github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

refactor: drop web installer in favor of setup via cli

Browse Source 
This makes the installation a bit more secure by ensuring a user does not accidentally expose a way for unauthorized users to add new ssh keys to the system.

Additionally, this removes the extra HOSTNAME file to make the initial install process easier (that file was not modifiable by any dokku commands.

Closes #2247
This commit is contained in:
Jose Diaz-Gonzalez
2021-08-06 17:48:39 -04:00
parent 857850b4c6
commit a1c768b9b3
42 changed files with 154 additions and 702 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
plugins/00_dokku-standard/install
View File

@@ -2,12 +2,8 @@
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
if [[ ! -f "$DOKKU_ROOT/HOSTNAME" ]]; then
hostname -f >"$DOKKU_ROOT/HOSTNAME"
fi
if [[ ! -f "$DOKKU_ROOT/VHOST" ]]; then
[[ $(dig +short "$(<"$DOKKU_ROOT/HOSTNAME")") ]] && cp "$DOKKU_ROOT/HOSTNAME" "$DOKKU_ROOT/VHOST"
[[ $(dig +short "$(hostname -f)") ]] && hostname -f >"$DOKKU_ROOT/VHOST"
fi
dokku_path="$(which dokku)"
@@ -48,21 +44,34 @@ EOF
fi
mkdir -p /etc/update-motd.d
cat <<EOF >/etc/update-motd.d/99-dokku
cat <<DOKKU_EOF >/etc/update-motd.d/99-dokku
#!/bin/sh
if [ ! -f "/home/dokku/HOSTNAME" ]; then
echo "\nTo avoid cli-based dokku configuration, use the web installer"
echo "Debian-based installs should have this running and available"
echo "on port 80. You can also install it via the following commands:"
echo ""
echo " cd /root/dokku"
echo " sudo make dokku-installer\n"
fi
EOF
chmod +x /etc/update-motd.d/99-dokku
if [ ! -s "$DOKKU_ROOT/VHOST" ]; then
cat <<'EOF'
chown dokku:dokku "$DOKKU_ROOT/HOSTNAME"
! If using virtualhost routing is desired (eg. my-app => my-app.dokku.me), set a global domain for your server:
dokku domains:set-global dokku.me
EOF
fi
if [ ! -s "$DOKKU_ROOT/.ssh/authorized_keys" ]; then
cat <<'EOF'
! Setup a user's ssh key for deployment by passing in the public ssh key as shown:
echo 'CONTENTS_OF_ID_RSA_PUB_FILE' | dokku ssh-keys:add admin
EOF
fi
if [ ! -f "$DOKKU_ROOT/VHOST" ] || [ ! -s "$DOKKU_ROOT/.ssh/authorized_keys" ]; then
cat <<'EOF'
EOF
fi
DOKKU_EOF
chmod +x /etc/update-motd.d/99-dokku
if [[ -f "$DOKKU_ROOT/VHOST" ]]; then
chown dokku:dokku "$DOKKU_ROOT/VHOST"

