katalon-cli 0.1.2__tar.gz → 0.1.3__tar.gz

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: katalon-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: Installer & Updater CLI für Katalon Production-Instanzen
 Author: Karl Krägelin
 Author-email: Karl Krägelin <karlkraegelin@gmail.com>
@@ -66,7 +66,13 @@ uv run pytest
 
 - `core/state.py` — `installation.json`, Single Source of Truth für laufende Version.
 - `core/release.py` — GitHub-Release-Metadaten (`katalon-release.json` Asset), 1h Cache.
-- `core/compose_gen.py` + `templates/compose.yaml.j2` — rendert `compose.yaml` aus Version + TLS-Modus.
+- `core/compose_gen.py` + `templates/compose.yaml.j2` + `templates/nginx.conf.j2` — rendert `compose.yaml`
+  + `nginx.conf` aus Version + TLS-Modus; erzeugt bei `tls_mode=standalone` ein selbstsigniertes
+  Zertifikat unter `<dir>/certs/` (eigenes Zertifikat dort ablegen, um es zu ersetzen).
+  `install` fragt zusätzlich `MEDIA_ROOT` ab und legt `<dir>/compose.override.yaml.example` an
+  (instanzspezifische Overrides — umbenennen zu `compose.override.yaml`, wird automatisch eingebunden
+  und bei Updates nicht angefasst). Optionale Env-Vars (Admin-Login, SMTP, Geonames, …) landet
+  auskommentiert in `.env`.
 - `core/backup.py` — `pg_dump` vor jedem Update; Rollback restauriert Dump statt `alembic downgrade`.
 - `core/docker.py` — dünner `docker compose`-Subprocess-Wrapper.
 - `main.py` — Typer-Commands, interaktive Teile über `rich.prompt`/`rich.progress`.

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/README.md

@@ -52,7 +52,13 @@ uv run pytest
 
 - `core/state.py` — `installation.json`, Single Source of Truth für laufende Version.
 - `core/release.py` — GitHub-Release-Metadaten (`katalon-release.json` Asset), 1h Cache.
-- `core/compose_gen.py` + `templates/compose.yaml.j2` — rendert `compose.yaml` aus Version + TLS-Modus.
+- `core/compose_gen.py` + `templates/compose.yaml.j2` + `templates/nginx.conf.j2` — rendert `compose.yaml`
+  + `nginx.conf` aus Version + TLS-Modus; erzeugt bei `tls_mode=standalone` ein selbstsigniertes
+  Zertifikat unter `<dir>/certs/` (eigenes Zertifikat dort ablegen, um es zu ersetzen).
+  `install` fragt zusätzlich `MEDIA_ROOT` ab und legt `<dir>/compose.override.yaml.example` an
+  (instanzspezifische Overrides — umbenennen zu `compose.override.yaml`, wird automatisch eingebunden
+  und bei Updates nicht angefasst). Optionale Env-Vars (Admin-Login, SMTP, Geonames, …) landet
+  auskommentiert in `.env`.
 - `core/backup.py` — `pg_dump` vor jedem Update; Rollback restauriert Dump statt `alembic downgrade`.
 - `core/docker.py` — dünner `docker compose`-Subprocess-Wrapper.
 - `main.py` — Typer-Commands, interaktive Teile über `rich.prompt`/`rich.progress`.

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.1.2"
+version = "0.1.3"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 requires-python = ">=3.12"

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.1.2"
+version = "0.1.3"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 authors = [

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/src/katalon_cli/core/backup.py

