Merge pull request 'maj master' (#1) from 0k/0k-charms:master into master

Reviewed-on: https://git.myceliandre.fr/StephanSainleger/0k-charms/pulls/1

apache/build/Dockerfile

@@ -1,7 +1,7 @@
 ## copy of 'php:7.3-apache' image
 ## XXXvlab: will need to move towards separate apache and php, so that nginx can
 ## replace apache in all conf.
-FROM docker.0k.io/php:7.3-apache-1
+FROM docker.0k.io/php:7.4.13-apache
 
 ## Limesurvey
 # RUN apt-get update && \
@@ -20,7 +20,7 @@ FROM docker.0k.io/php:7.3-apache-1
 
 ## Framadate
 RUN apt-get update && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y libicu-dev libpq-dev libxml2-dev && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y libonig-dev libicu-dev libpq-dev libxml2-dev && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     docker-php-ext-install mbstring intl xml pdo_pgsql
@@ -30,7 +30,7 @@ RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y libexif-dev libexif12 libfreetype6-dev libjpeg62-turbo-dev libpng-dev && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ && \
+    docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr/include/ && \
     docker-php-ext-install exif gd pdo_mysql mysqli
 
 ## gogocarto
@@ -39,13 +39,13 @@ RUN apt-get update && \
         libbz2-dev libc-client-dev libcurl4-openssl-dev libfreetype6-dev \
         libgd-dev libicu-dev libkrb5-dev libmagickcore-dev libmagickwand-dev \
         libmcrypt-dev libmemcached-dev libtidy-dev libxml2-dev libxslt-dev \
-        libz-dev libzip-dev" && \
+        libz-dev libzip-dev libonig-dev" && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         bzip2 cron g++ gettext git gnupg imagemagick libfreetype6 libgd3 \
         libmcrypt4 libmemcached11 libmemcachedutil2 libsodium23 libtidy5deb1 \
         libxml2 libxslt1.1 libzip4 nano openssl unzip ${BUILD_PACKAGES} && \
-    docker-php-ext-configure gd --with-freetype-dir=/usr/include/ \
-                                --with-jpeg-dir=/usr/include/ && \
+    docker-php-ext-configure gd --with-freetype=/usr/include/ \
+                                --with-jpeg=/usr/include/ && \
     docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
     docker-php-ext-configure hash --with-mhash && \
     docker-php-ext-install bcmath bz2 calendar dba curl exif gd gettext \
@@ -63,14 +63,11 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 
-
-
 ## XXXvlab: could load these in 'entrypoint.sh' to be more dynamic
 RUN a2enmod headers proxy_http rewrite ssl proxy_wstunnel http2 proxy_connect
 
 ## Can remove this when SSL certificate are all valid ones
-RUN apt-get update && apt-get install -y --force-yes ssl-cert
-
+RUN apt-get update && apt-get install -y ssl-cert
 
 COPY entrypoint.sh /entrypoint.sh
 

bitwarden/metadata.yml

@@ -1,6 +1,6 @@
 description: Bitwarden Server
-#docker-image: bitwardenrs/server:1.17.0-alpine
-docker-image: docker.0k.io/bitwarden:1.17.0
+#docker-image: bitwardenrs/server:1.22.2-alpine
+docker-image: docker.0k.io/bitwarden:1.22.2
 data-resources:
   - /data
 uses:

codimd/hooks/init

@@ -1,12 +0,0 @@
-#!/bin/bash
-
-init-config-add "\
-$SERVICE_NAME:
-  environment:
-    CMD_USECDN: \"false\"
-"
-
-## ``codimd`` create uploads folder with wrong permission
-
-mkdir -p "$SERVICE_DATASTORE/home/hackmd/app/public/uploads"
-chown -R 1500:1500 "$SERVICE_DATASTORE/home/hackmd/app/public/"

cron/build/Dockerfile

@@ -1,7 +1,7 @@
-FROM debian:jessie
+FROM docker.0k.io/debian:jessie
 
 RUN apt-get update && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes cron moreutils && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y cron moreutils && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

cron/hooks/init

@@ -19,6 +19,12 @@ fi
     exit 1
 }
 
+[ "$HOST_COMPOSE_LAUNCHER_OPTS" ] || {
+    err "\$HOST_COMPOSE_LAUNCHER_OPTS is expected to be set."
+    exit 1
+}
+
+
 [ "$COMPOSE_LAUNCHER_BIN" ] || {
     err "\$COMPOSE_LAUNCHER_BIN is expected to be set."
     exit 1
@@ -31,7 +37,7 @@ $CHARM_NAME:
     - /etc/timezone:/etc/timezone:ro
     - \$DOCKER_COMPOSE_PATH/bin/dc:/bin/dc:ro
     - $COMPOSE_LAUNCHER_BIN:/bin/compose:ro
-    - $COMPOSE_LAUNCHER_OPTS:$COMPOSE_LAUNCHER_OPTS:ro
+    - $HOST_COMPOSE_LAUNCHER_OPTS:$COMPOSE_LAUNCHER_OPTS:ro
   environment:
     TZ: $timezone
     COMPOSE_LAUNCHER_OPTS: $COMPOSE_LAUNCHER_OPTS

cron/hooks/pre_deploy

@@ -0,0 +1,20 @@
+#!/bin/bash
+## Should be executable N time in a row with same result.
+
+set -e
+
+cron_config_hash() {
+    debug "Adding config hash to enable recreating upon config change."
+    config_hash=$({
+                     find "$SERVICE_CONFIGSTORE/etc/cron"{,.hourly,.weekly,.daily,.monthly} \
+                          -type f -exec md5sum {} \;
+                  } | md5_compat) || exit 1
+    init-config-add "
+$MASTER_BASE_SERVICE_NAME:
+  labels:
+    - compose.config_hash=$config_hash
+"
+}
+
+
+cron_config_hash || exit 1

cron/metadata.yml

@@ -11,7 +11,9 @@ data-resources:
 host-resources:
   - /var/run/docker.sock
 provides:
-  schedule-command:
+  schedule-command:  ## for one command
+    tech-dep: False
+  schedule-commands: ## for several commands
     tech-dep: False
 
 uses:   ## optional

cyclos/hooks/init

@@ -40,7 +40,7 @@ done < <(array_values_to_stdin PROPS)
 init-config-add "
 $SERVICE_NAME:
   environment:
-    JAVA_OPTS: |
+    JAVA_OPTS: >-
       -Dcyclos.cors.origin=*
       -Dcyclos.header.remoteAddress=X-Forwarded-For
       -Dcyclos.header.protocol=X-Forwarded-Proto

