setup: make all the scripts do the right thing and run through a full rebuild

README.md

@@ -1,32 +1,22 @@
-apt install jq docker-compose
+# hackerspace.zone
 
-```
+Infrastructure for the self-hosted, single-sign-on, community-run services.
-cd keycloak
-sudo docker-compose up -d
-sleep 30
-./setup
-```
 
-```
+* Set the domain name in `env.production`
-cd ../nginx
+* Create the DNS entries in the domain for `login`, `cloud`, `matrix`, `dashboard`, `docs` and maybe more.
-./setup
+* Install dependencies:
-sudo docker-compose up -d
-```
 
 ```
-cd ../hedgedoc
+apt install jq docker-compose
-./setup
-sudo docker-compose up -d
 ```
 
-```
+* Setup each of the services. `keycloak` and `nginx` are required to start the others:
-cd ../nextcloud
-sudo docker-compose up -d
-./setup
-```
 
 ```
-cd ../mastodon
+./keycloak/setup
-./setup
+./nginx/setup
-sudo docker-compose up
+./hedgedoc/setup
+./nextcloud/setup
+./mastodon/setup
+./grafana/setup
 ```

grafana/setup

@@ -8,12 +8,18 @@ source env.production || die "no local env?"
 
 BASE="https://$KEYCLOAK_HOSTNAME/realms/$REALM/protocol/openid-connect"
 
-if [ ! -r "env.secrets" ]; then
+if [ -r "env.secrets" ]; then
-	GRAFANA_CLIENT_SECRET="$(openssl rand -hex 32)"
+	docker-compose up -d || die "grafana: unable to start container"
-	GRAFANA_ADMIN_PASSWORD="$(openssl rand -hex 4)"
+	exit 0
+fi
+
+docker-compose down 2>/dev/null
 
-	echo "Generating secrets: admin password $GRAFANA_ADMIN_PASSWORD"
+GRAFANA_CLIENT_SECRET="$(openssl rand -hex 32)"
-	cat <<EOF > env.secrets
+GRAFANA_ADMIN_PASSWORD="$(openssl rand -hex 4)"
+
+echo "Generating secrets: admin password $GRAFANA_ADMIN_PASSWORD"
+cat <<EOF > env.secrets
 # Do not check in!
 GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
 GF_SERVER_ROOT_URL=https://$GRAFANA_HOSTNAME/
@@ -23,13 +29,9 @@ GF_AUTH_GENERIC_OAUTH_TOKEN_URL=$BASE/token
 GF_AUTH_GENERIC_OAUTH_API_URL=$BASE/userinfo
 GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=$GRAFANA_CLIENT_SECRET
 EOF
-else
-	source env.secrets || die "no secret env?"
-fi
 
-docker-compose down
 
-../keycloak/client-delete 'grafana' || echo "client did not exist?"
+../keycloak/client-delete 'grafana' 2>/dev/null
 
 ../keycloak/client-create << EOF || die "unable to create client id"
 {
@@ -43,4 +45,4 @@ docker-compose down
 }
 EOF
 
-docker-compose up -d || die "unable to bring up grafana"
+docker-compose up -d || die "grafana: unable to bring up container"

hedgedoc/setup

@@ -6,14 +6,19 @@ cd "$DIRNAME"
 source ../env.production || die "no top levle env?"
 source env.production || die "no local env?"
 
-docker-compose down
+if [ -r "./env.secrets" ]; then
+	docker-compose up -d || die "hedgedoc: unable to start"
+	exit 0
+fi
+
+docker-compose down 2>/dev/null
 
 # regenerate the client secrets
 CLIENT_SECRET="$(openssl rand -hex 20)"
 SESSION_SECRET="$(openssl rand -hex 20)"
 
-rm -f env.secrets
 cat <<EOF > env.secrets
+# DO NOT CHECK IN
 CMD_OAUTH2_CLIENT_SECRET=$CLIENT_SECRET
 CMD_SESSION_SECRET=$SESSION_SECRET
 EOF
@@ -46,5 +51,4 @@ EOF
 }
 EOF
 
