chore: retag product images to vnclagoon/* (#2)

Part-of: <http://gitlab.vnc.biz/uxf/vnc-hybridauth2/-/merge_requests/23>

.dockerignore

@@ -0,0 +1,10 @@
+.git
+.gitlab-ci.yml
+Jenkinsfile.deprecated
+startgcpdevapi.sh
+.gitea
+node_modules
+scan
+debian
+tools
+*.tgz

.gitea/workflows/deploy.yml

@@ -0,0 +1,61 @@
+name: Build + push image
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+env:
+  REGISTRY: gitea.saas.vnc.biz
+  IMAGE: gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute image tag
+        run: |
+          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-8)
+          echo "SHORT_SHA=${SHORT_SHA}" >> $GITHUB_ENV
+
+      # kaniko builds straight from a Dockerfile and pushes to the registry, running
+      # as a static binary inside the job container — the runner has no Docker daemon.
+      - name: Fetch kaniko (daemon-less image builder)
+        run: |
+          set -euo pipefail
+          curl -fsSL -o /tmp/crane.tgz \
+            https://github.com/google/go-containerregistry/releases/download/v0.21.9/go-containerregistry_Linux_x86_64.tar.gz
+          tar -xzf /tmp/crane.tgz -C /usr/local/bin crane
+          mkdir -p /tmp/kaniko-root
+          crane export gcr.io/kaniko-project/executor:debug /tmp/kaniko-fs.tar
+          tar -xf /tmp/kaniko-fs.tar -C /tmp/kaniko-root
+          cp /tmp/kaniko-root/kaniko/executor /usr/local/bin/kaniko-executor
+          chmod +x /usr/local/bin/kaniko-executor
+          /usr/local/bin/kaniko-executor version
+
+      # kaniko's push auth reads $DOCKER_CONFIG/config.json (go-containerregistry
+      # authn.DefaultKeychain). Write to both locations and export DOCKER_CONFIG so
+      # auth is picked up regardless of how $HOME resolves.
+      - name: Configure registry auth for push
+        run: |
+          AUTH=$(printf '%s:%s' "${REGISTRY_USER}" "${REGISTRY_TOKEN}" | base64 -w0)
+          CFG=$(printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY}" "${AUTH}")
+          mkdir -p /kaniko/.docker "$HOME/.docker"
+          printf '%s' "$CFG" > /kaniko/.docker/config.json
+          printf '%s' "$CFG" > "$HOME/.docker/config.json"
+          echo "DOCKER_CONFIG=/kaniko/.docker" >> "$GITHUB_ENV"
+
+      # The Dockerfile lives at the repo root; its ADD/COPY paths (app/, package.json,
+      # yarn.lock, config.js) are relative to the root.
+      - name: Build + push image
+        run: |
+          /usr/local/bin/kaniko-executor \
+            --context "dir://${GITHUB_WORKSPACE}" \
+            --dockerfile Dockerfile \
+            --skip-tls-verify-registry="${REGISTRY}" \
+            --destination "${IMAGE}:sha-${SHORT_SHA}" \
+            --destination "${IMAGE}:latest"

.gitlab-ci.yml

@@ -1,44 +0,0 @@
-image: docker:19.03.1
-
-variables:
-  DOCKER_HOST: tcp://localhost:2375
-  DOCKER_TLS_CERTDIR: ''
-  IMAGE_TAG: eu.gcr.io/vnc-development/vnc-hybridauth-api:development-$CI_COMMIT_SHORT_SHA
-  IMAGE_TAG_PROD: eu.gcr.io/vnc-dev-275609/vnc-hybridauth-api:production-$CI_COMMIT_SHORT_SHA
-  IMAGE_TAG_SAAS: eu.gcr.io/vnc-saas/vnc-hybridauth-api:saas-$CI_COMMIT_SHORT_SHA
-
-services:
-  - docker:19.03.1-dind
-
-docker-build-development-api:  
-  before_script:
-    - base64 -d $SA_Development | docker login -u _json_key --password-stdin https://eu.gcr.io
-  stage: build
-  script:
-    - cd docker
-    - docker build -t $IMAGE_TAG .
-    - docker push $IMAGE_TAG
-  only:
-    - master
-
-docker-build-production-api:
-  before_script:
-    - base64 -d $SA_Production | docker login -u _json_key --password-stdin https://eu.gcr.io  
-  stage: build
-  script:
-    - cd docker
-    - docker build -t $IMAGE_TAG_PROD .
-    - docker push $IMAGE_TAG_PROD
-  only:
-    - master
-
-docker-build-saas-api:
-  before_script:
-    - base64 -d $SA_Saas | docker login -u _json_key --password-stdin https://eu.gcr.io  
-  stage: build
-  script:
-    - cd docker
-    - docker build -t $IMAGE_TAG_SAAS .
-    - docker push $IMAGE_TAG_SAAS
-  only:
-    - master

