wmantly
9fb240ff45
Composes theta42/sso-manager-node and theta42/proxy (as git submodules) on a single Docker network and automates first-run wiring. - docker-compose.yml: sso-manager (build ./sso-manager-node/Dockerfile.openldap) + proxy (build ./proxy/Dockerfile) on theta-net; SSO UI + mgmt port bound to localhost, LDAPS published, proxy 80/443/4443 published. - setup.sh: idempotent one-command bring-up — validates .env, starts SSO, runs the bootstrap, writes ./proxy.env, starts the proxy, prints admin login. - bootstrap/bootstrap.js: runs inside the sso-manager container (self-contained, Node built-ins + fetch only) — creates the LDAP service account, first admin (+ app_sso_admin/app_sso_oauth_admin membership), registers the proxy as an OIDC client via the SSO HTTP API, emits CLIENT_ID/CLIENT_SECRET. - .env.example: all tunables (LDAP_BASE_DN, LDAP_ADMIN_PASS, JWT_SECRET, SSO_HOST, PROXY_HOST, BOOTSTRAP_ADMIN_*, LDAP_SERVICE_PASS, SMTP_*, ports). - README.md + docs/ (Jekyll site for GitHub Pages): quickstart, architecture, standalone usage. Co-Authored-By: Claude <noreply@anthropic.com>
239 lines
11 KiB
Bash
Executable File
239 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# theta-env setup — one-command bring-up of the unified SSO Manager + Proxy stack.
|
|
#
|
|
# git clone --recursive <theta-env> && cd theta-env
|
|
# cp .env.example .env # edit the REQUIRED values
|
|
# ./setup.sh
|
|
#
|
|
# Idempotent: safe to re-run. It (re)starts the SSO Manager, runs the bootstrap
|
|
# (which converges the LDAP service account / first admin / OAuth client to the
|
|
# .env values), writes ./proxy.env (the proxy's env_file), then starts the proxy.
|
|
#
|
|
# What it does, in order:
|
|
# 1. Validate .env (copy from .env.example if missing) + the REQUIRED values.
|
|
# 2. docker compose up -d sso-manager; wait for /health.
|
|
# 3. docker compose exec sso-manager node /bootstrap/bootstrap.js
|
|
# -> prints CLIENT_ID / CLIENT_SECRET / ALREADY_CONFIGURED on stdout.
|
|
# 4. Write ./proxy.env from .env + the bootstrap output (the proxy's app_* env).
|
|
# 5. docker compose up -d proxy; wait for /health.
|
|
# 6. Print the first-admin login + the public URLs.
|
|
#
|
|
# Requires: docker + docker compose (v1 standalone or v2 plugin). The compose
|
|
# file uses `version: '3.8'` + single-level ${VAR} interpolation so v1 works.
|
|
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
# ── Helpers ──────────────────────────────────────────────────────────────────
|
|
info() { printf '\033[1;34m[setup]\033[0m %s\n' "$*"; }
|
|
warn() { printf '\033[1;33m[setup]\033[0m %s\n' "$*" >&2; }
|
|
error() { printf '\033[1;31m[setup]\033[0m %s\n' "$*" >&2; }
|
|
die() { error "$*"; exit 1; }
|
|
|
|
# Detect docker compose (v2 plugin `docker compose` or v1 standalone `docker-compose`).
|
|
if docker compose version >/dev/null 2>&1; then
|
|
COMPOSE=(docker compose)
|
|
elif command -v docker-compose >/dev/null 2>&1; then
|
|
COMPOSE=(docker-compose)
|
|
else
|
|
die "docker compose not found. Install Docker Compose (v2 plugin or v1 standalone)."
|
|
fi
|
|
|
|
# ── 1. Load + validate .env ───────────────────────────────────────────────────
|
|
if [[ ! -f .env ]]; then
|
|
if [[ -f .env.example ]]; then
|
|
cp .env.example .env
|
|
info "Created .env from .env.example — EDIT IT and re-run ./setup.sh."
|
|
info "Required: LDAP_ADMIN_PASS, JWT_SECRET, SSO_HOST, PROXY_HOST, BOOTSTRAP_ADMIN_PASS."
