fix: prepare cert automation
This commit is contained in:
+5
-3
@@ -6,7 +6,8 @@ RUN apk add gettext lua5.2 lua5.2-bitop lua5.2-socket lua5.2-dbi-postgresql lua5
|
||||
lua5.2-filesize lua5.2-lpeg_patterns lua5.2-hiredis lua5.2-socket lua5.2-lpeg lua5.2-filesystem lua5.2-ldap \
|
||||
lua5.2-rapidjson lua5.2-redis lua5.2-sec lua5.2-lzlib lua5.2-cjson lua5.2-dev \
|
||||
libidn-dev libidn icu icu-dev libpq postgresql-dev make gcc expat expat-dev \
|
||||
libxmlb-dev libstdc++6 libc-dev openssl openssl-dev htop nginx
|
||||
libxmlb-dev libstdc++6 libc-dev openssl openssl-dev htop nodejs nodejs-dev \
|
||||
libc-dev g++ yarn nagios-plugins-tcp
|
||||
|
||||
RUN wget https://prosody.im/downloads/source/prosody-0.11.6.tar.gz
|
||||
RUN tar xvfz prosody-0.11.6.tar.gz
|
||||
@@ -18,8 +19,9 @@ RUN mkdir /vnc
|
||||
RUN mkdir -p /var/run/prosody/
|
||||
RUN mkdir -p /var/log/prosody/
|
||||
RUN mkdir -p /etc/prosodycert/
|
||||
RUN mkdir -p /run/nginx && chown nginx:nginx /run/nginx/
|
||||
RUN mkdir -p /srv/public && mkdir -p /etc/tls-update
|
||||
|
||||
RUN yarn global add http-server
|
||||
|
||||
RUN addgroup prosody
|
||||
RUN adduser -D -S -h /var/lib/prosody -H -G prosody prosody
|
||||
@@ -40,6 +42,6 @@ ADD vnctalk /vnc/vnctalk
|
||||
RUN cd /vnc/vnctalk && cp -Rp * /usr/local/lib/prosody/modules/
|
||||
ADD config /vnc/config
|
||||
|
||||
ENV __FLUSH_LOG yes
|
||||
ENV __FLUSH_LOG=yes
|
||||
|
||||
CMD ["/vnc/config/startup.sh"]
|
||||
|
||||
Executable
+12
@@ -0,0 +1,12 @@
|
||||
#!/bin/sh
|
||||
|
||||
if [ -f /etc/tls-update/tls.crt ]; then
|
||||
OLDHASH=$(md5sum /etc/prosody-ssl.pem | awk '{print $1}')
|
||||
NEWHASH=$(md5sum /etc/tls-update/tls.crt | awk '{print $1}')
|
||||
if [ "x$OLDHASH" != "x$NEWHASH" ]; then
|
||||
# cert in secret is changed - fail healthcheck to restart with new cert
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
/usr/lib/nagios/plugins/check_tcp -H 127.0.0.1 -p 5582 -w 6 -c 3
|
||||
@@ -1,7 +1,7 @@
|
||||
<html>
|
||||
<head><title>VNClagoon redirect</title></head>
|
||||
<script type="text/javascript">
|
||||
window.location.replace("${httpRedirectTarget}");
|
||||
window.location.replace("${REDIRECT_TARGET}");
|
||||
</script>
|
||||
<body>
|
||||
|
||||
|
||||
Executable
+66
@@ -0,0 +1,66 @@
|
||||
#!/bin/sh
|
||||
|
||||
echo "running startup"
|
||||
|
||||
mkdir -p /etc/prosody/certs
|
||||
|
||||
if [ -z "$redirectTarget" ]; then
