ConfigLMM 0.4.0 → 0.5.0

data/Plugins/Apps/Homepage/Homepage.lmm.rb

@@ -0,0 +1,54 @@
+
+module ConfigLMM
+    module LMM
+        class Homepage < Framework::Plugin
+
+            NAME = 'Homepage'
+            USER = 'homepage'
+            HOME_DIR = '/var/lib/homepage'
+
+            def actionHomepageBuild(id, target, activeState, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, NAME, target, state, context, options)
+                end
+            end
+
+            def actionHomepageDeploy(id, target, activeState, context, options)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        if !target.key?('Proxy') || target['Proxy'] != 'only'
+                            Podman.ensurePresent(linuxConnection, options)
+                            Podman.createUser(USER, HOME_DIR, 'Homepage', linuxConnection, options)
+                            linuxConnection.withUserShell(USER) do |shell|
+                                shell.createDirs(options, '~/config')
+                            end
+
+                            configPath = './Homepage'
+                            configPath = target['ConfigPath'] if target['ConfigPath']
+                            Dir[configPath + '/*'].each do |file|
+                                linuxConnection.upload(file, HOME_DIR + '/config/', options)
+                            end
+
+                            path = Podman.containersPath(HOME_DIR)
+                            linuxConnection.upload(__dir__ + '/Homepage.container', path, options)
+                            if target.key?('Proxy') && target['Proxy'] == false
+                                linuxConnection.exec("sed -i 's|PublishPort=127.0.0.1:13400:|PublishPort=0.0.0.0:13400:|' #{path}/Homepage.container", false, options)
+                                linuxConnection.firewallAddPort('13400/tcp', options)
+                            end
+
+                            linuxConnection.reloadUserServices(USER, options)
+                            linuxConnection.restartUserService(USER, 'Homepage', options)
+                        end
+                        if !target.key?('Proxy') || !!target['Proxy']
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                target['ConfigName'] = target['Name']
+                                nginxConnection.provision(__dir__, NAME, target, activeState, context, options)
+                            end
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/IPFS/IPFS.conf.erb

@@ -20,9 +20,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/ipfs.access.log;
-    error_log   /var/log/nginx/ipfs.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/IPFS/IPFS.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionIPFSDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/InfluxDB/InfluxDB.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/influxdb.access.log;
-    error_log   /var/log/nginx/influxdb.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/InfluxDB/InfluxDB.lmm.rb

@@ -10,7 +10,6 @@ module ConfigLMM
             def actionInfluxDBDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Jackett/Jackett.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/jackett.access.log;
-    error_log   /var/log/nginx/jackett.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/Jackett/Jackett.lmm.rb

@@ -10,7 +10,6 @@ module ConfigLMM
             def actionJackettDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Jellyfin/Jellyfin.conf.erb

@@ -17,9 +17,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/jellyfin.access.log;
-    error_log   /var/log/nginx/jellyfin.error.log;
-
     include config-lmm/errors.conf;
     include config-lmm/ssl.conf;
 

data/Plugins/Apps/Jellyfin/Jellyfin.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionJellyfinDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/LetsEncrypt/LetsEncrypt.lmm.rb

@@ -7,48 +7,69 @@ module ConfigLMM
             CONFIG_DIR = '/etc/letsencrypt/'
 
             def actionLetsEncryptDeploy(id, target, activeState, context, options)
-                self.ensurePackage(PACKAGE_NAME, target['Location'])
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        linuxConnection.ensurePackage(PACKAGE_NAME, options)
 