Dockerfile

@@ -0,0 +1,33 @@
+FROM alpine:3.22.4 AS builder
+
+RUN apk update
+RUN apk update && apk upgrade && apk add --no-cache make gcc nodejs npm python3 g++ gcc libc-dev expat-dev libxml2-dev libxmlb-dev yarn nodejs-dev && rm -rf /var/cache/apk/*
+
+RUN mkdir -p /usr/share/vnctalk-hybrid-authenticator2
+RUN mkdir -p /usr/share/vnctalk-hybrid-authenticator2/config
+ADD app /usr/share/vnctalk-hybrid-authenticator2/app
+
+COPY package.json /usr/share/vnctalk-hybrid-authenticator2/package.json
+COPY yarn.lock /usr/share/vnctalk-hybrid-authenticator2/yarn.lock
+COPY config.js /usr/share/vnctalk-hybrid-authenticator2/config/vnc-hybrid-authenticator.js
+
+RUN cd /usr/share/vnctalk-hybrid-authenticator2 && yarn install
+
+FROM alpine:3.22.4
+
+RUN apk update && apk upgrade && apk add --no-cache nodejs npm expat libxml2 libxmlb && rm -rf /var/cache/apk/*
+
+COPY --from=builder /usr/share/vnctalk-hybrid-authenticator2 /usr/share/vnctalk-hybrid-authenticator2
+# Create non-root user and transfer ownership
+RUN addgroup -g 1001 vncuser && \
+    adduser -D -u 1001 -G vncuser vncuser
+
+USER vncuser
+
+
+LABEL org.opencontainers.image.source=https://github.com/vnc-biz/vnclagoon-images
+
+#RUN npm install /usr/share/vnctalk-hybrid-authenticator2/app
+
+CMD ["node", "/usr/share/vnctalk-hybrid-authenticator2/app/app.js"]
+

Jenkinsfile

@@ -1,92 +0,0 @@
-#!groovy
-
-pipeline {
-  agent none
-
-  environment {
-    git_commit_message = ''
-    git_commit_diff = ''
-    git_commit_author = ''
-    git_commit_author_name = ''
-    git_commit_author_email = ''
-    ANDROID_HOME = '/opt/android-sdk/'
-  }
-
-  stages {
-
-    // --- BUILD ---
-    stage('Build') {
-      agent {
-        label 'vncportal'
-      }
-      steps {
-        parallel(
-          'frontend': {
-            node('vncportal') {
-              deleteDir()
-              checkout scm
-              sh 'yarn cache clean'
-              sh 'yarn install'
-              sh "tar cfz frontend.tgz node_modules"
-              stash includes: 'frontend.tgz', name: 'frontend'
-              deleteDir()
-            }
-          },
-        )
-      }
-    }
-
-
-    stage('Packaging') {
-      agent {
-        label 'master'
-      }
-      steps {
-        sh "echo 'Packaging'"
-        deleteDir()
-        checkout scm
-        sh "git fetch --tags"
-        sh "makechangelog.uxf > debian/changelog"
-        sh "cat debian/changelog"
-        sh "mkdir src"
-        sh "sed -n 1p debian/changelog | grep -oP '\\((.*?)\\)' > src/version.txt"
-        sh "echo '####################################################'"
-        sh "cat src/version.txt"
-        sh "echo '####################################################'"
-
-        sh 'rm config/vnc-hybrid-authenticator.js'
-        sh 'cp -P conf.template/vnc-hybridauth2.js config/vnc-hybrid-authenticator.js'
-        // yarn fails on node4 with kurento stuff
-        unstash 'frontend'
-        sh 'tar xfz frontend.tgz'
-        lock('debianbuild') {
-          sh "cd debian; debuild --check-dirname-level 0 --no-tgz-check --no-lintian -kjenkins@vnc.biz -p'gpg --no-tty --passphrase q3tx65wurstbrot'; cd .."
-        }
-        sh "mkdir -p ../pkgarchive/"
-        sh "scp ../*.deb repo@factorypackages.rz.vnc.biz:/srv/repo/apt/incoming/"
-        sh "ssh repo@factorypackages.rz.vnc.biz /srv/repo/bin/import-new-packages.sh"
-
-        // Import to GCP deb repository
-        sh "scp ../*.deb repo@34.89.202.54:/srv/repo/apt/incoming/"
-        sh "ssh repo@34.89.202.54 /srv/repo/bin/import-new-packages.sh"
-
-        sh "mv ../*.deb ../pkgarchive/"
-        sh "rm ../*.dsc"
-        sh "rm ../*amd64.build"
-        sh "rm ../*amd64.changes"
-      }
-    }
-  }
-
-  post {
-    always {
-      emailext (
-        to: 'stefan.saenger@vnc.biz',
-        subject: "${env.JOB_NAME} #${env.BUILD_NUMBER}",
-        body: "Build URL: ${env.BUILD_URL}.",
-        attachLog: false,
-      )
-    }
-  }
-
-}