cyclos/hooks/pre_deploy

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+##
+## Get domain in option of relation "web-proxy"
+##
+
+## XXXvlab: there is a tiny lapse of time where database is not yet
+## installed, and admin password is the default value.
+
+
+. lib/common
+
+set -ex
+
+
+admin_password=$(options-get admin-password 2>/dev/null ) || exit 1
+
+CONTROL_PASSWORD_FILE="$SERVICE_DATASTORE/.control-pass"
+## Was it already properly propagated to database ?
+control_password=$(H "${admin_password}")
+if ! [ -e "$CONTROL_PASSWORD_FILE" ] || [ "$control_password" != "$(cat "$CONTROL_PASSWORD_FILE")" ]; then
+
+    hash="$(htpasswd -nbBC 10 USER "$admin_password" | cut -f 2- -d :)" || {
+        err "Couldn't generate hash for admin password."
+        exit 1
+    }
+
+    if ! sql < <(e "
+    UPDATE passwords SET value = '$hash'
+    WHERE user_id = 1
+      AND status = 'ACTIVE'
+      AND password_type_id in (
+        SELECT id FROM password_types
+        WHERE input_method = 'TEXT_BOX'
+          AND password_mode = 'MANUAL');
+    "); then
+        debug "Failed to set password for admin users."
+        exit 1
+    fi
+    mkdir -p "${CONTROL_PASSWORD_FILE%/*}"
+    e "$control_password" > "$CONTROL_PASSWORD_FILE"
+fi
+
+
+
+url=$(named-relation-get "web-proxy" url) || exit 1
+
+CONTROL_URL_FILE="$SERVICE_DATASTORE/.control-url"
+## Was it already properly propagated to database ?
+control_url=$(H "${url}")
+if ! [ -e "$CONTROL_URL_FILE" ] || [ "$control_url" != "$(cat "$CONTROL_URL_FILE")" ]; then
+    ## In ``configurations`` table, columns login_url, logout_url, root_url
+
+    if ! sql < <(e "
+    UPDATE configurations
+    SET
+         root_url = '$url'
+    "); then
+        debug "Failed to set password for admin users."
+        exit 1
+    fi
+    e "$control_password" > "$CONTROL_URL_FILE"
+fi

cyclos/lib/common

@@ -1,4 +1,4 @@
-# -*- mode: bash -*-
+# -*- mode: shell-script -*-
 
 
 CYCLOS_CONFIG="/usr/local/cyclos/WEB-INF/classes/cyclos.properties"
@@ -12,3 +12,62 @@ cyclos:build() {
         docker cp "$container_id":"$CYCLOS_CONFIG" "$HOST_CYCLOS_CONFIG" &&
         docker rm "$container_id"
 }
+
+
+named-relation-get-target-service() {
+    local relation="$1" ts
+    if ! read-0 ts _ _ < <(get_service_relation "$SERVICE_NAME" "$relation"); then
+        err "Couldn't find relation ${DARKCYAN}$relation${NORMAL}."
+        return 1
+    fi
+    e "$ts"
+}
+
+
+## XXXvlab: Consider for inclusion in compose-core
+relation-get-config() {
+    local relation="$1" ts relation_dir
+
+    ts=$(named-relation-get-target-service "$relation") || return 1
+    relation_dir=$(get_relation_data_dir "$SERVICE_NAME" "$ts" "$relation") || return 1
+    cat "${relation_dir}/data"
+}
+
+
+named-relation-get() {
+    local relation="$1" key="$2" config
+
+    config=$(relation-get-config "$relation") || return 1
+
+    e "$config" | shyaml get-value "$key" || {
+        err "Couldn't get ${WHITE}$key${NORMAL} value" \
+            "in ${DARKCYAN}$relation${NORMAL} relation's data."
+        exit 1
+    }
+}
+
+
+sql() {
+    (
+        DBNAME="$(named-relation-get "postgres-database" dbname)" || exit 1
+        ts=$(named-relation-get-target-service "postgres-database") || exit 1
+
+        export SERVICE_NAME="$ts"
+        export SERVICE_DATASTORE="$DATASTORE/$SERVICE_NAME"
+        DOCKER_BASE_IMAGE=$(service_base_docker_image "$SERVICE_NAME")
+        export DOCKER_BASE_IMAGE
+
+        target_charm=$(get_service_charm "$ts") || exit 1
+        target_charm_path=$(charm.get_dir "$target_charm") || exit 1
+
+        set +e
+
+        . "$target_charm_path/lib/common"
+
+        set -e
+
+        ensure_db_docker_running
+
+        ddb "$DBNAME"
+    )
+}

cyclos/metadata.yml

@@ -1,5 +1,5 @@
-## Based on cyclos/cyclos:4.13.2
-docker-image: docker.0k.io/cyclos:4.13.2
+## Based on cyclos/cyclos:4.14
+docker-image: docker.0k.io/cyclos:4.14.7
 config-resources:
   - /usr/local/cyclos/WEB-INF/classes/cyclos.properties
 data-resources:
@@ -24,6 +24,8 @@ uses:
         - earthdistance
         - postgis
         - unaccent
+      init-sql: !bash-stdout |
+        zcat "$BASE_CHARM_PATH/src/init.sql.gz"
   log-rotate:
     #constraint: required | recommended | optional
     #auto: pair | summon | none ## default: pair

drone/metadata.yml

@@ -47,3 +47,17 @@ uses:
       proxy: "Public access"
     default-options:
       target: !var-expand ${MASTER_BASE_SERVICE_NAME}:80
+  backup:
+    constraint: recommended
+    auto: pair
+    solves:
+      backup: "Automatic regular backups of sql database"
+    default-options:
+      ## First pattern matching wins, no pattern matching includes.
+      ## include-patterns are checked first, then exclude-patterns
+      ## Patterns rules:
+      ##  - ending / for directory
+      ##  - '*' authorized
+      ##  - must start with a '/', will start from $SERVICE_DATASTORE
+      # include-patterns:
+      #   - /var/backups/pg/

etherpad/README.org

@@ -0,0 +1,33 @@
+# -*- ispell-local-dictionary: "english" -*-
+
+#+TITLE: Etherpad Charm
+
+* Upgrade
+
+Based on https://github.com/ether/etherpad-lite , following:
+
+https://github.com/ether/etherpad-lite/blob/develop/doc/docker.md
+
+Used:
+
+#+begin_src sh
+TAG=1.8.14
+git clone https://github.com/ether/etherpad-lite --depth 1 -b $TAG
+docker build --build-arg INSTALL_SOFFICE=1 \
+             --build-arg ETHERPAD_PLUGINS=" \
+            ep_font_family ep_mammoth ep_comments_page ep_table_of_contents \
+            ep_markdown ep_image_upload ep_spellcheck ep_headings2 ep_align \
+            ep_who_did_what ep_what_have_i_missed ep_embedmedia \
+            ep_openid_connect ep_rss ep_git_commit_saved_revision" \
+       . -t docker.0k.io/etherpad:${TAG}-0k
+docker push docker.0k.io/etherpad:${TAG}-0k
+#+end_src
+
+
+* Admin password
+
+We choose to NOT include admin panel as it allows to change settings
+and install plugins but this will not allow to reproduce an install
+easily. We can do this on the =compose.yml= side in a reproducible
+manner.
+

etherpad/hooks/init

@@ -0,0 +1,39 @@
+#!/bin/bash
+
+## Init is run on host
+## For now it is run every time the script is launched, but
+## it should be launched only once after build.
+
+## Accessible variables are:
+## - SERVICE_NAME        Name of current service
+## - DOCKER_BASE_IMAGE   Base image from which this service might be built if any
+## - SERVICE_DATASTORE           Location on host of the DATASTORE of this service
+## - SERVICE_CONFIGSTORE         Location on host of the CONFIGSTORE of this service
+
+
+. lib/common
+
+set -e
+
+
+dirs=(
+    "$SERVICE_DATASTORE/var/lib/etherpad"
+)
+
+uid_gid=($(docker_get_uid_gid "$SERVICE_NAME" "etherpad" "etherpad")) || {
+    err "Could not fetch uid/gid on image of service ${DARKYELLOW}$SERVICE_NAME${NORMAL}."
+    return 1
+}
+
+uid="${uid_gid[0]}"
+gid="${uid_gid[1]}"
+for dir in "${dirs[@]}"; do
+    mkdir -p "$dir"
+    find "$dir" \! -uid "$uid" -print0 | while read-0 f; do
+        chown -v "$uid" "$f" || return 1
+    done
+    find "$dir" \! -gid "$gid" -print0 | while read-0 f; do
+        chgrp -v "$gid" "$f" || return 1
+    done
+done
+

etherpad/hooks/postgres_database-relation-joined

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -e
+
+PASSWORD="$(relation-get password)"
+USER="$(relation-get user)"
+DBNAME="$(relation-get dbname)"
+
+control=$(echo -en "$USER\0$DBNAME\0$PASSWORD\0$ADMIN_PASSWORD" | md5_compat)
+
+config-add "\
+services:
+  $MASTER_BASE_SERVICE_NAME:
+    environment:
+      DB_TYPE: postgres
+      DB_HOST: \"$MASTER_TARGET_SERVICE_NAME\"
+      DB_NAME: \"$DBNAME\"
+      DB_PASS: \"$PASSWORD\"
+      DB_USER: \"$USER\"
+"
+
+[ "$control" == "$(relation-get control 2>/dev/null)" ] && exit 0
+
+relation-set control "$control"
+
+info "Configured $SERVICE_NAME code for $TARGET_SERVICE_NAME access."

