Browse Source

Merge pull request 'maj master' (#1) from 0k/0k-charms:master into master

Reviewed-on: https://git.myceliandre.fr/StephanSainleger/0k-charms/pulls/1
master
StephanSainleger 3 years ago
parent
commit
62a3948f5d
  1. 17
      apache/build/Dockerfile
  2. 4
      bitwarden/metadata.yml
  3. 12
      codimd/hooks/init
  4. 4
      cron/build/Dockerfile
  5. 8
      cron/hooks/init
  6. 20
      cron/hooks/pre_deploy
  7. 4
      cron/metadata.yml
  8. 2
      cyclos/hooks/init
  9. 63
      cyclos/hooks/pre_deploy
  10. 61
      cyclos/lib/common
  11. 6
      cyclos/metadata.yml
  12. BIN
      cyclos/src/init.sql.gz
  13. 14
      drone/metadata.yml
  14. 33
      etherpad/README.org
  15. 39
      etherpad/hooks/init
  16. 26
      etherpad/hooks/postgres_database-relation-joined
  17. 53
      etherpad/metadata.yml
  18. 3
      gitea/metadata.yml
  19. 47
      gogocarto/README.org
  20. 4
      gogocarto/hooks/init
  21. 2
      gogocarto/hooks/mongo_database-relation-joined
  22. 11
      gogocarto/hooks/publish_dir-relation-joined
  23. 44
      gogocarto/hooks/schedule_commands-relation-joined
  24. 44
      gogocarto/lib/common
  25. 5
      gogocarto/metadata.yml
  26. 12
      hedgedoc/hooks/init
  27. 0
      hedgedoc/hooks/postgres_database-relation-joined
  28. 22
      hedgedoc/hooks/web_proxy-relation-joined
  29. 4
      hedgedoc/metadata.yml
  30. 2
      logrotate/build/src/entrypoint.sh
  31. 19
      mariadb/build/Dockerfile
  32. 20
      mariadb/build/src/entrypoint.sh
  33. 48
      mariadb/hooks/init
  34. 102
      mariadb/hooks/install.d/60-backup.sh
  35. 3
      mariadb/hooks/schedule_command-relation-joined
  36. 4
      mariadb/metadata.yml
  37. 42
      mariadb/resources/bin/mysql-backup
  38. 27
      monujo/hooks/init
  39. 17
      monujo/metadata.yml
  40. 4
      mysql/hooks/install
  41. 13
      nextcloud/build/Dockerfile
  42. 14
      nextcloud/build/database-accept-dots.patch
  43. 2
      nextcloud/metadata.yml
  44. 50
      odoo-tecnativa/actions/install
  45. 20
      onlyoffice/hooks/init
  46. 3
      onlyoffice/hooks/nextcloud_app-relation-joined
  47. 34
      onlyoffice/hooks/postgres_database-relation-joined
  48. 36
      onlyoffice/metadata.yml
  49. 14
      peertube/build/Dockerfile
  50. 26
      peertube/build/dbname.patch
  51. 1
      peertube/hooks/init
  52. 2
      peertube/hooks/postgres_database-relation-joined
  53. 2
      postgres/metadata.yml
  54. 4
      precise/0k-odoo-light/hooks/install
  55. 2
      precise/apt-cacher/hooks/install
  56. 42
      precise/base-0k/hooks/install.d/00-base.sh
  57. 2
      precise/base-0k/hooks/install.d/05-shyaml.sh
  58. 6
      precise/base-0k/hooks/install.d/20-kal-scripts.sh
  59. 80
      precise/base-0k/hooks/install.d/30-customize.sh
  60. 2
      precise/ca/hooks/install
  61. 2
      precise/git/hooks/install
  62. 4
      precise/host/hooks/install.d/38-ntp.sh
  63. 3
      precise/host/hooks/install.d/39-logrotate.sh
  64. 5
      precise/host/hooks/install.d/40-btrfs.sh
  65. 45
      precise/host/hooks/install.d/50-lxc.sh
  66. 38
      precise/host/hooks/install.d/60-docker.sh
  67. 1
      precise/host/hooks/install.d/61-mirror-dir.sh
  68. 23
      precise/host/hooks/install.d/70-0k.sh
  69. 23
      precise/host/hooks/install.d/75-fail2ban.sh
  70. 19
      precise/host/hooks/install.d/80-dns-waterfall.sh
  71. 253
      precise/host/hooks/install.d/90-shorewall.sh
  72. 37
      precise/host/hooks/install.d/95-checks.sh
  73. 74
      precise/host/hooks/install.d/96-backup-lxc.sh
  74. 2
      precise/mirror/hooks/install
  75. 2
      precise/pypi-cacher/hooks/install
  76. 2
      precise/svn/hooks/install
  77. 8
      precise/vpn/hooks/install
  78. 60
      rocketchat/README.org
  79. 4
      rocketchat/metadata.yml
  80. 125
      rsync-backup-target/README.org
  81. 10
      rsync-backup-target/build/Dockerfile
  82. 42
      rsync-backup-target/build/entrypoint.sh
  83. 7
      rsync-backup-target/build/src/etc/sudoers.d/recover
  84. 3
      rsync-backup-target/build/src/etc/sudoers.d/rsync
  85. 76
      rsync-backup-target/build/src/usr/local/sbin/request-recovery-key
  86. 106
      rsync-backup-target/build/src/usr/local/sbin/ssh-admin-cmd-validate
  87. 66
      rsync-backup-target/build/src/usr/local/sbin/ssh-cmd-validate
  88. 152
      rsync-backup-target/build/src/usr/local/sbin/ssh-key
  89. 97
      rsync-backup-target/build/src/usr/local/sbin/ssh-recover-cmd-validate
  90. 68
      rsync-backup-target/build/src/usr/local/sbin/ssh-update-keys
  91. 73
      rsync-backup-target/hooks/init
  92. 83
      rsync-backup-target/hooks/log_rotate-relation-joined
  93. 12
      rsync-backup-target/metadata.yml
  94. 50
      rsync-backup-target/resources/bin/compose-add-rsync-key
  95. 2
      rsync-backup/build/Dockerfile
  96. 38
      rsync-backup/hooks/install.d/60-install.sh
  97. 1
      rsync-backup/hooks/schedule_command-relation-joined
  98. 2
      rsync-backup/metadata.yml
  99. 652
      rsync-backup/resources/bin/mirror-dir
  100. 12
      searx/hooks/web_proxy-relation-joined

17
apache/build/Dockerfile

@ -1,7 +1,7 @@
## copy of 'php:7.3-apache' image
## XXXvlab: will need to move towards separate apache and php, so that nginx can
## replace apache in all conf.
FROM docker.0k.io/php:7.3-apache-1
FROM docker.0k.io/php:7.4.13-apache
## Limesurvey
# RUN apt-get update && \
@ -20,7 +20,7 @@ FROM docker.0k.io/php:7.3-apache-1
## Framadate
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y libicu-dev libpq-dev libxml2-dev && \
DEBIAN_FRONTEND=noninteractive apt-get install -y libonig-dev libicu-dev libpq-dev libxml2-dev && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
docker-php-ext-install mbstring intl xml pdo_pgsql
@ -30,7 +30,7 @@ RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y libexif-dev libexif12 libfreetype6-dev libjpeg62-turbo-dev libpng-dev && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ && \
docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr/include/ && \
docker-php-ext-install exif gd pdo_mysql mysqli
## gogocarto
@ -39,13 +39,13 @@ RUN apt-get update && \
libbz2-dev libc-client-dev libcurl4-openssl-dev libfreetype6-dev \
libgd-dev libicu-dev libkrb5-dev libmagickcore-dev libmagickwand-dev \
libmcrypt-dev libmemcached-dev libtidy-dev libxml2-dev libxslt-dev \
libz-dev libzip-dev" && \
libz-dev libzip-dev libonig-dev" && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
bzip2 cron g++ gettext git gnupg imagemagick libfreetype6 libgd3 \
libmcrypt4 libmemcached11 libmemcachedutil2 libsodium23 libtidy5deb1 \
libxml2 libxslt1.1 libzip4 nano openssl unzip ${BUILD_PACKAGES} && \
docker-php-ext-configure gd --with-freetype-dir=/usr/include/ \
--with-jpeg-dir=/usr/include/ && \
docker-php-ext-configure gd --with-freetype=/usr/include/ \
--with-jpeg=/usr/include/ && \
docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
docker-php-ext-configure hash --with-mhash && \
docker-php-ext-install bcmath bz2 calendar dba curl exif gd gettext \
@ -63,14 +63,11 @@ RUN apt-get update && \
rm -rf /var/lib/apt/lists/*
## XXXvlab: could load these in 'entrypoint.sh' to be more dynamic
RUN a2enmod headers proxy_http rewrite ssl proxy_wstunnel http2 proxy_connect
## Can remove this when SSL certificate are all valid ones
RUN apt-get update && apt-get install -y --force-yes ssl-cert
RUN apt-get update && apt-get install -y ssl-cert
COPY entrypoint.sh /entrypoint.sh

