github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

refactor: drop web installer in favor of setup via cli

Browse Source 
This makes the installation a bit more secure by ensuring a user does not accidentally expose a way for unauthorized users to add new ssh keys to the system.

Additionally, this removes the extra HOSTNAME file to make the initial install process easier (that file was not modifiable by any dokku commands.

Closes #2247
This commit is contained in:
Jose Diaz-Gonzalez
2021-08-06 17:48:39 -04:00
parent 857850b4c6
commit a1c768b9b3
42 changed files with 154 additions and 702 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/appendices/0.25.0-migration-guide.md
View File

@@ -30,3 +30,4 @@ The [dokku-registry](https://github.com/dokku/dokku-registry) plugin is now buil
## Removals
- As of April 2021, Ubuntu 16.04 is no longer an LTS release, and support has been removed. Packages may still install on older versions of Ubuntu, but are no longer tested, and therefore no support will be provided.
- The web installer has been removed. Users are now required to setup Dokku via cli commands. This change was made to combat potential security issues where users ignored the web installer, allowing unauthorized users to add their keys to the host.

2
docs/deployment/user-management.md
View File

@@ -18,7 +18,7 @@ Users in Dokku are managed via the `~/dokku/.ssh/authorized_keys` file. It is *h
### Listing SSH keys
You can use the `ssh-keys:list` command to show all configured SSH keys. Any key added via the `dokku-installer` will be associated with the `admin` key name.
You can use the `ssh-keys:list` command to show all configured SSH keys.
```shell
dokku ssh-keys:list

6
docs/development/plugin-triggers.md
View File

@@ -799,8 +799,8 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
if [[ ! -f "$DOKKU_ROOT/HOSTNAME" ]]; then
hostname -f > $DOKKU_ROOT/HOSTNAME
if [[ ! -f "$DOKKU_ROOT/VHOST" ]]; then
hostname -f > $DOKKU_ROOT/VHOST
fi
```
@@ -2375,7 +2375,7 @@ Note that the trigger should exit as follows:
The `SSH_USER` is the original ssh user. If you are running remote commands, this user will typically be `dokku`, and as such should not be trusted when checking permissions. If you are connected via ssh as a different user who then invokes `dokku`, the value of this variable will be that user's name (`root`, `myuser`, etc.).
The `SSH_NAME` is the `NAME` variable set via the `sshcommand acl-add` command. If you have set a user via the `dokku-installer`, this value will be set to `admin`. For installs via debian package, this value _may_ be `default`. For reference, the following command can be run as the root user to specify a specific `NAME` for a given ssh key:
The `SSH_NAME` is the `NAME` variable set via the `sshcommand acl-add` command. For reference, the following command can be run as the root user to specify a specific `NAME` for a given ssh key:
```shell
sshcommand acl-add dokku NAME < $PATH_TO_SSH_KEY

4
docs/getting-started/advanced-installation.md
View File

@@ -50,12 +50,10 @@ The Herokuish package is recommended but not required if not using Heroku buildp
## Configuring an unattended installation
Once Dokku is installed, if you are not using the web-installer, you'll want to configure the virtualhost setup as well as the push user. If you do not, your installation will be considered incomplete and you will not be able to deploy applications.
Once Dokku is installed, you'll want to configure the virtualhost setup as well as the push user. If you do not, your installation will be considered incomplete and you will not be able to deploy applications.
For Debian, unattended installation is described [Debian installation guide](/docs/getting-started/install/debian.md).
> Warning: You should also stop and disable the `dokku-installer` service to remove public access to adding SSH keys.
Set up a domain using your preferred vendor and a wildcard domain pointing to the host running Dokku. You can manage this global domain using the [domains plugin](/docs/configuration/domains.md).
Follow the [user management documentation](/docs/deployment/user-management.md) in order to add SSH keys for users to Dokku, or to give other Unix accounts access to Dokku.

1
docs/getting-started/install/debian.md
View File

@@ -36,7 +36,6 @@ After setting the desired options, proceed with the installation as described ab
| Name | Type | Default | Description |
| ------------------ | ------- | --------------------- | ------------------------------------------------------------------------ |
| dokku/web_config | boolean | true | Use web-based config for below options |
| dokku/vhost_enable | boolean | false | Use vhost-based deployments (e.g. `[yourapp].dokku.me`) |
| dokku/hostname | string | dokku.me | Hostname, used as vhost domain and for showing app URL after deploy |
| dokku/skip_key_file| boolean | false | Don't check for the existence of the dokku/key_file. Warning: Setting this to true, will require you to manually add an SSH key later on. |

