refactor: drop web installer in favor of setup via cli
This makes the installation a bit more secure by ensuring a user does not accidentally expose a way for unauthorized users to add new ssh keys to the system. Additionally, this removes the extra HOSTNAME file to make the initial install process easier (that file was not modifiable by any dokku commands. Closes #2247
This commit is contained in:
8
debian/config
vendored
8
debian/config
vendored
@@ -10,14 +10,6 @@ fi
|
||||
readonly ACTION="${1:-configure}"
|
||||
readonly VERSION="${2:-dev}"
|
||||
|
||||
db_input "high" "dokku/web_config" || true
|
||||
db_go || true
|
||||
|
||||
db_get "dokku/web_config"
|
||||
if [ $RET = "true" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
db_input "high" "dokku/nginx_enable" || true
|
||||
db_input "high" "dokku/hostname" || true
|
||||
db_input "high" "dokku/vhost_enable" || true
|
||||
|
||||
3
debian/lintian-overrides
vendored
3
debian/lintian-overrides
vendored
@@ -10,6 +10,3 @@ dokku: hardening-no-relro
|
||||
|
||||
# Built golang binaries link to libc
|
||||
dokku: missing-dependency-on-libc
|
||||
|
||||
# Temporary python dependency until #2247 is resolved
|
||||
dokku: python-script-but-no-python-dep usr/share/dokku/contrib/dokku-installer.py
|
||||
|
||||
37
debian/postinst
vendored
37
debian/postinst
vendored
@@ -102,40 +102,7 @@ setup-sshcommand() {
|
||||
fi
|
||||
}
|
||||
|
||||
setup-dokku-installer() {
|
||||
NGINX_ROOT="/etc/nginx"
|
||||
[[ -x /usr/bin/openresty ]] && NGINX_ROOT="/usr/local/openresty/nginx/conf"
|
||||
|
||||
if command -v "python3" &>/dev/null; then
|
||||
sed -i '1 s/^.*$/#!\/usr\/bin\/env python3/' /usr/share/dokku/contrib/dokku-installer.py
|
||||
elif command -v "python2.7" &>/dev/null; then
|
||||
sed -i '1 s/^.*$/#!\/usr\/bin\/env python2.7/' /usr/share/dokku/contrib/dokku-installer.py
|
||||
fi
|
||||
|
||||
if [[ -f "$NGINX_ROOT/conf.d/dokku-installer.conf" ]]; then
|
||||
echo "Setting up dokku-installer"
|
||||
/usr/share/dokku/contrib/dokku-installer.py onboot
|
||||
|
||||
if command -v systemctl &>/dev/null; then
|
||||
echo "Enabling dokku-installer"
|
||||
systemctl enable dokku-installer
|
||||
fi
|
||||
|
||||
installer_status="$(service dokku-installer status 2>/dev/null || true)"
|
||||
if echo $installer_status | grep -Eq "(inactive|waiting)" >/dev/null; then
|
||||
echo "Starting dokku-installer"
|
||||
service dokku-installer start || echo "Unable to start dokku-installer"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
dpkg-handling() {
|
||||
db_get "dokku/web_config"
|
||||
if [ "$RET" = "true" ]; then
|
||||
db_stop
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f "${DOKKU_ROOT}/VHOST" ]; then
|
||||
echo "VHOST file detected, skipping modification"
|
||||
else
|
||||
@@ -147,9 +114,6 @@ dpkg-handling() {
|
||||
fi
|
||||
fi
|
||||
|
||||
db_get "dokku/hostname"
|
||||
echo "$RET" >"${DOKKU_ROOT}/HOSTNAME"
|
||||
|
||||
if [ -z "${DEBCONF_RECONFIGURE}" ]; then
|
||||
db_get "dokku/key_file"
|
||||
if [ -f "$RET" ]; then
|
||||
@@ -173,7 +137,6 @@ case "$1" in
|
||||
setup-storage
|
||||
setup-plugins
|
||||
setup-sshcommand
|
||||
setup-dokku-installer
|
||||
dpkg-handling
|
||||
;;
|
||||
|
||||
|
||||
47
debian/preinst
vendored
47
debian/preinst
vendored
@@ -7,55 +7,8 @@ if [[ -e /usr/share/debconf/confmodule ]]; then
|
||||
. /usr/share/debconf/confmodule
|
||||
fi
|
||||
|
||||
setup_dokku_installer() {
|
||||
NGINX_BASE_PATH="$1"
|
||||
NGINX_INIT_NAME="$2"
|
||||
|
||||
NGINX_CONF="${NGINX_BASE_PATH}/conf.d/dokku-installer.conf"
|
||||
|
||||
rm -f $NGINX_CONF
|
||||
touch $NGINX_CONF
|
||||
|
||||
{
|
||||
echo 'upstream dokku-installer { server 127.0.0.1:2000; }'
|
||||
echo 'server {'
|
||||
echo ' listen 80;'
|
||||
echo ' location / {'
|
||||
echo ' proxy_pass http://dokku-installer;'
|
||||
echo ' }'
|
||||
echo '}'
|
||||
} >>$NGINX_CONF
|
||||
|
||||
rm -f $NGINX_BASE_PATH/sites-enabled/*
|
||||
DOKKU_DISTRO="$(
|
||||
. /etc/os-release >/dev/null 2>&1 || true
|
||||
echo "$ID"
|
||||
)"
|
||||
case "$DOKKU_DISTRO" in
|
||||
debian)
|
||||
/usr/sbin/invoke-rc.d "$NGINX_INIT_NAME" reload || /usr/sbin/invoke-rc.d "$NGINX_INIT_NAME" start
|
||||
;;
|
||||
ubuntu)
|
||||
if [[ -x /usr/bin/sv ]]; then
|
||||
/usr/bin/sv reload "$NGINX_INIT_NAME" || /usr/bin/sv start "$NGINX_INIT_NAME"
|
||||
else
|
||||
"/etc/init.d/$NGINX_INIT_NAME" reload || "/etc/init.d/$NGINX_INIT_NAME" start
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
install)
|
||||
db_get "dokku/web_config"
|
||||
if [ "$RET" = "true" ]; then
|
||||
if [[ -x /usr/bin/openresty ]]; then
|
||||
setup_dokku_installer "/usr/local/openresty/nginx/conf" "openresty"
|
||||
else
|
||||
setup_dokku_installer "/etc/nginx" "nginx"
|
||||
fi
|
||||
fi
|
||||
|
||||
db_get "dokku/skip_key_file"
|
||||
if [ -z "${DEBCONF_RECONFIGURE}" ] && [ "$RET" != "true" ]; then
|
||||
db_get "dokku/key_file"
|
||||
|
||||
5
debian/templates
vendored
5
debian/templates
vendored
@@ -1,8 +1,3 @@
|
||||
Template: dokku/web_config
|
||||
Description: Enable the web-based config page?
|
||||
Type: boolean
|
||||
Default: true
|
||||
|
||||
Template: dokku/vhost_enable
|
||||
Description: Enable vhost-based deployments?
|
||||
Type: boolean
|
||||
|
||||
Reference in New Issue
Block a user