@@ -49,7 +49,7 @@ def restore_backup(instance_dir: Path, backup_dir: Path) -> None:
     docker.compose(instance_dir, "exec", "-T", "db", "dropdb", "-U", "katalon", "katalon")
     docker.compose(instance_dir, "exec", "-T", "db", "createdb", "-U", "katalon", "katalon")
     subprocess.run(
-        [*docker.compose_command(), "-f", str(instance_dir / "compose.yaml"),
+        [*docker.compose_command(), *docker.compose_files(instance_dir),
          "exec", "-T", "db", "psql", "-U", "katalon", "katalon"],
         input=dump_file.read_text(),
         cwd=instance_dir,

katalon_cli-0.1.3/src/katalon_cli/core/compose_gen.py

@@ -0,0 +1,82 @@
+"""Rendert compose.yaml + nginx.conf aus Template + Release-Version + TLS-Modus."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+from jinja2 import Environment, PackageLoader, select_autoescape
+
+_env = Environment(
+    loader=PackageLoader("katalon_cli", "templates"),
+    autoescape=select_autoescape(disabled_extensions=(".yaml", ".j2", ".conf")),
+    trim_blocks=True,
+    lstrip_blocks=True,
+)
+
+
+def render_compose(
+    *,
+    version: str,
+    base_url: str,
+    tls_mode: str,
+    registry: str = "ghcr.io/katalon-collections/katalon",
+) -> str:
+    template = _env.get_template("compose.yaml.j2")
+    return template.render(
+        version=version,
+        base_url=base_url,
+        tls_mode=tls_mode,
+        registry=registry,
+    )
+
+
+def render_nginx_conf(*, tls_mode: str) -> str:
+    template = _env.get_template("nginx.conf.j2")
+    return template.render(tls_mode=tls_mode)
+
+
+def write_compose(instance_dir: Path, **kwargs) -> Path:
+    content = render_compose(**kwargs)
+    path = instance_dir / "compose.yaml"
+    path.write_text(content)
+
+    nginx_path = instance_dir / "nginx.conf"
+    nginx_path.write_text(render_nginx_conf(tls_mode=kwargs["tls_mode"]))
+
+    if kwargs["tls_mode"] == "standalone":
+        ensure_self_signed_cert(instance_dir, host=_host_of(kwargs["base_url"]))
+
+    return path
+
+
+def ensure_self_signed_cert(instance_dir: Path, *, host: str) -> None:
+    """Legt ein selbstsigniertes Zertifikat an, falls keins vorhanden ist.
+
+    Für echtes TLS eigenes Zertifikat (z.B. Let's Encrypt) unter
+    <instance_dir>/certs/fullchain.pem + privkey.pem ablegen — wird nicht überschrieben.
+    """
+    certs_dir = instance_dir / "certs"
+    fullchain = certs_dir / "fullchain.pem"
+    privkey = certs_dir / "privkey.pem"
+    if fullchain.exists() and privkey.exists():
+        return
+
+    certs_dir.mkdir(parents=True, exist_ok=True)
+    subprocess.run(
+        [
+            "openssl", "req", "-x509", "-nodes", "-newkey", "rsa:2048",
+            "-days", "825",
+            "-keyout", str(privkey),
+            "-out", str(fullchain),
+            "-subj", f"/CN={host}",
+        ],
+        check=True,
+        capture_output=True,
+    )
+
+
+def _host_of(base_url: str) -> str:
+    from urllib.parse import urlparse
+
+    return urlparse(base_url).hostname or "localhost"

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/src/katalon_cli/core/docker.py

@@ -24,10 +24,18 @@ def compose_command() -> list[str]:
     raise DockerError("Docker Compose ist nicht installiert.")
 
 
+def compose_files(instance_dir: Path) -> list[str]:
+    files = ["-f", str(instance_dir / "compose.yaml")]
+    override = instance_dir / "compose.override.yaml"
+    if override.exists():
+        files += ["-f", str(override)]
+    return files
+
+
 def compose(
     instance_dir: Path, *args: str, check: bool = True, capture: bool = False
 ) -> subprocess.CompletedProcess:
-    cmd = [*compose_command(), "-f", str(instance_dir / "compose.yaml"), *args]
+    cmd = [*compose_command(), *compose_files(instance_dir), *args]
     return subprocess.run(
         cmd,
         cwd=instance_dir,

{katalon_cli-0.1.2 → katalon_cli-0.1.3}/src/katalon_cli/main.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import platform
 import secrets
+import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
 from urllib.parse import urlparse
@@ -26,12 +27,81 @@ console = Console()
 DEFAULT_DIR = default_instance_dir()
 