|
|
exit 0
|
|
else
|
|
die ".env not found and no .env.example to copy from."
|
|
fi
|
|
fi
|
|
|
|
# shellcheck disable=SC1091
|
|
set -a; source .env; set +a
|
|
|
|
require() { [[ -n "${!1:-}" ]] || die ".env is missing required key: $1"; }
|
|
require LDAP_BASE_DN
|
|
require LDAP_ADMIN_PASS
|
|
require SSO_HOST
|
|
require PROXY_HOST
|
|
require BOOTSTRAP_ADMIN_UID
|
|
require BOOTSTRAP_ADMIN_PASS
|
|
|
|
# JWT_SECRET: generate + persist if blank (so it survives re-runs).
|
|
if [[ -z "${JWT_SECRET:-}" ]]; then
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
JWT_SECRET=$(openssl rand -hex 32)
|
|
else
|
|
JWT_SECRET="theta-env-jwt-$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' ')"
|
|
fi
|
|
if grep -q '^JWT_SECRET=' .env; then
|
|
sed -i "s|^JWT_SECRET=.*|JWT_SECRET=${JWT_SECRET}|" .env
|
|
else
|
|
printf 'JWT_SECRET=%s\n' "$JWT_SECRET" >> .env
|
|
fi
|
|
info "Generated + persisted JWT_SECRET into .env (save it — it signs all tokens)."
|
|
fi
|
|
|
|
# Default BOOTSTRAP_ADMIN_EMAIL if blank.
|
|
BOOTSTRAP_ADMIN_EMAIL="${BOOTSTRAP_ADMIN_EMAIL:-admin@${PROXY_HOST}}"
|
|
# Default LDAP_SERVICE_PASS if blank (random).
|
|
if [[ -z "${LDAP_SERVICE_PASS:-}" ]]; then
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
LCD=$(openssl rand -hex 16)
|
|
else
|
|
LCD="svc-$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' ')"
|
|
fi
|
|
LDAP_SERVICE_PASS="$LCD"
|
|
if grep -q '^LDAP_SERVICE_PASS=' .env; then
|
|
sed -i "s|^LDAP_SERVICE_PASS=.*|LDAP_SERVICE_PASS=${LDAP_SERVICE_PASS}|" .env
|
|
else
|
|
printf 'LDAP_SERVICE_PASS=%s\n' "$LDAP_SERVICE_PASS" >> .env
|
|
fi
|
|
info "Generated + persisted LDAP_SERVICE_PASS into .env."
|
|
fi
|
|
|
|
info "Stack config:"
|
|
info " Base DN: ${LDAP_BASE_DN}"
|
|
info " SSO host: https://${SSO_HOST}"
|
|
info " Proxy host: https://${PROXY_HOST}"
|
|
info " Admin uid: ${BOOTSTRAP_ADMIN_UID}"
|
|
|
|
# ── 2. Start SSO Manager, wait for health ─────────────────────────────────────
|
|
info "Building + starting sso-manager (first run builds the image; this takes a while)..."
|
|
"${COMPOSE[@]}" up -d --build sso-manager
|
|
|
|
info "Waiting for sso-manager to be healthy..."
|
|
for i in $(seq 1 60); do
|
|
status=$("${COMPOSE[@]}" ps -o json sso-manager 2>/dev/null \
|
|
| grep -o '"Health":"healthy"' || true)
|
|
if [[ -n "$status" ]]; then info "sso-manager is healthy."; break; fi
|
|
# Fall back to probing /health directly (compose v1 lacks `ps -o json`).
|
|
if docker exec sso-manager wget -q -O- http://localhost:3001/health >/dev/null 2>&1; then
|
|
info "sso-manager is healthy (probed /health)."; break
|
|
fi
|
|
if (( i == 60 )); then die "sso-manager did not become healthy in 60s. Check: ${COMPOSE[*]} logs sso-manager"; fi
|
|
sleep 2
|
|
done
|
|
|
|
# ── 3. Run the bootstrap (writes CLIENT_ID/CLIENT_SECRET/ALREADY_CONFIGURED) ──
|
|
# PROXY_ENV_EXISTS tells the bootstrap whether to rotate the client secret: if
|
|
# proxy.env already exists, keep the existing secret (the proxy can still read
|
|
# it); if not, rotate so a wiped-and-restored proxy gets a usable secret.
|
|
PROXY_ENV_EXISTS=0
|
|
[[ -f ./proxy.env ]] && PROXY_ENV_EXISTS=1
|
|
|
|
info "Running bootstrap (creates/updates the LDAP service account, first admin, OAuth client)..."
