single-dockerfile
Ubuntu
3 years ago
parent
45cae54638
commit
05e87eb945
@ -0,0 +1,2 @@ |
||||
.*.swp |
||||
data |
||||
@ -0,0 +1,7 @@ |
||||
DOMAIN_NAME=example.com |
||||
REALM=spacestation |
||||
|
||||
KEYCLOAK_HOSTNAME=login.${DOMAIN_NAME} |
||||
HEDGEDOC_HOSTNAME=docs.${DOMAIN_NAME} |
||||
MASTODON_HOSTNAME=social.${DOMAIN_NAME} |
||||
NEXTCLOUD_HOSTNAME=cloud.${DOMAIN_NAME} |
||||
@ -0,0 +1,2 @@ |
||||
CMD_OAUTH2_CLIENT_SECRET=abcdef1234 |
||||
CMD_SESSION_SECRET=abcdef1234 |
||||
@ -0,0 +1,40 @@ |
||||
#!/bin/bash |
||||
die() { echo >&2 "$@" ; exit 1 ; } |
||||
|
||||
DIRNAME="$(dirname $0)" |
||||
cd "$DIRNAME" |
||||
[ -r env.production ] && source env.production |
||||
[ -r ../env.production ] && source ../env.production |
||||
|
||||
cd ../keycloak |
||||
|
||||
sudo docker-compose exec -T keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
create clients \ |
||||
-r "$REALM" \ |
||||
-f - <<EOF || die "unable to create hedgedoc client" |
||||
{ |
||||
"clientId": "hedgedoc", |
||||
"rootUrl": "https://$HEDGEDOC_HOSTNAME", |
||||
"adminUrl": "https://$HEDGEDOC_HOSTNAME", |
||||
"redirectUris": [ "https://$HEDGEDOC_HOSTNAME/*" ], |
||||
"webOrigins": [ "https://$HEDGEDOC_HOSTNAME" ], |
||||
"clientAuthenticatorType": "client-secret", |
||||
"secret": "$CMD_OAUTH2_CLIENT_SECRET", |
||||
"defaultClientScopes": [ |
||||
"web-origins", |
||||
"acr", |
||||
"profile", |
||||
"roles", |
||||
"id", |
||||
"email" |
||||
], |
||||
"optionalClientScopes": [ |
||||
"address", |
||||
"phone", |
||||
"offline_access", |
||||
"microprofile-jwt" |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
@ -0,0 +1 @@ |
||||
KEYCLOAK_ADMIN_PASSWORD=abcd@1234! |
||||
@ -0,0 +1,73 @@ |
||||
#!/bin/bash |
||||
die() { echo >&2 "ERROR: $@" ; exit 1 ; } |
||||
info() { echo >&2 "$@" ; } |
||||
|
||||
DIRNAME="$(dirname $0)" |
||||
cd "$DIRNAME" |
||||
source ../env.production |
||||
source ./env.production |
||||
|
||||
info "logging into server" |
||||
sudo docker-compose exec keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
config credentials \ |
||||
--server http://localhost:8080/ \ |
||||
--user admin \ |
||||
--password "$KEYCLOAK_ADMIN_PASSWORD" \ |
||||
--realm master \ |
||||
|| die "unable to login" |
||||
|
||||
|
||||
info "Create a new realm for '$REALM'" |
||||
sudo docker-compose exec keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
create realms \ |
||||
-s "realm=$REALM" \ |
||||
-s enabled=true \ |
||||
|| die "unable to create realm" |
||||
|
||||
|
||||
# https://github.com/hedgedoc/hedgedoc/issues/56 |
||||
info "Fix up a id bug" |
||||
sudo docker-compose exec -T keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
create client-scopes \ |
||||
-r "$REALM" \ |
||||
-f - <<EOF || die "unable to create mapping" |
||||
{ |
||||
"name": "id", |
||||
"protocol": "openid-connect", |
||||
"attributes": { |
||||
"include.in.token.scope": "true", |
||||
"display.on.consent.screen": "true" |
||||
}, |
||||
"protocolMappers": [ |
||||
{ |
||||
"name": "id", |
||||
"protocol": "openid-connect", |
||||
"protocolMapper": "oidc-usermodel-property-mapper", |
||||
"consentRequired": false, |
||||
"config": { |
||||
"user.attribute": "id", |
||||
"id.token.claim": "true", |
||||
"access.token.claim": "true", |
||||
"jsonType.label": "String", |
||||
"userinfo.token.claim": "true" |
||||
} |
||||
} |
||||
] |
||||
} |
||||
EOF |
||||
|
||||
|
||||
info "Create an admin user in realm" |
||||
sudo docker-compose exec -T keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
create users \ |
||||
-o \ |
||||
--fields id,username \ |
||||
-r "$REALM" \ |
||||
-s username=admin \ |
||||
-s enabled=true \ |
||||
-s 'credentials=[{"type":"'$KEYCLOAK_ADMIN_PASSWORD'","value":"admin","temporary":false}]' \ |
||||
|| die "$REALM: unable to create admin user" |
||||
@ -0,0 +1,14 @@ |
||||
#!/bin/bash |
||||