 TLS_CHOICES = {
-    "standalone": "Standalone — Katalon verwaltet HTTPS via Caddy (Ports 80+443)",
+    "standalone": "Standalone — eigenes nginx mit selbstsigniertem Zertifikat (Ports 80+443)",
     "behind-proxy": "Hinter eigenem Reverse-Proxy — kein TLS hier",
     "none": "Kein TLS (lokal / IP)",
 }
 
 
+OPTIONAL_ENV_MARKER = "# --- optionale Config (auskommentiert, bei Bedarf aktivieren) ---"
+OPTIONAL_ENV_BLOCK = f"""
+{OPTIONAL_ENV_MARKER}
+# DEFAULT_ADMIN_EMAIL=admin@example.org
+# DEFAULT_ADMIN_PASSWORD=changeme
+# GEONAMES_USERNAME=demo
+# SMTP_ENABLED=false
+# SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_USERNAME=
+# SMTP_PASSWORD=
+# SMTP_FROM=
+# CORS_ORIGINS=["http://localhost"]
+# MAX_UPLOAD_SIZE_MB=200
+"""
+
+
+def _ensure_env_vars(dir: Path, base_url: str, media_root: str | None = None) -> None:
+    """Schreibt fehlende Pflicht-Env-Vars nach — idempotent, überschreibt nichts Vorhandenes."""
+    env_path = dir / ".env"
+    raw = env_path.read_text() if env_path.exists() else ""
+    existing: dict[str, str] = {}
+    for line in raw.splitlines():
+        if "=" in line and not line.startswith("#"):
+            key, _, value = line.partition("=")
+            existing[key] = value
+
+    postgres_password = existing.get("POSTGRES_PASSWORD", secrets.token_urlsafe(24))
+    defaults = {
+        "KATALON_BASE_URL": base_url,
+        "POSTGRES_PASSWORD": postgres_password,
+        "DATABASE_URL": f"postgresql://katalon:{postgres_password}@db:5432/katalon",
+        "SECRET_KEY": secrets.token_urlsafe(32),
+        "KATALON_SECRETS_KEY": secrets.token_urlsafe(32),
+        "CANTALOUPE_PUBLIC_URL": base_url,
+    }
+    if media_root is not None:
+        defaults["MEDIA_ROOT"] = media_root
+    for key, value in defaults.items():
+        existing.setdefault(key, value)
+
+    content = "".join(f"{key}={value}\n" for key, value in existing.items())
+    if OPTIONAL_ENV_MARKER not in raw:
+        content += OPTIONAL_ENV_BLOCK
+    env_path.write_text(content)
+
+
+OVERRIDE_EXAMPLE = """\
+# compose.override.yaml
+# Instanzspezifische Anpassungen hier eintragen, dann in "compose.override.yaml"
+# umbenennen — docker compose bindet sie automatisch neben compose.yaml ein und
+# katalon-cli überschreibt sie bei Updates nicht.
+services:
+  api:
+    environment:
+      - EXTRA_VAR=value
+
+  db:
+    volumes:
+      - /mnt/external-disk/katalon-db:/var/lib/postgresql/data
+"""
+
+
+def _write_override_example(dir: Path) -> None:
+    path = dir / "compose.override.yaml.example"
+    if not path.exists():
+        path.write_text(OVERRIDE_EXAMPLE)
+
+
 def _run_checks(dir: Path, ports: list[int] | None = None) -> bool:
     ok = True
     for result in checks.run_all(dir, ports=ports):
@@ -65,6 +135,10 @@ def install(
     )
     base_url = Prompt.ask("KATALON_BASE_URL", default="http://localhost")
 
+    console.print()
+    console.print("MEDIA_ROOT — Verzeichnis auf dem Host, in dem Katalon Mediendateien ablegt.")
+    media_root = Prompt.ask("MEDIA_ROOT", default=str(dir / "media"))
+
     tls_mode = "none"
     if urlparse(base_url).hostname not in (None, "localhost", "127.0.0.1"):
         console.print()
@@ -92,15 +166,11 @@ def install(
 
         progress.add_task("Schreibe compose.yaml + .env …", total=None)
         dir.mkdir(parents=True, exist_ok=True)
+        Path(media_root).mkdir(parents=True, exist_ok=True)
         write_compose(dir, version=meta.version, base_url=base_url, tls_mode=tls_mode)
 