README.md

@@ -0,0 +1,41 @@
+# vnc-hybridauth2 (vnctalk-hybrid-authenticator2)
+
+Hybrid authenticator for VNCtalk / VNCmail. An Express service that sits between the
+auth-proxy's `hybridAuthURL` and the directory backends: it authenticates users against
+**LDAP** and the **VNCdirectory** PostgreSQL DB, and issues/verifies the XMPP JWT
+(`xmppToken`) that Prosody and the mail/talk APIs share for SSO.
+
+Prosody's `mod_auth_http_async` points `hybridaAuthUrl` at this service's HTTP-basic
+endpoint (default port `9544`).
+
+## Build & image
+
+Built by Gitea Actions (`.gitea/workflows/deploy.yml`) on every push to `master`, using
+kaniko (no Docker daemon on the runner). The image is pushed to the Gitea registry:
+
+- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:latest`
+- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:sha-<short-sha>`
+
+Registry auth uses the `REGISTRY_USER` / `REGISTRY_TOKEN` Actions secrets. The image runs
+as the non-root `vncuser` (uid 1001) and starts `node /usr/share/vnctalk-hybrid-authenticator2/app/app.js`.
+
+## Configuration
+
+`config.js` (copied into the image as `config/vnc-hybrid-authenticator.js`) is env-driven;
+the `development` profile reads `NODE_ENV`-scoped values from `process.env` (LDAP URI/bind,
+Postgres host/port/name/user/pass, `xmppToken`, `domain`). Provide them via the deployment
+(ArgoCD in the `vnc-iac-env` GitOps repo), sourced from Infisical — do **not** commit
+secrets to this repo.
+
+## Deploy
+
+Deployed by the ArgoCD application in `vnc-iac-env` (the hybrid-auth service that Prosody
+and the mail/talk APIs call). This repo has no live deploy manifest; the image tag is pinned
+in that GitOps repo.
+
+## Legacy removed
+
+The GitLab CI (`.gitlab-ci.yml`), `Jenkinsfile.deprecated`, and the GCP dev bootstrap
+(`startgcpdevapi.sh`) were removed during the GitLab → Gitea migration. The old
+`eu.gcr.io/vnc-development/vnc-hybridauth-api` promotion flow (`prod-*` / `stable-*` tags)
+is not carried over; the current build pushes a single `master` → `sha-*` + `latest`.

app/app.js

@@ -5,7 +5,7 @@ var jwt = require('jsonwebtoken');
 var express = require('express');
 require('express-async-errors');
 var bodyParser = require('body-parser');
-var request = require('request');
+var request = require('@cypress/request');
 var Pool = require('pg-pool');
 var LDAP = require('ldapjs');
 