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-
-                    self.class.sshStart(uri) do |ssh|
-                        ssh.scp.upload!(__dir__ + '/rfc2136.ini', CONFIG_DIR)
-                        ssh.scp.upload!(__dir__ + '/renew-certificates.service', '/etc/systemd/system/')
-                        ssh.scp.upload!(__dir__ + '/renew-certificates.timer', '/etc/systemd/system/')
-                        self.class.exec("mkdir -p #{CONFIG_DIR}renewal-hooks/deploy", ssh)
+                        linuxConnection.upload(__dir__ + '/rfc2136.ini', CONFIG_DIR, options)
+                        linuxConnection.upload(__dir__ + '/renew-certificates.service', '/etc/systemd/system/', options)
+                        linuxConnection.upload(__dir__ + '/renew-certificates.timer', '/etc/systemd/system/', options)
+                        linuxConnection.createDirs(options, CONFIG_DIR + "renewal-hooks/deploy")
                         target['Hooks'].to_a.each do |hook|
-                            ssh.scp.upload!(__dir__ + '/hooks/' + hook + '.sh', "#{CONFIG_DIR}renewal-hooks/deploy/")
+                            linuxConnection.upload(__dir__ + '/hooks/' + hook + '.sh', "#{CONFIG_DIR}renewal-hooks/deploy/", options)
                         end
-                        self.class.exec("chmod +x #{CONFIG_DIR}renewal-hooks/deploy/*.sh", ssh)
-                        self.class.exec("sed -i 's|$IP|#{target['DNS']['IP']}|' #{CONFIG_DIR}/rfc2136.ini", ssh)
-                        self.class.exec("sed -i 's|$SECRET|#{ENV['LETSENCRYPT_DNS_SECRET']}|' #{CONFIG_DIR}/rfc2136.ini", ssh)
-                        self.class.exec("chmod 600 #{CONFIG_DIR}/rfc2136.ini", ssh)
+                        linuxConnection.exec("chmod +x #{CONFIG_DIR}renewal-hooks/deploy/*.sh", false, options)
+                        linuxConnection.fileReplace(CONFIG_DIR + 'rfc2136.ini', '\$IP', target['DNS']['IP'] , options)
+
+                        secretId, secretName = target['DNS']['SecretId'].to_s.split('.')
+                        key = nil
+                        key = context.secrets.load(secretId, secretName) if secretId && secretName
+                        key = context.secrets.load('LETSENCRYPT', 'DNS_SECRET') if key.nil?
+                        raise Framework::PluginProcessError.new('LetsEncrypt missing RFC2136 TSIG key! Specify DNS.SecretId or LETSENCRYPT_DNS_SECRET env variable') unless key
+
+                        linuxConnection.fileReplace(CONFIG_DIR + 'rfc2136.ini', '\$SECRET', key, options)
+                        linuxConnection.setPrivate(CONFIG_DIR + 'rfc2136.ini', options)
                         if target['Domain']
-                            createCertificate('Wildcard', target['Domain'], target, ssh)
+                            createCertificate('Wildcard', target['Domain'], target, linuxConnection, options)
                         end
-                        target['Certificates'].to_h.each do |name, domain|
-                            createCertificate(name, domain, target, ssh)
+                        target['Certificates'].to_h.each do |name, domains|
+                            createCertificate(name, domains, target, linuxConnection, options)
                         end
 
-                        self.class.exec("systemctl daemon-reload", ssh)
-                        self.class.exec("systemctl enable renew-certificates.timer", ssh)
-                        self.class.exec("systemctl start renew-certificates.timer", ssh)
+                        linuxConnection.reloadServiceManager(options)
+                        linuxConnection.ensureServiceAutoStart('renew-certificates.timer', options)
+                        linuxConnection.startService('renew-certificates.timer', options)
+
+                        target['Hooks'].to_a.each do |hook|
+                            linuxConnection.exec("#{CONFIG_DIR}renewal-hooks/deploy/#{hook}.sh", false, options)
+                        end
                     end
-                else
-                    # TODO
                 end
             end
 
-            def createCertificate(name, domain, target, ssh)
-                domains = ['--domains "' + Addressable::IDNA.to_ascii(domain) + '"']
-                if domain.start_with?('*.')
-                    domains << '--domains "' + Addressable::IDNA.to_ascii(domain[2..-1]) + '"'
+            def createCertificate(name, domains, target, connection, options)
+                return if connection.fileLink?("#{CONFIG_DIR}live/#{name}/fullchain.pem", options)
+                connection.exec("rm -rf #{CONFIG_DIR}live/#{name}", false, options)
+
+                domainList = []
+                domains = [domains] unless domains.is_a?(Array)
+                domains.each do |domain|
+                    domainList << '--domains "' + Addressable::IDNA.to_ascii(domain) + '"'
+                    if addBaseDomain?(domain, domains)
+                        domainList << '--domains "' + Addressable::IDNA.to_ascii(domain[2..-1]) + '"'
+                    end
                 end
                 extra = ''
                 extra = '--dns-rfc2136-propagation-seconds ' + target['DNS']['Propagation'].to_s if target['DNS']['Propagation']
-                self.class.exec("certbot certonly --dns-rfc2136 --dns-rfc2136-credentials=/etc/letsencrypt/rfc2136.ini #{extra} --non-interactive --agree-tos --email #{target['EMail']} --cert-name '#{name}' #{domains.join(' ')}", ssh)
+
+                connection.exec("certbot certonly --dns-rfc2136 --dns-rfc2136-credentials=#{CONFIG_DIR}rfc2136.ini #{extra} --non-interactive --agree-tos --email #{target['EMail']} --cert-name '#{name}' #{domainList.join(' ')}", false, options)
+            end
+
+            def addBaseDomain?(domain, domains)
+                return false unless domain.start_with?('*.')
+                match = '*.' + domain[2..-1].split('.')[1..].join('.')
+                return false if match == '*.' || domains.any? { |d| d.casecmp?(match) }
+                true
             end
 