4
bitwarden/metadata.yml

@ -1,6 +1,6 @@
description: Bitwarden Server
#docker-image: bitwardenrs/server:1.17.0-alpine
docker-image: docker.0k.io/bitwarden:1.17.0
#docker-image: bitwardenrs/server:1.22.2-alpine
docker-image: docker.0k.io/bitwarden:1.22.2
data-resources:
- /data
uses:

12
codimd/hooks/init

@ -1,12 +0,0 @@
#!/bin/bash
init-config-add "\
$SERVICE_NAME:
environment:
CMD_USECDN: \"false\"
"
## ``codimd`` create uploads folder with wrong permission
mkdir -p "$SERVICE_DATASTORE/home/hackmd/app/public/uploads"
chown -R 1500:1500 "$SERVICE_DATASTORE/home/hackmd/app/public/"

4
cron/build/Dockerfile

@ -1,7 +1,7 @@
FROM debian:jessie
FROM docker.0k.io/debian:jessie
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes cron moreutils && \
DEBIAN_FRONTEND=noninteractive apt-get install -y cron moreutils && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*

8
cron/hooks/init

@ -19,6 +19,12 @@ fi
exit 1
}
[ "$HOST_COMPOSE_LAUNCHER_OPTS" ] || {
err "\$HOST_COMPOSE_LAUNCHER_OPTS is expected to be set."
exit 1
}
[ "$COMPOSE_LAUNCHER_BIN" ] || {
err "\$COMPOSE_LAUNCHER_BIN is expected to be set."
exit 1
@ -31,7 +37,7 @@ $CHARM_NAME:
- /etc/timezone:/etc/timezone:ro
- \$DOCKER_COMPOSE_PATH/bin/dc:/bin/dc:ro
- $COMPOSE_LAUNCHER_BIN:/bin/compose:ro
- $COMPOSE_LAUNCHER_OPTS:$COMPOSE_LAUNCHER_OPTS:ro
- $HOST_COMPOSE_LAUNCHER_OPTS:$COMPOSE_LAUNCHER_OPTS:ro
environment:
TZ: $timezone
COMPOSE_LAUNCHER_OPTS: $COMPOSE_LAUNCHER_OPTS

20
cron/hooks/pre_deploy

@ -0,0 +1,20 @@
#!/bin/bash
## Should be executable N time in a row with same result.
set -e
cron_config_hash() {
debug "Adding config hash to enable recreating upon config change."
config_hash=$({
find "$SERVICE_CONFIGSTORE/etc/cron"{,.hourly,.weekly,.daily,.monthly} \
-type f -exec md5sum {} \;
} | md5_compat) || exit 1
init-config-add "
$MASTER_BASE_SERVICE_NAME:
labels:
- compose.config_hash=$config_hash
"
}
cron_config_hash || exit 1

4
cron/metadata.yml

@ -11,7 +11,9 @@ data-resources:
host-resources:
- /var/run/docker.sock
provides:
schedule-command:
schedule-command: ## for one command
tech-dep: False
schedule-commands: ## for several commands
tech-dep: False
uses: ## optional

2
cyclos/hooks/init

@ -40,7 +40,7 @@ done < <(array_values_to_stdin PROPS)
init-config-add "
$SERVICE_NAME:
environment:
JAVA_OPTS: |
JAVA_OPTS: >-
-Dcyclos.cors.origin=*
-Dcyclos.header.remoteAddress=X-Forwarded-For
-Dcyclos.header.protocol=X-Forwarded-Proto

63
cyclos/hooks/pre_deploy

@ -0,0 +1,63 @@
#!/bin/bash
##
## Get domain in option of relation "web-proxy"
##
## XXXvlab: there is a tiny lapse of time where database is not yet
## installed, and admin password is the default value.
. lib/common
set -ex
admin_password=$(options-get admin-password 2>/dev/null ) || exit 1
CONTROL_PASSWORD_FILE="$SERVICE_DATASTORE/.control-pass"
## Was it already properly propagated to database ?
control_password=$(H "${admin_password}")
if ! [ -e "$CONTROL_PASSWORD_FILE" ] || [ "$control_password" != "$(cat "$CONTROL_PASSWORD_FILE")" ]; then
hash="$(htpasswd -nbBC 10 USER "$admin_password" | cut -f 2- -d :)" || {
err "Couldn't generate hash for admin password."
exit 1
}
if ! sql < <(e "
UPDATE passwords SET value = '$hash'
WHERE user_id = 1
AND status = 'ACTIVE'
AND password_type_id in (
SELECT id FROM password_types
WHERE input_method = 'TEXT_BOX'
AND password_mode = 'MANUAL');
"); then
debug "Failed to set password for admin users."
exit 1
fi
mkdir -p "${CONTROL_PASSWORD_FILE%/*}"
e "$control_password" > "$CONTROL_PASSWORD_FILE"
fi
url=$(named-relation-get "web-proxy" url) || exit 1
CONTROL_URL_FILE="$SERVICE_DATASTORE/.control-url"
## Was it already properly propagated to database ?
control_url=$(H "${url}")
if ! [ -e "$CONTROL_URL_FILE" ] || [ "$control_url" != "$(cat "$CONTROL_URL_FILE")" ]; then
## In ``configurations`` table, columns login_url, logout_url, root_url
if ! sql < <(e "
UPDATE configurations
SET
root_url = '$url'
"); then
debug "Failed to set password for admin users."
exit 1
fi
e "$control_password" > "$CONTROL_URL_FILE"
fi

61
cyclos/lib/common

@ -1,4 +1,4 @@
# -*- mode: bash -*-
# -*- mode: shell-script -*-
CYCLOS_CONFIG="/usr/local/cyclos/WEB-INF/classes/cyclos.properties"
@ -12,3 +12,62 @@ cyclos:build() {
docker cp "$container_id":"$CYCLOS_CONFIG" "$HOST_CYCLOS_CONFIG" &&
docker rm "$container_id"
}
named-relation-get-target-service() {
local relation="$1" ts
if ! read-0 ts _ _ < <(get_service_relation "$SERVICE_NAME" "$relation"); then
err "Couldn't find relation ${DARKCYAN}$relation${NORMAL}."
return 1
fi
e "$ts"
}
## XXXvlab: Consider for inclusion in compose-core
relation-get-config() {
local relation="$1" ts relation_dir
ts=$(named-relation-get-target-service "$relation") || return 1
relation_dir=$(get_relation_data_dir "$SERVICE_NAME" "$ts" "$relation") || return 1
cat "${relation_dir}/data"
}
named-relation-get() {
local relation="$1" key="$2" config
config=$(relation-get-config "$relation") || return 1
e "$config" | shyaml get-value "$key" || {
err "Couldn't get ${WHITE}$key${NORMAL} value" \
"in ${DARKCYAN}$relation${NORMAL} relation's data."
exit 1
}
}
sql() {
(
DBNAME="$(named-relation-get "postgres-database" dbname)" || exit 1
ts=$(named-relation-get-target-service "postgres-database") || exit 1
export SERVICE_NAME="$ts"
export SERVICE_DATASTORE="$DATASTORE/$SERVICE_NAME"
DOCKER_BASE_IMAGE=$(service_base_docker_image "$SERVICE_NAME")
export DOCKER_BASE_IMAGE
target_charm=$(get_service_charm "$ts") || exit 1
target_charm_path=$(charm.get_dir "$target_charm") || exit 1
set +e
. "$target_charm_path/lib/common"
set -e
ensure_db_docker_running
ddb "$DBNAME"
)
}