@@ -42,39 +42,48 @@ if (!config.noLDAP) {
        failAfter: 10
      }
    });
- }	 
+ }
 }
 
-
-
-var dbpool = new Pool({
+let dbpoolOpts = {
   database: config.database.name,
   user: config.database.user,
   password: config.database.pass,
   host: config.database.host,
   port: config.database.port,
-  ssl: true,
   max: 20, // set pool max size to 20
   min: 4, // set min pool size to 4
   idleTimeoutMillis: config.database.idleTimeoutMillis, // close idle clients after 1 second
   connectionTimeoutMillis: config.database.connectionTimeoutMillis, // return an error after 1 second if connection could not be established
-})
+}
+
+if (!config.disableDBtls) {
+  dbpoolOpts['ssl'] = { rejectUnauthorized: false };
+}
+
+var dbpool = new Pool(dbpoolOpts);
+
+
+let projectPoolOpts = {
+  database: config.vncproject.name,
+  user: config.vncproject.user,
+  password: config.vncproject.pass,
+  host: config.vncproject.host,
+  port: config.vncproject.port,
+  max: 20, // set pool max size to 20
+  min: 4, // set min pool size to 4
+  idleTimeoutMillis: config.database.idleTimeoutMillis, // close idle clients after 1 second
+  connectionTimeoutMillis: config.database.connectionTimeoutMillis, // return an error after 1 second if connection could not be established
+}
+
+if (!config.disableDBtls) {
+  projectPoolOpts['ssl'] = { rejectUnauthorized: false };
+}
 
 
 var projectPool;
 if (config.vncproject) {
-  projectPool = new Pool({
-    database: config.vncproject.name,
-    user: config.vncproject.user,
-    password: config.vncproject.pass,
-    host: config.vncproject.host,
-    port: config.vncproject.port,
-    ssl: true,
-    max: 20, // set pool max size to 20
-    min: 4, // set min pool size to 4
-    idleTimeoutMillis: config.database.idleTimeoutMillis, // close idle clients after 1 second
-    connectionTimeoutMillis: config.database.connectionTimeoutMillis, // return an error after 1 second if connection could not be established
-  })
+  projectPool = new Pool(projectPoolOpts);
 }
 
 app.use(bodyParser.json()); // for parsing application/json
@@ -247,14 +256,21 @@ function IsValidRedmineUser(username) {
         queryparams[0] = uid;
         queryparams[1] = "api";
         queryparams[2] = "@" + config.domain;
-    var query = "SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn, ";
-    query += "users.login||$3 as email, tokens.value AS RedmineAPIKey FROM users, tokens ";
-    query += "WHERE users.status=1 AND lower(users.login)=$1 and tokens.action=$2 and tokens.user_id=users.id";
+
+    query = "SELECT users.login AS uid, users.firstname AS givenName, users.lastname AS sn, organizations.name as memberOf, organizations.active as org_active, ";
+    query += " users.login||$3 as email, tokens.value AS RedmineAPIKey FROM users, tokens, organization_users, organizations ";
+    query += " WHERE users.status=1 AND lower(users.login)=$1 and tokens.action=$2 and tokens.user_id=users.id and organization_users.user_id=users.id and organizations.id=organization_users.organization_id and organizations.active";
+
 