-        env_path = dir / ".env"
-        if not env_path.exists():
-            env_path.write_text(
-                f"KATALON_BASE_URL={base_url}\n"
-                f"POSTGRES_PASSWORD={secrets.token_urlsafe(24)}\n"
-                f"SECRET_KEY={secrets.token_urlsafe(32)}\n"
-            )
+        _ensure_env_vars(dir, base_url, media_root=media_root)
+        _write_override_example(dir)
 
         state = InstallationState(
             version=meta.version,
@@ -113,6 +183,14 @@ def install(
         state.save(dir)
 
     console.print(f"[green]✔[/] Instanz eingerichtet in [bold]{dir}[/]")
+    console.print(
+        f"Optionale Config-Variablen sind auskommentiert in [bold]{dir / '.env'}[/] angelegt "
+        "(Admin-Login, SMTP, Geonames, …) — bei Bedarf einkommentieren."
+    )
+    console.print(
+        f"Instanzspezifische compose-Overrides: [bold]{dir / 'compose.override.yaml.example'}[/] "
+        "nach compose.override.yaml umbenennen."
+    )
     console.print("Starten mit: [bold]katalon start --dir " + str(dir) + "[/]")
 
 
@@ -219,6 +297,7 @@ def update(
 
     steps = [
         ("Backup erstellen", lambda: backup_mod.create_backup(dir)),
+        ("Env-Vars ergänzen", lambda: _ensure_env_vars(dir, state.base_url)),
         (
             "compose.yaml rendern",
             lambda: write_compose(dir, version=meta.version, base_url=state.base_url, tls_mode=state.tls_mode),
@@ -291,7 +370,7 @@ def rollback(
 def main() -> None:
     try:
         app()
-    except (FileNotFoundError, docker.DockerError, backup_mod.BackupError) as exc:
+    except (FileNotFoundError, docker.DockerError, backup_mod.BackupError, subprocess.CalledProcessError) as exc:
         console.print(f"[red]✖[/] {exc}")
         raise SystemExit(1) from exc
 

