre-hook: "/pg_backup.sh backup"
+        backupbot.restore.post-hook: '/pg_backup.sh restore'
+    configs:
+        - source: pg_backup
+          target: /pg_backup.sh
+          mode: 0555
   redis:
     image: redis:8.0
     networks:
@@ -145,6 +147,7 @@ services:
     environment:
       <<: *redis-env
       VIRTUAL_HOST: channels.${DOMAIN}
+      APP_URL: ${DOMAIN}
     deploy:
       labels:
         - "traefik.enable=true"
@@ -202,6 +205,9 @@ configs:
   entrypoint:
     name: ${STACK_NAME}_entrypoint_${LOOMIO_ENTRYPOINT_VERSION}
     file: entrypoint.sh
+  pg_backup:
+    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
+    file: pg_backup.sh
 
 secrets:
   devise_secret:

entrypoint.sh

@@ -25,6 +25,11 @@ file_env "DEVISE_SECRET"
 file_env "SECRET_COOKIE_TOKEN"
 file_env "POSTGRES_PASSWORD"
 file_env "SMTP_PASSWORD"
+
+if [ "$OAUTH_ENABLED" = "1" ]; then
+	file_env "OAUTH_APP_SECRET"
+fi  
+
 export DB_HOST="db"
 export DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db/${POSTGRES_DB}"
 

pg_backup.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+
+set -e
+
+BACKUP_PATH="/pgdata"
+LATEST_BACKUP_FILE="${BACKUP_PATH}/backup.sql"
+
+function backup {
+  FILE_WITH_DATE="${BACKUP_PATH}/backup_$(date +%F).sql"
+  
+  if [ -f "$POSTGRES_PASSWORD_FILE" ]; then
+    export PGPASSWORD=$(cat "$POSTGRES_PASSWORD_FILE")
+  fi
+  
+  echo "Creating backup at ${FILE_WITH_DATE}..."
+  pg_dump -U "${POSTGRES_USER:-postgres}" "${POSTGRES_DB:-postgres}" > "${FILE_WITH_DATE}"
+  
+  echo "Copying to ${LATEST_BACKUP_FILE}..."
+  cp -f "${FILE_WITH_DATE}" "${LATEST_BACKUP_FILE}"
+  
+  echo "Backup done. You will find it at ${LATEST_BACKUP_FILE}"
+}
+
+function restore {
+    echo "Restoring database from ${LATEST_BACKUP_FILE}..."
+
+    cd ${BACKUP_PATH}
+    
+    function restore_config {
+        echo "Restoring original pg_hba.conf configuration..."
+        cat pg_hba.conf.bak > pg_hba.conf
+        su postgres -c 'pg_ctl reload'
+    }
+    
+    # Don't allow any other connections than local
+    echo "Setting up temporary pg_hba.conf to only allow local connections..."
+    cp pg_hba.conf pg_hba.conf.bak
+    echo "local all all trust" > pg_hba.conf
+    su postgres -c 'pg_ctl reload'
+    trap restore_config EXIT INT TERM
+
+    # Recreate Database
+    echo "Dropping existing database ${POSTGRES_DB:-postgres}..."
+    psql -U "${POSTGRES_USER:-postgres}" -d postgres -c "DROP DATABASE \"${POSTGRES_DB:-postgres}\" WITH (FORCE);" 
+    
+    echo "Creating fresh database ${POSTGRES_DB:-postgres}..."
+    createdb -U "${POSTGRES_USER:-postgres}" "${POSTGRES_DB:-postgres}"
+    
+    echo "Restoring data from ${LATEST_BACKUP_FILE}..."
+    psql -U "${POSTGRES_USER:-postgres}" -d "${POSTGRES_DB:-postgres}" -1 -f "${LATEST_BACKUP_FILE}"
+
+    trap - EXIT INT TERM
+    restore_config
+    
+    echo "Database restore completed successfully."
+}
+
+# Execute the function passed as argument
+case "$1" in
+  backup)
+    backup
+    ;;
+  restore)
+    restore
+    ;;
+  *)
+    echo "Usage: $0 {backup|restore}"
+    exit 1
+    ;;
+esac

release/5.1.0+v3.0.0

@@ -0,0 +1 @@
+Add support for OAuth2. To use this feature copy and populate the new oauth2 env variables from the .env.sample to your locale .env config and insert the oauth2_app_secret secret into your recipe:

release/5.2.0+v3.0.20

@@ -0,0 +1 @@
+upgrade loomio from version 3.0.0 to 3.0.20

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}