ConfigLMM 0.3.0 → 0.5.0

data/Plugins/Apps/Nginx/nginx.lmm.rb

@@ -1,22 +1,24 @@
 
+require_relative 'Connection'
+
 module ConfigLMM
     module LMM
         class Nginx < Framework::NginxApp
-            CERTBOT_PACKAGE = 'CertBotNginx'
-            REPOS_CACHE = '~/.cache/configlmm/repos'
-            ERROR_PAGES_REPO = 'https://github.com/HttpErrorPages/HttpErrorPages.git'
+            PACKAGE_NAME = 'Nginx'
+            SERVICE_NAME = :nginx
+            ERROR_PAGES_REPO = 'https://github.com/ConfigLMM/HttpErrorPages.git'
 
             def actionNginxBuild(id, target, activeState, context, options)
-
                 dir = options['output'] + '/nginx/'
-                mkdir(dir + 'conf.d', options[:dry])
-                mkdir(dir + 'servers-lmm', options[:dry])
-                copy(__dir__ + '/config-lmm', dir, options[:dry])
-                copy(__dir__ + '/nginx.conf', dir, options[:dry])
-                copy(__dir__ + '/conf.d/configlmm.conf', dir + 'conf.d/', options[:dry])
-
-                mkdir(options['output'] + WWW_DIR + 'root', options[:dry])
-                mkdir(options['output'] + WWW_DIR + 'errors', options[:dry])
+                local.mkdir(dir + 'conf.d', options[:dry])
+                local.mkdir(dir + 'servers-lmm', options[:dry])
+                local.copy(__dir__ + '/config-lmm', dir, options[:dry])
+                local.copy(__dir__ + '/nginx.conf', dir, options[:dry])
+                local.copy(__dir__ + '/conf.d/configlmm.conf', dir + 'conf.d/', options[:dry])
+                local.copy(__dir__ + '/conf.d/languages.conf', dir + 'conf.d/', options[:dry])
+
+                local.mkdir(options['output'] + NginxConnection::WWW_DIR + 'root', options[:dry])
+                local.mkdir(options['output'] + NginxConnection::WWW_DIR + 'errors', options[:dry])
             end
 
             # TODO
@@ -27,93 +29,113 @@ module ConfigLMM
             def actionNginxDeploy(id, target, activeState, context, options)
                 dir = options['output'] + '/nginx/'
 
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    raise Framework::PluginProcessError.new("Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-                    self.class.sshStart(uri) do |ssh|
-                        Framework::LinuxApp.ensurePackages([CERTBOT_PACKAGE], ssh)
-                        self.class.prepareNginxConfig(target, ssh)
-
-                        self.class.sshExec!(ssh, "mkdir -p #{CONFIG_DIR}conf.d")
-                        self.class.sshExec!(ssh, "mkdir -p #{WWW_DIR}root")
-                        self.class.sshExec!(ssh, "mkdir -p #{WWW_DIR}errors")
-                        ssh.scp.upload!(dir + 'nginx.conf', CONFIG_DIR + 'nginx.conf')
-                        ssh.scp.upload!(dir + 'conf.d/configlmm.conf', CONFIG_DIR + 'conf.d/configlmm.conf')
-                        resolverIP = self.class.sshExec!(ssh, "cat /etc/resolv.conf | grep 'nameserver' | grep -v ':' | cut -d ' ' -f 2").strip
-                        self.class.sshExec!(ssh, "sed -i 's|^resolver .*|resolver #{resolverIP};|' /etc/nginx/conf.d/configlmm.conf")
-
-                        self.class.uploadFolder(dir + 'config-lmm', CONFIG_DIR, ssh)
-                        self.class.uploadFolder(dir + 'servers-lmm', CONFIG_DIR, ssh)
-
-                        template = ERB.new(File.read(__dir__ + '/main.conf.erb'))
-                        renderTemplate(template, target, dir + 'main.conf', options)
-                        ssh.scp.upload!(dir + 'main.conf', CONFIG_DIR + 'main.conf')
-
-                        if !self.class.remoteFilePresent?(WWW_DIR + 'errors/HTTP500.html', ssh)
-                            errorPages = File.expand_path(REPOS_CACHE + '/HttpErrorPages')
-                            if !File.exist?(errorPages)
-                                mkdir(File.expand_path(REPOS_CACHE), false)
-                                begin
-                                    Framework::LinuxApp.ensurePackages(['git', 'Yarn'], '@me')
-                                rescue error
-                                    prompt.say(error, :color => :red)
-                                end
-                                `cd #{REPOS_CACHE} && git clone --quiet #{ERROR_PAGES_REPO} > /dev/null`
-                            end
-                            `cd #{errorPages} && yarn install --silent`
-                            `cd #{errorPages} && yarn run static config-dist.json > /dev/null`
-                            `cd #{errorPages} && cp -R dist errors`
-                            self.class.uploadFolder(errorPages + '/errors', WWW_DIR, ssh)
-                        end
+                # Consider:
+                # * Deploy on current host
+                # * Deploy on remote host thru SSH (eg. VPS)
+                # * Using already existing solution like Chef/Puppet/Ansible/etc
+                # * Provision from some Cloud provider
+                # We implement this as we go - what people actually use
 