     // var query = "select SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn, users.login||\'@talk.vnc.de\' AS mail FROM users WHERE users.status=1 AND users.login=$1 AND substring(users.hashed_password, 0, length(users.hashed_password)+1) = encode(digest(users.salt||encode(digest(:password, \'sha1\'), \'hex\'), \'sha1\'), \'hex\')";
     dbpool.query(query, queryparams, function (derr, dres) {
       if (derr == null) {
           if (dres.rowCount > 0) {
+            /*
+            console.log("isValidRedmine query: ", query);
+            console.log("isValidRedmine queryparams: ", queryparams);
+            console.log("isValidRedmine dres.rows: ", dres.rows);
+            */
             var redmineUser = {
               id: dres.rows[0].uid,
               firstname: dres.rows[0].givenname,
@@ -419,7 +435,7 @@ app.get('/', async function (req, res) {
   if (req.headers.authorization && req.headers.authorization.startsWith("Basic")) {
     try {
       var b64input = req.headers.authorization.split(" ")[1];
-      var decodedInput = new Buffer(b64input, 'base64').toString('ascii');
+      var decodedInput = Buffer.from(b64input, 'base64').toString('ascii');
       var username = decodedInput.split(":")[0];
       var passwordArray = decodedInput.split(":");
       var password = "";
@@ -430,6 +446,7 @@ app.get('/', async function (req, res) {
         }
       }
       if (config.useRedmineAuth) {
+
          let validRedmineUser = false;
          var finalProfile = {};
          let userProfile = await IsValidRedmineUser(username);
@@ -437,7 +454,7 @@ app.get('/', async function (req, res) {
          if (userProfile) {
            validRedmineUser = true;
          }
-         console.log(moment().format("LTS") + ' username ' + username +' - IsValidRedmineUser: ', validRedmineUser);
+         console.log(moment().format("LTS") + ' username ' + username +' - IsValidRedmineUser: ', validRedmineUser, userProfile);
          if (config.debug) {
            console.log(moment().format("LTS") + ' username ' + username +' - password: ', password);
          }
@@ -450,12 +467,12 @@ app.get('/', async function (req, res) {
              }
              console.log("IsValidJWT: ", IsValidJWT(username, password));
            if (validRedmineUser && (validRedmineAuth || IsValidOldSecret(username, password) || IsValidJWT(username, password))) {
-             res.status(200).json(userProfile);
+             res.set({"WWW-Authenticate": "Basic " + username}).status(200).json(userProfile);
            } else {
-             res.status(401).json(null);
+             res.set({"WWW-Authenticate": "Basic " + username}).status(401).json(null);
            }
          } else {
-           res.status(401).json(null);
+           res.set({"WWW-Authenticate": "Basic " + username}).status(401).json(null);
          }
 
       } else {
@@ -537,7 +554,7 @@ app.get('/login2fa', async function (req, res) {
   if (req.headers.authorization && req.headers.authorization.startsWith("Basic")) {
     try {
       var b64input = req.headers.authorization.split(" ")[1];
-      var decodedInput = new Buffer(b64input, 'base64').toString('ascii');
+      var decodedInput = Buffer.from(b64input, 'base64').toString('ascii');
       var username = decodedInput.split(":")[0];
       var passwordArray = decodedInput.split(":");
       var password = "";
@@ -556,6 +573,7 @@ app.get('/login2fa', async function (req, res) {
            validRedmineUser = true;
          }
          console.log(moment().format("LTS") + ' username ' + username +' - IsValidRedmineUser: ', validRedmineUser);
+         console.log(moment().format("LTS") + ' username ' + username +' - userProfile: ', userProfile);
          if (config.debug) {
            console.log(moment().format("LTS") + ' username ' + username +' - password: ', password);
          }
@@ -568,9 +586,9 @@ app.get('/login2fa', async function (req, res) {
              }
              console.log("IsValidJWT: ", IsValidJWT(username, password));
            if (validRedmineUser && (validRedmineAuth || IsValidOldSecret(username, password) || IsValidJWT(username, password))) {
-             res.status(200).json(userProfile);
+             res.set({"WWW-Authenticate": "Basic " + username}).status(200).json(userProfile);
            } else {
-             res.status(401).json(null);
+             res.set({"WWW-Authenticate": "Basic " + username}).status(401).json(null);
            }
          } else {
            res.status(401).json(null);
@@ -646,11 +664,16 @@ app.get('/login2fa', async function (req, res) {
     }
   } else {
     console.log(moment().format("LTS") + ' no auth header');
-    res.status(401).json(null);
+    res.set({"WWW-Authenticate": "Basic vnclagoon"}).status(401).json(null);
   }
 
 });
 