|
||||
REDIRECT_TARGET="https://vnclagoon.com"
|
||||
else
|
||||
REDIRECT_TARGET="$redirectTarget"
|
||||
fi
|
||||
|
||||
echo "redirect: $REDIRECT_TARGET"
|
||||
|
||||
export REDIRECT_TARGET
|
||||
|
||||
envsubst < /vnc/config/index.html.template > /srv/public/index.html
|
||||
cat /vnc/config/status.html > /srv/public/status.html
|
||||
|
||||
defaultProsodySSLkey="LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRHdqakRJL2hiWERXZTQKRlB0RGtCbG9wUjBJSTQ2U25tY001R3ZQSzlXVkx6dXM0YlBsTmF5Y2dVVFhGTUR2OThmTTdCa3pYaEFuRGorTAo4VTQ1dnp6bW1STHQ3aDBHdStud0t1dXg2Z2MvTW9XVjJYd3JlY1U0bUp2Z0IvTW9QZ05ReGNVVlhHYTF6VFJLCm5VMDJDa28zUEZaNmxWNkFEN3dISGR0cXhTbGQxdTVxMnZMa3VHM2psellqZFJmc2tTdjNLS1BJS3FKdUszM0sKUnRDb1J1TzBvZFNzOHN2MmhmYVdEangvZEEyQ29ubXh3RTlIa3VCUFhIWnQzM2s3ajdTWkh6ZnZxZ1BibVRXNwpuTmhTWVRCa05LRXpHU051a0gvQTcrS0VUWXJoVFcwTUNVSkNIbE5oSlY5MmYxaFBjeGVHMGhJV0J0bEoyS1RuClNHQUI3S0FaQWdNQkFBRUNnZ0VBQ3g4bjFrTVpIenc1YldOYThwYTQ5Z09jUWdJUzEyaUhieXNvYU4ybjlFdkkKd0lkMjM4UUpoUHJkQ2V5bHR2S0h4RXV1SnBmVXUxbUhTcHNQZU5BRXFzeXMrVjhtN0diSHZCamY2TXZmSmViYQpFa0dKNGlDeEk1cTZxakx6NVFwbzhOVVQ5WmJlRU0yNSt6RW1ucmIvRTJxd3ZONG5EbGlyNHRCWWtxa203bldvCmdjbFk4RHpWSy9qcHZpSThSVmkzckFBTGlPbU50NWgwUHJGN0dFYVBRQ3Z4eVVEa1VZVGRaUjB1bTFMalZmZjUKcEMvVlRhUzFsdkNCd3JTb0FRdUlnQVRjQ0xGTDRpS0FIQjFHdnEwK2FsQXBCaWFpY1Z0WGQ5c0tBalBsS3R2dgpOamJFc3BBUzJFSVBBRHRZNmg4Yzd3R016NGxCenEzSm5oaVppUFJkZVFLQmdRRDVqMGtpbmFORitXR3dFbVVYCjBLWkk2dnM3R0YwelVQaW1FaFBPRmxrYVczcTZYUXFpN3ArbVpJUUhreEpmWlVMcEdtUm1rL3JsMlBHUnZzTzkKWHAyamVTbmQyRnlGdnRkYUpTcXMyOTNVRC8vZmtuQTQ5U0E2NW5tSkYrdUFkMlRBQW5JOFNmTVZHV2hLNGltbQo0aU1BNzRKM2RvUG1XdzFHWm9JZzZ6NzVCd0tCZ1FEMncyc09md2lJVlNvT3JqWitNMzJrUytmVWFjRUxxSmNQCk4wc0Z6Um1YY0RPY1VyamlCcDNwOXRzcmxqNzc4TkpWUkVSTG1PVHRleVFJWjVpTVBLQW15cTNleHBhY2FFSHIKN1M3WUtVcXBRRGZhbkNCVkdYcFdmcW84bDZZeEM3SVhKSFY5SjVZV05HWWVzWW5QWVh0dEdPQVlRQWlxUnpRYwpHdHpycHRMMTN3S0JnUURzNmVIOFFycWx5MEc1N1R5Ymh6RFZPSDZZYzJESFBxOU91UXFrTXdNVHlwU1FKNVBaCmFiK1dMd1pJU282K2tWc2NBRG9nUjR1QWVKdWNTUVY1MlVDOTJHQ3VncUFUT0VFcEN1K2dlbm4wdjl1aFcxdSsKTnJjS001SmRXNS91cldtdi9xS0VLWS9qRCtPNmMwb25hN2JmUklFTytDdnZtN0RXaktvc3BpZDZNUUtCZ1FEWgpIcGpUNkhKWmdwVysxUXFkZ0RETW52MGNxUEJ5a2FSWWZ3NUR6SEw0RElGY3lteGljKy8rTEhZcm84ZEhabDJyCktLWHUzbGlQbkFuWVcwNmVGYm5VYUFFVVF5ZkI5dm9KM0dlYlNybW1zaHB5LzJ4emREZHdZNExtVFlpdEh0MVQKLzRCZzNyUHdWYXFFMXpHcWh0dFM0dEJLaGcwWnhnelRyYzgwaVZTVmdRS0JnUUNCZ1pYaVEwY3FpWkpHdWkrcwoxRXhWdnNBdjh4NnJLMmEzc0ZvOXE1WEc4NnZuVEdrVElNNmZCWXo2Qm1lMTdiTDgrYmVKcjRmeVc4WWlENGVWCjFrQWxuaUdlYnZDcTNrSlh4U0VhdjQxM0dLQzhkMFZqWVpFbUVaN1hkU1dxcWVWa0xpUGNNVFdnaC9DdmpLU3YKVnpnOGFyN3VZaUh3WGdPQXNFVWJpWllNaUE9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg=="