-                        Framework::LinuxApp.createCertificateOverSSH(ssh)
-                    end
-                else
-                    self.class.prepareNginxConfig(target, nil)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        self.class.withConnection(linuxConnection) do |nginxConnection|
+                            target['Deploy'] = true unless target.key?('Deploy')
 
-                    copy(dir + '/config-lmm', CONFIG_DIR, options[:dry])
-                    copy(dir + '/nginx.conf', CONFIG_DIR, options[:dry])
+                            if target['Deploy']
+                                linuxConnection.ensurePackage(PACKAGE_NAME, options)
 
-                    copy(dir + '/servers-lmm', CONFIG_DIR, options['dry'])
-                    mkdir(WWW_DIR + 'root', options[:dry])
-                    mkdir(WWW_DIR + 'errors', options[:dry])
+                                linuxConnection.createDirs(options, "#{NginxConnection::CONFIG_DIR}conf.d", "#{NginxConnection::WWW_DIR}root", "#{NginxConnection::WWW_DIR}errors")
 
-                    template = ERB.new(File.read(__dir__ + '/main.conf.erb'))
-                    renderTemplate(template, target, dir + 'main.conf', options)
-                    copy(dir + '/main.conf', CONFIG_DIR, options[:dry])
+                                linuxConnection.upload(dir + 'nginx.conf', NginxConnection::CONFIG_DIR + 'nginx.conf', options)
+                                linuxConnection.upload(dir + 'conf.d/configlmm.conf', NginxConnection::CONFIG_DIR + 'conf.d/configlmm.conf', options)
+                                linuxConnection.upload(dir + 'conf.d/languages.conf', NginxConnection::CONFIG_DIR + 'conf.d/languages.conf', options)
 
-                    dir = "/etc/letsencrypt/live/Wildcard/"
-                    `mkdir -p #{dir}`
-                    if !File.exist?(dir + 'fullchain.pem')
-                        `openssl req -x509 -noenc -days 90 -newkey rsa:2048 -keyout #{dir}privkey.pem -out #{dir}fullchain.pem -subj "/C=US/O=ConfigLMM/CN=Wildcard"`
-                         `cp #{dir}fullchain.pem #{dir}chain.pem`
-                    end
+                                if options['dry']
+                                    linuxConnection.exec("cat /etc/resolv.conf | grep 'nameserver' | grep -v ':' | head -n 1 | cut -d ' ' -f 2", { **options, 'dry': true })
+                                end
+                                resolverIP = linuxConnection.exec("cat /etc/resolv.conf | grep 'nameserver' | grep -v ':' | head -n 1 | cut -d ' ' -f 2", { **options, 'dry': false }).strip
+
+                                linuxConnection.fileReplace('/etc/nginx/conf.d/configlmm.conf', '^resolver .*', "resolver #{resolverIP};", options)
+
+                                linuxConnection.uploadFolder(dir + 'config-lmm', NginxConnection::CONFIG_DIR, options)
+                                linuxConnection.uploadFolder(dir + 'servers-lmm', NginxConnection::CONFIG_DIR, options)
+
+                                target = target.dup
+                                target['NginxVersion'] = nginxConnection.nginxVersion
+                                template = ERB.new(File.read(__dir__ + '/main.conf.erb'))
+                                local.renderTemplate(template, target, dir + 'main.conf', options)
+                                linuxConnection.upload(dir + 'main.conf', NginxConnection::CONFIG_DIR + 'main.conf', options)
+
+                                if !linuxConnection.filePresent?(NginxConnection::WWW_DIR + 'errors/HTTP500.en_US.html', { **options, 'dry' => false })
+                                    errorPages = File.expand_path(REPOS_CACHE + '/HttpErrorPages')
+                                    if !File.exist?(errorPages)
+                                        local.mkdir(File.expand_path(REPOS_CACHE), options['dry'])
+                                        begin
+                                            Linux.withConnection(local) do |localLinux|
+                                                localLinux.ensurePackages(['git'], options) unless localLinux.hasBinaries?(['git'], options)
+                                            end
+                                        rescue RuntimeError => error
+                                            prompt.say(error, :color => :red)
+                                        end
+                                        local.exec("cd #{REPOS_CACHE} && git clone --quiet #{ERROR_PAGES_REPO}", false, options)
+                                        local.exec("cd #{errorPages} && cp -R dist errors", false, options)
+                                    else
+                                        local.exec("cd #{REPOS_CACHE}/HttpErrorPages && git pull", false, options)
+                                        local.exec("cd #{errorPages} && cp -R dist errors", false, options)
+                                    end
+                                    linuxConnection.uploadFolder(errorPages + '/errors', NginxConnection::WWW_DIR, options)
+                                end
 
