Compare commits
14 Commits
f9bf59aa56
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
| bc301d6b29 | |||
| 9f89356c85 | |||
| 2721249a89 | |||
| a64247de4e | |||
| 420a7756af | |||
| 1a0252de1a | |||
| d74e913023 | |||
| 7ffbe713e9 | |||
| 1a60f94b13 | |||
| 8173b798a8 | |||
| b492ff208f | |||
| 321578a74a | |||
| 7236c8854d | |||
| 7ee27178f9 |
8
Makefile
8
Makefile
@@ -19,6 +19,12 @@ TERRAFORM_ENV := production
|
|||||||
config_dir := ./config/
|
config_dir := ./config/
|
||||||
apps_config := $(config_dir)apps.config
|
apps_config := $(config_dir)apps.config
|
||||||
|
|
||||||
|
BUTANE := butane -d ${PWD}
|
||||||
|
|
||||||
|
ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes)
|
||||||
|
BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd
|
||||||
|
endif
|
||||||
|
|
||||||
IMAGE_DEPS :=
|
IMAGE_DEPS :=
|
||||||
|
|
||||||
COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
|
COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
|
||||||
@@ -84,7 +90,7 @@ restic-scheduled-snapshot.sh \
|
|||||||
app/.env \
|
app/.env \
|
||||||
$(config_dir)ssh-keys \
|
$(config_dir)ssh-keys \
|
||||||
app.tar.gz
|
app.tar.gz
|
||||||
cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
|
cat cl.yaml | $(BUTANE) > ignition.json
|
||||||
|
|
||||||
generated.tfvars: $(apps_config) make-generated.sh
|
generated.tfvars: $(apps_config) make-generated.sh
|
||||||
./make-generated.sh $(apps_config) > generated.tfvars
|
./make-generated.sh $(apps_config) > generated.tfvars
|
||||||
|
|||||||
@@ -24,6 +24,8 @@ app/nassella/lldap_postgres_password \
|
|||||||
app/nassella/authelia_postgres_db \
|
app/nassella/authelia_postgres_db \
|
||||||
app/nassella/authelia_postgres_user \
|
app/nassella/authelia_postgres_user \
|
||||||
app/nassella/authelia_postgres_password \
|
app/nassella/authelia_postgres_password \
|
||||||
|
app/nassella/lldap_admin_password \
|
||||||
|
app/nassella/stripe_api_key \
|
||||||
app/nassella/nassella.env \
|
app/nassella/nassella.env \
|
||||||
app/nassella/authelia-config/configuration.yml \
|
app/nassella/authelia-config/configuration.yml \
|
||||||
app/nassella/lldap-config/lldap_config.toml
|
app/nassella/lldap-config/lldap_config.toml
|
||||||
|
|||||||
2
cl.yaml
2
cl.yaml
@@ -20,7 +20,7 @@ passwd:
|
|||||||
users:
|
users:
|
||||||
- name: core
|
- name: core
|
||||||
ssh_authorized_keys_local:
|
ssh_authorized_keys_local:
|
||||||
- /ssh-keys
|
- config/ssh-keys
|
||||||
- name: nextcloud
|
- name: nextcloud
|
||||||
uid: 1001
|
uid: 1001
|
||||||
systemd:
|
systemd:
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ if [ $? -ne 0 ]; then
|
|||||||
|
|
||||||
if [ $status -eq 10 ]; then
|
if [ $status -eq 10 ]; then
|
||||||
# restic repo is not initialized so initialize it
|
# restic repo is not initialized so initialize it
|
||||||
AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
|
AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
|
||||||
init_status=$?
|
init_status=$?