-
+docker-compose up -d || die "hedgedoc: unable to start container"
-docker-compose up -d || die "unable to start container"

keycloak/README.md

@@ -1,146 +1,7 @@
-For initial setup;
+# Keycloak
 
-* Setup auth credentials
+Keycloak is the single-sign-on user authentication provider.
-```
+You must set the `KEYCLOAK_ADMIN_PASSWORD` in the `env.secrets` file.
-sudo docker-compose exec keycloak \
+This is the most important secret: it allows user accounts to be created
-  /opt/keycloak/bin/kcadm.sh \
+for all the other services.
-  config credentials \
-  --server http://localhost:8080/ \
-  --user admin \
-  --password admin \
-  --realm master \
 
-```
-
-* Create a new realm for the `spacestation`:
-```
-sudo docker-compose exec keycloak \
-  /opt/keycloak/bin/kcadm.sh \
-  create realms \
-  -s realm=spacestation \
-  -s enabled=true \
-
-```
-
-# Fix up a id bug
-
-* https://github.com/hedgedoc/hedgedoc/issues/56
-
-```
-sudo docker-compose exec -T keycloak \
-  /opt/keycloak/bin/kcadm.sh \
-  create client-scopes \
-  -r spacestation \
-  -f - <<EOF
- {
-      "name": "id",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "true",
-        "display.on.consent.screen": "true"
-      },
-      "protocolMappers": [
-        {
-          "name": "id",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-property-mapper",
-          "consentRequired": false,
-          "config": {
-            "user.attribute": "id",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-}
-EOF
-
-# Create a client in the realm with a provided shared secret and client scope
-
-```
-sudo docker-compose exec -T keycloak \
-  /opt/keycloak/bin/kcadm.sh \
-  create clients \
-  -r spacestation \
-  -f - <<EOF
-{
-	"clientId": "hedgedoc",
-	"rootUrl": "http://spacestation:3000/",
-	"adminUrl": "http://spacestation:3000/",
-	"redirectUris": [ "http://spacestation:3000/*" ],
-	"webOrigins": [ "http://spacestation:3000" ],
-	"clientAuthenticatorType": "client-secret",
-	"secret": "abcdef1234",
-	"defaultClientScopes": [
-		"web-origins",
-		"acr",
-		"profile",
-		"roles",
-		"id",
-		"email"
-	],
-	"optionalClientScopes": [
-		"address",
-		"phone",
-		"offline_access",
-		"microprofile-jwt"
-	]
-}
-EOF
-```
-
-
-* Create an admin user
-```
-kcadm.sh create users \
-  -o \
-  --fields id,username \
-  -r spacestation \
-  -s username=admin \
-  -s enabled=true \
-  -s 'credentials=[{"type":"password","value":"admin","temporary":false}]' \
-
-
-
-sudo docker-compose exec keycloak \
-  /opt/keycloak/bin/kcadm.sh \
-  config credentials \
-  --server http://localhost:8080/ \
-  --user admin \
-  --password admin \
-  --realm master
-```
-
-
-```
-Create a new realm:
-  $ kcadm.sh create realms -s realm=demorealm -s enabled=true
-
-Create a new realm role in realm 'demorealm' returning newly created role:
-  $ kcadm.sh create roles -r demorealm -s name=manage-all -o
-
-Create a new user in realm 'demorealm' returning only 'id', and 'username' attributes:
-  $ kcadm.sh create users -r demorealm -s username=testuser -s enabled=true -o --fields id,username
-
-Create a new client using configuration read from standard input:
-  $ kcadm.sh create clients -r demorealm  -f - << EOF
-  {
-    "clientId": "my_client"
-  }
-  EOF
-
-Create a new group using configuration JSON passed as 'body' argument:
-  $ kcadm.sh create groups -r demorealm -b '{ "name": "Admins" }'
-
-Create a client using file as a template, and override some attributes - return an 'id' of new client:
-  $ kcadm.sh create clients -r demorealm -f my_client.json -s clientId=my_client2 -s 'redirectUris=["http://localhost:8980/myapp/*"]' -i
-
-Create a new client role for client my_client in realm 'demorealm' (replace ID with output of previous example command):
-  $ kcadm.sh create clients/ID/roles -r demorealm -s name=client_role
-
-
-Use 'kcadm.sh help' for general information and a list of commands
-
-```