etherpad/metadata.yml

@@ -0,0 +1,53 @@
+name: etherpad
+summary: "Etherpad-lite server"
+maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
+inherit: base-0k
+## Custom built from git 1.8.14 https://github.com/ether/etherpad-lite with
+## build arg --build-arg INSTALL_SOFFICE=1
+docker-image: docker.0k.io/etherpad:1.8.14-soffice  ## custom built from git m etherpad/etherpad
+description: |
+  Etherpad-lite service.
+
+data-resources:
+  - /var/lib/etherpad
+
+docker-compose:
+  command: node src/node/server.js --apikey /var/lib/etherpad/APIKEY.txt
+  environment:
+    SOFFICE: '/usr/bin/soffice'
+
+uses:
+  postgres-database:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    constraint: required
+    auto: summon
+    solves:
+      database: "main storage"
+    default-options:
+      extensions:
+        - unaccent
+  web-proxy:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    constraint: recommended
+    auto: pair
+    solves:
+      proxy: "Public access"
+    default-options:
+      target: !var-expand ${MASTER_BASE_SERVICE_NAME}:9001
+
+  backup:
+    constraint: recommended
+    auto: pair
+    solves:
+      backup: "Automatic regular backup"
+    default-options:
+      ## First pattern matching wins, no pattern matching includes.
+      ## include-patterns are checked first, then exclude-patterns
+      ## Patterns rules:
+      ##  - ending / for directory
+      ##  - '*' authorized
+      ##  - must start with a '/', will start from $SERVICE_DATASTORE
+      #exclude-patterns:
+      #  - "/var/lib/odoo/sessions/"

gitea/metadata.yml

@@ -1,7 +1,8 @@
 description: "Gitea Server"
 maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
 ## XXXvlab: docker uses the 'build' directory or the 'image:' option here.
-docker-image: docker.0k.io/gitea:1.0.0
+## based on gitea/gitea:1.14.2
+docker-image: docker.0k.io/gitea:1.14.2
 docker-compose:
   ports:
     - "5022:22"

gogocarto/README.org

@@ -15,35 +15,28 @@ far from being mature, we try here to get only the released part.
 We are talking of:
 [[https://gitlab.adullact.net/pixelhumain/GoGoCarto/-/blob/f3c10f16fc08b533ef44f1325fdb50f87fa73224/docs/installation_docker.md][gogocarto docker install documentation]]
 
-** Intermediate docker image is cached on docker.0k.io if needed
+** Updating
 
-To rebuild a new version, I pushed the huge docker image of
-=gogocarto= container that is required in the process (that contains
-apache and all build/install tools). Note that this should not require
-to be rebuild if anything important changes in the directory =docker/=.
+This process will ensure to avoid rebuilding the gigantic intermediate
+image needed (with apache and build/install tools).
 
-Using:
+You need to run this from the root of a code checkout of:
+https://gitlab.adullact.net/pixelhumain/GoGoCarto
 
 #+begin_src sh
 docker_tree_hash=$(git rev-parse HEAD:docker)
-docker tag docker_gogocarto docker.0k.io/gogocarto-builder:${docker_tree_hash}
-docker push docker.0k.io/gogocarto-builder:${docker_tree_hash}
+## Intermediate docker image is cached on docker.0k.io if needed
+if ! docker pull docker.0k.io/gogocarto-builder:${docker_tree_hash}; then
+    make build &&
+    docker tag docker_gogocarto docker.0k.io/gogocarto-builder:${docker_tree_hash} &&
+    docker push docker.0k.io/gogocarto-builder:${docker_tree_hash}
+else
+    docker tag docker.0k.io/gogocarto-builder:${docker_tree_hash} docker_gogocarto
+fi
+make up &&
+docker-compose -f docker/docker-compose.yml exec gogocarto make init
 #+end_src
 
-So, if needed, it can be pulled back to avoid the hassle of making it:
-
-#+begin_src sh
-docker_tree_hash=$(git rev-parse HEAD:docker)
-docker pull docker.0k.io/gogocarto-builder:${docker_tree_hash} &&
-docker tag docker.0k.io/gogocarto-builder:${docker_tree_hash} docker_gogocarto
-#+end_src
-
-You still need to do (as of <2020-10-20 Tue>):
-- get the latest source code
-- =make up= to launch de containers with the images
-- =make shell= from the latest git repos
-- =make init= in the container
-
 ** Full release is cached on =docker.0k.io/downloads=
 
 This is the content of the source tree, once populated by =make init=.
@@ -55,7 +48,6 @@ As of <2020-10-23 Fri>, the =Makefile='s =init= target is:
 #+begin_src sh
 $ grep ^init Makefile -A1
 init: install assets load-fixtures fix-perms ## Initialize the project
-
 #+end_src
 
 Note that =load-fixtures= target is actually the mongodb initialization:
@@ -71,7 +63,7 @@ load-fixtures: ## Create the DB schema, generate DB classes and load fixtures
 This will be done in the =hooks/mongo_database-relation-joined= accordingly.
 
 
-*** create the full data release bundle this is what was made:
+*** create the full data release bundle this is what was made
 
 #+begin_src sh
 ## correct bundles links (no idea if it is needed)
@@ -94,6 +86,7 @@ commit_sha=$(git describe HEAD --tags)
 tar cjv \
     bin web vendor config src templates translations \
     --exclude=.git --exclude=.gitignore \
+    --owner=root --group=root \
     > gogocarto-${commit_sha}.tar.bz2
 #+end_src
 
@@ -103,9 +96,3 @@ all non '\*.{php,yml,js}' files. I noticed many many unrelated files in
 
 We need =bin= for symphony utilities that allows to setup things.
 
