forbes-0023
fb13795ef7
Add docker-compose.allinone.yaml with five services: - PostgreSQL 16 with auto-applied migrations - MinIO for S3-compatible file storage - OpenLDAP (bitnami/openldap:2.6) with memberOf overlay and preconfigured silo-admins/silo-users/silo-viewers groups - Silo API server built from Dockerfile - Nginx reverse proxy (optional, via --profile nginx) Add scripts/setup-docker.sh interactive helper that generates deployments/.env and deployments/config.docker.yaml with random credentials. Supports --non-interactive for CI. Add deployments/ldap/ LDIF init scripts for memberOf overlay and Silo role groups. Add deployments/nginx/ reverse proxy configs.
345 lines
11 KiB
Bash
Executable File
345 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Silo Docker Setup Script
|
|
# Generates .env and config.docker.yaml for the all-in-one Docker Compose stack.
|
|
#
|
|
# Usage:
|
|
# ./scripts/setup-docker.sh # interactive
|
|
# ./scripts/setup-docker.sh --non-interactive # use defaults / env vars
|
|
# ./scripts/setup-docker.sh --domain silo.example.com
|
|
# ./scripts/setup-docker.sh --with-nginx
|
|
#
|
|
# Output:
|
|
# deployments/.env - Docker Compose environment variables
|
|
# deployments/config.docker.yaml - Silo server configuration
|
|
|
|
set -euo pipefail
|
|
|
|
# Colors (disabled if not a terminal)
|
|
if [[ -t 1 ]]; then
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
BOLD='\033[1m'
|
|
NC='\033[0m'
|
|
else
|
|
RED='' GREEN='' YELLOW='' BLUE='' BOLD='' NC=''
|
|
fi
|
|
|
|
log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
|
|
log_success() { echo -e "${GREEN}[OK]${NC} $*"; }
|
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Defaults
|
|
# ---------------------------------------------------------------------------
|
|
DOMAIN="localhost"
|
|
NON_INTERACTIVE=false
|
|
WITH_NGINX=false
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_DIR="${SCRIPT_DIR}/.."
|
|
OUTPUT_DIR="${PROJECT_DIR}/deployments"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Parse arguments
|
|
# ---------------------------------------------------------------------------
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--non-interactive) NON_INTERACTIVE=true; shift ;;
|
|
--domain) DOMAIN="$2"; shift 2 ;;
|
|
--with-nginx) WITH_NGINX=true; shift ;;
|
|
--output-dir) OUTPUT_DIR="$2"; shift 2 ;;
|
|
-h|--help)
|
|
echo "Usage: $0 [OPTIONS]"
|
|
echo ""
|
|
echo "Options:"
|
|
echo " --non-interactive Use defaults and env vars, no prompts"
|
|
echo " --domain DOMAIN Server hostname (default: localhost)"
|
|
echo " --with-nginx Print instructions for the nginx profile"
|
|
echo " --output-dir DIR Output directory (default: ./deployments)"
|
|
echo " -h, --help Show this help"
|
|
exit 0
|
|
;;
|
|
*) log_error "Unknown option: $1"; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Helpers
|
|
# ---------------------------------------------------------------------------
|
|
generate_secret() {
|
|
local len="${1:-32}"
|
|
openssl rand -hex "$len" 2>/dev/null \
|
|
|| head -c "$len" /dev/urandom | od -An -tx1 | tr -d ' \n'
|
|
}
|
|
|
|
prompt() {
|
|
local var_name="$1" prompt_text="$2" default="$3"
|
|
if [[ "$NON_INTERACTIVE" == "true" ]]; then
|
|
eval "$var_name=\"$default\""
|
|
return
|
|
fi
|
|
local input
|
|
read -r -p "$(echo -e "${BOLD}${prompt_text}${NC} [${default}]: ")" input
|
|
eval "$var_name=\"${input:-$default}\""
|
|
}
|
|
|
|
prompt_secret() {
|
|
local var_name="$1" prompt_text="$2" default="$3"
|
|
if [[ "$NON_INTERACTIVE" == "true" ]]; then
|
|
eval "$var_name=\"$default\""
|
|
return
|
|
fi
|
|
local input
|
|
read -r -p "$(echo -e "${BOLD}${prompt_text}${NC} [auto-generated]: ")" input
|
|
eval "$var_name=\"${input:-$default}\""
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Banner
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo -e "${BOLD}Silo Docker Setup${NC}"
|
|
echo "Generates configuration for the all-in-one Docker Compose stack."
|
|
echo ""
|
|
|
|
# Check for existing files
|
|
if [[ -f "${OUTPUT_DIR}/.env" ]]; then
|
|
log_warn "deployments/.env already exists."
|
|
if [[ "$NON_INTERACTIVE" == "false" ]]; then
|
|
read -r -p "Overwrite? [y/N]: " overwrite
|
|
if [[ "${overwrite,,}" != "y" ]]; then
|
|
log_info "Aborted."
|
|
exit 0
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Gather configuration
|
|
# ---------------------------------------------------------------------------
|
|
log_info "Gathering configuration..."