|
|
BOOTSTRAP_OUT=$("${COMPOSE[@]}" exec -T \
|
|
-e LDAP_BASE_DN="${LDAP_BASE_DN}" \
|
|
-e LDAP_ADMIN_PASS="${LDAP_ADMIN_PASS}" \
|
|
-e BOOTSTRAP_ADMIN_UID="${BOOTSTRAP_ADMIN_UID}" \
|
|
-e BOOTSTRAP_ADMIN_PASS="${BOOTSTRAP_ADMIN_PASS}" \
|
|
-e BOOTSTRAP_ADMIN_EMAIL="${BOOTSTRAP_ADMIN_EMAIL}" \
|
|
-e LDAP_SERVICE_PASS="${LDAP_SERVICE_PASS}" \
|
|
-e SSO_HOST="${SSO_HOST}" \
|
|
-e PROXY_HOST="${PROXY_HOST}" \
|
|
-e PROXY_ENV_EXISTS="${PROXY_ENV_EXISTS}" \
|
|
sso-manager node /bootstrap/bootstrap.js) \
|
|
|| die "bootstrap failed:\n${BOOTSTRAP_OUT}"
|
|
|
|
# Parse KEY=VALUE lines from stdout (bootstrap logs go to stderr, so this is clean).
|
|
getval() { echo "$BOOTSTRAP_OUT" | grep -m1 "^$1=" | cut -d= -f2-; }
|
|
CLIENT_ID=$(getval CLIENT_ID)
|
|
CLIENT_SECRET=$(getval CLIENT_SECRET)
|
|
ALREADY_CONFIGURED=$(getval ALREADY_CONFIGURED)
|
|
[[ -n "$CLIENT_ID" ]] || die "bootstrap did not return CLIENT_ID:\n${BOOTSTRAP_OUT}"
|
|
[[ -n "$CLIENT_SECRET" ]] || die "bootstrap did not return CLIENT_SECRET:\n${BOOTSTRAP_OUT}"
|
|
|
|
# ── 4. Write ./proxy.env (the proxy's env_file) ───────────────────────────────
|
|
# All app_* so the proxy reads them via @simpleworkjs/conf (>=1.1.0) env overrides.
|
|
# Browser-facing endpoints use https://${SSO_HOST}; server-to-server
|
|
# token/userinfo use the internal http://sso-manager:3001 (no hairpin through the
|
|
# public TLS listener). LDAP over LDAPS on the docker network with the SSO's
|
|
# self-signed cert (rejectUnauthorized=false). adminGroups + adminUsers are JSON
|
|
# arrays (conf coerces via JSON.parse).
|
|
if [[ "$CLIENT_SECRET" == "__UNCHANGED__" ]]; then
|
|
if [[ -f ./proxy.env ]]; then
|
|
info "proxy.env exists and client unchanged — preserving existing proxy.env."
|
|
CLIENT_SECRET=$(grep -m1 '^app_oidc__clientSecret=' ./proxy.env | cut -d= -f2-)
|
|
[[ -n "$CLIENT_SECRET" ]] || die "proxy.env exists but has no app_oidc__clientSecret; delete it and re-run."
|
|
else
|
|
# Shouldn't happen (bootstrap only emits __UNCHANGED__ when proxy.env exists),
|
|
# but recover by rotating: re-run bootstrap with PROXY_ENV_EXISTS=0.
|
|
die "proxy.env missing but bootstrap said unchanged. Delete proxy.env if present and re-run."
|
|
fi
|
|
fi
|
|
|
|
info "Writing ./proxy.env (proxy app_* config)..."