+app.get('/health', async function (req, res) {
+  console.log(moment().format("LTS") + ' health check called');
+  res.status(200).json(null);
+});
+
 var server = app.listen(servicePort, function () {
   var host = server.address().address;
   var port = server.address().port;

config.js

@@ -1,6 +1,7 @@
 module.exports = {
   development: {
     servicePort: 9544,
+    disableDBtls: process.env.disableDBtls || false,
     domain: process.env.domain || 'dev.vnc.de',
     xmppToken: process.env.xmppToken || 'xah6niighohshieKahtah',
     useRedmineAuth: true,
@@ -23,7 +24,7 @@ module.exports = {
       idleTimeoutMillis: 10000,
       connectionTimeoutMillis: 10000
     },
-    redminedb: {
+    vncproject: {
       host: process.env.redmineDbHost || "127.0.0.1",
       port: process.env.redmineDbPort || 54322,
       name: process.env.redmineDbName || "redmine",

config/vnc-hybrid-authenticator.js

@@ -4,6 +4,7 @@ module.exports = {
     domain: 'dev.vnc.de',
     xmppToken: 'xah6niighohshieKahtah',
     useRedmineAuth: true,
+    disableDBtls: false,
     ldap: {
       ldapUri: 'none',
       bindDn: 'uid=zimbra,cn=admins,cn=zimbra',

docker/Dockerfile

@@ -1,15 +0,0 @@
-FROM  eu.gcr.io/vnc-development/docker-vnc-base:latest
-
-RUN apt-get update
-RUN curl -sL https://deb.nodesource.com/setup_12.x | bash -
-RUN apt-get install -y nodejs
-RUN apt-get install -y build-essential
-RUN npm install -g serve
-RUN npm install pm2 -g
-
-RUN apt-get install -y vnctalk-hybrid-authenticator2
-COPY config.js /usr/share/vnctalk-hybrid-authenticator2/config/vnc-hybrid-authenticator.js
-
-#RUN npm install /usr/share/vnctalk-hybrid-authenticator2/app
-
-ENTRYPOINT ["pm2-runtime", "/usr/share/vnctalk-hybrid-authenticator2/app/app.js"]

package.json

@@ -5,24 +5,32 @@
   "main": "app.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "sh startgcpdevapi.sh",
+    "start": "node app/app.js",
     "start:gr13": "NODE_ENV=gr13 node app/app.js"
   },
   "author": "VNC Software AG",
   "license": "",
   "dependencies": {
-    "body-parser": "1.18.3",
-    "express": "4.13.4",
+    "body-parser": "1.20.3",
+    "express": "4.22.1",
     "express-async-errors": "3.1.1",
-    "express-basic-auth": "1.1.6",
+    "express-basic-auth": "1.2.1",
     "hmacsha1": "1.0.0",
-    "jsonwebtoken": "8.3.0",
-    "ldapjs": "^1.0.2",
-    "md5": "2.2.1",
-    "moment": "2.22.2",
-    "morgan": "1.8.2",
-    "pg": "7.6.0",
-    "pg-pool": "2.0.3",
-    "request": "2.83.0"
+    "jsonwebtoken": "9.0.3",
+    "ldapjs": "1.0.2",
+    "md5": "2.3.0",
+    "moment": "2.29.4",
+    "morgan": "1.10.1",
+    "pg": "8.8.0",
+    "pg-pool": "3.5.2",
+    "@cypress/request": "3.0.10"
+  },
+  "resolutions": {
+    "brace-expansion": "5.0.6",
+    "form-data": "4.0.6",
+    "lodash": "4.18.1",
+    "minimatch": "10.2.4",
+    "qs": "6.15.2",
+    "uuid": "14.0.0"
   }
 }