6
cyclos/metadata.yml

@ -1,5 +1,5 @@
## Based on cyclos/cyclos:4.13.2
docker-image: docker.0k.io/cyclos:4.13.2
## Based on cyclos/cyclos:4.14
docker-image: docker.0k.io/cyclos:4.14.7
config-resources:
- /usr/local/cyclos/WEB-INF/classes/cyclos.properties
data-resources:
@ -24,6 +24,8 @@ uses:
- earthdistance
- postgis
- unaccent
init-sql: !bash-stdout |
zcat "$BASE_CHARM_PATH/src/init.sql.gz"
log-rotate:
#constraint: required | recommended | optional
#auto: pair | summon | none ## default: pair

BIN
cyclos/src/init.sql.gz

14
drone/metadata.yml

@ -47,3 +47,17 @@ uses:
proxy: "Public access"
default-options:
target: !var-expand ${MASTER_BASE_SERVICE_NAME}:80
backup:
constraint: recommended
auto: pair
solves:
backup: "Automatic regular backups of sql database"
default-options:
## First pattern matching wins, no pattern matching includes.
## include-patterns are checked first, then exclude-patterns
## Patterns rules:
## - ending / for directory
## - '*' authorized
## - must start with a '/', will start from $SERVICE_DATASTORE
# include-patterns:
# - /var/backups/pg/

33
etherpad/README.org

@ -0,0 +1,33 @@
# -*- ispell-local-dictionary: "english" -*-
#+TITLE: Etherpad Charm
* Upgrade
Based on https://github.com/ether/etherpad-lite , following:
https://github.com/ether/etherpad-lite/blob/develop/doc/docker.md
Used:
#+begin_src sh
TAG=1.8.14
git clone https://github.com/ether/etherpad-lite --depth 1 -b $TAG
docker build --build-arg INSTALL_SOFFICE=1 \
--build-arg ETHERPAD_PLUGINS=" \
ep_font_family ep_mammoth ep_comments_page ep_table_of_contents \
ep_markdown ep_image_upload ep_spellcheck ep_headings2 ep_align \
ep_who_did_what ep_what_have_i_missed ep_embedmedia \
ep_openid_connect ep_rss ep_git_commit_saved_revision" \
. -t docker.0k.io/etherpad:${TAG}-0k
docker push docker.0k.io/etherpad:${TAG}-0k
#+end_src
* Admin password
We choose to NOT include admin panel as it allows to change settings
and install plugins but this will not allow to reproduce an install
easily. We can do this on the =compose.yml= side in a reproducible
manner.

39
etherpad/hooks/init

@ -0,0 +1,39 @@
#!/bin/bash
## Init is run on host
## For now it is run every time the script is launched, but
## it should be launched only once after build.
## Accessible variables are:
## - SERVICE_NAME Name of current service
## - DOCKER_BASE_IMAGE Base image from which this service might be built if any
## - SERVICE_DATASTORE Location on host of the DATASTORE of this service
## - SERVICE_CONFIGSTORE Location on host of the CONFIGSTORE of this service
. lib/common
set -e
dirs=(
"$SERVICE_DATASTORE/var/lib/etherpad"
)
uid_gid=($(docker_get_uid_gid "$SERVICE_NAME" "etherpad" "etherpad")) || {
err "Could not fetch uid/gid on image of service ${DARKYELLOW}$SERVICE_NAME${NORMAL}."
return 1
}
uid="${uid_gid[0]}"
gid="${uid_gid[1]}"
for dir in "${dirs[@]}"; do
mkdir -p "$dir"
find "$dir" \! -uid "$uid" -print0 | while read-0 f; do
chown -v "$uid" "$f" || return 1
done
find "$dir" \! -gid "$gid" -print0 | while read-0 f; do
chgrp -v "$gid" "$f" || return 1
done
done

26
etherpad/hooks/postgres_database-relation-joined

@ -0,0 +1,26 @@
#!/bin/bash
set -e
PASSWORD="$(relation-get password)"
USER="$(relation-get user)"
DBNAME="$(relation-get dbname)"
control=$(echo -en "$USER\0$DBNAME\0$PASSWORD\0$ADMIN_PASSWORD" | md5_compat)
config-add "\
services:
$MASTER_BASE_SERVICE_NAME:
environment:
DB_TYPE: postgres
DB_HOST: \"$MASTER_TARGET_SERVICE_NAME\"
DB_NAME: \"$DBNAME\"
DB_PASS: \"$PASSWORD\"
DB_USER: \"$USER\"
"
[ "$control" == "$(relation-get control 2>/dev/null)" ] && exit 0
relation-set control "$control"
info "Configured $SERVICE_NAME code for $TARGET_SERVICE_NAME access."

53
etherpad/metadata.yml

@ -0,0 +1,53 @@
name: etherpad
summary: "Etherpad-lite server"
maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
inherit: base-0k
## Custom built from git 1.8.14 https://github.com/ether/etherpad-lite with
## build arg --build-arg INSTALL_SOFFICE=1
docker-image: docker.0k.io/etherpad:1.8.14-soffice ## custom built from git m etherpad/etherpad
description: |
Etherpad-lite service.
data-resources:
- /var/lib/etherpad
docker-compose:
command: node src/node/server.js --apikey /var/lib/etherpad/APIKEY.txt
environment:
SOFFICE: '/usr/bin/soffice'
uses:
postgres-database:
#constraint: required | recommended | optional
#auto: pair | summon | none ## default: pair
constraint: required
auto: summon
solves:
database: "main storage"
default-options:
extensions:
- unaccent
web-proxy:
#constraint: required | recommended | optional
#auto: pair | summon | none ## default: pair
constraint: recommended
auto: pair
solves:
proxy: "Public access"
default-options:
target: !var-expand ${MASTER_BASE_SERVICE_NAME}:9001
backup:
constraint: recommended
auto: pair
solves:
backup: "Automatic regular backup"
default-options:
## First pattern matching wins, no pattern matching includes.
## include-patterns are checked first, then exclude-patterns
## Patterns rules:
## - ending / for directory
## - '*' authorized
## - must start with a '/', will start from $SERVICE_DATASTORE
#exclude-patterns:
# - "/var/lib/odoo/sessions/"

3
gitea/metadata.yml

@ -1,7 +1,8 @@
description: "Gitea Server"
maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
## XXXvlab: docker uses the 'build' directory or the 'image:' option here.
docker-image: docker.0k.io/gitea:1.0.0
## based on gitea/gitea:1.14.2
docker-image: docker.0k.io/gitea:1.14.2
docker-compose:
ports:
- "5022:22"