-* Roadmap
-
-** TODO mongo / the default database name is probably not correctly set.
-
-Indeed, it seems it is defaulted to =gogocarto_default= and I didn't find
-yet how to set it. There's a connection with SAAS mode I think.

gogocarto/hooks/init

@@ -16,8 +16,6 @@
 set -e
 
 
-if ! [ -e "$GOGOCARTO_CODE" ]; then
-    gogocarto:init || exit 1
-fi
+gogocarto:init || exit 1
 
 gogocarto:config || exit 1

gogocarto/hooks/mongo_database-relation-joined

@@ -24,6 +24,8 @@ MONGODB_URL=$MONGO_URL
 MONGODB_DATABASE=$DBNAME
 ###< doctrine/mongodb-odm-bundle ###
 
+DATABASE_NAME=$DBNAME
+
 EOF
 
 if [ -e "$inited" ]; then

gogocarto/hooks/publish_dir-relation-joined

@@ -49,6 +49,7 @@ cat <<EOF > "${GOGOCARTO_CODE}"/web/.htaccess
 
 Options -MultiViews
 RewriteEngine On
+RewriteRule ^js/.* - [L]
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteRule ^(.*)$ index.php/\$1 [QSA,L]
 
@@ -59,8 +60,10 @@ config-add "
 services:
   $MASTER_TARGET_SERVICE_NAME:
     volumes:
-      - $SERVICE_CONFIGSTORE/opt/apps/gogocarto:/opt/apps/gogocarto:rw
-      - $SERVICE_DATASTORE/var/cache/gogocarto:/opt/apps/gogocarto/var/cache:rw
-      - $SERVICE_DATASTORE/var/lib/gogocarto/sessions:/opt/apps/gogocarto/var/sessions:rw
-      - $SERVICE_DATASTORE/var/log/gogocarto:/opt/apps/gogocarto/var/log:rw
+      - $GOGOCARTO_CODE:$GOGOCARTO_DIR:rw
+      - $SERVICE_DATASTORE/var/cache/gogocarto:$GOGOCARTO_DIR/var/cache:rw
+      - $SERVICE_DATASTORE/var/lib/gogocarto/sessions:$GOGOCARTO_DIR/var/sessions:rw
+      - $SERVICE_DATASTORE/var/log/gogocarto:$GOGOCARTO_DIR/var/log:rw
+      ## Required to give PHP access to this dir
+      - $upload_dir:$GOGOCARTO_DIR/web/uploads:rw
 "

gogocarto/hooks/schedule_commands-relation-joined

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+## When writing relation script, remember:
+##  - they should be idempotents
+##  - they can be launched while the dockers is already up
+##  - they are launched from the host
+##  - the target of the link is launched first, and get a chance to ``relation-set``
+##  - both side of the scripts get to use ``relation-get``.
+
+. lib/common
+
+set -e
+
+## XXXvlab: should use container name here so that it could support
+## multiple postgres
+label=${SERVICE_NAME}
+DST=$CONFIGSTORE/$TARGET_SERVICE_NAME/etc/cron/$label
+
+## XXXvlab: Should we do a 'docker exec' instead ?
+bin_console="dc run -u www-data --rm --entrypoint \\\"$GOGOCARTO_DIR/bin/console\\\" $MASTER_BASE_SERVICE_NAME"
+
+## Warning: 'docker -v' will use HOST directory even if launched from
+##   'cron' container.
+file_put "$DST" <<EOF
+@daily     root  lock ${label}-checkvote -D -p 10 -c "\
+    $bin_console app:elements:checkvote" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-checkvote_script.log
+
+@daily     root  lock ${label}-checkExternalSourceToUpdate -D -p 10 -c "\
+    $bin_console app:elements:checkExternalSourceToUpdate" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-checkExternalSourceToUpdate_script.log
+
+@daily     root  lock ${label}-notify-moderation -D -p 10 -c "\
+    $bin_console app:notify-moderation" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-notify-moderation_script.log
+
+
+@hourly     root  lock ${label}-sendNewsletter -D -p 10 -c "\
+    $bin_console app:users:sendNewsletter" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-sendNewsletter_script.log
+
+
+*/5 * * * *     root  lock ${label}-webhooks-post -D -p 10 -c "\
+    $bin_console --env=prod app:webhooks:post" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-webhooks-post_script.log
+
+
+EOF
+chmod +x "$DST"

gogocarto/lib/common

@@ -1,15 +1,45 @@
 # -*- mode: shell-script -*-
 
-
-GOGOCARTO_CODE="$SERVICE_CONFIGSTORE/opt/apps/gogocarto"
-GOGOCARTO_RELEASE=3.1.3-2-gf3c10f1
+GOGOCARTO_DIR="/opt/apps/gogocarto"
+GOGOCARTO_CODE="$SERVICE_CONFIGSTORE$GOGOCARTO_DIR"
+GOGOCARTO_RELEASE=3.1.3-56-g6b8ba361
 GOGOCARTO_URL=https://docker.0k.io/downloads/gogocarto-"${GOGOCARTO_RELEASE}".tar.bz2
 
 
 gogocarto:init() {
-    mkdir -p "${GOGOCARTO_CODE}" &&
-    cd "${GOGOCARTO_CODE}" &&
-    curl "$GOGOCARTO_URL" | tar xjv
+    current_version=""
+    if [ -d "${GOGOCARTO_CODE}" ]; then
+        current_version=$(cat "${GOGOCARTO_CODE}"/.version) || {
+            err "Couldn't find ${GOGOCARTO_CODE}/.version file."
+            echo "  Your config dir is in a broken state." >&2
+            return 1
+        }
+    else
+        mkdir -p "${GOGOCARTO_CODE}" &&
+            cd "${GOGOCARTO_CODE}" &&
+            git init . &&
+        git config user.email "root@localhost" &&
+        git config user.name "Root" || {
+            err "Couldn't create directory ${GOGOCARTO_CODE}, or init it with git."
+            return 1
+         }
+    fi
+    if [ "$current_version" != "$GOGOCARTO_RELEASE" ]; then
+        cd "${GOGOCARTO_CODE}" || return 1
+        if [ -d "$PWD"/.git ]; then
+            rm -rf "$PWD"/* "$PWD"/{.version,.inited-*,.env} || return 1
+        else
+            err "Can't find the '.git' directory in ${GOGOCARTO_CODE}."
+            return 1
+        fi
+        curl -L "$GOGOCARTO_URL" | tar xjv || {
+            err "Couldn't download $GOGOCARTO_URL."
+            return 1
+        }
+        echo "$GOGOCARTO_RELEASE" > .version
+        git add -A . &&
+            git commit -m "Release $GOGOCARTO_RELEASE"
+    fi
 }
 
 
@@ -21,7 +51,7 @@ gogocarto:config() {
     cat <<EOF > "${GOGOCARTO_CODE}"/.env
 
 ###> symfony/framework-bundle ###
-APP_ENV=$APP_ENV
+APP_ENV=${APP_ENV}
 APP_SECRET=82ec369b81caab5446ddfc3b5edb4d00
 CSRF_PROTECTION=$(
     [ "$APP_ENV" == "prod" ] &&

gogocarto/metadata.yml

@@ -26,3 +26,8 @@ uses:
     auto: summon
     solves:
       database: "main storage"
+  schedule-commands:
+    constraint: recommended
+    auto: pair
+    solves:
+      maintenance: "Production scheduled tasks"

hedgedoc/hooks/init

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+init-config-add "\
+$SERVICE_NAME:
+  environment:
+    CMD_USECDN: \"false\"
+"
+
+## ``codimd`` create uploads folder with wrong permission
+uid=$(docker_get_uid "$SERVICE_NAME" "hedgedoc")
+mkdir -p "$SERVICE_DATASTORE/hedgedoc/public/uploads"
+chown "$uid" "$SERVICE_DATASTORE/hedgedoc/public/uploads"

hedgedoc/hooks/web_proxy-relation-joined

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+DOMAIN=$(relation-get domain) || exit 1
+
+## These are mainly to setup the correct web-hook
+if [ "$MASTER_BASE_SERVICE_NAME" == "$DOMAIN" ]; then
+    ## This is because the IP will be the docker container version
+    USESSL=""
+else
+    USESSL="CMD_PROTOCOL_USESSL: 'true'"
+fi
+
+config-add "\
+services:
+  $MASTER_BASE_SERVICE_NAME:
+    environment:
+      CMD_DOMAIN: $DOMAIN
+      $USESSL
+"
+