+                                linuxConnection.createWildecardCertificate(options)
+                            end
+
+                            if target['Servers']
+                                target['Servers'].each do |source|
+                                    name = File.basename(source)
+                                    linuxConnection.upload(source, NginxConnection::CONFIG_DIR + 'servers-lmm/' + name, options)
+                                end
+                            end
+
+                            if target['Deploy']
+                                linuxConnection.ensureServiceAutoStart(SERVICE_NAME, options)
+                                linuxConnection.startService(SERVICE_NAME, options)
+
+                                linuxConnection.firewallAddService('http', options)
+                                linuxConnection.firewallAddService('https', options)
+                            else
+                                linuxConnection.reloadService(SERVICE_NAME, options)
+                            end
+                        end
+                    end
                 end
-                # Consider:
-                # * Deploy on current host
-                # * Deploy on remote host thru SSH (eg. VPS)
-                # * Using already existing solution like Chef/Puppet/Ansible/etc
-                # * Provision from some Cloud provider
-                # We implement this as we go - what people actually use
             end
 
             def actionNginxProxyBuild(id, target, activeState, context, options)
-                updateTargetConfig(target)
-
-                template = ERB.new(File.read(__dir__ + '/proxy.conf.erb'))
-                renderTemplate(template, target, options['output'] + '/nginx/servers-lmm/' + target['Name'] + '.conf', options)
+                target['ConfigName'] = target['Name']
 
+                self.class.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, 'proxy', target, activeState, context, options)
+                end
                 actionNginxBuild(id, target, activeState, context, options)
             end
 
             def actionNginxProxyDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
+                raise Framework::PluginProcessError.new('Proxy field must be set!') unless target['Proxy']
+
+                target['ConfigName'] = target['Name']
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        self.class.withConnection(linuxConnection) do |nginxConnection|
+                            nginxConnection.provision(__dir__, 'proxy', target, activeState, context, options)
+                        end
+                    end
                 end
             end
 
+            def self.withConnection(linuxConnection)
+                yield(NginxConnection.new(linuxConnection))
+            end
+
         end
     end
 end

data/Plugins/Apps/Nginx/proxy.conf.erb

@@ -6,18 +6,36 @@ server {
         listen       <%= config['Port'] %>;
         listen  [::]:<%= config['Port'] %>;
     <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
-        http2 on;
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
         include config-lmm/ssl.conf;
     <% end %>
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/<%= config['Name'].downcase %>.access.log;
-    error_log   /var/log/nginx/<%= config['Name'].downcase %>.error.log;
+    <% if config['CertName'] %>
+        ssl_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/fullchain.pem";
+        ssl_certificate_key "/etc/letsencrypt/live/<%= config['CertName'] %>/privkey.pem";
+        ssl_trusted_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/chain.pem";
+    <% end %>
+
+    <% if !config.key?('HandleErrors') || config['HandleErrors'] %>
+        include config-lmm/errors.conf;
+    <% else %>
+       include config-lmm/gateway-errors.conf;
+    <% end %>
 
-    include config-lmm/errors.conf;
+    include config-lmm/security.conf;
 
     <% if config['Private'] %>
         include config-lmm/private.conf;

data/Plugins/Apps/Odoo/Odoo.conf.erb

@@ -37,9 +37,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/odoo.access.log;
-    error_log   /var/log/nginx/odoo.error.log;
-
     include config-lmm/errors.conf;
 
     location / {

data/Plugins/Apps/Odoo/Odoo.container

@@ -4,7 +4,8 @@ Description=Odoo container
 After=local-fs.target
 
 [Container]
-Image=odoo:latest
+ContainerName=Odoo
+Image=docker.io/odoo:latest
 EnvironmentFile=/var/lib/odoo/.config/containers/systemd/Odoo.env
 Network=slirp4netns:allow_host_loopback=true
 PublishPort=0.0.0.0:8069:8069
@@ -12,6 +13,11 @@ UserNS=keep-id:uid=101,gid=101
 Volume=/var/lib/odoo/config:/etc/odoo
 Volume=/var/lib/odoo/data:/var/lib/odoo
 Volume=/var/lib/odoo/addons:/mnt/extra-addons
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+Restart=on-failure
 