|
||||||
elif [ $status -ne 0 ]; then
|
elif [ $status -ne 0 ]; then
|
||||||
# something unexpected happened, exit
|
# something unexpected happened, exit
|
||||||
|
|||||||
@@ -31,8 +31,8 @@ set -e
|
|||||||
|
|
||||||
. $1 # source the apps.config file with then env vars
|
. $1 # source the apps.config file with then env vars
|
||||||
|
|
||||||
host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
|
# host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
|
||||||
|
host_admin_password_encoded="password" # unused
|
||||||
|
|
||||||
read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
|
read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
|
||||||
APP_CONFIGS+=('lb,root')
|
APP_CONFIGS+=('lb,root')
|
||||||
|
|||||||
@@ -30,7 +30,7 @@ RUN chicken-install srfi-1 srfi-13 srfi-18 srfi-19 srfi-158 srfi-194 \
|
|||||||
sxml-transforms schematra \
|
sxml-transforms schematra \
|
||||||
uri-common http-client medea intarweb \
|
uri-common http-client medea intarweb \
|
||||||
sql-null openssl postgresql crypto-tools \
|
sql-null openssl postgresql crypto-tools \
|
||||||
hmac sha2 string-utils
|
hmac sha2 string-utils base64
|
||||||
|
|
||||||
WORKDIR /var
|
WORKDIR /var
|
||||||
RUN mkdir nassella
|
RUN mkdir nassella
|
||||||
@@ -43,10 +43,17 @@ COPY run.scm run.scm
|
|||||||
RUN csc -O3 -o nassella-run run.scm
|
RUN csc -O3 -o nassella-run run.scm
|
||||||
RUN chmod +x nassella-run
|
RUN chmod +x nassella-run
|
||||||
|
|
||||||
|
FROM quay.io/coreos/butane:release AS butane
|
||||||
|
FROM hashicorp/terraform:1.15 AS terraform
|
||||||
|
|
||||||
FROM debian:trixie-slim
|
FROM debian:trixie-slim
|
||||||
RUN apt-get update && apt-get -y --no-install-recommends install \
|
RUN apt-get update && apt-get -y --no-install-recommends install \
|
||||||
libpq-dev ca-certificates gettext-base openssh-client restic \
|
libpq-dev ca-certificates gettext-base openssh-client restic make \
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
COPY --from=butane /usr/local/bin/butane /usr/local/bin/butane
|
||||||
|
COPY --from=terraform /bin/terraform /usr/local/bin/terraform
|
||||||
|
|
||||||
COPY --from=buildeggs /usr/local/ /usr/local/
|
COPY --from=buildeggs /usr/local/ /usr/local/
|
||||||
|
|
||||||
WORKDIR /var
|
WORKDIR /var
|
||||||
|
|||||||
@@ -45,7 +45,9 @@ create table user_service_configs(
|
|||||||
digitalocean_volume_size integer,
|
digitalocean_volume_size integer,
|
||||||
backblaze_application_key_enc varchar(255),
|
backblaze_application_key_enc varchar(255),
|
||||||
backblaze_key_id_enc varchar(255),
|
backblaze_key_id_enc varchar(255),
|
||||||
backblaze_bucket_url_enc varchar(255)
|
backblaze_bucket_url_enc varchar(255), -- deprecated 072526, replaced by bucket_name and bucket_id
|
||||||
|
backblaze_bucket_name_enc varchar(255),
|
||||||
|
backblaze_bucket_id_enc varchar(255)
|
||||||
);
|
);
|
||||||
create unique index user_service_configs_user_id_instance_id_idx on user_service_configs (user_id, instance_id);
|
create unique index user_service_configs_user_id_instance_id_idx on user_service_configs (user_id, instance_id);
|
||||||
|
|
||||||
@@ -62,6 +64,8 @@ insert into apps(app_name) values ('log-viewer');
|
|||||||
insert into apps(app_name) values ('ghost');
|
insert into apps(app_name) values ('ghost');
|
||||||
insert into apps(app_name) values ('instance-control');
|
insert into apps(app_name) values ('instance-control');
|
||||||
insert into apps(app_name) values ('wordpress');
|
insert into apps(app_name) values ('wordpress');
|
||||||
|
insert into apps(app_name) values ('lldap');
|
||||||
|
insert into apps(app_name) values ('authelia');
|
||||||
|
|
||||||
create table user_selected_apps(
|
create table user_selected_apps(
|
||||||
id bigserial primary key,
|