codimd/metadata.yml → hedgedoc/metadata.yml

@@ -1,6 +1,6 @@
-docker-image: docker.0k.io/hackmd:2.2.0  ## from: nabo.codimd.dev/hackmdio/hackmd:2.2.0
+docker-image: docker.0k.io/hedgedoc:1.7.2  ## from: quay.io/hedgedoc/hedgedoc:1.7.2-alpine
 data-resources:
-  - /home/hackmd/app/public/uploads
+  - /hedgedoc/public/uploads
 
 default-options:
 

logrotate/build/src/entrypoint.sh

@@ -10,4 +10,4 @@ do
 done >> status.clean
 mv status.clean status
 
-/usr/sbin/logrotate -s /var/lib/logrotate/status /etc/logrotate.conf
+/usr/sbin/logrotate -v -s /var/lib/logrotate/status /etc/logrotate.conf

mariadb/build/Dockerfile

@@ -0,0 +1,19 @@
+FROM alpine:3.9
+
+RUN apk add --no-cache mariadb mariadb-client mariadb-server-utils && \
+    rm -f /var/cache/apk/*
+
+## Required by mysql-backup
+RUN apk add --no-cache bash gzip && \
+    rm -f /var/cache/apk/*
+
+RUN mkdir -p /run/mysqld && \
+    chown -R mysql:mysql /run/mysqld
+
+RUN sed -i "s|.*bind-address\s*=.*|bind-address=0.0.0.0|g" /etc/my.cnf.d/mariadb-server.cnf
+
+COPY src/ /
+
+EXPOSE 3306
+
+ENTRYPOINT ["/entrypoint.sh"]

mariadb/build/src/entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+
+
+if ! [ -d /var/lib/mysql/mysql ]; then
+	chown -R mysql:mysql /var/lib/mysql
+	mysql_install_db --user=mysql --ldata=/var/lib/mysql > /dev/null
+fi
+
+
+
+## Support of Ctrl-C: see https://github.com/docker-library/mysql/issues/47
+run() {
+    "$@" &
+    pid="$!"
+    trap "kill -SIGQUIT $pid" INT TERM
+    wait
+}
+
+run mysqld --user=mysql --skip-name-resolve --skip-networking=0 "$@"

mariadb/hooks/init

@@ -25,31 +25,7 @@ fi
 if ! [ -d "$HOST_DATASTORE/${SERVICE_NAME}$DB_DATADIR" ]; then
 
     MYSQL_ROOT_PASSWORD="$(gen_password)"
-
-    debug docker run -e "MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD" \
-        --rm \
-        -v "$DATA_DIR:$DB_DATADIR" \
-        --entrypoint /bin/bash "$DOCKER_BASE_IMAGE"
-    docker run -e "MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD" \
-        --rm \
-        -v "$DATA_DIR:$DB_DATADIR" \
-        --entrypoint /bin/bash "$DOCKER_BASE_IMAGE" -c '
-    mysqld() {
-        echo "diverted mysqld call..." >&2;
-        echo "$*" | grep -E "(--help|--skip-networking)" >/dev/null 2>&1 || return;
-        echo "  .. Allowing call." >&2;
-        /usr/sbin/mysqld "$@";
-    }
-    export -f mysqld;
-    /docker-entrypoint.sh mysqld' || true
-    ## docker errorlevel is still 0 even if it failed.
-    ## AND we must ignore mysqld error !
-    [ "$(find "$DATA_DIR" \
-          -maxdepth 0 -type d -empty 2>/dev/null)" ] && {
-        err "Docker run probably failed to do it's job."
-        exit 1
-    }
-
+    mkdir -p "${HOST_DB_PASSFILE%/*}"
     ## XXXvlab: this won't help support multiple project running on the
     ## same host
     cat <<EOF > "$HOST_DB_PASSFILE"
@@ -57,5 +33,27 @@ if ! [ -d "$HOST_DATASTORE/${SERVICE_NAME}$DB_DATADIR" ]; then
 password=$MYSQL_ROOT_PASSWORD
 EOF
     chmod 600 "$HOST_DB_PASSFILE"
+
+    ## deactivating final connection check
+    ddb () { true; }
+    export -f ddb
+    ensure_db_docker_running || exit 1
+
+    docker exec -i "$_DB_NAME" mysql <<EOF
+USE mysql;
+GRANT ALL ON *.* TO 'root'@'%' IDENTIFIED BY '$MYSQL_ROOT_PASSWORD' WITH GRANT OPTION;
+GRANT ALL ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MYSQL_ROOT_PASSWORD' WITH GRANT OPTION;
+SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}');
+FLUSH PRIVILEGES;
+EOF
+
+    . lib/common
+
+    err=$(echo "$check_command" | ddb 2>&1 >/dev/null) || {
+        err "Docker run probably failed to do it's job."
+        echo "$err" | prefix "  " >&2
+        exit 1
+    }
+
     info "New root password for mysql. "
 fi

mariadb/hooks/install.d/60-backup.sh

@@ -0,0 +1,102 @@
+
+set -eux  ## important for unbound variable ?
+
+## Require these to be set
+# MYSQL_ROOT_PASSWORD=
+# MYSQL_CONTAINER=
+
+[ "${MYSQL_ROOT_PASSWORD}" ] || {
+    echo "Error: you must set \$MYSQL_ROOT_PASSWORD prior to running this script." >&2
+    exit 1
+}
+
+[ "${MYSQL_CONTAINER}" ] || {
+    echo "Error: you must set \$MYSQL_CONTAINER prior to running this script." >&2
+    exit 1
+}
+
+
+##
+## Init, to setup passwordless connection to mysql
+##
+
+type -p mysql >/dev/null || {
+    case $(lsb_release -is) in
+        Debian)
+            case $(lsb_release -rs) in
+                10)
+                    apt-get install -y default-mysql-client </dev/null
+                    ;;
+                *)
+                    apt-get install -y mysql-client </dev/null
+                    ;;
+            esac
+            ;;
+        Ubuntu)
+            apt-get install -y mysql-client </dev/null
+            ;;
+    esac
+}
+
+if ! [ -e "/root/.my.cnf" ]; then
+    cat <<EOF > ~/.my.cnf
+[client]
+password=${MYSQL_ROOT_PASSWORD}
+EOF
+    chmod 600 ~/.my.cnf
+fi
+
+##
+## installation of the mysql-backup script
+##
+
+
+apt-get install -y kal-shlib-{core,pretty,common} </dev/null
+ln -sf "${PWD}/resources/bin/mysql-backup" /usr/local/sbin/mysql-backup
+
+
+##
+## Connection to cron
+##
+
+
+depends cron
+cat <<EOF > /etc/cron.d/mysql-backup
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+0 * * * *   root   /usr/local/sbin/mysql-backup --host \$(docker-ip "$MYSQL_CONTAINER" 2>/dev/null | sed -r 's/ +/ /g' | cut -f 3 -d " ") | logger -t mysql-backup
+
+EOF
+
+
+##
+## Connection with backup
+##
+
+if type -p mirror-dir >/dev/null 2>&1; then
+    [ -d "/etc/mirror-dir" ] || {
+        echo "'mirror-dir' is installed but no '/etc/mirror-dir' was found." >&2
+        exit 1
+    }
+    depends shyaml
+
+    if ! sources=$(shyaml get-values default.sources < /etc/mirror-dir/config.yml); then
+        echo "Couldn't query 'default.sources' in '/etc/mirror-dir/config.yml'." >&2
+        exit 1
+    fi
+
+    if ! echo "$sources" | grep "^/var/backups/mysql$" 2>/dev/null; then
+        sed -i '/sources:/a\  - /var/backups/mysql' /etc/mirror-dir/config.yml
+        cat <<EOF >> /etc/mirror-dir/config.yml
+/var/backups/mysql:
+  exclude:
+    - "/*.inprogress"
+EOF
+    fi
+else
+    echo "warn: 'mirror-dir' not installed, backup won't be sent" >&2
+fi
+
+
+