die() { echo >&2 "ERROR: $@" ; exit 1 ; } |
||||
info() { echo >&2 "$@" ; } |
||||
|
||||
DIRNAME="$(dirname $0)" |
||||
cd "$DIRNAME" |
||||
source ../env.production |
||||
source ./env.production |
||||
|
||||
info "configuring mastodon" |
||||
sudo docker-compose run web \ |
||||
rails db:setup \ |
||||
|| die "unable to login" |
||||
|
||||
@ -0,0 +1,35 @@ |
||||
Enable SSO: |
||||
|
||||
``` |
||||
( cd ../keycloak ; sudo docker-compose exec -T keycloak \ |
||||
/opt/keycloak/bin/kcadm.sh \ |
||||
create clients \ |
||||
--realm master --user admin --password admin \ |
||||
-r spacestation \ |
||||
-f - ) <<EOF |
||||
{ |
||||
"clientId": "nextcloud", |
||||
"rootUrl": "http://spacestation:9000/", |
||||
"adminUrl": "http://spacestation:9000/", |
||||
"redirectUris": [ "http://spacestation:9000/*" ], |
||||
"webOrigins": [ "http://spacestation:9000" ], |
||||
"clientAuthenticatorType": "client-secret", |
||||
"secret": "nextcloud-secret" |
||||
} |
||||
EOF |
||||
``` |
||||
|
||||
and configure the social login app: |
||||
|
||||
``` |
||||
sudo docker-compose exec -u www-data -T nextcloud \ |
||||
./occ app:install sociallogin \ |
||||
&& sudo docker-compose exec -u www-data -T nextcloud \ |
||||
./occ config:app:set sociallogin prevent_create_email_exists --value=1 \ |
||||
&& sudo docker-compose exec -u www-data -T nextcloud \ |
||||
./occ config:app:set sociallogin update_profile_on_login --value=1 \ |
||||
&& sudo docker-compose exec -u www-data -T nextcloud \ |
||||
./occ config:app:set \ |
||||
sociallogin custom_providers \ |
||||
--value='{"custom_oidc":[{"name":"keycloak","title":"Keycloak","authorizeUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/auth","tokenUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/token","displayNameClaim":"","userInfoUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/userinfo","logoutUrl":"","clientId":"nextcloud","clientSecret":"nextcloud-secret","scope":"openid","groupsClaim":"roles","style":"keycloak","defaultGroup":""}]}' |
||||
``` |
||||
@ -0,0 +1 @@ |
||||
NEXTCLOUD_ADMIN_PASSWORD=admin |
||||
@ -0,0 +1,59 @@ |
||||
server { |
||||
listen 80; |
||||
server_name ${HEDGEDOC_HOSTNAME}; |
||||
location / { |
||||
return 301 https://$host$request_uri; |
||||
} |
||||
} |
||||
|
||||
map $http_upgrade $connection_upgrade { |
||||
default upgrade; |
||||
'' close; |
||||
} |
||||
|
||||
server { |
||||
server_name ${HEDGEDOC_HOSTNAME} |
||||
client_max_body_size 128m; |
||||
|
||||
sendfile on; |
||||
tcp_nopush on; |
||||
tcp_nodelay on; |
||||
keepalive_timeout 65; |
||||
types_hash_max_size 2048; |
||||
#include /etc/nginx/mime.types; |
||||
#default_type application/octet-stream; |
||||
|
||||
gzip on; |
||||
gzip_disable "msie6"; |
||||
|
||||
proxy_read_timeout 1800s; |
||||
|
||||
# required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486) |
||||
chunked_transfer_encoding on; |
||||
|
||||
location / { |
||||
proxy_pass http://spacestation:3000; |
||||
proxy_set_header Host $host; |
||||
proxy_set_header X-Real-IP $remote_addr; |
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||
proxy_set_header X-Forwarded-Proto $scheme; |
||||
} |
||||
|
||||
location /socket.io/ { |
||||
proxy_pass http://spacestation:3000; |
||||
proxy_set_header Host $host; |
||||
proxy_set_header X-Real-IP $remote_addr; |
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||
proxy_set_header X-Forwarded-Proto $scheme; |
||||
proxy_set_header Upgrade $http_upgrade; |
||||
proxy_set_header Connection $connection_upgrade; |
||||
} |
||||
|
||||
listen 443 ssl; |
||||
ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem; |
||||
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem; |
||||
include /etc/letsencrypt/options-ssl-nginx.conf; |
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; |
||||
} |
||||
|
||||
|
||||
Loading…
Reference in new issue