wmantly
9ca3b1a113
Two related fixes found while testing the Docker build: 1. Print the proxy's local anti-lockout admin (proxyadmin2) password in the summary. Previously this account was always created with username == password == "proxyadmin2" (a hardcoded proxy default — see theta42/proxy#133), and setup.sh had no way to know or surface whatever password ended up in use. Now generates a random CFG_PROXY_ADMIN_PASS the same way it already does for the SSO admin, writes it into proxy-secrets.js's auth.localAdminPass (read by the proxy once, on first creation of that account), and prints it in the final summary. read_config_kv() reads it back from proxy-secrets.js so this works correctly on re-runs too (config already exists -> ensure_config's early-return path never sets CFG_PROXY_ADMIN_PASS in that run's shell, same reasoning as the existing SSO_HOST/PROXY_HOST/ADMIN_PASS readback). 2. Pass GIT_COMMIT build-args so the proxy/sso-manager images bake in their real commit hash instead of "unknown". Both submodules' .git is a pointer file, not a real repo, so the images can never resolve their own commit from inside the Docker build context no matter what (see theta42/proxy#133 and theta42/sso-manager-node#43) -- only the host, where the submodule resolves correctly, can compute it. setup.sh does that with `git -C <submodule> rev-parse --short HEAD` right before each build and exports it for docker-compose.yml to pick up. Verified end to end against a real ./setup.sh run (not just docker build in isolation): - Local admin password printed on first run, logs in successfully; the DEFAULT ("proxyadmin2"/"proxyadmin2") correctly does NOT. - Re-running prints the SAME password (confirms the readback path works on re-runs, not just first-run). - `docker exec proxy cat /app/.build_commit` and the equivalent for sso-manager both match `git -C <submodule> rev-parse --short HEAD` on the host — footer now shows the real hash instead of "unknown".
55 lines
3.2 KiB
Bash
55 lines
3.2 KiB
Bash
# ─────────────────────────────────────────────────────────────────────────────
|
|
# setup.env — first-run setup for the theta-env stack.
|
|
#
|
|
# This file is used ONLY on the FIRST run of ./setup.sh, to generate
|
|
# ./config/sso-secrets.js + ./config/proxy-secrets.js with your domain filled
|
|
# in everywhere consistently. Once ./config/*.js exist they are operator-owned
|
|
# (edit them directly; setup.env is ignored on later runs).
|
|
#
|
|
# cp setup.env.example setup.env
|
|
# $EDITOR setup.env # set CFG_DOMAIN below to your domain
|
|
# ./setup.sh # generates ./config/ and builds the stack
|
|
#
|
|
# Copying this file to setup.env (gitignored) keeps your domain out of git.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# Your domain. THIS IS THE ONE PLACE THE DOMAIN IS ENTERED. Everything else
|
|
# derives from it: the SSO/proxy hostnames default to sso.<domain> /
|
|
# proxy.<domain>, and the LDAP base DN is built from it (example.com becomes
|
|
# dc=example,dc=com; a 3-label domain like myhost.duckdns.org becomes
|
|
# dc=myhost,dc=duckdns,dc=org — any number of labels works). Required —
|
|
# setup.sh refuses to run without it.
|
|
CFG_DOMAIN=example.com
|
|
|
|
# Public hostnames. Optional — default to sso.<domain> / proxy.<domain> derived
|
|
# from CFG_DOMAIN above. Uncomment and set only if your hostnames differ
|
|
# (e.g. a different subdomain, or the domain isn't the bare apex):
|
|
#CFG_SSO_HOST=sso.example.com
|
|
#CFG_PROXY_HOST=proxy.example.com
|
|
|
|
# Advanced: override the derived LDAP base DN directly (e.g. to namespace
|
|
# under an OU-style prefix). Leave unset to use the DN built from CFG_DOMAIN:
|
|
#CFG_BASE_DN=dc=example,dc=com
|
|
|
|
# Optional — sensible defaults if left blank:
|
|
#CFG_ORG=SSO Manager # app display name + outbound email org
|
|
#CFG_ADMIN_UID=admin # initial SSO admin username
|
|
#CFG_ADMIN_EMAIL=admin@proxy.example.com # defaults to admin@<proxyHost>
|
|
#CFG_LDAP_CERT_CN= # LDAP TLS cert CN; empty -> defaults to the domain
|
|
|
|
# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
|
|
#CFG_SMTP_HOST=smtp.example.com
|
|
#CFG_SMTP_PORT=587
|
|
#CFG_SMTP_USER=noreply@example.com
|
|
#CFG_SMTP_PASS=your-smtp-password
|
|
#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
|
|
|
|
# ── DO NOT put secrets here ──────────────────────────────────────────────────
|
|
# The LDAP admin password, JWT secret, admin password, LDAP service-account
|
|
# password, and the proxy's local admin password are all GENERATED (random)
|
|
# into ./config/sso-secrets.js + ./config/proxy-secrets.js on first run.
|
|
# Change them later by editing those files directly (the proxy's local admin
|
|
# password is the exception — see ./config/proxy-secrets.js's auth.localAdminPass
|
|
# comment for how to actually change it after the account exists). Do NOT set
|
|
# CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS /
|
|
# CFG_PROXY_ADMIN_PASS here. |