mariadb/hooks/schedule_command-relation-joined

@@ -33,12 +33,11 @@ COMPOSE_LAUNCHER_OPTS=$COMPOSE_LAUNCHER_OPTS
 
 $schedule   root lock $label -D -p 10 -c "\
     docker run --rm \
-        -e MYSQLHOST="${SERVICE_NAME}" \
         --network ${PROJECT_NAME}_default \
         -v \"$LOCAL_DB_PASSFILE\":/root/.my.cnf \
         -v \"$HOST_CHARM_STORE/${CHARM_REL_PATH#${CHARM_STORE}/}/resources/bin/mysql-backup:/usr/sbin/mysql-backup\" \
         -v \"$SERVICE_DATASTORE/var/backups/mysql:/var/backups/mysql\" \
         --entrypoint mysql-backup \
-        \"$DOCKER_BASE_IMAGE\"" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${label}_script.log
+        \"$DOCKER_BASE_IMAGE\" --host \"${SERVICE_NAME}\"" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${label}_script.log
 EOF
 chmod +x "$DST"

mariadb/metadata.yml

@@ -1,6 +1,4 @@
 name: MariaDB
-## From: mysql Ver 15.1 Distrib 10.0.21-MariaDB
-docker-image: docker.0k.io/mariadb:1.0.0
 maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
 provides:
   mysql-database:
@@ -18,7 +16,7 @@ uses:
       schedule: "31 * * * *"  ## schedule backup every hour
   ## This one is useful only if previous relation is used
   backup:
-    constraint: optional
+    constraint: recommended
     auto: pair
     solves:
       backup: "Automatic regular backups of dumps"

mariadb/resources/bin/mysql-backup

@@ -1,5 +1,34 @@
 #!/bin/bash
 
+
+usage="$exname [--host HOST] [DATABASE...]"
+
+
+DBS=()
+host=
+while [ "$1" ]; do
+    case "$1" in
+        "--help"|"-h")
+            echo "$usage" >&2
+            exit 0
+        ;;
+        "--host")
+            host="$2"
+            shift
+        ;;
+        *)
+            DBS+=("$1")
+        ;;
+    esac
+    shift
+done
+
+
+mysql_opts=()
+if [ "$host" ]; then
+    mysql_opts+=(-h "$host")
+fi
+
 m() {
     mysql "${mysql_opts[@]}" -Bs "$@"
 }
@@ -14,16 +43,13 @@ mysql_databases() {
 
 mysql_tables() {
     local db="$1"
-    echo "SHOW TABLES" | m "$db"
+     echo "SHOW TABLES" | m "$db"
 }
 
-mysql_opts=()
-if [ "$MYSQLHOST" ]; then
-    mysql_opts+=(-h "$MYSQLHOST")
-fi
-
 
-DBS=($(mysql_databases)) || exit 1
+if [ "${#DBS[@]}" == 0 ]; then
+    DBS=($(mysql_databases)) || exit 1
+fi
 
 mkdir -p /var/backups/mysql
 
@@ -38,7 +64,7 @@ for db in "${DBS[@]}"; do
     [ -d "$dst" ] && mv "$dst" "$dst.old"
     mkdir -p "$dst.inprogress"
     (( start = SECONDS ))
-    md "$db" --routines --no-data --add-drop-database --database "$db" | gzip --rsyncable > "$dst.inprogress/schema.sql.gz"
+    md "$db" --routines --no-data --add-drop-database --database "$db" | gzip --rsyncable > "$dst.inprogress/00-schema.sql.gz"
     tables=$(mysql_tables "$db")
     for table in $tables; do
         backup_file="$dst.inprogress/${table}.sql.gz"

monujo/hooks/init

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+## Init is run on host
+## For now it is run every time the script is launched, but
+## it should be launched only once after build.
+
+## Accessible variables are:
+## - SERVICE_NAME        Name of current service
+## - DOCKER_BASE_IMAGE   Base image from which this service might be built if any
+## - SERVICE_DATASTORE           Location on host of the DATASTORE of this service
+## - SERVICE_CONFIGSTORE         Location on host of the CONFIGSTORE of this service
+
+set -e
+
+APP_NAME=monujo
+SOURCE_URL="https://docker.0k.io/downloads/$APP_NAME-0.0.1.tar.bz2"
+LOCATION="$SERVICE_DATASTORE/opt/apps/$APP_NAME"
+
+mkdir -p "$LOCATION"
+if dir_is_empty "$LOCATION"; then
+    cd "$LOCATION"
+    wget -q "$SOURCE_URL" -O file.tar.bz2
+    tar xjf file.tar.bz2
+    rm file.tar.bz2
+    chown root:root "$LOCATION" -R
+fi
+

monujo/metadata.yml

@@ -0,0 +1,17 @@
+description: "LokWallet"
+maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
+subordinate: true
+
+uses:
+  publish-dir:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    scope: container
+    constraint: required
+    auto: summon
+    solves:
+      container: "main running server"
+    default-options:
+      location: !var-expand "$DATASTORE/$BASE_SERVICE_NAME/opt/apps/monujo"
+      # data-dirs: ## write permission for web-app
+      #   - .

mysql/hooks/install

@@ -9,11 +9,11 @@ GIT_0K_CLONE_OPTIONS=${GIT_0K_CLONE_OPTIONS:-""}
 GIT_0K_BASE=${GIT_0K_BASE:-"git.0k.io:/var/git"}
 
 
-apt-get install -y --force-yes cron kal-scripts
+apt-get install -y cron kal-scripts
 
 debconf-set-selections <<< "mysql-server mysql-server/root_password password $MYSQL_PASSWORD"
 debconf-set-selections <<< "mysql-server mysql-server/root_password_again password $MYSQL_PASSWORD"
-apt-get install -y --force-yes  mysql-server
+apt-get install -y  mysql-server
 
 
 

nextcloud/build/Dockerfile

@@ -1,13 +0,0 @@
-## This is a cache of nextcloud:18.0.1 image (gmp is included)
-FROM docker.0k.io/nextcloud:1.2.0
-
-
-##
-## What is following is only to patch nextcloud to remove
-## some database name checks
-##
-
-COPY database-accept-dots.patch /tmp/
-
-RUN cd /usr/src/nextcloud && \
-    patch -p1 < /tmp/database-accept-dots.patch

nextcloud/build/database-accept-dots.patch

@@ -1,14 +0,0 @@
-diff --git a/lib/private/Setup/AbstractDatabase.php b/lib/private/Setup/AbstractDatabase.php
-index 0cbfecf..a821a2e 100644
---- a/lib/private/Setup/AbstractDatabase.php
-+++ b/lib/private/Setup/AbstractDatabase.php
-@@ -72,9 +72,6 @@ abstract class AbstractDatabase {
- 		} elseif (empty($config['dbname'])) {
- 			$errors[] = $this->trans->t("%s enter the database name.", [$this->dbprettyname]);
- 		}
--		if(substr_count($config['dbname'], '.') >= 1) {
--			$errors[] = $this->trans->t("%s you may not use dots in the database name", array($this->dbprettyname));
--		}
- 		return $errors;
- 	}
- 