|
|
echo ""
|
|
|
|
# Domain / base URL
|
|
prompt DOMAIN "Server domain" "$DOMAIN"
|
|
|
|
if [[ "$WITH_NGINX" == "true" ]]; then
|
|
BASE_URL="http://${DOMAIN}"
|
|
elif [[ "$DOMAIN" == "localhost" ]]; then
|
|
BASE_URL="http://localhost:8080"
|
|
else
|
|
BASE_URL="http://${DOMAIN}:8080"
|
|
fi
|
|
|
|
# PostgreSQL
|
|
PG_PASSWORD_DEFAULT="$(generate_secret 16)"
|
|
prompt_secret POSTGRES_PASSWORD "PostgreSQL password" "$PG_PASSWORD_DEFAULT"
|
|
|
|
# MinIO
|
|
MINIO_AK_DEFAULT="$(generate_secret 10)"
|
|
MINIO_SK_DEFAULT="$(generate_secret 16)"
|
|
prompt_secret MINIO_ACCESS_KEY "MinIO access key" "$MINIO_AK_DEFAULT"
|
|
prompt_secret MINIO_SECRET_KEY "MinIO secret key" "$MINIO_SK_DEFAULT"
|
|
|
|
# OpenLDAP
|
|
LDAP_ADMIN_PW_DEFAULT="$(generate_secret 16)"
|
|
prompt_secret LDAP_ADMIN_PASSWORD "LDAP admin password" "$LDAP_ADMIN_PW_DEFAULT"
|
|
prompt LDAP_USERS "LDAP initial username" "siloadmin"
|
|
LDAP_USER_PW_DEFAULT="$(generate_secret 12)"
|
|
prompt_secret LDAP_PASSWORDS "LDAP initial user password" "$LDAP_USER_PW_DEFAULT"
|
|
|
|
# Session secret
|
|
SESSION_SECRET="$(generate_secret 32)"
|
|
|
|
# Silo local admin (fallback when LDAP is unavailable)
|
|
prompt SILO_ADMIN_USERNAME "Silo local admin username" "admin"
|
|
ADMIN_PW_DEFAULT="$(generate_secret 12)"
|
|
prompt_secret SILO_ADMIN_PASSWORD "Silo local admin password" "$ADMIN_PW_DEFAULT"
|
|
|
|
echo ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Write .env
|
|
# ---------------------------------------------------------------------------
|
|
log_info "Writing ${OUTPUT_DIR}/.env ..."
|
|
|
|
cat > "${OUTPUT_DIR}/.env" << EOF
|
|
# Generated by setup-docker.sh on $(date +%Y-%m-%d)
|
|
# Used by: docker compose -f deployments/docker-compose.allinone.yaml
|
|
|
|
# PostgreSQL
|
|
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
|
|
# MinIO
|
|
MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
|
|
MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
|
|
|
|
# OpenLDAP
|
|
LDAP_ADMIN_PASSWORD=${LDAP_ADMIN_PASSWORD}
|
|
LDAP_USERS=${LDAP_USERS}
|
|
LDAP_PASSWORDS=${LDAP_PASSWORDS}
|
|
|
|
# Silo
|
|
SILO_SESSION_SECRET=${SESSION_SECRET}
|
|
SILO_ADMIN_USERNAME=${SILO_ADMIN_USERNAME}
|
|
SILO_ADMIN_PASSWORD=${SILO_ADMIN_PASSWORD}
|
|
SILO_BASE_URL=${BASE_URL}
|
|
|
|
# Uncomment if using OIDC (Keycloak)
|
|
# SILO_OIDC_CLIENT_SECRET=
|
|
EOF
|
|
|
|
chmod 600 "${OUTPUT_DIR}/.env"
|
|
log_success "deployments/.env written"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Write config.docker.yaml
|
|
# ---------------------------------------------------------------------------
|
|
log_info "Writing ${OUTPUT_DIR}/config.docker.yaml ..."
|
|
|
|
# Note: Values wrapped in ${VAR} (inside the single-quoted YAMLEOF blocks)
|
|
# are NOT expanded by bash — they are written literally into the YAML file
|
|
# and expanded at runtime by the Go config loader via os.ExpandEnv().
|
|
# The base_url and cors origin use the bash variable directly since
|
|
# SILO_SERVER_BASE_URL is not a supported direct override in the Go loader.
|
|
{
|
|
cat << 'YAMLEOF'