startgcpdevapi.sh

@@ -1,61 +0,0 @@
-#!/bin/bash
-
-USERNAME=$USER;
-RSA_FILE=~/.ssh/id_rsa
-
-if [ -n "$ID_RSA" ]; then
-  RSA_FILE=$ID_RSA
-fi
-
-echo "RSA_FILE = $RSA_FILE"
-
-RSA_FILE=~/.ssh/id_rsa
-
-if [ -n "$ID_RSA" ]; then
-  RSA_FILE=$ID_RSA
-fi
-
-echo "RSA_FILE = $RSA_FILE"
-
-
-if [ -f ~/.vnc-gcp-user ]; then
- echo "found username config..."
- USERNAME=$(cat ~/.vnc-gcp-user | grep "^USERNAME" | awk -F "=" '{print $2}');
- echo "using username $USERNAME for gcp ssh tunnels"
-fi
-
-if [ -S "/tmp/vncddb.sock" ]; then
-  echo "Socket for vncdirectory database already active - skipping"
-else
-  echo "starting tunnel for vncdirectory db"
-  ssh -i $RSA_FILE "$USERNAME@10.0.201.44" -o "proxycommand ssh -W %h:%p $USERNAME@34.107.1.238" -f -N -M -S /tmp/vncddb.sock -L 54322:127.0.0.1:5432
-  sleep 3
-fi
-
-
-echo "starting..."
-export NODE_ENV=development
-export PORT=8000
-node app/app.js 2>&1 | tee -a /tmp/vncha-api.log &
-
-echo "waiting for api service to start..."
-sleep 10
-
-osslug=$(uname);
-serverup="1";
-
-while [ "$serverup" = 1 ]; do
-  serverup="0";
-  if [ "$osslug" = "Linux" ]; then
-    serverup=$(netstat -nlp 2>/dev/null | grep -c "9544");
-  fi
-  if [ "$osslug" = "Darwin" ]; then
-    serverup=$(netstat -an -ptcp 2>/dev/null | grep LISTEN | grep -c "9544");
-  fi
-
-  sleep 10
-done
-
-echo "api service no longer running - closing tunnels"
-
-ssh -S /tmp/vncddb.sock -O exit "$USER@10.0.201.44"

tools/broadcast.cfg

@@ -0,0 +1,5 @@
+BROADCASTSENDER=jenkins.bot@vnc.biz
+BROADCASTID=broadcast-gel4it1o9fvi@vnc.biz
+BCTITLE=Factory - VNC Hybridauth2
+BCRECEIPIENTS=leonidas.apostolidis@vnc.biz
+BCRESTURL=https://xmpp.vnc.biz/rest

tools/nagnotify.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+
+#######
+# Use Jenkins env vars if set otherwise use the gitlab-ci ones
+BUILD_URL=${BUILD_URL:-$CI_PIPELINE_URL}
+BRANCH_NAME=${BRANCH_NAME:-$CI_COMMIT_REF_NAME}
+#######
+
+echo "BRANCH: $BRANCH_NAME"
+
+if [ -f result.txt ]; then
+  RESULT=$(cat result.txt)
+  #debug
+  echo "result:"
+  cat result.txt
+fi
+
+if [ -f code-analysis.txt ]; then
+  CODEERR=$(cat code-analysis.txt)
+  #debug
+  echo "code-analysis"
+  cat code-analysis.txt
+fi
+
+AUTHOR=$(git log -1 | grep "^Author: " | awk -F "Author:" '{print $2}' | awk -F "<" '{print $1}')
+
+echo "All local branches:"; git branch
+echo "BRANCH_NAME: $BRANCH_NAME"
+
+JCHANGELOG=$(git log --pretty=format:%s origin/master..origin/$BRANCH_NAME | nl)
+
+echo "changes:"
+echo "$JCHANGELOG"
+
+
+if [ "$RESULT" ]; then
+  echo "$BUILD_URL - $RESULT"
+  case $RESULT in
+    SUCCESS|success)
+      if [ "$BRANCH_NAME" = "master" ]; then
+        echo -e "job  succesfully finished: $BUILD_URL \n Changes: \n $JCHANGELOG" | ./tools/sendbroadcast.sh
+        # nagzillac "room^vncmail__project@conference.vnc.biz^job  succesfully finished: $BUILD_URL - new APK is available at https://basepackages.vnc.biz/apk/VNCmail-2.0.0-$BUILD_ID.apk"
+      else
+        echo -e "job  succesfully finished: $BUILD_URL \n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+        # nagzillac "room^vncmail__project@conference.vnc.biz^job  succesfully finished: $BUILD_URL"
+      fi
+    ;;
+    UNSTABLE|WARNING|unstable)
+      if [ "$CODEERR" ]; then
+        if [ "$BRANCH_NAME" = "master" ]; then
+          echo -e "job  finished with warnings: $BUILD_URL \n $CODEERR \n Changes: \n $JCHANGELOG "  | ./tools/sendbroadcast.sh
+          # nagzillac "room^vncmail__project@conference.vnc.biz^job  finished with warnings: $BUILD_URL \n $CODEERR \n new APK is available at https://basepackages.vnc.biz/apk/VNCmail-2.0.0-$BUILD_ID.apk"
+        else
+          echo -e "job  finished with warnings: $BUILD_URL \n $CODEERR \n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+          # nagzillac "room^vncmail__project@conference.vnc.biz^job  finished with warnings: $BUILD_URL \n $CODEERR"
+        fi
+      else
+        echo -e "job  finished with warnings: $BUILD_URL \n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+        #nagzillac "room^vncmail__project@conference.vnc.biz^job  finished with warnings: $BUILD_URL"
+      fi
+    ;;
+    FAILURE)
+      if [ "$CODEERR" ]; then
+        CODENUM=$(wc -l code-analysis.txt | awk '{print $1}')
+        echo -e "job  FAILED - please check: $BUILD_URL \n code analysis found $CODENUM errors \n $CODEERR \n\n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+        # nagzillac "room^vncmail__project@conference.vnc.biz^job  FAILED - please check: $BUILD_URL \n code analysis found $CODENUM errors"
+      else
+        echo -e "job  FAILED - please check: $BUILD_URL immediately \n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+        # nagzillac "room^vncmail__project@conference.vnc.biz^job  FAILED - please check: $BUILD_URL immediately"
+      fi
+    ;;
+    *)
+      echo -e "job  finished with ambigous result - please check: $BUILD_URL immediately \n Changes: \n $JCHANGELOG \n Author: $AUTHOR"  | ./tools/sendbroadcast.sh
+      # nagzillac "chat^stefan.saenger@vnc.biz^job  finished with ambigous result - please check: $BUILD_URL immediately"
+    ;;
+  esac
+fi