 [Install]
 WantedBy=multi-user.target default.target

data/Plugins/Apps/Odoo/Odoo.lmm.rb

@@ -64,16 +64,15 @@ module ConfigLMM
                     if !target.key?('Proxy') || target['Proxy'] == true || target['Proxy'] == 'only'
                         deployNginxConfig(id, target, activeState, context, options)
                     end
-                    activeState['Location'] = '@me'
                 end
             end
 
-            def configurePostgreSQL(settings, ssh)
+            def configurePostgreSQL(settings, connection)
                 user = USER
                 password = SecureRandom.alphanumeric(20)
-                PostgreSQL.executeRemotelyOverSSH(settings, ssh) do |ssh|
-                    self.class.sshExec!(ssh, "su --login #{PostgreSQL::USER_NAME} --command 'createuser --createdb #{user}'", true)
-                    PostgreSQL.executeSQL("ALTER USER #{user} WITH PASSWORD '#{password}'", nil, ssh)
+                PostgreSQL.executeRemotely(settings, connection) do |connection|
+                    connection.exec("su --login #{PostgreSQL::USER_NAME} --command 'createuser --createdb #{user}'", true)
+                    PostgreSQL.executeSQL("ALTER USER #{user} WITH PASSWORD '#{password}'", nil, connection)
                 end
                 password
             end

data/Plugins/Apps/Ollama/Ollama.container

@@ -0,0 +1,26 @@
+
+[Unit]
+Description=Ollama container
+After=local-fs.target
+
+[Container]
+ContainerName=Ollama
+Image=docker.io/ollama/ollama:latest
+EnvironmentFile=/var/lib/ollama/.config/containers/systemd/Ollama.env
+PublishPort=127.0.0.1:11434:11434
+UserNS=keep-id:uid=1000,gid=1000
+# Need newer Podman to use this
+#GroupAdd=keep-groups
+PodmanArgs=--group-add keep-groups
+#PodmanArgs=--passwd-entry 'ollama:x:1000:1000:Ollama:/home/ollama:/bin/bash'
+Volume=/var/lib/ollama/data:/.ollama
+$DEVICES
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=12min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Ollama/Ollama.lmm.rb

@@ -0,0 +1,73 @@
+
+module ConfigLMM
+    module LMM
+        class Ollama < Framework::Plugin
+
+            USER = 'ollama'
+            HOME_DIR = '/var/lib/ollama'
+            PORT = 11434
+
+            def actionOllamaDeploy(id, target, activeState, context, options)
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'Ollama', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                                shell.createDirs(options, '~/data')
+                        end
+
+                        path = Podman.containersPath(HOME_DIR)
+
+                        linuxConnection.fileWrite("#{path}/Ollama.env", '', options)
+
+                        linuxConnection.setUserGroup("#{path}/Ollama.env", USER, USER, options)
+                        linuxConnection.setPrivate("#{path}/Ollama.env", options)
+
+                        linuxConnection.upload(__dir__ + '/Ollama.container', path, options)
+
+                        devices = linuxConnection.getGPUDevices(options)
+                        groups = linuxConnection.getGPUGroups(devices, options)
+                        linuxConnection.userAddGroups(USER, groups, options)
+
+                        if devices.include?('/dev/kfd')
+                            linuxConnection.fileReplace("#{path}/Ollama.container", ':latest', ':rocm', options)
+                        end
+
+                        devicesString = ''
+                        if !devices.empty?
+                            devicesString = devices.map { |device| "AddDevice=#{device}" }.join('\n')
+                        end
+                        linuxConnection.fileReplace("#{path}/Ollama.container", '\$DEVICES', devicesString, { **options, escape: false })
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'Ollama', options)
+                    end
+                end
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:Ollama, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+
+                        linuxConnection.stopUserService(USER, 'Ollama', options)
+
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.rm(path + '/Ollama.container', options[:dry])
+
+                        linuxConnection.reloadUserServices(USER, options)
+
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            linuxConnection.deleteUserAndGroup(USER, options)
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end
+