47
gogocarto/README.org

@ -15,35 +15,28 @@ far from being mature, we try here to get only the released part.
We are talking of:
[[https://gitlab.adullact.net/pixelhumain/GoGoCarto/-/blob/f3c10f16fc08b533ef44f1325fdb50f87fa73224/docs/installation_docker.md][gogocarto docker install documentation]]
** Intermediate docker image is cached on docker.0k.io if needed
** Updating
To rebuild a new version, I pushed the huge docker image of
=gogocarto= container that is required in the process (that contains
apache and all build/install tools). Note that this should not require
to be rebuild if anything important changes in the directory =docker/=.
This process will ensure to avoid rebuilding the gigantic intermediate
image needed (with apache and build/install tools).
Using:
You need to run this from the root of a code checkout of:
https://gitlab.adullact.net/pixelhumain/GoGoCarto
#+begin_src sh
docker_tree_hash=$(git rev-parse HEAD:docker)
docker tag docker_gogocarto docker.0k.io/gogocarto-builder:${docker_tree_hash}
docker push docker.0k.io/gogocarto-builder:${docker_tree_hash}
## Intermediate docker image is cached on docker.0k.io if needed
if ! docker pull docker.0k.io/gogocarto-builder:${docker_tree_hash}; then
make build &&
docker tag docker_gogocarto docker.0k.io/gogocarto-builder:${docker_tree_hash} &&
docker push docker.0k.io/gogocarto-builder:${docker_tree_hash}
else
docker tag docker.0k.io/gogocarto-builder:${docker_tree_hash} docker_gogocarto
fi
make up &&
docker-compose -f docker/docker-compose.yml exec gogocarto make init
#+end_src
So, if needed, it can be pulled back to avoid the hassle of making it:
#+begin_src sh
docker_tree_hash=$(git rev-parse HEAD:docker)
docker pull docker.0k.io/gogocarto-builder:${docker_tree_hash} &&
docker tag docker.0k.io/gogocarto-builder:${docker_tree_hash} docker_gogocarto
#+end_src
You still need to do (as of <2020-10-20 Tue>):
- get the latest source code
- =make up= to launch de containers with the images
- =make shell= from the latest git repos
- =make init= in the container
** Full release is cached on =docker.0k.io/downloads=
This is the content of the source tree, once populated by =make init=.
@ -55,7 +48,6 @@ As of <2020-10-23 Fri>, the =Makefile='s =init= target is:
#+begin_src sh
$ grep ^init Makefile -A1
init: install assets load-fixtures fix-perms ##ย Initialize the project
#+end_src
Note that =load-fixtures= target is actually the mongodb initialization:
@ -71,7 +63,7 @@ load-fixtures: ## Create the DB schema, generate DB classes and load fixtures
This will be done in the =hooks/mongo_database-relation-joined= accordingly.
*** create the full data release bundle this is what was made:
*** create the full data release bundle this is what was made
#+begin_src sh
## correct bundles links (no idea if it is needed)
@ -94,6 +86,7 @@ commit_sha=$(git describe HEAD --tags)
tar cjv \
bin web vendor config src templates translations \
--exclude=.git --exclude=.gitignore \
--owner=root --group=root \
> gogocarto-${commit_sha}.tar.bz2
#+end_src
@ -103,9 +96,3 @@ all non '\*.{php,yml,js}' files. I noticed many many unrelated files in
We need =bin= for symphony utilities that allows to setup things.
* Roadmap
** TODO mongo / the default database name is probably not correctly set.
Indeed, it seems it is defaulted to =gogocarto_default= and I didn't find
yet how to set it. There's a connection with SAAS mode I think.

4
gogocarto/hooks/init

@ -16,8 +16,6 @@
set -e
if ! [ -e "$GOGOCARTO_CODE" ]; then
gogocarto:init || exit 1
fi
gogocarto:init || exit 1
gogocarto:config || exit 1

2
gogocarto/hooks/mongo_database-relation-joined

@ -24,6 +24,8 @@ MONGODB_URL=$MONGO_URL
MONGODB_DATABASE=$DBNAME
###< doctrine/mongodb-odm-bundle ###
DATABASE_NAME=$DBNAME
EOF
if [ -e "$inited" ]; then

11
gogocarto/hooks/publish_dir-relation-joined

@ -49,6 +49,7 @@ cat <<EOF > "${GOGOCARTO_CODE}"/web/.htaccess
Options -MultiViews
RewriteEngine On
RewriteRule ^js/.* - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php/\$1 [QSA,L]
@ -59,8 +60,10 @@ config-add "
services:
$MASTER_TARGET_SERVICE_NAME:
volumes:
- $SERVICE_CONFIGSTORE/opt/apps/gogocarto:/opt/apps/gogocarto:rw
- $SERVICE_DATASTORE/var/cache/gogocarto:/opt/apps/gogocarto/var/cache:rw
- $SERVICE_DATASTORE/var/lib/gogocarto/sessions:/opt/apps/gogocarto/var/sessions:rw
- $SERVICE_DATASTORE/var/log/gogocarto:/opt/apps/gogocarto/var/log:rw
- $GOGOCARTO_CODE:$GOGOCARTO_DIR:rw
- $SERVICE_DATASTORE/var/cache/gogocarto:$GOGOCARTO_DIR/var/cache:rw
- $SERVICE_DATASTORE/var/lib/gogocarto/sessions:$GOGOCARTO_DIR/var/sessions:rw
- $SERVICE_DATASTORE/var/log/gogocarto:$GOGOCARTO_DIR/var/log:rw
## Required to give PHP access to this dir
- $upload_dir:$GOGOCARTO_DIR/web/uploads:rw
"

44
gogocarto/hooks/schedule_commands-relation-joined

@ -0,0 +1,44 @@
#!/bin/bash
## When writing relation script, remember:
## - they should be idempotents
## - they can be launched while the dockers is already up
## - they are launched from the host
## - the target of the link is launched first, and get a chance to ``relation-set``
## - both side of the scripts get to use ``relation-get``.
. lib/common
set -e
## XXXvlab: should use container name here so that it could support
## multiple postgres
label=${SERVICE_NAME}
DST=$CONFIGSTORE/$TARGET_SERVICE_NAME/etc/cron/$label
## XXXvlab: Should we do a 'docker exec' instead ?
bin_console="dc run -u www-data --rm --entrypoint \\\"$GOGOCARTO_DIR/bin/console\\\" $MASTER_BASE_SERVICE_NAME"
## Warning: 'docker -v' will use HOST directory even if launched from
## 'cron' container.
file_put "$DST" <<EOF
@daily root lock ${label}-checkvote -D -p 10 -c "\
$bin_console app:elements:checkvote" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-checkvote_script.log
@daily root lock ${label}-checkExternalSourceToUpdate -D -p 10 -c "\
$bin_console app:elements:checkExternalSourceToUpdate" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-checkExternalSourceToUpdate_script.log
@daily root lock ${label}-notify-moderation -D -p 10 -c "\
$bin_console app:notify-moderation" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-notify-moderation_script.log
@hourly root lock ${label}-sendNewsletter -D -p 10 -c "\
$bin_console app:users:sendNewsletter" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-sendNewsletter_script.log
*/5 * * * * root lock ${label}-webhooks-post -D -p 10 -c "\
$bin_console --env=prod app:webhooks:post" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${SERVICE_NAME}-webhooks-post_script.log
EOF
chmod +x "$DST"