1
docs/getting-started/install/docker.md
View File

@@ -29,7 +29,6 @@ Dokku is run in the following configuration:
- Container HTTPS port 443 is exposed on the host as 8443.
- Data within the container is stored on the host within the `/var/lib/dokku` directory.
- The docker socket is mounted into container
- The "web installer" is not supported.
Application repositories, plugin config, as well as plugin data are persisted to disk within the specified host directory for `/var/lib/dokku`.

1
docs/getting-started/install/dreamhost.md
View File

@@ -180,7 +180,6 @@ apt:
-----END PGP PUBLIC KEY BLOCK-----
debconf_selections:
web: dokku dokku/web_config boolean false
vhost: dokku dokku/vhost_enable boolean true
# set the domain name of the new Dokku server
hostname: dokku dokku/hostname string $YOUR_FULL_QUALIFIED_DOMAIN

12
docs/getting-started/install/vagrant.md
View File

@@ -38,8 +38,16 @@
> For users that have customized the IP address of their VM - either in a custom `Vagrantfile` or via the `DOKKU_IP` environment variable - and are not using `10.0.0.2` for the Vagrant IP, you'll need to instead use the output of `vagrant ssh-config dokku` for your `~/.ssh/config` entry.
6. Copy your SSH key via `cat ~/.ssh/id_rsa.pub | pbcopy` and paste it into the dokku-installer at http://dokku.me . Change the `Hostname` field on the Dokku Setup screen to your domain and then check the box that says **Use virtualhost naming**. Then click **Finish Setup** to install your key. You'll be directed to application deployment instructions from here.
6. Connect to the server and add your ssh key to the install. Additionally, set the global domain name to `dokku.me`.
Please note, the `dokku.me` domain is setup to point to `10.0.0.2` along with all subdomains (i.e. `yourapp.dokku.me`). If you change the `DOKKU_IP` in your Vagrant setup you'll need to update your `/etc/hosts` file to point your reconfigured IP address.
```shell
# usually your key is already available under the current user's `~/.ssh/authorized_keys` file
cat ~/.ssh/authorized_keys | dokku ssh-keys:add admin
# you can use any domain you already have access to
dokku domains:set-global dokku.me
```
> Please note, the `dokku.me` domain is setup to point to `10.0.0.2` along with all subdomains (i.e. `yourapp.dokku.me`). If you change the `DOKKU_IP` in your Vagrant setup you'll need to update your `/etc/hosts` file to point your reconfigured IP address.
You are now ready to deploy an app or install plugins.

16
docs/getting-started/installation.md
View File

@@ -35,17 +35,23 @@ When connecting a domain, either a single domain or a wildcard may be associated
#### 3. Setup SSH key and Virtualhost Settings
Once the installation is complete, you can open a browser to setup your SSH key and virtualhost settings. Open your browser of choice and navigate to the host's IP address - or the domain you assigned to that IP previously - and configure Dokku via the web admin.
Once the installation is complete, you should configure an ssh key and set your global domain:from-archive
Alternatively, instructions to skip the web installer with an unattended installation are available in the [advanced install guide](/docs/getting-started/advanced-installation.md#configuring).
```shell
# usually your key is already available under the current user's `~/.ssh/authorized_keys` file
cat ~/.ssh/authorized_keys | dokku ssh-keys:add admin
> **Warning:** If you don't complete setup via the web installer (even if you set up SSH keys and virtual hosts otherwise) your Dokku installation will remain vulnerable to anyone finding the setup page and inserting their key. You can check if it is still running via `ps auxf | grep dokku-installer`, and it may be stopped via your server's init system - usually either `service dokku-installer stop` or `stop dokku-installer`.
# you can use any domain you already have access to
dokku domains:set-global dokku.me
```
> **Warning:** Web installer is not available on CentOS and Arch Linux. You will need to configure [SSH keys](/docs/deployment/user-management.md#adding-ssh-keys) and [virtual hosts](/docs/configuration/domains.md#customizing-hostnames) using dokku command line interface - see unattended installation linked above.
See the [user management](/docs/deployment/user-management.md#adding-ssh-keys) and [domains documentation](/docs/configuration/domains.md#customizing-hostnames) for more information.
Alternatively, instructions for an unattended installation are available in the [advanced install guide](/docs/getting-started/advanced-installation.md#configuring).
#### 4. Deploy your first application
Once you save your settings, the web admin will self-terminate and you should be able to run or [deploy to the Dokku installation](/docs/deployment/application-deployment.md).
At this point, you should be able to run or [deploy to the Dokku installation](/docs/deployment/application-deployment.md).
### Installing via other methods