         end

data/Plugins/Apps/LibreTranslate/LibreTranslate.container

@@ -0,0 +1,21 @@
+
+[Unit]
+Description=LibreTranslate container
+After=local-fs.target
+
+[Container]
+ContainerName=LibreTranslate
+Image=docker.io/libretranslate/libretranslate:latest
+Exec=--host 0.0.0.0 $ARGS
+PublishPort=127.0.0.1:15100:5000
+UserNS=keep-id:uid=1032,gid=1032
+Volume=/var/lib/libretranslate/.local:/home/libretranslate/.local
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=32min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/LibreTranslate/LibreTranslate.lmm.rb

@@ -0,0 +1,34 @@
+
+module ConfigLMM
+    module LMM
+        class LibreTranslate < Framework::Plugin
+
+            USER = 'libretranslate'
+            HOME_DIR = '/var/lib/libretranslate'
+
+            def actionLibreTranslateDeploy(id, target, activeState, context, options)
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'LibreTranslate', linuxConnection, options)
+
+                        path = Podman.containersPath(HOME_DIR)
+
+                        linuxConnection.upload(__dir__ + '/LibreTranslate.container', path, options)
+
+                        args = ['--metrics']
+                        linuxConnection.fileReplace("#{path}/LibreTranslate.container", '\$ARGS', args.join(' '), options)
+                        if target['Listen']
+                            linuxConnection.fileReplace("#{path}/LibreTranslate.container", '127.0.0.1', target['Listen'], options)
+                        end
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'LibreTranslate', options)
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/Lobsters/Containerfile

@@ -0,0 +1,81 @@
+# Use an official Ruby image as a base
+ARG RUBY_VERSION
+FROM ruby:${RUBY_VERSION} AS base
+
+# Install base packages
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 mariadb-client sendmail vim && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Latest releases available at https://github.com/aptible/supercronic/releases
+ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.33/supercronic-linux-amd64 \
+    SUPERCRONIC_SHA1SUM=71b0d58cc53f6bd72cf2f293e09e294b79c666d8 \
+    SUPERCRONIC=supercronic-linux-amd64
+
+RUN curl -fsSLO "$SUPERCRONIC_URL" \
+ && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+ && chmod +x "$SUPERCRONIC" \
+ && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+ && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+
+ENV BUNDLE_DEPLOYMENT="1" BUNDLE_PATH="/usr/local/bundle" BUNDLE_WITHOUT="development"
+
+# Throw-away build stage to reduce size of final image
+FROM base AS build
+
+# Install packages needed to build gems
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential git libyaml-dev pkg-config && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Set working directory
+WORKDIR /lobsters
+
+COPY . .
+
+# Install application gems
+RUN bundle install && \
+    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
+
+RUN mkdir -p /srv/lobste.rs/log && \
+    ln -sf /lobsters /srv/lobste.rs/http
+
+# Temporary generate secrets
+RUN RAILS_ENV=production ./bin/rails credentials:edit
+
+# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
+RUN SECRET_KEY_BASE_DUMMY=1 RAILS_ENV=production ./bin/rails assets:precompile
+
+# Remove secrets
+RUN rm -rf ./config/credentials.yml.enc ./config/master.key ./config/database.yml ./tmp/* /srv/lobste.rs/log/*
+
+# Final stage for app image
+FROM base
+
+WORKDIR /lobsters
+
+# Copy built artifacts: gems, application
+COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --from=build /lobsters /lobsters
+COPY --from=build /srv/lobste.rs /srv/lobste.rs
+
+COPY crontab /etc/
+
+RUN ln -sf /config/master.key /lobsters/config/master.key && \
+    ln -sf /config/credentials.yml.enc /lobsters/config/credentials.yml.enc && \
+    ln -sf /config/database.yml /lobsters/config/database.yml
+
+RUN mv /lobsters/public /lobsters/public_source && ln -sf /srv/lobsters/public /lobsters/public
+
+# Run and own only the runtime files as a non-root user for security
+RUN groupadd --system --gid 1000 lobsters && \
+    useradd lobsters --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    chown -R lobsters:lobsters /lobsters/tmp /srv/lobste.rs/log
+
+ENV LD_PRELOAD="/usr/lib/x86_64-linux-gnu/libjemalloc.so.2"
+
+# Expose port for Rails server
+EXPOSE 9292
+
+ENTRYPOINT ["/lobsters/entrypoint.sh"]
+CMD ["server"]