44
gogocarto/lib/common

@ -1,15 +1,45 @@
# -*- mode: shell-script -*-
GOGOCARTO_CODE="$SERVICE_CONFIGSTORE/opt/apps/gogocarto"
GOGOCARTO_RELEASE=3.1.3-2-gf3c10f1
GOGOCARTO_DIR="/opt/apps/gogocarto"
GOGOCARTO_CODE="$SERVICE_CONFIGSTORE$GOGOCARTO_DIR"
GOGOCARTO_RELEASE=3.1.3-56-g6b8ba361
GOGOCARTO_URL=https://docker.0k.io/downloads/gogocarto-"${GOGOCARTO_RELEASE}".tar.bz2
gogocarto:init() {
mkdir -p "${GOGOCARTO_CODE}" &&
cd "${GOGOCARTO_CODE}" &&
curl "$GOGOCARTO_URL" | tar xjv
current_version=""
if [ -d "${GOGOCARTO_CODE}" ]; then
current_version=$(cat "${GOGOCARTO_CODE}"/.version) || {
err "Couldn't find ${GOGOCARTO_CODE}/.version file."
echo " Your config dir is in a broken state." >&2
return 1
}
else
mkdir -p "${GOGOCARTO_CODE}" &&
cd "${GOGOCARTO_CODE}" &&
git init . &&
git config user.email "root@localhost" &&
git config user.name "Root" || {
err "Couldn't create directory ${GOGOCARTO_CODE}, or init it with git."
return 1
}
fi
if [ "$current_version" != "$GOGOCARTO_RELEASE" ]; then
cd "${GOGOCARTO_CODE}" || return 1
if [ -d "$PWD"/.git ]; then
rm -rf "$PWD"/* "$PWD"/{.version,.inited-*,.env} || return 1
else
err "Can't find the '.git' directory in ${GOGOCARTO_CODE}."
return 1
fi
curl -L "$GOGOCARTO_URL" | tar xjv || {
err "Couldn't download $GOGOCARTO_URL."
return 1
}
echo "$GOGOCARTO_RELEASE" > .version
git add -A . &&
git commit -m "Release $GOGOCARTO_RELEASE"
fi
}
@ -21,7 +51,7 @@ gogocarto:config() {
cat <<EOF > "${GOGOCARTO_CODE}"/.env
###> symfony/framework-bundle ###
APP_ENV=$APP_ENV
APP_ENV=${APP_ENV}
APP_SECRET=82ec369b81caab5446ddfc3b5edb4d00
CSRF_PROTECTION=$(
[ "$APP_ENV" == "prod" ] &&

5
gogocarto/metadata.yml

@ -26,3 +26,8 @@ uses:
auto: summon
solves:
database: "main storage"
schedule-commands:
constraint: recommended
auto: pair
solves:
maintenance: "Production scheduled tasks"

12
hedgedoc/hooks/init

@ -0,0 +1,12 @@
#!/bin/bash
init-config-add "\
$SERVICE_NAME:
environment:
CMD_USECDN: \"false\"
"
## ``codimd`` create uploads folder with wrong permission
uid=$(docker_get_uid "$SERVICE_NAME" "hedgedoc")
mkdir -p "$SERVICE_DATASTORE/hedgedoc/public/uploads"
chown "$uid" "$SERVICE_DATASTORE/hedgedoc/public/uploads"

0
codimd/hooks/postgres_database-relation-joined → hedgedoc/hooks/postgres_database-relation-joined

22
hedgedoc/hooks/web_proxy-relation-joined

@ -0,0 +1,22 @@
#!/bin/bash
set -e
DOMAIN=$(relation-get domain) || exit 1
## These are mainly to setup the correct web-hook
if [ "$MASTER_BASE_SERVICE_NAME" == "$DOMAIN" ]; then
## This is because the IP will be the docker container version
USESSL=""
else
USESSL="CMD_PROTOCOL_USESSL: 'true'"
fi
config-add "\
services:
$MASTER_BASE_SERVICE_NAME:
environment:
CMD_DOMAIN: $DOMAIN
$USESSL
"

4
codimd/metadata.yml → hedgedoc/metadata.yml

@ -1,6 +1,6 @@
docker-image: docker.0k.io/hackmd:2.2.0 ## from: nabo.codimd.dev/hackmdio/hackmd:2.2.0
docker-image: docker.0k.io/hedgedoc:1.7.2 ## from: quay.io/hedgedoc/hedgedoc:1.7.2-alpine
data-resources:
- /home/hackmd/app/public/uploads
- /hedgedoc/public/uploads
default-options:

2
logrotate/build/src/entrypoint.sh

@ -10,4 +10,4 @@ do
done >> status.clean
mv status.clean status
/usr/sbin/logrotate -s /var/lib/logrotate/status /etc/logrotate.conf
/usr/sbin/logrotate -v -s /var/lib/logrotate/status /etc/logrotate.conf

19
mariadb/build/Dockerfile

@ -0,0 +1,19 @@
FROM alpine:3.9
RUN apk add --no-cache mariadb mariadb-client mariadb-server-utils && \
rm -f /var/cache/apk/*
## Required by mysql-backup
RUN apk add --no-cache bash gzip && \
rm -f /var/cache/apk/*
RUN mkdir -p /run/mysqld && \
chown -R mysql:mysql /run/mysqld
RUN sed -i "s|.*bind-address\s*=.*|bind-address=0.0.0.0|g" /etc/my.cnf.d/mariadb-server.cnf
COPY src/ /
EXPOSE 3306
ENTRYPOINT ["/entrypoint.sh"]

20
mariadb/build/src/entrypoint.sh

@ -0,0 +1,20 @@
#!/bin/sh
if ! [ -d /var/lib/mysql/mysql ]; then
chown -R mysql:mysql /var/lib/mysql
mysql_install_db --user=mysql --ldata=/var/lib/mysql > /dev/null
fi
## Support of Ctrl-C: see https://github.com/docker-library/mysql/issues/47
run() {
"$@" &
pid="$!"
trap "kill -SIGQUIT $pid" INT TERM
wait
}
run mysqld --user=mysql --skip-name-resolve --skip-networking=0 "$@"

48
mariadb/hooks/init

@ -25,31 +25,7 @@ fi
if ! [ -d "$HOST_DATASTORE/${SERVICE_NAME}$DB_DATADIR" ]; then
MYSQL_ROOT_PASSWORD="$(gen_password)"
debug docker run -e "MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD" \
--rm \
-v "$DATA_DIR:$DB_DATADIR" \
--entrypoint /bin/bash "$DOCKER_BASE_IMAGE"
docker run -e "MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD" \
--rm \
-v "$DATA_DIR:$DB_DATADIR" \
--entrypoint /bin/bash "$DOCKER_BASE_IMAGE" -c '
mysqld() {
echo "diverted mysqld call..." >&2;
echo "$*" | grep -E "(--help|--skip-networking)" >/dev/null 2>&1 || return;
echo " .. Allowing call." >&2;
/usr/sbin/mysqld "$@";
}
export -f mysqld;
/docker-entrypoint.sh mysqld' || true
## docker errorlevel is still 0 even if it failed.
## AND we must ignore mysqld error !
[ "$(find "$DATA_DIR" \
-maxdepth 0 -type d -empty 2>/dev/null)" ] && {
err "Docker run probably failed to do it's job."
exit 1
}
mkdir -p "${HOST_DB_PASSFILE%/*}"
## XXXvlab: this won't help support multiple project running on the
## same host
cat <<EOF > "$HOST_DB_PASSFILE"
@ -57,5 +33,27 @@ if ! [ -d "$HOST_DATASTORE/${SERVICE_NAME}$DB_DATADIR" ]; then
password=$MYSQL_ROOT_PASSWORD
EOF
chmod 600 "$HOST_DB_PASSFILE"
## deactivating final connection check
ddb () { true; }
export -f ddb
ensure_db_docker_running || exit 1
docker exec -i "$_DB_NAME" mysql <<EOF
USE mysql;
GRANT ALL ON *.* TO 'root'@'%' IDENTIFIED BY '$MYSQL_ROOT_PASSWORD' WITH GRANT OPTION;
GRANT ALL ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MYSQL_ROOT_PASSWORD' WITH GRANT OPTION;
SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}');
FLUSH PRIVILEGES;
EOF
. lib/common
err=$(echo "$check_command" | ddb 2>&1 >/dev/null) || {
err "Docker run probably failed to do it's job."
echo "$err" | prefix " " >&2
exit 1
}
info "New root password for mysql. "
fi