|
|
# Silo Configuration — Docker Compose (all-in-one)
|
|
# Generated by scripts/setup-docker.sh
|
|
#
|
|
# Values using ${VAR} syntax are expanded from environment variables at
|
|
# startup. Direct env var overrides (SILO_DB_PASSWORD, etc.) take precedence
|
|
# over YAML values — see docs/CONFIGURATION.md for the full reference.
|
|
|
|
server:
|
|
host: "0.0.0.0"
|
|
port: 8080
|
|
YAMLEOF
|
|
|
|
cat << EOF
|
|
base_url: "${BASE_URL}"
|
|
EOF
|
|
|
|
cat << 'YAMLEOF'
|
|
|
|
database:
|
|
host: "postgres"
|
|
port: 5432
|
|
name: "silo"
|
|
user: "silo"
|
|
password: "${SILO_DB_PASSWORD}"
|
|
sslmode: "disable"
|
|
max_connections: 10
|
|
|
|
storage:
|
|
endpoint: "minio:9000"
|
|
access_key: "${SILO_MINIO_ACCESS_KEY}"
|
|
secret_key: "${SILO_MINIO_SECRET_KEY}"
|
|
bucket: "silo-files"
|
|
use_ssl: false
|
|
region: "us-east-1"
|
|
|
|
schemas:
|
|
directory: "/etc/silo/schemas"
|
|
default: "kindred-rd"
|
|
|
|
freecad:
|
|
uri_scheme: "silo"
|
|
|
|
auth:
|
|
enabled: true
|
|
session_secret: "${SILO_SESSION_SECRET}"
|
|
|
|
# Local accounts (fallback when LDAP is unavailable)
|
|
local:
|
|
enabled: true
|
|
default_admin_username: "${SILO_ADMIN_USERNAME}"
|
|
default_admin_password: "${SILO_ADMIN_PASSWORD}"
|
|
|
|
# OpenLDAP (provided by the Docker Compose stack)
|
|
ldap:
|
|
enabled: true
|
|
url: "ldap://openldap:1389"
|
|
base_dn: "dc=silo,dc=local"
|
|
user_search_dn: "ou=users,dc=silo,dc=local"
|
|
user_attr: "cn"
|
|
email_attr: "mail"
|
|
display_attr: "cn"
|
|
group_attr: "memberOf"
|
|
role_mapping:
|
|
admin:
|
|
- "cn=silo-admins,ou=groups,dc=silo,dc=local"
|
|
editor:
|
|
- "cn=silo-users,ou=groups,dc=silo,dc=local"
|
|
viewer:
|
|
- "cn=silo-viewers,ou=groups,dc=silo,dc=local"
|
|
tls_skip_verify: false
|
|
|
|
oidc:
|
|
enabled: false
|
|
|
|
cors:
|
|
allowed_origins:
|
|
YAMLEOF
|
|
|
|
cat << EOF
|
|
- "${BASE_URL}"
|
|
EOF
|
|
} > "${OUTPUT_DIR}/config.docker.yaml"
|
|
|
|
log_success "deployments/config.docker.yaml written"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Summary
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo -e "${BOLD}============================================${NC}"
|
|
echo -e "${BOLD}Setup complete!${NC}"
|
|
echo -e "${BOLD}============================================${NC}"
|
|
echo ""
|
|
echo "Generated files:"
|
|
echo " deployments/.env - secrets and credentials"
|
|
echo " deployments/config.docker.yaml - server configuration"
|
|
echo ""
|
|
echo -e "${BOLD}Credentials:${NC}"
|
|
echo " PostgreSQL: silo / ${POSTGRES_PASSWORD}"
|
|
echo " MinIO: ${MINIO_ACCESS_KEY} / ${MINIO_SECRET_KEY}"
|
|
echo " MinIO Console: http://localhost:9001"
|
|
echo " LDAP Admin: cn=admin,dc=silo,dc=local / ${LDAP_ADMIN_PASSWORD}"
|
|
echo " LDAP User: ${LDAP_USERS} / ${LDAP_PASSWORDS}"
|
|
echo " Silo Admin: ${SILO_ADMIN_USERNAME} / ${SILO_ADMIN_PASSWORD} (local fallback)"
|
|
echo " Base URL: ${BASE_URL}"
|
|
echo ""
|
|
echo -e "${BOLD}Next steps:${NC}"
|
|
echo ""
|
|
echo " # Start the stack"
|
|
if [[ "$WITH_NGINX" == "true" ]]; then
|
|
echo " docker compose -f deployments/docker-compose.allinone.yaml --profile nginx up -d"
|
|
else
|
|
echo " docker compose -f deployments/docker-compose.allinone.yaml up -d"
|
|
fi
|
|
echo ""
|
|
echo " # Check status"
|
|
echo " docker compose -f deployments/docker-compose.allinone.yaml ps"
|
|
echo ""
|
|
echo " # View logs"
|
|
echo " docker compose -f deployments/docker-compose.allinone.yaml logs -f silo"
|
|
echo ""
|
|
echo " # Open in browser"
|
|
echo " ${BASE_URL}"
|
|
echo ""
|
|
echo " # Log in with LDAP: ${LDAP_USERS} / <password above>"
|
|
echo " # Or local admin: ${SILO_ADMIN_USERNAME} / <password above>"
|
|
echo ""
|
|
if [[ "$WITH_NGINX" != "true" ]]; then
|
|
echo " To add nginx later:"
|
|
echo " docker compose -f deployments/docker-compose.allinone.yaml --profile nginx up -d"
|
|
echo ""
|
|
fi
|
|
echo "Save these credentials somewhere safe. The passwords in deployments/.env"
|
|
echo "are the source of truth for the running stack."
|
|
echo ""
|