data/Plugins/Apps/Lobsters/Lobsters-Tasks.container

@@ -0,0 +1,26 @@
+
+[Unit]
+Description=Lobsters tasks container
+After=local-fs.target
+
+[Container]
+ContainerName=LobstersTasks
+Image=ConfigLM.moe/lobsters:master
+EnvironmentFile=/var/lib/lobsters/.config/containers/systemd/Lobsters.env
+Network=slirp4netns:allow_host_loopback=true
+UserNS=keep-id:uid=1000,gid=1000
+Exec=cron
+Volume=/var/lib/lobsters/config:/config
+Volume=/var/lib/lobsters/logs:/srv/lobste.rs/log
+Volume=/var/lib/lobsters/cache:/srv/lobste.rs/cache
+Volume=/var/lib/lobsters/storage:/srv/lobste.rs/storage
+Volume=/var/lib/lobsters/queue:/srv/lobste.rs/queue
+Volume=/var/lib/lobsters/tmp:/lobsters/tmp
+Volume=/srv/lobsters:/srv/lobsters
+LogDriver=journald
+
+[Service]
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Lobsters/Lobsters.conf.erb

@@ -0,0 +1,99 @@
+
+upstream lobsters {
+    <% if config['Server'] %>
+        server <%= config['Server'] %>;
+    <% else %>
+        server 127.0.0.1:19292;
+    <% end %>
+}
+
+server {
+
+    <% if config['NginxVersion'] >= 1.25 %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl;
+            listen  [::]:<%= config['Port'] %> ssl;
+
+            include config-lmm/ssl.conf;
+        <% end %>
+        http2 on;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl http2;
+            listen  [::]:<%= config['Port'] %> ssl http2;
+
+            include config-lmm/ssl.conf;
+        <% end %>
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    root /srv/lobsters/public;
+
+    include config-lmm/errors.conf;
+
+    # max upload size for avatars (the only upload the site takes now)
+    client_max_body_size 2M;
+
+    location @lobsters {
+        proxy_pass  http://lobsters;
+
+        include config-lmm/proxy.conf;
+    }
+
+    location ~ ^/assets/ {
+        gzip_static on;
+        expires     max;
+        add_header  Cache-Control public;
+        break;
+    }
+
+    location ~ ^/avatars/ {
+        expires     max;
+        add_header  Cache-Control public;
+        try_files $uri @lobsters;
+        break;
+    }
+
+    # file-based full-page caching, bypass if user has cookies
+    set $use_file_cache "";
+
+    if ($cookie_lobster_trap = "") {
+        set $use_file_cache "${use_file_cache}S";       # S = no session cookie
+    }
+    if ($cookie_tag_filters = "") {
+        set $use_file_cache "${use_file_cache}F";       # F = no filter cookie
+    }
+    if (-f $document_root/cache$uri/index.html) {
+        set $use_file_cache "${use_file_cache}I";       # I = index file cached
+    }
+    if ($use_file_cache = "SFI") {
+        rewrite (.*) /cache/$1/index.html break;
+    }
+    if (-f $document_root/cache$uri.html) {
+        set $use_file_cache "${use_file_cache}H";       # H = HTML file cached
+    }
+    if ($use_file_cache = "SFH") {
+        rewrite (.*) /cache/$1.html break;
+    }
+    if (-f $document_root/cache$uri) {
+        set $use_file_cache "${use_file_cache}O";       # O = other non-extentioned file cached
+    }
+    if ($use_file_cache = "SFO") {
+        rewrite (.*) /cache/$1 break;
+    }
+
+    location / {
+        try_files $uri @lobsters;
+    }
+
+}

data/Plugins/Apps/Lobsters/Lobsters.container

@@ -0,0 +1,27 @@
+
+[Unit]
+Description=Lobsters container
+After=local-fs.target
+
+[Container]
+ContainerName=Lobsters
+Image=ConfigLM.moe/lobsters:master
+EnvironmentFile=/var/lib/lobsters/.config/containers/systemd/Lobsters.env
+Network=slirp4netns:allow_host_loopback=true
+UserNS=keep-id:uid=1000,gid=1000
+PublishPort=127.0.0.1:19292:9292
+Volume=/var/lib/lobsters/config:/config
+Volume=/var/lib/lobsters/logs:/srv/lobste.rs/log
+Volume=/var/lib/lobsters/cache:/srv/lobste.rs/cache
+Volume=/var/lib/lobsters/storage:/srv/lobste.rs/storage
+Volume=/var/lib/lobsters/queue:/srv/lobste.rs/queue
+Volume=/var/lib/lobsters/tmp:/lobsters/tmp
+Volume=/srv/lobsters:/srv/lobsters
+LogDriver=journald
+
+[Service]
+TimeoutStartSec=6min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target