102
mariadb/hooks/install.d/60-backup.sh

@ -0,0 +1,102 @@
set -eux ## important for unbound variable ?
## Require these to be set
# MYSQL_ROOT_PASSWORD=
# MYSQL_CONTAINER=
[ "${MYSQL_ROOT_PASSWORD}" ] || {
echo "Error: you must set \$MYSQL_ROOT_PASSWORD prior to running this script." >&2
exit 1
}
[ "${MYSQL_CONTAINER}" ] || {
echo "Error: you must set \$MYSQL_CONTAINER prior to running this script." >&2
exit 1
}
##
## Init, to setup passwordless connection to mysql
##
type -p mysql >/dev/null || {
case $(lsb_release -is) in
Debian)
case $(lsb_release -rs) in
10)
apt-get install -y default-mysql-client </dev/null
;;
*)
apt-get install -y mysql-client </dev/null
;;
esac
;;
Ubuntu)
apt-get install -y mysql-client </dev/null
;;
esac
}
if ! [ -e "/root/.my.cnf" ]; then
cat <<EOF > ~/.my.cnf
[client]
password=${MYSQL_ROOT_PASSWORD}
EOF
chmod 600 ~/.my.cnf
fi
##
## installation of the mysql-backup script
##
apt-get install -y kal-shlib-{core,pretty,common} </dev/null
ln -sf "${PWD}/resources/bin/mysql-backup" /usr/local/sbin/mysql-backup
##
## Connection to cron
##
depends cron
cat <<EOF > /etc/cron.d/mysql-backup
SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
0 * * * * root /usr/local/sbin/mysql-backup --host \$(docker-ip "$MYSQL_CONTAINER" 2>/dev/null | sed -r 's/ +/ /g' | cut -f 3 -d " ") | logger -t mysql-backup
EOF
##
## Connection with backup
##
if type -p mirror-dir >/dev/null 2>&1; then
[ -d "/etc/mirror-dir" ] || {
echo "'mirror-dir' is installed but no '/etc/mirror-dir' was found." >&2
exit 1
}
depends shyaml
if ! sources=$(shyaml get-values default.sources < /etc/mirror-dir/config.yml); then
echo "Couldn't query 'default.sources' in '/etc/mirror-dir/config.yml'." >&2
exit 1
fi
if ! echo "$sources" | grep "^/var/backups/mysql$" 2>/dev/null; then
sed -i '/sources:/a\ - /var/backups/mysql' /etc/mirror-dir/config.yml
cat <<EOF >> /etc/mirror-dir/config.yml
/var/backups/mysql:
exclude:
- "/*.inprogress"
EOF
fi
else
echo "warn: 'mirror-dir' not installed, backup won't be sent" >&2
fi

3
mariadb/hooks/schedule_command-relation-joined

@ -33,12 +33,11 @@ COMPOSE_LAUNCHER_OPTS=$COMPOSE_LAUNCHER_OPTS
$schedule root lock $label -D -p 10 -c "\
docker run --rm \
-e MYSQLHOST="${SERVICE_NAME}" \
--network ${PROJECT_NAME}_default \
-v \"$LOCAL_DB_PASSFILE\":/root/.my.cnf \
-v \"$HOST_CHARM_STORE/${CHARM_REL_PATH#${CHARM_STORE}/}/resources/bin/mysql-backup:/usr/sbin/mysql-backup\" \
-v \"$SERVICE_DATASTORE/var/backups/mysql:/var/backups/mysql\" \
--entrypoint mysql-backup \
\"$DOCKER_BASE_IMAGE\"" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${label}_script.log
\"$DOCKER_BASE_IMAGE\" --host \"${SERVICE_NAME}\"" 2>&1 | ts '\%F \%T \%Z' >> /var/log/cron/${label}_script.log
EOF
chmod +x "$DST"

4
mariadb/metadata.yml

@ -1,6 +1,4 @@
name: MariaDB
## From: mysql Ver 15.1 Distrib 10.0.21-MariaDB
docker-image: docker.0k.io/mariadb:1.0.0
maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
provides:
mysql-database:
@ -18,7 +16,7 @@ uses:
schedule: "31 * * * *" ## schedule backup every hour
## This one is useful only if previous relation is used
backup:
constraint: optional
constraint: recommended
auto: pair
solves:
backup: "Automatic regular backups of dumps"

42
mariadb/resources/bin/mysql-backup

@ -1,5 +1,34 @@
#!/bin/bash
usage="$exname [--host HOST] [DATABASE...]"
DBS=()
host=
while [ "$1" ]; do
case "$1" in
"--help"|"-h")
echo "$usage" >&2
exit 0
;;
"--host")
host="$2"
shift
;;
*)
DBS+=("$1")
;;
esac
shift
done
mysql_opts=()
if [ "$host" ]; then
mysql_opts+=(-h "$host")
fi
m() {
mysql "${mysql_opts[@]}" -Bs "$@"
}
@ -14,16 +43,13 @@ mysql_databases() {
mysql_tables() {
local db="$1"
echo "SHOW TABLES" | m "$db"
echo "SHOW TABLES" | m "$db"
}
mysql_opts=()
if [ "$MYSQLHOST" ]; then
mysql_opts+=(-h "$MYSQLHOST")
fi
DBS=($(mysql_databases)) || exit 1
if [ "${#DBS[@]}" == 0 ]; then
DBS=($(mysql_databases)) || exit 1
fi
mkdir -p /var/backups/mysql
@ -38,7 +64,7 @@ for db in "${DBS[@]}"; do
[ -d "$dst" ] && mv "$dst" "$dst.old"
mkdir -p "$dst.inprogress"
(( start = SECONDS ))
md "$db" --routines --no-data --add-drop-database --database "$db" | gzip --rsyncable > "$dst.inprogress/schema.sql.gz"
md "$db" --routines --no-data --add-drop-database --database "$db" | gzip --rsyncable > "$dst.inprogress/00-schema.sql.gz"
tables=$(mysql_tables "$db")
for table in $tables; do
backup_file="$dst.inprogress/${table}.sql.gz"

27
monujo/hooks/init

@ -0,0 +1,27 @@
#!/bin/bash
## Init is run on host
## For now it is run every time the script is launched, but
## it should be launched only once after build.
## Accessible variables are:
## - SERVICE_NAME Name of current service
## - DOCKER_BASE_IMAGE Base image from which this service might be built if any
## - SERVICE_DATASTORE Location on host of the DATASTORE of this service
## - SERVICE_CONFIGSTORE Location on host of the CONFIGSTORE of this service
set -e
APP_NAME=monujo
SOURCE_URL="https://docker.0k.io/downloads/$APP_NAME-0.0.1.tar.bz2"
LOCATION="$SERVICE_DATASTORE/opt/apps/$APP_NAME"
mkdir -p "$LOCATION"
if dir_is_empty "$LOCATION"; then
cd "$LOCATION"
wget -q "$SOURCE_URL" -O file.tar.bz2
tar xjf file.tar.bz2
rm file.tar.bz2
chown root:root "$LOCATION" -R
fi

17
monujo/metadata.yml

@ -0,0 +1,17 @@
description: "LokWallet"
maintainer: "Valentin Lab <valentin.lab@kalysto.org>"
subordinate: true
uses:
publish-dir:
#constraint: required | recommended | optional
#auto: pair | summon | none ## default: pair
scope: container
constraint: required
auto: summon
solves:
container: "main running server"
default-options:
location: !var-expand "$DATASTORE/$BASE_SERVICE_NAME/opt/apps/monujo"
# data-dirs: ## write permission for web-app
# - .