keycloak/setup

@@ -6,10 +6,29 @@ DIRNAME="$(dirname $0)"
 cd "$DIRNAME"
 source ../env.production
 source ./env.production
-source ./env.secrets
+
+if [ -r "./env.secrets" ]; then
+	docker-compose up -d || die "keycloak: unable to start container"
+	exit 0
+fi
+
+docker-compose down 2>/dev/null
+
+KEYCLOAK_ADMIN_PASSWORD="$(openssl rand -hex 8)"
+echo "Keycloak admin password $KEYCLOAK_ADMIN_PASSWORD"
+
+cat <<EOF > env.secrets
+# DO NOT CHECK IN
+KEYCLOAK_ADMIN_PASSWORD=$KEYCLOAK_ADMIN_PASSWORD
+EOF
+
+docker-compose up -d || die "unable to start keycloak"
+echo "sleeping a minute while keycloak initializes..." 
+sleep 30
+
 
 info "logging into server"
-sudo docker-compose exec keycloak \
+docker-compose exec keycloak \
   /opt/keycloak/bin/kcadm.sh \
   config credentials \
   --server http://localhost:8080/ \
@@ -20,7 +39,7 @@ sudo docker-compose exec keycloak \
 
 
 info "Create a new realm for '$REALM'"
-sudo docker-compose exec keycloak \
+docker-compose exec keycloak \
   /opt/keycloak/bin/kcadm.sh \
   create realms \
   -s "realm=$REALM" \
@@ -30,7 +49,7 @@ sudo docker-compose exec keycloak \
 
 # https://github.com/hedgedoc/hedgedoc/issues/56
 info "Fix up a id bug"
-sudo docker-compose exec -T keycloak \
+docker-compose exec -T keycloak \
   /opt/keycloak/bin/kcadm.sh \
   create client-scopes \
   -r "$REALM" \
@@ -62,7 +81,7 @@ EOF
 
 
 info "Create an admin user in realm"
-sudo docker-compose exec -T keycloak \
+docker-compose exec -T keycloak \
   /opt/keycloak/bin/kcadm.sh \
   create users \
   -o \

mastodon/README.md

@@ -1,16 +1,4 @@
-This needs setup run *first* and then `docker-compose up`
+# Mastodon
 
----
+This is the vanilla version with Elastic Search and Single-Sign-On enabled.
-
+No other user accounts are allowed to join.
-
-Notes from https://gist.github.com/TrillCyborg/84939cd4013ace9960031b803a0590c4
-
-elastic search needs hacks to set permissions on data directory
-
-there's an interactive setup stage?
-
-need to preconfigure with hostname, email, etc
-
-VAPID key stuff?
-
-rails db:setup

mastodon/setup

@@ -10,27 +10,17 @@ source ./env.production
 mkdir -p data/system
 chmod 777 data/system
 
-rm -f env.secrets
+if [ -r "./env.secrets" ]; then
-cat > env.secrets << EOF
+	docker-compose up -d || die "unable to restart mastodon"
-# Fake file to make db:setup happy
+	exit 0
-SECRET_KEY_BASE=000000
+fi
-OTP_SECRET=000000
-OIDC_CLIENT_SECRET=000000
-EOF
 
 # have to bring it all down before we touch the files
 docker-compose down
 
-if [ -z "$MASTODON_SKIP_DB_INIT" ]; then
-	info "configuring mastodon"
-	sudo docker-compose run --rm mastodon \
-	  rails db:setup \
-	|| die "unable to login"
-fi
-
 OIDC_CLIENT_SECRET="$(openssl rand -hex 32)"
 
-# now create the real secrets file,
+# create the secrets file,
 # along with some parameters that should be in the environment
 cat <<EOF > env.secrets
 # DO NOT CHECK IN
@@ -43,12 +33,20 @@ SECRET_KEY_BASE=$(openssl rand -hex 32)
 OTP_SECRET=$(openssl rand -hex 32)
 EOF
 