77
plugins/common/functions
View File

@@ -933,7 +933,6 @@ internal_get_app_urls() {
source "$PLUGIN_AVAILABLE_PATH/config/functions"
local APP="$2"
local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
local URLS_FILE="$DOKKU_ROOT/$APP/URLS"
local DOKKU_PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP || true)
@@ -969,42 +968,56 @@ internal_get_app_urls() {
;;
esac
else
local SCHEME="http"
local SSL="$DOKKU_ROOT/$APP/tls"
if [[ -e "$SSL/server.crt" && -e "$SSL/server.key" ]]; then
local SCHEME="https"
if [[ -s "$DOKKU_ROOT/VHOST" ]]; then
while read -r VHOST || [[ -n "$VHOST" ]]; do
internal_get_app_url_with_vhost "$APP" "$VHOST"
done <"$DOKKU_ROOT/VHOST"
else
internal_get_app_url_with_vhost "$APP" "$(hostname -f)"
fi
fi
}
if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "false" ]]; then
if [[ -n "$RAW_TCP_PORTS" ]]; then
local APP_CONTAINER_PORTS="$(get_container_ports "$APP")"
local app_port
for app_port in $APP_CONTAINER_PORTS; do
echo "$(<"$DOKKU_ROOT/HOSTNAME"):$app_port (container)"
done
else
local DOKKU_APP_WEB_LISTENERS PORT
DOKKU_APP_WEB_LISTENERS="$(plugn trigger network-get-listeners "$APP" "web" | xargs)"
for DOKKU_APP_WEB_LISTENER in $DOKKU_APP_WEB_LISTENERS; do
PORT="$(echo "$DOKKU_APP_WEB_LISTENER" | cut -d ':' -f2)"
echo "$SCHEME://$(<"$DOKKU_ROOT/HOSTNAME"):$PORT (container)"
done
shopt -u nullglob
fi
elif [[ -n "$DOKKU_PROXY_PORT_MAP" ]]; then
local port_map
for port_map in $DOKKU_PROXY_PORT_MAP; do
local scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")"
local listen_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")"
echo "$scheme://$(<"$DOKKU_ROOT/HOSTNAME"):$listen_port"
done
elif [[ -n "$RAW_TCP_PORTS" ]]; then
for p in $RAW_TCP_PORTS; do
echo "http://$(<"$DOKKU_ROOT/HOSTNAME"):$p"
internal_get_app_url_with_vhost() {
declare APP="$1" VHOST="$2"
local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
local DOKKU_PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP || true)
local SCHEME="http"
local SSL="$DOKKU_ROOT/$APP/tls"
if [[ -e "$SSL/server.crt" && -e "$SSL/server.key" ]]; then
local SCHEME="https"
fi
if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "false" ]]; then
if [[ -n "$RAW_TCP_PORTS" ]]; then
local APP_CONTAINER_PORTS="$(get_container_ports "$APP")"
local app_port
for app_port in $APP_CONTAINER_PORTS; do
echo "$VHOST:$app_port (container)"
done
else
echo "$SCHEME://$(<"$DOKKU_ROOT/HOSTNAME")"
local DOKKU_APP_WEB_LISTENERS PORT
DOKKU_APP_WEB_LISTENERS="$(plugn trigger network-get-listeners "$APP" "web" | xargs)"
for DOKKU_APP_WEB_LISTENER in $DOKKU_APP_WEB_LISTENERS; do
PORT="$(echo "$DOKKU_APP_WEB_LISTENER" | cut -d ':' -f2)"
echo "$SCHEME://$VHOST:$PORT (container)"
done
shopt -u nullglob
fi
elif [[ -n "$DOKKU_PROXY_PORT_MAP" ]]; then
local port_map
for port_map in $DOKKU_PROXY_PORT_MAP; do
local scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")"
local listen_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")"
echo "$scheme://$VHOST:$listen_port"
done
elif [[ -n "$RAW_TCP_PORTS" ]]; then
for p in $RAW_TCP_PORTS; do
echo "http://$VHOST:$p"
done
else
echo "$SCHEME://$VHOST"
fi
}

9
plugins/domains/functions
View File

@@ -206,14 +206,9 @@ get_app_domains() {
declare desc="return app domains"
local APP=$1
local APP_VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
local GLOBAL_HOSTNAME_PATH="$DOKKU_ROOT/HOSTNAME"
if [[ "$(is_app_vhost_enabled "$APP")" == "true" ]]; then
if [[ -f "$APP_VHOST_PATH" ]]; then
cat "$APP_VHOST_PATH"
elif [[ -f "$GLOBAL_HOSTNAME_PATH" ]]; then
cat "$GLOBAL_HOSTNAME_PATH"
fi
if [[ "$(is_app_vhost_enabled "$APP")" == "true" ]] && [[ -f "$APP_VHOST_PATH" ]]; then
cat "$APP_VHOST_PATH"
fi
}

6
plugins/nginx-vhosts/functions
View File

@@ -160,7 +160,7 @@ configure_nginx_ports() {
local DOKKU_PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP)
local IS_APP_VHOST_ENABLED=true
local UPSTREAM_PORT="5000"
plugn trigger domains-vhost-enabled "$APP" || IS_APP_VHOST_ENABLED=false
plugn trigger domains-vhost-enabled "$APP" 2>/dev/null || IS_APP_VHOST_ENABLED=false
if [[ -z "$DOKKU_PROXY_PORT" ]] && [[ -z "$RAW_TCP_PORTS" ]]; then
if [[ "$IS_APP_VHOST_ENABLED" == "false" ]]; then
@@ -370,7 +370,7 @@ nginx_build_config() {
fi
local IS_APP_VHOST_ENABLED=true
plugn trigger domains-vhost-enabled "$APP" || IS_APP_VHOST_ENABLED=false
plugn trigger domains-vhost-enabled "$APP" 2>/dev/null || IS_APP_VHOST_ENABLED=false
if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "true" ]]; then
if [[ -z "$DOKKU_APP_LISTEN_PORT" ]] && [[ -z "$DOKKU_APP_LISTEN_IP" ]]; then
@@ -407,7 +407,7 @@ nginx_build_config() {
if [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
local SSL_VHOSTS=$(grep -E "^${SSL_HOSTNAME_REGEX}$" "$VHOST_PATH" || true)
else
local SSL_VHOSTS=$(<"$DOKKU_ROOT/HOSTNAME")
local SSL_VHOSTS=$(<"$DOKKU_ROOT/VHOST")
fi
local SSL_SERVER_NAME
local host