refactor: drop web installer in favor of setup via cli

This makes the installation a bit more secure by ensuring a user does not accidentally expose a way for unauthorized users to add new ssh keys to the system.

Additionally, this removes the extra HOSTNAME file to make the initial install process easier (that file was not modifiable by any dokku commands.

Closes #2247
This commit is contained in:
Jose Diaz-Gonzalez
2021-08-06 17:48:39 -04:00
parent 857850b4c6
commit a1c768b9b3
42 changed files with 154 additions and 702 deletions

8
debian/config vendored
View File

@@ -10,14 +10,6 @@ fi
readonly ACTION="${1:-configure}"
readonly VERSION="${2:-dev}"
db_input "high" "dokku/web_config" || true
db_go || true
db_get "dokku/web_config"
if [ $RET = "true" ]; then
exit 0
fi
db_input "high" "dokku/nginx_enable" || true
db_input "high" "dokku/hostname" || true
db_input "high" "dokku/vhost_enable" || true

View File

@@ -10,6 +10,3 @@ dokku: hardening-no-relro
# Built golang binaries link to libc
dokku: missing-dependency-on-libc
# Temporary python dependency until #2247 is resolved
dokku: python-script-but-no-python-dep usr/share/dokku/contrib/dokku-installer.py

37
debian/postinst vendored
View File

@@ -102,40 +102,7 @@ setup-sshcommand() {
fi
}
setup-dokku-installer() {
NGINX_ROOT="/etc/nginx"
[[ -x /usr/bin/openresty ]] && NGINX_ROOT="/usr/local/openresty/nginx/conf"
if command -v "python3" &>/dev/null; then
sed -i '1 s/^.*$/#!\/usr\/bin\/env python3/' /usr/share/dokku/contrib/dokku-installer.py
elif command -v "python2.7" &>/dev/null; then
sed -i '1 s/^.*$/#!\/usr\/bin\/env python2.7/' /usr/share/dokku/contrib/dokku-installer.py
fi
if [[ -f "$NGINX_ROOT/conf.d/dokku-installer.conf" ]]; then
echo "Setting up dokku-installer"
/usr/share/dokku/contrib/dokku-installer.py onboot
if command -v systemctl &>/dev/null; then
echo "Enabling dokku-installer"
systemctl enable dokku-installer
fi
installer_status="$(service dokku-installer status 2>/dev/null || true)"
if echo $installer_status | grep -Eq "(inactive|waiting)" >/dev/null; then
echo "Starting dokku-installer"
service dokku-installer start || echo "Unable to start dokku-installer"
fi
fi
}
dpkg-handling() {
db_get "dokku/web_config"
if [ "$RET" = "true" ]; then
db_stop
exit 0
fi
if [ -f "${DOKKU_ROOT}/VHOST" ]; then
echo "VHOST file detected, skipping modification"
else
@@ -147,9 +114,6 @@ dpkg-handling() {
fi
fi
db_get "dokku/hostname"
echo "$RET" >"${DOKKU_ROOT}/HOSTNAME"
if [ -z "${DEBCONF_RECONFIGURE}" ]; then
db_get "dokku/key_file"
if [ -f "$RET" ]; then
@@ -173,7 +137,6 @@ case "$1" in
setup-storage
setup-plugins
setup-sshcommand
setup-dokku-installer
dpkg-handling
;;

47
debian/preinst vendored
View File

@@ -7,55 +7,8 @@ if [[ -e /usr/share/debconf/confmodule ]]; then
. /usr/share/debconf/confmodule
fi
setup_dokku_installer() {
NGINX_BASE_PATH="$1"
NGINX_INIT_NAME="$2"
NGINX_CONF="${NGINX_BASE_PATH}/conf.d/dokku-installer.conf"
rm -f $NGINX_CONF
touch $NGINX_CONF
{
echo 'upstream dokku-installer { server 127.0.0.1:2000; }'
echo 'server {'
echo ' listen 80;'
echo ' location / {'
echo ' proxy_pass http://dokku-installer;'
echo ' }'
echo '}'
} >>$NGINX_CONF
rm -f $NGINX_BASE_PATH/sites-enabled/*
DOKKU_DISTRO="$(
. /etc/os-release >/dev/null 2>&1 || true
echo "$ID"
)"
case "$DOKKU_DISTRO" in
debian)
/usr/sbin/invoke-rc.d "$NGINX_INIT_NAME" reload || /usr/sbin/invoke-rc.d "$NGINX_INIT_NAME" start
;;
ubuntu)
if [[ -x /usr/bin/sv ]]; then
/usr/bin/sv reload "$NGINX_INIT_NAME" || /usr/bin/sv start "$NGINX_INIT_NAME"
else
"/etc/init.d/$NGINX_INIT_NAME" reload || "/etc/init.d/$NGINX_INIT_NAME" start
fi
;;
esac
}
case "$1" in
install)
db_get "dokku/web_config"
if [ "$RET" = "true" ]; then
if [[ -x /usr/bin/openresty ]]; then
setup_dokku_installer "/usr/local/openresty/nginx/conf" "openresty"
else
setup_dokku_installer "/etc/nginx" "nginx"
fi
fi
db_get "dokku/skip_key_file"
if [ -z "${DEBCONF_RECONFIGURE}" ] && [ "$RET" != "true" ]; then
db_get "dokku/key_file"

5
debian/templates vendored
View File

@@ -1,8 +1,3 @@
Template: dokku/web_config
Description: Enable the web-based config page?
Type: boolean
Default: true
Template: dokku/vhost_enable
Description: Enable vhost-based deployments?
Type: boolean