4
mysql/hooks/install

@ -9,11 +9,11 @@ GIT_0K_CLONE_OPTIONS=${GIT_0K_CLONE_OPTIONS:-""}
GIT_0K_BASE=${GIT_0K_BASE:-"git.0k.io:/var/git"}
apt-get install -y --force-yes cron kal-scripts
apt-get install -y cron kal-scripts
debconf-set-selections <<< "mysql-server mysql-server/root_password password $MYSQL_PASSWORD"
debconf-set-selections <<< "mysql-server mysql-server/root_password_again password $MYSQL_PASSWORD"
apt-get install -y --force-yes mysql-server
apt-get install -y mysql-server

13
nextcloud/build/Dockerfile

@ -1,13 +0,0 @@
## This is a cache of nextcloud:18.0.1 image (gmp is included)
FROM docker.0k.io/nextcloud:1.2.0
##
## What is following is only to patch nextcloud to remove
## some database name checks
##
COPY database-accept-dots.patch /tmp/
RUN cd /usr/src/nextcloud && \
patch -p1 < /tmp/database-accept-dots.patch

14
nextcloud/build/database-accept-dots.patch

@ -1,14 +0,0 @@
diff --git a/lib/private/Setup/AbstractDatabase.php b/lib/private/Setup/AbstractDatabase.php
index 0cbfecf..a821a2e 100644
--- a/lib/private/Setup/AbstractDatabase.php
+++ b/lib/private/Setup/AbstractDatabase.php
@@ -72,9 +72,6 @@ abstract class AbstractDatabase {
} elseif (empty($config['dbname'])) {
$errors[] = $this->trans->t("%s enter the database name.", [$this->dbprettyname]);
}
- if(substr_count($config['dbname'], '.') >= 1) {
- $errors[] = $this->trans->t("%s you may not use dots in the database name", array($this->dbprettyname));
- }
return $errors;
}

2
nextcloud/metadata.yml

@ -1,9 +1,9 @@
docker-image: docker.0k.io/nextcloud:18.0.1-myc
data-resources:
- /var/www/html
- /var/lib/nextcloud/data
config-resources:
- /var/www/html/config
provides:
nextcloud-app:
uses:

50
odoo-tecnativa/actions/install

@ -0,0 +1,50 @@
#!/bin/bash
## Load action gets a first argument a DIRECTORY holding the necessary files.
##
##
if [ -z "$SERVICE_DATASTORE" ]; then
echo "This script is meant to be run through 'compose' to work properly." >&2
exit 1
fi
usage="$exname [-h|--help] DBNAME [MODULE ...]"
dbname=
modules=()
while [ "$1" ]; do
case "$1" in
"--help"|"-h")
print_usage
exit 0
;;
*)
[ -z "$dbname" ] && { dbname=$1 ; shift ; continue ; }
modules+=("$1")
;;
esac
shift
done
if [ -z "$dbname" ]; then
err "You must provide a destination database name as second argument."
print_usage
exit 1
fi
if [ -z "${modules[*]}" ]; then
err "You must provide at least one module as third argument."
print_usage
exit 1
fi
modules="$(echo "${modules[@]}" | tr " " ",")"
## This can work only if ~/.my.cnf is correctly created by init.
set -e
launch_docker_compose run "$CONTAINER_NAME" --init="$modules" -d "$dbname" --stop-after-init
info "Installed '$modules' module(s) into database '$dbname'."

20
onlyoffice/hooks/init

@ -13,9 +13,23 @@
set -e
if ! [ -e "$SERVICE_CONFIGSTORE/etc/onlyoffice/documentserver/local.json" ]; then
image_id=$(service_base_image_id "$SERVICE_NAME") || {
err "couldn't get image id of $SERVICE_NAME."
exit 1
}
CONTROL_FILE="$SERVICE_CONFIGSTORE/etc/onlyoffice/.image_id"
if [ "$(cat "$CONTROL_FILE")" != "$image_id" ]; then
## first time we need to extract configuration from image
rm -rf "$SERVICE_CONFIGSTORE/etc/onlyoffice"
mkdir -p "$SERVICE_CONFIGSTORE/etc/onlyoffice"
service_base_image_export_dir "$SERVICE_NAME" /etc/onlyoffice/documentserver "$SERVICE_CONFIGSTORE/etc/onlyoffice/"
fi
printf "%s" "$image_id" > "$CONTROL_FILE"
else
## probably not needed to regenerate fonts
init-config-add "\
$MASTER_BASE_SERVICE_NAME:
environment:
GENERATE_FONTS: \"false\"
"
fi

3
onlyoffice/hooks/nextcloud_app-relation-joined

@ -15,7 +15,8 @@ compose --no-relations --no-init \
app:install onlyoffice \; \
config:system:set onlyoffice DocumentServerInternalUrl --value="http://$MASTER_BASE_SERVICE_NAME/" \; \
config:system:set onlyoffice StorageUrl --value="http://$MASTER_TARGET_SERVICE_NAME/" \; \
config:app:set onlyoffice jwt_secret --value="$KEY"
config:app:set onlyoffice jwt_secret --value="$KEY" \; \
config:system:set allow_local_remote_servers --type=boolean --value=true
ONLYOFFICE_CFG="$SERVICE_CONFIGSTORE/etc/onlyoffice/documentserver/local.json"

34
onlyoffice/hooks/postgres_database-relation-joined

@ -0,0 +1,34 @@
#!/bin/bash
. lib/common
set -e
PASSWORD="$(relation-get password)"
USER="$(relation-get user)"
DBNAME="$(relation-get dbname)"
ADMIN_PASSWORD=$(relation-base-compose-get admin-password 2>/dev/null) || {
if [ -e "$CONFIG" ]; then
ADMIN_PASSWORD=$(grep ^admin_passwd "$CONFIG" | sed -r 's/^admin_passwd\s+=\s+(.+)$/\1/g')
fi
if [ -z "$ADMIN_PASSWORD" ]; then
info "Generating odoo admin password"
ADMIN_PASSWORD=$(gen_password)
fi
}
database=$(options-get database 2>/dev/null) || true
database="${database:-$DBNAME}"
config-add "\
services:
$MASTER_BASE_SERVICE_NAME:
environment:
DB_TYPE: \"postgres\"
DB_HOST: \"$MASTER_TARGET_SERVICE_NAME\"
DB_NAME: \"$DBNAME\"
DB_PWD: \"$PASSWORD\"
DB_USER: \"$USER\"
"
info "Configured $SERVICE_NAME code for $TARGET_SERVICE_NAME access."

36
onlyoffice/metadata.yml

@ -1,7 +1,14 @@
docker-image: docker.0k.io/oods:1.0.0
# from: https://github.com/0k/Docker-DocumentServer (6.1.0)
docker-image: docker.0k.io/oods:2.0.0
data-resources:
- /var/www/onlyoffice/Data
- /var/log/onlyoffice
## not documented but found in entrypoint and docker inspect
- /var/lib/onlyoffice
- /var/lib/postgres
- /var/lib/rabbitmq
- /var/lib/redis
- /usr/share/fonts/truetype/custom
config-resources:
- /etc/onlyoffice/documentserver
@ -25,3 +32,30 @@ uses:
proxy: "Public access"
default-options:
target: !var-expand ${MASTER_BASE_SERVICE_NAME}:80
postgres-database:
constraint: required
auto: summon
solves:
database: "main storage"
## XXXvlab: this should not be necessary as official documentation
## seems to explain that all data are either logs or caches. But we
## had issues with onlyoffice not sending back modifications to the
## filesystem. With some tweaks, we can sometimes gets the data from
## application cache. So for now, we must include this data to
## backup.
backup:
constraint: recommended
auto: pair
solves:
backup: "Automatic regular backups of dumps"
default-options:
## First pattern matching wins, no pattern matching includes.
## include-patterns are checked first, then exclude-patterns
## Patterns rules:
## - ending / for directory
## - '*' authorized
## - must start with a '/', will start from $SERVICE_DATASTORE
include-patterns:
- /var/lib/onlyoffice/