id bigserial primary key,
|
||||||
@@ -89,7 +93,7 @@ create table user_app_configs(
|
|||||||
create unique index user_app_configs_user_id_instance_id_idx on user_app_configs (user_id, instance_id);
|
create unique index user_app_configs_user_id_instance_id_idx on user_app_configs (user_id, instance_id);
|
||||||
|
|
||||||
|
|
||||||
create type deployment_status as enum ('queued', 'in-progress', 'complete', 'failed');
|
create type deployment_status as enum ('ignored', 'queued', 'in-progress', 'complete', 'failed');
|
||||||
|
|
||||||
create table deployments(
|
create table deployments(
|
||||||
id bigserial primary key,
|
id bigserial primary key,
|
||||||
|
|||||||
86
src/db.scm
86
src/db.scm
@@ -197,7 +197,6 @@ returning users.user_id;"
|
|||||||
(user-encrypt-for-db ssh-key-pub user-key user-iv user-id)
|
(user-encrypt-for-db ssh-key-pub user-key user-iv user-id)
|
||||||
(user-encrypt-for-db restic-password user-key user-iv user-id)))))
|
(user-encrypt-for-db restic-password user-key user-iv user-id)))))
|
||||||
(query conn "insert into user_service_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
(query conn "insert into user_service_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
||||||
(query conn "insert into user_selected_apps(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
|
||||||
(query conn "insert into user_app_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
(query conn "insert into user_app_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
||||||
(query conn "insert into user_terraform_state(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
(query conn "insert into user_terraform_state(user_id, instance_id) values ($1, $2);" user-id instance-id)
|
||||||
instance-id)))
|
instance-id)))
|
||||||
@@ -249,7 +248,9 @@ returning users.user_id;"
|
|||||||
(digitalocean-volume-size . ("digitalocean_volume_size" #f))
|
(digitalocean-volume-size . ("digitalocean_volume_size" #f))
|
||||||
(backblaze-application-key . ("backblaze_application_key_enc" #t))
|
(backblaze-application-key . ("backblaze_application_key_enc" #t))
|
||||||
(backblaze-key-id . ("backblaze_key_id_enc" #t))
|
(backblaze-key-id . ("backblaze_key_id_enc" #t))
|
||||||
(backblaze-bucket-url . ("backblaze_bucket_url_enc" #t))))
|
(backblaze-bucket-url . ("backblaze_bucket_url_enc" #t))
|
||||||
|
(backblaze-bucket-name . ("backblaze_bucket_name_enc" #t))
|
||||||
|
(backblaze-bucket-id . ("backblaze_bucket_id_enc" #t))))
|
||||||
|
|
||||||
(define *user-service-configs-reverse-column-map*
|
(define *user-service-configs-reverse-column-map*
|
||||||
(map (lambda (config)
|
(map (lambda (config)
|
||||||
@@ -377,7 +378,8 @@ where usa.user_id=$1 and usa.instance_id=$2;"
|
|||||||
'((queued . "queued")
|
'((queued . "queued")
|
||||||
(in-progress . "in-progress")
|
(in-progress . "in-progress")
|
||||||
(complete . "complete")
|
(complete . "complete")
|
||||||
(failed . "failed")))
|
(failed . "failed")
|
||||||
|
(ignored . "ignored")))
|
||||||
(define (create-deployment conn user-id instance-id)
|
(define (create-deployment conn user-id instance-id)
|
||||||
(value-at
|
(value-at
|
||||||
(query conn
|
(query conn
|
||||||
@@ -516,37 +518,51 @@ where usa.user_id=$1 and usa.instance_id=$2;"
|
|||||||
"select apps.app_name, usa.installed_version, usa.instance_id from user_selected_apps usa
|
"select apps.app_name, usa.installed_version, usa.instance_id from user_selected_apps usa
|
||||||
join apps on apps.id=usa.app_id
|
join apps on apps.id=usa.app_id
|
||||||
where user_id=$1;"
|
where user_id=$1;"
|
||||||
user-id))))
|
user-id)))
|
||||||
(map
|
(undeployed-res
|
||||||
(lambda (instance)
|
(query conn
|
||||||
(cons `(apps . ,(alist-ref (alist-ref 'instance-id instance) instance-apps))
|