|
||||
|
||||
defaultProsodySSLcert="LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ5ekNDQXQrZ0F3SUJBZ0lVZSsyVmpVM3psWDVzUHVqWGFZNnY0UWZOK2VRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2JqRUxNQWtHQTFVRUJoTUNSMEl4RXpBUkJnTlZCQW9NQ2xCeWIzTnZaSGtnU1UweExEQXFCZ05WQkFzTQpJMmgwZEhCek9pOHZjSEp2YzI5a2VTNXBiUzlrYjJNdlkyVnlkR2xtYVdOaGRHVnpNUnd3R2dZRFZRUUREQk5GCmVHRnRjR3hsSUdObGNuUnBabWxqWVhSbE1CNFhEVEl5TURrd01qRXlNVGt3T1ZvWERUSXpNRGt3TWpFeU1Ua3cKT1Zvd2JqRUxNQWtHQTFVRUJoTUNSMEl4RXpBUkJnTlZCQW9NQ2xCeWIzTnZaSGtnU1UweExEQXFCZ05WQkFzTQpJMmgwZEhCek9pOHZjSEp2YzI5a2VTNXBiUzlrYjJNdlkyVnlkR2xtYVdOaGRHVnpNUnd3R2dZRFZRUUREQk5GCmVHRnRjR3hsSUdObGNuUnBabWxqWVhSbE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0MKQVFFQThJNHd5UDRXMXcxbnVCVDdRNUFaYUtVZENDT09rcDVuRE9Scnp5dlZsUzg3ck9HejVUV3NuSUZFMXhUQQo3L2ZIek93Wk0xNFFKdzQvaS9GT09iODg1cGtTN2U0ZEJydnA4Q3Jyc2VvSFB6S0ZsZGw4SzNuRk9KaWI0QWZ6CktENERVTVhGRlZ4bXRjMDBTcDFOTmdwS056eFdlcFZlZ0ErOEJ4M2Jhc1VwWGRidWF0cnk1TGh0NDVjMkkzVVgKN0pFcjl5aWp5Q3FpYml0OXlrYlFxRWJqdEtIVXJQTEw5b1gybGc0OGYzUU5ncUo1c2NCUFI1TGdUMXgyYmQ5NQpPNCswbVI4Mzc2b0QyNWsxdTV6WVVtRXdaRFNoTXhramJwQi93Ty9paEUySzRVMXREQWxDUWg1VFlTVmZkbjlZClQzTVhodElTRmdiWlNkaWs1MGhnQWV5Z0dRSURBUUFCbzRHTU1JR0pNQXdHQTFVZEV3UUZNQU1CQWY4d2VRWUQKVlIwUkJISXdjSUlKYkc5allXeG9iM04wb0NRR0NDc0dBUVVGQndnSG9CZ1dGbDk0YlhCd0xXTnNhV1Z1ZEM1cwpiMk5oYkdodmMzU2dKQVlJS3dZQkJRVUhDQWVnR0JZV1gzaHRjSEF0YzJWeWRtVnlMbXh2WTJGc2FHOXpkS0FYCkJnZ3JCZ0VGQlFjSUJhQUxEQWxzYjJOaGJHaHZjM1F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUpGK0dBZ28KSW8vWlBqVWM4YWJQbXZCMHZNTlhRVURYVGlzdkxRdDg5MGJmNzVDWkM2SFVGekw5ZjljamQ1NU1ZTG80QllxZQpVcjZOL3R3ZGRHWVNwb3JBY1dQWmtIb3F5bmQ5QXhIR0VpQUtvV2s5VXB0U2crcWhRd1JLQ1owQnBKemcrOENqCmtUdHBiWmdMa0s5RWhmSWlXbW1LSG41cHovYkhaK0FHaU9ESzcrYmsxZk1IZ0dDemFjVWVsU2lwSS9WOE1jY3IKbitwaGRRc2pjN1Vpd05zNlFEL2dxSS9GME1pV2FCd3ZiSjg0dWk3YkF4OFJqZ29OZC9ya3htUGhyQzBtL2VYYgpjUGFTOXpEMGFuUFN3ZUQ5VEQzUXBvNXZaNlJMempzNjZRR09VK0Y0a1dIU2NMTmVhaW9mOUV1aEMxQ0VrMDk4CmxQZ0F2SEQydTlKcURLdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
|
||||
|
||||
|
||||
if [ -n "$prosodySSLkey" ]; then
|
||||
echo "$prosodySSLkey" | base64 -d > /etc/prosody-ssl.key
|
||||
else
|
||||
echo "$defaultProsodySSLkey" | base64 -d > /etc/prosody-ssl.key