nextcloud/metadata.yml

@@ -1,9 +1,9 @@
+docker-image: docker.0k.io/nextcloud:18.0.1-myc
 data-resources:
   - /var/www/html
   - /var/lib/nextcloud/data
 config-resources:
   - /var/www/html/config
-
 provides:
   nextcloud-app:
 uses:

odoo-tecnativa/actions/install

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+## Load action gets a first argument a DIRECTORY holding the necessary files.
+##
+##
+
+if [ -z "$SERVICE_DATASTORE" ]; then
+    echo "This script is meant to be run through 'compose' to work properly." >&2
+    exit 1
+fi
+
+usage="$exname [-h|--help] DBNAME [MODULE ...]"
+
+dbname=
+modules=()
+while [ "$1" ]; do
+    case "$1" in
+        "--help"|"-h")
+            print_usage
+            exit 0
+        ;;
+        *)
+            [ -z "$dbname" ] && { dbname=$1 ; shift ; continue ; }
+            modules+=("$1")
+        ;;
+    esac
+    shift
+done
+
+if [ -z "$dbname" ]; then
+    err "You must provide a destination database name as second argument."
+    print_usage
+    exit 1
+fi
+
+if [ -z "${modules[*]}" ]; then
+    err "You must provide at least one module as third argument."
+    print_usage
+    exit 1
+fi
+
+modules="$(echo "${modules[@]}" | tr " " ",")"
+
+## This can work only if ~/.my.cnf is correctly created by init.
+
+set -e
+
+launch_docker_compose run "$CONTAINER_NAME" --init="$modules" -d "$dbname" --stop-after-init
+
+info "Installed '$modules' module(s) into database '$dbname'."

onlyoffice/hooks/init

@@ -13,9 +13,23 @@
 
 set -e
 
-if ! [ -e "$SERVICE_CONFIGSTORE/etc/onlyoffice/documentserver/local.json" ]; then
+image_id=$(service_base_image_id "$SERVICE_NAME") || {
+    err "couldn't get image id of $SERVICE_NAME."
+    exit 1
+}
+
+CONTROL_FILE="$SERVICE_CONFIGSTORE/etc/onlyoffice/.image_id"
+if [ "$(cat "$CONTROL_FILE")" != "$image_id" ]; then
     ## first time we need to extract configuration from image
+    rm -rf "$SERVICE_CONFIGSTORE/etc/onlyoffice"
     mkdir -p "$SERVICE_CONFIGSTORE/etc/onlyoffice"
     service_base_image_export_dir "$SERVICE_NAME" /etc/onlyoffice/documentserver "$SERVICE_CONFIGSTORE/etc/onlyoffice/"
-fi
-
+    printf "%s" "$image_id" > "$CONTROL_FILE"
+else
+    ## probably not needed to regenerate fonts
+    init-config-add "\
+$MASTER_BASE_SERVICE_NAME:
+  environment:
+    GENERATE_FONTS: \"false\"
+"
+fi

onlyoffice/hooks/nextcloud_app-relation-joined

@@ -15,7 +15,8 @@ compose --no-relations --no-init \
         app:install onlyoffice \; \
         config:system:set onlyoffice DocumentServerInternalUrl --value="http://$MASTER_BASE_SERVICE_NAME/" \; \
         config:system:set onlyoffice StorageUrl --value="http://$MASTER_TARGET_SERVICE_NAME/" \; \
-        config:app:set onlyoffice jwt_secret --value="$KEY"
+        config:app:set onlyoffice jwt_secret --value="$KEY" \; \
+        config:system:set allow_local_remote_servers --type=boolean --value=true
 
 
 ONLYOFFICE_CFG="$SERVICE_CONFIGSTORE/etc/onlyoffice/documentserver/local.json"

onlyoffice/hooks/postgres_database-relation-joined

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+. lib/common
+
+set -e
+
+PASSWORD="$(relation-get password)"
+USER="$(relation-get user)"
+DBNAME="$(relation-get dbname)"
+ADMIN_PASSWORD=$(relation-base-compose-get admin-password 2>/dev/null) || {
+    if [ -e "$CONFIG" ]; then
+        ADMIN_PASSWORD=$(grep ^admin_passwd "$CONFIG" | sed -r 's/^admin_passwd\s+=\s+(.+)$/\1/g')
+    fi
+    if [ -z "$ADMIN_PASSWORD" ]; then
+        info "Generating odoo admin password"
+        ADMIN_PASSWORD=$(gen_password)
+    fi
+}
+
+database=$(options-get database 2>/dev/null) || true
+database="${database:-$DBNAME}"
+
+config-add "\
+services:
+  $MASTER_BASE_SERVICE_NAME:
+    environment:
+      DB_TYPE: \"postgres\"
+      DB_HOST: \"$MASTER_TARGET_SERVICE_NAME\"
+      DB_NAME: \"$DBNAME\"
+      DB_PWD: \"$PASSWORD\"
+      DB_USER: \"$USER\"
+"
+
+info "Configured $SERVICE_NAME code for $TARGET_SERVICE_NAME access."

onlyoffice/metadata.yml

@@ -1,7 +1,14 @@
-docker-image: docker.0k.io/oods:1.0.0
+# from: https://github.com/0k/Docker-DocumentServer (6.1.0)
+docker-image: docker.0k.io/oods:2.0.0
 data-resources:
   - /var/www/onlyoffice/Data
   - /var/log/onlyoffice
+  ## not documented but found in entrypoint and docker inspect
+  - /var/lib/onlyoffice
+  - /var/lib/postgres
+  - /var/lib/rabbitmq
+  - /var/lib/redis
+  - /usr/share/fonts/truetype/custom
 config-resources:
   - /etc/onlyoffice/documentserver
 
@@ -25,3 +32,30 @@ uses:
       proxy: "Public access"
     default-options:
       target: !var-expand ${MASTER_BASE_SERVICE_NAME}:80
+
+  postgres-database:
+    constraint: required
+    auto: summon
+    solves:
+      database: "main storage"
+
+  ## XXXvlab: this should not be necessary as official documentation
+  ## seems to explain that all data are either logs or caches. But we
+  ## had issues with onlyoffice not sending back modifications to the
+  ## filesystem. With some tweaks, we can sometimes gets the data from
+  ## application cache.  So for now, we must include this data to
+  ## backup.
+  backup:
+    constraint: recommended
+    auto: pair
+    solves:
+      backup: "Automatic regular backups of dumps"
+    default-options:
+      ## First pattern matching wins, no pattern matching includes.
+      ## include-patterns are checked first, then exclude-patterns
+      ## Patterns rules:
+      ##  - ending / for directory
+      ##  - '*' authorized
+      ##  - must start with a '/', will start from $SERVICE_DATASTORE
+      include-patterns:
+        - /var/lib/onlyoffice/

peertube/build/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.9 AS common
+FROM alpine:3.14 AS common
 