14
peertube/build/Dockerfile

@ -1,4 +1,4 @@
FROM alpine:3.9 AS common
FROM alpine:3.14 AS common
RUN apk add gnupg ffmpeg
@ -13,11 +13,10 @@ FROM common AS builder
## Download target release
##
ENV PEERTUBE_RELEASE=v2.1.1
ENV PEERTUBE_RELEASE=v3.3.0
RUN apk add wget
COPY ./*.patch /tmp
RUN mkdir -p /opt/apps/peertube && \
cd /opt/apps/peertube && \
wget https://github.com/Chocobozzz/PeerTube/releases/download/${PEERTUBE_RELEASE}/peertube-${PEERTUBE_RELEASE}.tar.xz && \
@ -25,12 +24,12 @@ RUN mkdir -p /opt/apps/peertube && \
rm peertube-${PEERTUBE_RELEASE}.tar.xz && \
mv peertube-${PEERTUBE_RELEASE}/* . && \
rmdir peertube-${PEERTUBE_RELEASE} && \
cat /tmp/*.patch | patch -p1 && \
mkdir -p /etc/peertube /var/lib/peertube && \
ln -sf /var/lib/peertube /opt/apps/peertube/storage
RUN apk add yarn ## Build command
RUN apk add git build-base python bash ## Build deps
RUN apk add yarn ## Build command
RUN apk add git build-base python3 bash && \
ln -sf /usr/bin/python3 /usr/local/bin/python ## Build deps
RUN chown -R peertube:peertube /opt/apps/peertube
@ -39,7 +38,6 @@ RUN apk add npm ## only needed to install things that should be in yarn
USER peertube
RUN cd /opt/apps/peertube && \
npm install bcrypt && \
yarn install --production --pure-lockfile && \
yarn cache clean
@ -92,7 +90,7 @@ VOLUME /etc/peertube
EXPOSE 9000
RUN apk add nodejs-npm
RUN apk add nodejs npm
## runtime deps
RUN apk add openssl

26
peertube/build/dbname.patch

@ -1,26 +0,0 @@
diff --git a/dist/server/initializers/checker-before-init.js b/dist/server/initializers/checker-before-init.js
index d8422ee..5eb3678 100644
--- a/dist/server/initializers/checker-before-init.js
+++ b/dist/server/initializers/checker-before-init.js
@@ -16,7 +16,7 @@ function checkMissedConfig() {
const required = ['listen.port', 'listen.hostname',
'webserver.https', 'webserver.hostname', 'webserver.port',
'trust_proxy',
- 'database.hostname', 'database.port', 'database.suffix', 'database.username', 'database.password', 'database.pool.max',
+ 'database.hostname', 'database.port', 'database.dbname', 'database.username', 'database.password', 'database.pool.max',
'smtp.hostname', 'smtp.port', 'smtp.username', 'smtp.password', 'smtp.tls', 'smtp.from_address',
'email.body.signature', 'email.subject.prefix',
'storage.avatars', 'storage.videos', 'storage.logs', 'storage.previews', 'storage.thumbnails', 'storage.torrents', 'storage.cache',
diff --git a/dist/server/initializers/config.js b/dist/server/initializers/config.js
index 6aa916f..89d16fe 100644
--- a/dist/server/initializers/config.js
+++ b/dist/server/initializers/config.js
@@ -12,7 +12,7 @@ const CONFIG = {
HOSTNAME: config.get('listen.hostname')
},
DATABASE: {
- DBNAME: 'peertube' + config.get('database.suffix'),
+ DBNAME: config.get('database.dbname'),
HOSTNAME: config.get('database.hostname'),
PORT: config.get('database.port'),
USERNAME: config.get('database.username'),

1
peertube/hooks/init

@ -66,6 +66,7 @@ for section in "${VALID_SECTION[@]}"; do
done >> "$HOST_CONFIG_DIR/local.yaml"
if ! [ -e "$HOST_DATA_DIR/config.json" ]; then
mkdir -p "$HOST_DATA_DIR"
echo "{}" > "$HOST_DATA_DIR/config.json"
fi

2
peertube/hooks/postgres_database-relation-joined

@ -15,7 +15,7 @@ cat <<EOF >> "$HOST_CONFIG_DIR/local.yaml"
database:
hostname: '$TARGET_SERVICE_NAME'
## We had to patch peertube to have a direct dbname (doh!)
dbname: '$DBNAME'
name: '$DBNAME'
port: 5432
username: '$USER'
password: '$PASSWORD'

2
postgres/metadata.yml

@ -15,7 +15,7 @@ uses:
schedule: "31 * * * *" ## schedule backup every hour
## This one is useful only if previous relation is used
backup:
constraint: optional
constraint: recommended
auto: pair
solves:
backup: "Automatic regular backups of dumps"

4
precise/0k-odoo-light/hooks/install

@ -15,7 +15,7 @@ DEPS_TO_REMOVE="git"
KEEP_ONLY_PO=${KEEP_ONLY_PO:-fr en de}
apt-get install -y --force-yes --no-install-recommends \
apt-get install -y --no-install-recommends \
$DEPS $DEPS_TO_REMOVE
## XXXvlab: should use base-0k code instead !
@ -71,7 +71,7 @@ fi
RELEASE=jessie VIRTUALENV= hooks/install
)
apt-get remove -y --force-yes $DEPS_TO_REMOVE
apt-get remove -y $DEPS_TO_REMOVE
apt-get autoremove -y
rm -rf /opt/apps/git-sub /usr/lib/git-core/git-sub

2
precise/apt-cacher/hooks/install

@ -3,7 +3,7 @@
set -eux
apt-get install -y --force-yes apt-cacher-ng
apt-get install -y apt-cacher-ng
## This is needed to enable https_port

42
precise/base-0k/hooks/install.d/00-base.sh

@ -2,21 +2,55 @@
set +eux
## Certificate DST_Root_CA-X3 expired, it needs to be removed
## from list of available certificates. Debian <10 have the issue.
##
## Fixing: https://www.reddit.com/r/sysadmin/comments/pzags0/lets_encrypts_dst_root_ca_x3_expired_yesterday/
## see also: https://techcrunch.com/2021/09/21/lets-encrypt-root-expiry/?guccounter=1
modified_certificate=
mkdir -p /usr/local/share/ca-certificates/custom
for certfile_name in isrgrootx1:ISRG_Root_X1 isrg-root-x2 lets-encrypt-r3; do
certfile=${certfile_name%%:*}
name=${certfile_name#*:}
echo "Checking $certfile for $name"
if ! [ -e "/usr/local/share/ca-certificates/custom/$certfile".crt ] &&
! [ -e "/etc/ssl/certs/$name.pem" ]; then
wget --no-check-certificate https://letsencrypt.org/certs/"$certfile".pem \
-O "/usr/local/share/ca-certificates/custom/$certfile".crt
modified_certificate=1
fi
done
if grep "^mozilla/DST_Root_CA_X3.crt" /etc/ca-certificates.conf 2>/dev/null 2>&1; then
sed -ri 's%^(mozilla/DST_Root_CA_X3.crt)%!\1%g' /etc/ca-certificates.conf
fi
if [ -n "$modified_certificate" ]; then
update-ca-certificates
fi
## We can now do the ``apt-get update`` safely...
apt-get update
apt-get -y --force-yes install bash-completion wget bzip2 git-core \
apt-get -y install bash-completion wget bzip2 git-core \
less tmux mosh \
sudo git vim file </dev/null
apt-get -y --force-yes python-software-properties </dev/null ||
apt-get -y --force-yes software-properties-common </dev/null
apt-get -y python-software-properties </dev/null ||