+info "mastodon: creating push keys"
 docker-compose run --rm mastodon \
-  rails mastodon:webpush:generate_vapid_key \
+	rails mastodon:webpush:generate_vapid_key \
-  >> env.secrets \
+	>> env.secrets \
 || die "unable to generate vapid key"
 
+info "mastodon: setting up database"
+docker-compose run --rm mastodon \
+	rails db:setup \
+|| die "unable to login"
+
+source ./env.secrets
 
+info "mastodon: creating keycloak interface"
 ../keycloak/client-delete mastodon
 ../keycloak/client-create <<EOF || die "Unable to create keycloak client"
 {
@@ -62,4 +60,4 @@ docker-compose run --rm mastodon \
 }
 EOF
 
-docker-compose up -d
+docker-compose up -d || die "mastodon: unable to start container"

matrix/setup

@@ -27,7 +27,6 @@ docker run -it --rm \
 || die "unable to generate synapse config"
 
 MATRIX_CLIENT_SECRET="$(openssl rand -hex 20)"
-#MATRIX_CLIENT_SECRET="abcdef1234"
 
 cat <<EOF >> "$HOMESERVER_YAML"
 web_client_location: https://${MATRIX_HOSTNAME}/

nextcloud/setup

@@ -6,20 +6,23 @@ cd "$DIRNAME"
 source ../env.production || die "no top level env?"
 source env.production || die "no local env?"
 
-if [ ! -r "env.secrets" ]; then
+if [ -r "./env.secrets" ]; then
-	NEXTCLOUD_CLIENT_SECRET="$(openssl rand -hex 32)"
+	docker-compose up -d || die "nextcloud: unable to start"
-	NEXTCLOUD_ADMIN_PASSWORD="$(openssl rand -hex 4)"
+	exit 0
+fi
+
+docker-compose down 2>/dev/null
+
+NEXTCLOUD_CLIENT_SECRET="$(openssl rand -hex 32)"
+NEXTCLOUD_ADMIN_PASSWORD="$(openssl rand -hex 6)"
 
-	echo "Generating secrets: admin password $NEXTCLOUD_ADMIN_PASSWORD"
+echo "Generating secrets: admin password $NEXTCLOUD_ADMIN_PASSWORD"
-	cat <<EOF > env.secrets
+cat <<EOF > env.secrets
 # Do not check in!
 NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_ADMIN_PASSWORD
 NEXTCLOUD_TRUSTED_DOMAINS=$NEXTCLOUD_HOSTNAME
 NEXTCLOUD_CLIENT_SECRET=$NEXTCLOUD_CLIENT_SECRET
 EOF
-else
-	source env.secrets || die "no secret env?"
-fi
 
 BASE="https://$KEYCLOAK_HOSTNAME/realms/$REALM/protocol/openid-connect"
 PROVIDER="$(jq -c . <<EOF
@@ -50,14 +53,13 @@ docker-compose up -d || die "unable to bring up docker"
 
 # wait for the nextcloud instance to be responsive
 # TODO: how to find out if it is ready?
-echo "SLEEPING..."
+echo "Sleeping a minute while nextcloud installs"
-sleep 30
+sleep 60
-
 
 
 docker-compose exec -u www-data -T nextcloud bash -x <<EOF || die "unable to configure sociallogin"
-./occ app:remove sociallogin || echo "not yet installed"
+./occ app:install calendar
-./occ app:install sociallogin || exit 1
+./occ app:install sociallogin
 ./occ config:app:set sociallogin prevent_create_email_exists --value=1 || exit 1
 ./occ config:app:set sociallogin update_profile_on_login --value=1 || exit 1
 ./occ config:app:set sociallogin custom_providers --value='$PROVIDER' || exit 1

stop-all

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+for file in */docker-compose.yaml ; do
+	dir="$(dirname "$file")"
+	echo "$dir"
+	( cd "$dir" ; docker-compose down )
+done