|
||||
fi
|
||||
|
||||
if [ -n "$prosodySSLcert" ]; then
|
||||
echo "$prosodySSLcert" | base64 -d > /etc/prosody-ssl.pem
|
||||
else
|
||||
echo "$defaultProsodySSLcert" | base64 -d > /etc/prosody-ssl.pem
|
||||
fi
|
||||
|
||||
if [ -f /etc/tls-update/tls.crt ]; then
|
||||
cat /etc/tls-update/tls.crt > /etc/prosody-ssl.pem
|
||||
fi
|
||||
|
||||
if [ -f /etc/tls-update/tls.key ]; then
|
||||
cat /etc/tls-update/tls.key > /etc/prosody-ssl.key
|
||||
fi
|
||||
|
||||
if [ -z "$log_slow_events_threshold" ]; then
|
||||
log_slow_events_threshold="1.5"
|
||||
fi
|
||||
|
||||
if [ -z "$DEFAULT_JITSI_CONFERENCE" ]; then
|
||||
DEFAULT_JITSI_CONFERENCE="conference.jitsi.dev.vnc.de"
|
||||
export DEFAULT_JITSI_CONFERENCE
|
||||
fi
|
||||
|
||||
chmod 444 /etc/prosody-ssl.pem
|
||||
chmod 444 /etc/prosody-ssl.key
|
||||
|
||||
mkdir -p /etc/prosody
|
||||
chmod 755 /etc/prosody
|
||||
envsubst < /vnc/config/prosody.cfg.lua.template > /etc/prosody/prosody.cfg.lua
|
||||
|
||||
cat /etc/prosody/prosody.cfg.lua
|
||||
|
||||
# su prosody -c /usr/local/bin/prosody -F
|
||||
env
|
||||
|
||||
/usr/local/bin/http-server /srv/public/ -p 8080 -r --proxy http://localhost:8080?
|
||||
+11
-4
@@ -12,9 +12,8 @@ fi
|
||||
|
||||
export REDIRECT_TARGET
|
||||
|
||||
envsubst < /vnc/config/index.html.template > /var/www/localhost/htdocs/index.html
|
||||
|
||||
envsubst < /vnc/config/default.conf.template > /etc/nginx/conf.d/default.conf
|
||||
envsubst < /vnc/config/index.html.template > /srv/public/index.html
|
||||
cat /vnc/config/status.html > /srv/public/status.html
|
||||
|
||||
defaultProsodySSLkey="LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRHdqakRJL2hiWERXZTQKRlB0RGtCbG9wUjBJSTQ2U25tY001R3ZQSzlXVkx6dXM0YlBsTmF5Y2dVVFhGTUR2OThmTTdCa3pYaEFuRGorTAo4VTQ1dnp6bW1STHQ3aDBHdStud0t1dXg2Z2MvTW9XVjJYd3JlY1U0bUp2Z0IvTW9QZ05ReGNVVlhHYTF6VFJLCm5VMDJDa28zUEZaNmxWNkFEN3dISGR0cXhTbGQxdTVxMnZMa3VHM2psellqZFJmc2tTdjNLS1BJS3FKdUszM0sKUnRDb1J1TzBvZFNzOHN2MmhmYVdEangvZEEyQ29ubXh3RTlIa3VCUFhIWnQzM2s3ajdTWkh6ZnZxZ1BibVRXNwpuTmhTWVRCa05LRXpHU051a0gvQTcrS0VUWXJoVFcwTUNVSkNIbE5oSlY5MmYxaFBjeGVHMGhJV0J0bEoyS1RuClNHQUI3S0FaQWdNQkFBRUNnZ0VBQ3g4bjFrTVpIenc1YldOYThwYTQ5Z09jUWdJUzEyaUhieXNvYU4ybjlFdkkKd0lkMjM4UUpoUHJkQ2V5bHR2S0h4RXV1SnBmVXUxbUhTcHNQZU5BRXFzeXMrVjhtN0diSHZCamY2TXZmSmViYQpFa0dKNGlDeEk1cTZxakx6NVFwbzhOVVQ5WmJlRU0yNSt6RW1ucmIvRTJxd3ZONG5EbGlyNHRCWWtxa203bldvCmdjbFk