 RUN apk add gnupg ffmpeg
 
@@ -13,11 +13,10 @@ FROM common AS builder
 ## Download target release
 ##
 
-ENV PEERTUBE_RELEASE=v2.1.1
+ENV PEERTUBE_RELEASE=v3.3.0
 
 
 RUN apk add wget
-COPY ./*.patch /tmp
 RUN mkdir -p /opt/apps/peertube && \
     cd /opt/apps/peertube && \
     wget https://github.com/Chocobozzz/PeerTube/releases/download/${PEERTUBE_RELEASE}/peertube-${PEERTUBE_RELEASE}.tar.xz && \
@@ -25,12 +24,12 @@ RUN mkdir -p /opt/apps/peertube && \
     rm peertube-${PEERTUBE_RELEASE}.tar.xz && \
     mv peertube-${PEERTUBE_RELEASE}/* . && \
     rmdir peertube-${PEERTUBE_RELEASE} && \
-    cat /tmp/*.patch | patch -p1 && \
     mkdir -p /etc/peertube /var/lib/peertube && \
     ln -sf /var/lib/peertube /opt/apps/peertube/storage
 
-RUN apk add yarn                        ## Build command
-RUN apk add git build-base python bash  ## Build deps
+RUN apk add yarn                         ## Build command
+RUN apk add git build-base python3 bash && \
+    ln -sf /usr/bin/python3 /usr/local/bin/python ## Build deps
 
 RUN chown -R peertube:peertube /opt/apps/peertube
 
@@ -39,7 +38,6 @@ RUN apk add npm  ## only needed to install things that should be in yarn
 USER peertube
 
 RUN cd /opt/apps/peertube && \
-    npm install bcrypt && \
     yarn install --production --pure-lockfile && \
     yarn cache clean
 
@@ -92,7 +90,7 @@ VOLUME /etc/peertube
 
 EXPOSE 9000
 
-RUN apk add nodejs-npm
+RUN apk add nodejs npm
 
 ## runtime deps
 RUN apk add openssl

peertube/build/dbname.patch

@@ -1,26 +0,0 @@
-diff --git a/dist/server/initializers/checker-before-init.js b/dist/server/initializers/checker-before-init.js
-index d8422ee..5eb3678 100644
---- a/dist/server/initializers/checker-before-init.js
-+++ b/dist/server/initializers/checker-before-init.js
-@@ -16,7 +16,7 @@ function checkMissedConfig() {
-     const required = ['listen.port', 'listen.hostname',
-         'webserver.https', 'webserver.hostname', 'webserver.port',
-         'trust_proxy',
--        'database.hostname', 'database.port', 'database.suffix', 'database.username', 'database.password', 'database.pool.max',
-+        'database.hostname', 'database.port', 'database.dbname', 'database.username', 'database.password', 'database.pool.max',
-         'smtp.hostname', 'smtp.port', 'smtp.username', 'smtp.password', 'smtp.tls', 'smtp.from_address',
-         'email.body.signature', 'email.subject.prefix',
-         'storage.avatars', 'storage.videos', 'storage.logs', 'storage.previews', 'storage.thumbnails', 'storage.torrents', 'storage.cache',
-diff --git a/dist/server/initializers/config.js b/dist/server/initializers/config.js
-index 6aa916f..89d16fe 100644
---- a/dist/server/initializers/config.js
-+++ b/dist/server/initializers/config.js
-@@ -12,7 +12,7 @@ const CONFIG = {
-         HOSTNAME: config.get('listen.hostname')
-     },
-     DATABASE: {
--        DBNAME: 'peertube' + config.get('database.suffix'),
-+        DBNAME: config.get('database.dbname'),
-         HOSTNAME: config.get('database.hostname'),
-         PORT: config.get('database.port'),
-         USERNAME: config.get('database.username'),

peertube/hooks/init

@@ -66,6 +66,7 @@ for section in "${VALID_SECTION[@]}"; do
 done >> "$HOST_CONFIG_DIR/local.yaml"
 
 if ! [ -e "$HOST_DATA_DIR/config.json" ]; then
+    mkdir -p "$HOST_DATA_DIR"
     echo "{}" > "$HOST_DATA_DIR/config.json"
 fi
 

peertube/hooks/postgres_database-relation-joined

@@ -15,7 +15,7 @@ cat <<EOF >> "$HOST_CONFIG_DIR/local.yaml"
 database:
   hostname: '$TARGET_SERVICE_NAME'
   ## We had to patch peertube to have a direct dbname (doh!)
-  dbname: '$DBNAME'
+  name: '$DBNAME'
   port: 5432
   username: '$USER'
   password: '$PASSWORD'

postgres/metadata.yml

@@ -15,7 +15,7 @@ uses:
       schedule: "31 * * * *"  ## schedule backup every hour
   ## This one is useful only if previous relation is used
   backup:
-    constraint: optional
+    constraint: recommended
     auto: pair
     solves:
       backup: "Automatic regular backups of dumps"

precise/0k-odoo-light/hooks/install

@@ -15,7 +15,7 @@ DEPS_TO_REMOVE="git"
 
 KEEP_ONLY_PO=${KEEP_ONLY_PO:-fr en de}
 
-apt-get install -y --force-yes --no-install-recommends \
+apt-get install -y --no-install-recommends \
     $DEPS $DEPS_TO_REMOVE
 
 ## XXXvlab: should use base-0k code instead !
@@ -71,7 +71,7 @@ fi
 RELEASE=jessie VIRTUALENV= hooks/install
 )
 
-apt-get remove -y --force-yes $DEPS_TO_REMOVE
+apt-get remove -y $DEPS_TO_REMOVE
 apt-get autoremove -y
 
 rm -rf /opt/apps/git-sub /usr/lib/git-core/git-sub

precise/apt-cacher/hooks/install

@@ -3,7 +3,7 @@
 set -eux 
 
 
-apt-get install -y --force-yes apt-cacher-ng
+apt-get install -y apt-cacher-ng
 
 
 ## This is needed to enable https_port

precise/base-0k/hooks/install.d/00-base.sh

@@ -2,21 +2,55 @@
 
 set +eux
 
+
+## Certificate DST_Root_CA-X3 expired, it needs to be removed
+## from list of available certificates. Debian <10 have the issue.
+##
+## Fixing: https://www.reddit.com/r/sysadmin/comments/pzags0/lets_encrypts_dst_root_ca_x3_expired_yesterday/
+## see also: https://techcrunch.com/2021/09/21/lets-encrypt-root-expiry/?guccounter=1
+
+modified_certificate=
+mkdir -p /usr/local/share/ca-certificates/custom
+for certfile_name in isrgrootx1:ISRG_Root_X1 isrg-root-x2 lets-encrypt-r3; do
+    certfile=${certfile_name%%:*}
+    name=${certfile_name#*:}
+    echo "Checking $certfile for $name"
+    if ! [ -e "/usr/local/share/ca-certificates/custom/$certfile".crt ] &&
+       ! [ -e "/etc/ssl/certs/$name.pem" ]; then
+        wget --no-check-certificate https://letsencrypt.org/certs/"$certfile".pem \
+             -O "/usr/local/share/ca-certificates/custom/$certfile".crt
+        modified_certificate=1
+    fi
+done
+
+if grep "^mozilla/DST_Root_CA_X3.crt" /etc/ca-certificates.conf 2>/dev/null 2>&1; then
+    sed -ri 's%^(mozilla/DST_Root_CA_X3.crt)%!\1%g' /etc/ca-certificates.conf
+fi
+
+if [ -n "$modified_certificate" ]; then
+        update-ca-certificates
+fi
+
+## We can now do the ``apt-get update`` safely...
+
 apt-get update
-apt-get -y --force-yes install bash-completion wget bzip2 git-core \
+apt-get -y install bash-completion wget bzip2 git-core \
         less tmux mosh \
         sudo git vim file </dev/null
 
-apt-get -y --force-yes python-software-properties </dev/null ||
-    apt-get -y --force-yes software-properties-common </dev/null
+apt-get -y python-software-properties </dev/null ||