tools/sendbroadcast.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+BCBODY=`cat`
+
+function die_err() {
+        echo "$0: $*" >&2
+        exit 1
+}
+
+
+OldPWD=$(pwd)
+BaseDir=$(git rev-parse --show-toplevel)
+cd "$BaseDir" || exit 1
+
+
+CURLCRED="vnctalk:ohtai2Eicai4aiting7bec2am6Aih"
+
+if [ -f "tools/broadcast.cfg" ]; then
+  echo "found config"
+else
+  cd "$OldPWD" || exit 1
+  die_err "no broadcst config - bailing out"
+fi
+
+RECEIPIENTS=$(cat tools/broadcast.cfg | grep "^BCRECEIPIENTS" | awk -F "=" '{print $2}' | tr ',' '\n' | awk '{print "<to>" $0 "</to>"}' | sed 's/ //g' | grep -v "<to></to>");
+BROADCASTSENDER=$(cat tools/broadcast.cfg | grep "^BROADCASTSENDER" | awk -F "=" '{print $2}');
+BROADCASTID=$(cat tools/broadcast.cfg | grep "^BROADCASTID" | awk -F "=" '{print $2}');
+BCTITLE=$(cat tools/broadcast.cfg | grep "^BCTITLE" | awk -F "=" '{print $2}');
+MSGID=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
+BCRESTURL=$(cat tools/broadcast.cfg | grep "^BCRESTURL" | awk -F "=" '{print $2}');
+
+echo "<message xmlns=\"jabber:client\" type=\"normal\" id=\"$MSGID\" to=\"$BROADCASTID\" from=\"$BROADCASTSENDER\">" > "/tmp/$MSGID.xml"
+echo "<body>$BCBODY</body>" >> "/tmp/$MSGID.xml"
+echo "<vncTalkBroadcast xmlns=\"xmpp:vnctalk\" title=\"$BCTITLE\">" >> "/tmp/$MSGID.xml"
+echo "$RECEIPIENTS"  >> "/tmp/$MSGID.xml"
+echo "  </vncTalkBroadcast>
+</message>" >> "/tmp/$MSGID.xml"
+
+echo "raw message:"
+cat "/tmp/$MSGID.xml"
+
+curl -u "$CURLCRED" -H "Content-Type: text/xml" -X POST --data-binary "@/tmp/$MSGID.xml" "$BCRESTURL"