4RHpWSy9qcHZpSThSVmkzckFBTGlPbU50NWgwUHJGN0dFYVBRQ3Z4eVVEa1VZVGRaUjB1bTFMalZmZjUKcEMvVlRhUzFsdkNCd3JTb0FRdUlnQVRjQ0xGTDRpS0FIQjFHdnEwK2FsQXBCaWFpY1Z0WGQ5c0tBalBsS3R2dgpOamJFc3BBUzJFSVBBRHRZNmg4Yzd3R016NGxCenEzSm5oaVppUFJkZVFLQmdRRDVqMGtpbmFORitXR3dFbVVYCjBLWkk2dnM3R0YwelVQaW1FaFBPRmxrYVczcTZYUXFpN3ArbVpJUUhreEpmWlVMcEdtUm1rL3JsMlBHUnZzTzkKWHAyamVTbmQyRnlGdnRkYUpTcXMyOTNVRC8vZmtuQTQ5U0E2NW5tSkYrdUFkMlRBQW5JOFNmTVZHV2hLNGltbQo0aU1BNzRKM2RvUG1XdzFHWm9JZzZ6NzVCd0tCZ1FEMncyc09md2lJVlNvT3JqWitNMzJrUytmVWFjRUxxSmNQCk4wc0Z6Um1YY0RPY1VyamlCcDNwOXRzcmxqNzc4TkpWUkVSTG1PVHRleVFJWjVpTVBLQW15cTNleHBhY2FFSHIKN1M3WUtVcXBRRGZhbkNCVkdYcFdmcW84bDZZeEM3SVhKSFY5SjVZV05HWWVzWW5QWVh0dEdPQVlRQWlxUnpRYwpHdHpycHRMMTN3S0JnUURzNmVIOFFycWx5MEc1N1R5Ymh6RFZPSDZZYzJESFBxOU91UXFrTXdNVHlwU1FKNVBaCmFiK1dMd1pJU282K2tWc2NBRG9nUjR1QWVKdWNTUVY1MlVDOTJHQ3VncUFUT0VFcEN1K2dlbm4wdjl1aFcxdSsKTnJjS001SmRXNS91cldtdi9xS0VLWS9qRCtPNmMwb25hN2JmUklFTytDdnZtN0RXaktvc3BpZDZNUUtCZ1FEWgpIcGpUNkhKWmdwVysxUXFkZ0RETW52MGNxUEJ5a2FSWWZ3NUR6SEw0RElGY3lteGljKy8rTEhZcm84ZEhabDJyCktLWHUzbGlQbkFuWVcwNmVGYm5VYUFFVVF5ZkI5dm9KM0dlYlNybW1zaHB5LzJ4emREZHdZNExtVFlpdEh0MVQKLzRCZzNyUHdWYXFFMXpHcWh0dFM0dEJLaGcwWnhnelRyYzgwaVZTVmdRS0JnUUNCZ1pYaVEwY3FpWkpHdWkrcwoxRXhWdnNBdjh4NnJLMmEzc0ZvOXE1WEc4NnZuVEdrVElNNmZCWXo2Qm1lMTdiTDgrYmVKcjRmeVc4WWlENGVWCjFrQWxuaUdlYnZDcTNrSlh4U0VhdjQxM0dLQzhkMFZqWVpFbUVaN1hkU1dxcWVWa0xpUGNNVFdnaC9DdmpLU3YKVnpnOGFyN3VZaUh3WGdPQXNFVWJpWllNaUE9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg=="
|
||||
|
||||
@@ -33,6 +32,15 @@ else
|
||||
echo "$defaultProsodySSLcert" | base64 -d > /etc/prosody-ssl.pem
|
||||
fi
|
||||
|
||||
if [ -f /etc/tls-update/tls.crt ]; then
|
||||
cat /etc/tls-update/tls.crt > /etc/prosody-ssl.pem
|
||||
fi
|
||||
|
||||
if [ -f /etc/tls-update/tls.key ]; then
|
||||
cat /etc/tls-update/tls.key > /etc/prosody-ssl.key
|
||||
fi
|
||||
|
||||
|
||||
if [ -z "$log_slow_events_threshold" ]; then
|
||||
log_slow_events_threshold="1.5"
|
||||
fi
|
||||
@@ -57,5 +65,4 @@ env
|
||||
touch /var/log/prosody.log
|
||||
tail -f /var/log/prosody.log &
|
||||
|
||||
/usr/sbin/nginx
|
||||
/usr/local/bin/prosody -F
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
<html>
|
||||
<head><title>VNClagoon status</title></head>
|
||||
<body>
|
||||
<center><h1>VNClagoon status</h1></center>
|
||||
<hr><center>OK</center>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Reference in New Issue
Block a user