|
|
cat > ./proxy.env << PROXYEOF
|
|
# Generated by setup.sh from .env + the bootstrap output. DO NOT COMMIT.
|
|
# The proxy reads these via @simpleworkjs/conf app_* env overrides.
|
|
|
|
# ── OIDC (browser-facing endpoints use the public SSO URL; token/userinfo use
|
|
# the internal docker-network URL so the proxy never hairpins through TLS).
|
|
app_oidc__issuer=https://${SSO_HOST}
|
|
app_oidc__authorizationEndpoint=https://${SSO_HOST}/oauth/authorize
|
|
app_oidc__endSessionEndpoint=https://${SSO_HOST}/oauth/logout
|
|
app_oidc__tokenEndpoint=http://sso-manager:3001/oauth/token
|
|
app_oidc__userinfoEndpoint=http://sso-manager:3001/oauth/userinfo
|
|
app_oidc__clientId=${CLIENT_ID}
|
|
app_oidc__clientSecret=${CLIENT_SECRET}
|
|
app_oidc__redirectUri=https://${PROXY_HOST}/api/auth/oidc/callback
|
|
app_oidc__enabled=true
|
|
|
|
# ── LDAP (direct bind over LDAPS on the docker network; self-signed cert).
|
|
app_ldap__url=ldaps://sso-manager:636
|
|
app_ldap__bindDN=cn=ldapclient,ou=people,${LDAP_BASE_DN}
|
|
app_ldap__bindPassword=${LDAP_SERVICE_PASS}
|
|
app_ldap__searchBase=ou=people,${LDAP_BASE_DN}
|
|
app_ldap__userFilter=(objectClass=posixAccount)
|
|
app_ldap__tlsOptions__rejectUnauthorized=false
|
|
|
|
# ── Auth (anti-lockout: the local proxyadmin2 user + SSO admin group).
|
|
app_auth__adminGroups=["app_sso_admin"]
|
|
app_auth__adminUsers=["proxyadmin2"]
|
|
PROXYEOF
|
|
chmod 600 ./proxy.env
|
|
|
|
if [[ "$ALREADY_CONFIGURED" == "1" ]]; then
|
|
info "Stack was already configured — proxy.env refreshed with current creds."
|
|
else
|
|
info "OAuth client registered + proxy.env written."
|
|
fi
|
|
|
|
# ── 5. Start the proxy, wait for health ───────────────────────────────────────
|
|
info "Building + starting proxy (first run builds the image; this takes a while)..."
|
|
"${COMPOSE[@]}" up -d --build proxy
|
|
|
|
info "Waiting for proxy to be healthy..."
|
|
for i in $(seq 1 60); do
|
|
if docker exec proxy curl -fsS http://localhost:3000/health >/dev/null 2>&1; then
|
|
info "proxy is healthy."; break
|
|
fi
|
|
if (( i == 60 )); then die "proxy did not become healthy in 60s. Check: ${COMPOSE[*]} logs proxy"; fi
|
|
sleep 2
|
|
done
|
|
|
|
# ── 6. Summary ───────────────────────────────────────────────────────────────
|
|
echo
|
|
info "\033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
|
|
echo
|
|
echo " SSO Manager UI: https://${SSO_HOST} (fronted by the proxy under TLS)"
|
|
echo " first-run fallback: http://127.0.0.1:${SSO_PORT:-3001}"
|
|
echo " Proxy mgmt UI: https://${PROXY_HOST}"
|
|
echo " first-run fallback: http://127.0.0.1:${MGMT_PORT:-3000}"
|
|
echo
|
|
echo " First admin login:"
|
|
echo " user: ${BOOTSTRAP_ADMIN_UID}"
|
|
echo " pass: ${BOOTSTRAP_ADMIN_PASS}"
|
|
echo
|
|
echo " Next: add DNS records (or /etc/hosts) pointing ${SSO_HOST} and ${PROXY_HOST}"
|
|
echo " at this host, then open https://${SSO_HOST} and log in as the admin."
|
|
echo " The proxy auto-issues Let's Encrypt certs if port 80 is reachable;"
|
|
echo " otherwise it serves a self-signed fallback on the LAN."
|
|
echo
|
|
echo " Re-run ./setup.sh any time to converge the stack to .env (idempotent)." |