(string-append
|
||||||
instance))
|
"select i.instance_id from instances as i "
|
||||||
|
"left join deployments d on d.instance_id = i.instance_id "
|
||||||
|
"where i.user_id=$1 and d.status is null "
|
||||||
|
"group by d.id, i.instance_id;")
|
||||||
|
user-id)))
|
||||||
|
(append
|
||||||
(map
|
(map
|
||||||
(lambda (row-num)
|
(lambda (instance)
|
||||||
(map (lambda (item)
|
(cons `(apps . ,(alist-ref (alist-ref 'instance-id instance) instance-apps))
|
||||||
(let* ((key (car item))
|
instance))
|
||||||
(value (cdr item))
|
(map
|
||||||
(config (alist-ref key `((root_domain . root-domain)
|
(lambda (row-num)
|
||||||
(config_enc . config)
|
(cons '(deployed . #t)
|
||||||
(instance_id . instance-id)
|
(map (lambda (item)
|
||||||
;; (wg_easy_version . wg-easy)
|
(let* ((key (car item))
|
||||||
;; (nextcloud_version . nextcloud)
|
(value (cdr item))
|
||||||
;; (ghost_version . ghost)
|
(config (alist-ref key `((root_domain . root-domain)
|
||||||
;; (nassella_version . nassella)
|
(config_enc . config)
|
||||||
;; (log_viewer_version . log-viewer)
|
(instance_id . instance-id)
|
||||||
;; (instance_control_version . instance-control)
|
;; (wg_easy_version . wg-easy)
|
||||||
,@*deployments-reverse-column-map*))))
|
;; (nextcloud_version . nextcloud)
|
||||||
`(,config . ,(if (sql-null? value)
|
;; (ghost_version . ghost)
|
||||||
#f
|
;; (nassella_version . nassella)
|
||||||
(if (and (string? value) (member config *deployments-column-map*))
|
;; (log_viewer_version . log-viewer)
|
||||||
(string->symbol value)
|
;; (instance_control_version . instance-control)
|
||||||
(if (eq? key 'config_enc)
|
,@*deployments-reverse-column-map*))))
|
||||||
(with-input-from-string
|
`(,config . ,(if (sql-null? value)
|
||||||
(user-decrypt-from-db value user-key user-iv user-id)
|
#f
|
||||||
read)
|
(if (and (string? value) (member config *deployments-column-map*))
|
||||||
value))))))
|
(string->symbol value)
|
||||||
(row-alist res row-num)))
|
(if (eq? key 'config_enc)
|
||||||
(iota (row-count res)))))))
|
(with-input-from-string
|
||||||
|
(user-decrypt-from-db value user-key user-iv user-id)
|
||||||
|
read)
|
||||||
|
value))))))
|
||||||
|
(row-alist res row-num))))
|
||||||
|
(iota (row-count res))))
|
||||||
|
(map (lambda (id) `((instance-id . ,id) (deployed . #f)))
|
||||||
|
(if (> (row-count undeployed-res) 0)
|
||||||
|
(row-values undeployed-res)
|
||||||
|
'()))))))
|
||||||
|
|
||||||
(define (update-user-terraform-state conn user-id instance-id state backup)
|
(define (update-user-terraform-state conn user-id instance-id state backup)
|
||||||
(receive (user-key user-iv auth-user-id)
|
(receive (user-key user-iv auth-user-id)
|
||||||
@@ -644,7 +660,9 @@ where user_id=$1;"
|
|||||||
(4 . "fixing-app-normalization")
|
(4 . "fixing-app-normalization")
|
||||||
(5 . "adding-wordpress-app")
|
(5 . "adding-wordpress-app")
|
||||||
(6 . "adding-lldap-app")
|
(6 . "adding-lldap-app")
|
||||||
(7 . "adding-authelia-app")))
|
(7 . "adding-authelia-app")
|
||||||
|
(8 . "adding-backblaze-bucket-name-and-id")
|
||||||
|
(9 . "extend-deployment-status-add-ignored")))
|
||||||
|
|
||||||
(define (run-pending-migrations conn)
|
(define (run-pending-migrations conn)
|
||||||
(let* ((migration-ids (sort (map car *migrations*) <))
|
(let* ((migration-ids (sort (map car *migrations*) <))
|
||||||
|
|||||||
@@ -0,0 +1,2 @@
|
|||||||
|
alter table user_service_configs add backblaze_bucket_name_enc varchar(255);
|
||||||
|
alter table user_service_configs add backblaze_bucket_id_enc varchar(255);
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
alter type deployment_status add value 'ignored';
|
||||||
1328
src/nassella.scm
1328
src/nassella.scm
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user