katalon_cli-0.1.3/src/katalon_cli/templates/compose.yaml.j2

@@ -0,0 +1,165 @@
+services:
+  db:
+    image: postgis/postgis:16-3.4
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-katalon}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-katalon}
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-katalon}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.4
+    restart: unless-stopped
+    environment:
+      discovery.type: single-node
+      xpack.security.enabled: "false"
+      ES_JAVA_OPTS: "-Xms${ES_HEAP_SIZE:-512m} -Xmx${ES_HEAP_SIZE:-512m}"
+    volumes:
+      - es_data:/usr/share/elasticsearch/data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:9200/_cluster/health | grep -v red"]
+      interval: 15s
+      timeout: 10s
+      retries: 20
+
+  cantaloupe:
+    image: islandora/cantaloupe:main
+    restart: unless-stopped
+    volumes:
+      - ${MEDIA_ROOT:-./media}:/var/lib/cantaloupe/images:ro
+      - type: tmpfs
+        target: /var/lib/cantaloupe/cache
+        tmpfs:
+          size: ${CANTALOUPE_CACHE_TMPFS_SIZE:-512m}
+    environment:
+      CANTALOUPE_SOURCE_STATIC: FilesystemSource
+      CANTALOUPE_FILESYSTEMSOURCE_LOOKUP_STRATEGY: BasicLookupStrategy
+      CANTALOUPE_FILESYSTEMSOURCE_BASICLOOKUPSTRATEGY_PATH_PREFIX: /var/lib/cantaloupe/images/
+      CANTALOUPE_BASE_URI: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
+      CANTALOUPE_CACHE_SERVER_DERIVATIVE: FilesystemCache
+      CANTALOUPE_CACHE_SERVER_DERIVATIVE_ENABLED: "true"
+      CANTALOUPE_FILESYSTEMCACHE_PATHNAME: /var/lib/cantaloupe/cache
+      CANTALOUPE_PROCESSOR_MANUALSELECTIONSTRATEGY_JPG: Java2dProcessor
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8182/iiif/3"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  api:
+    image: {{ registry }}-api:{{ version }}
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      ELASTICSEARCH_URL: ${ELASTICSEARCH_URL:-http://elasticsearch:9200}
+      CANTALOUPE_URL: ${CANTALOUPE_URL:-http://cantaloupe:8182}
+      CANTALOUPE_PUBLIC_URL: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
+      MEDIA_ROOT: /var/lib/katalon/media
+      FIRST_RUN_CREDENTIALS_PATH: ${FIRST_RUN_CREDENTIALS_PATH:-/var/lib/katalon/first-run-credentials.txt}
+      DEBUG: "false"
+    volumes:
+      - ${MEDIA_ROOT:-./media}:/var/lib/katalon/media
+    depends_on:
+      db: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      cantaloupe: { condition: service_healthy }
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  worker:
+    image: {{ registry }}-worker:{{ version }}
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      CANTALOUPE_URL: ${CANTALOUPE_URL:-http://cantaloupe:8182}
+      CANTALOUPE_PUBLIC_URL: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
+      MEDIA_ROOT: /var/lib/katalon/media
+    volumes:
+      - ${MEDIA_ROOT:-./media}:/var/lib/katalon/media
+    depends_on:
+      db: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      cantaloupe: { condition: service_healthy }
+
+  beat:
+    image: {{ registry }}-worker:{{ version }}
+    restart: unless-stopped
+    command: ["celery", "-A", "katalon.workers.celery_app", "beat", "--loglevel=info"]
+    env_file: .env
+    environment:
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      CANTALOUPE_URL: ${CANTALOUPE_URL:-http://cantaloupe:8182}
+      CANTALOUPE_PUBLIC_URL: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
+    depends_on:
+      db: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      cantaloupe: { condition: service_healthy }
+
+  admin:
+    image: {{ registry }}-admin:{{ version }}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/index.html > /dev/null 2>&1 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    depends_on:
+      api: { condition: service_healthy }
+
+  portal:
+    image: {{ registry }}-portal:{{ version }}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/index.html > /dev/null 2>&1 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    depends_on:
+      api: { condition: service_healthy }
+
+  nginx:
+    image: nginx:alpine
+    restart: unless-stopped
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+{% if tls_mode == "standalone" %}
+      - ./certs:/etc/nginx/certs:ro
+{% endif %}
+    ports:
+{% if tls_mode == "standalone" %}
+      - "80:80"
+      - "443:443"
+{% elif tls_mode == "behind-proxy" %}
+      - "127.0.0.1:8080:80"
+{% else %}
+      - "80:80"
+{% endif %}
+    depends_on:
+      api: { condition: service_healthy }
+      admin: { condition: service_healthy }
+      portal: { condition: service_healthy }
+
+volumes:
+  db_data:
+  es_data:

katalon_cli-0.1.3/src/katalon_cli/templates/nginx.conf.j2

@@ -0,0 +1,106 @@
+resolver 127.0.0.11 valid=10s ipv6=off;
+
+server {
+{% if tls_mode == "standalone" %}
+    listen 80;
+    listen 443 ssl;
+    ssl_certificate /etc/nginx/certs/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/privkey.pem;
+{% else %}
+    listen 80;
+{% endif %}
+    client_max_body_size 500m;
+
+    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; connect-src 'self' https:; frame-src 'self' https://www.openstreetmap.org; worker-src 'self' blob:" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+
+    location /api/ {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /v1/ {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /portal/v1/ {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location = /health {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location = /oai {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location ^~ /ark:/ {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /iiif/ {
+        auth_request /internal/media-authorize;
+        set $upstream_cantaloupe cantaloupe:8182;
+        proxy_pass http://$upstream_cantaloupe;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+    }
+
+    location = /internal/media-authorize {
+        internal;
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api/v1/media/_authorize;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URI $request_uri;
+        proxy_set_header Authorization $http_authorization;
+    }
+
+    location /admin/ {
+        set $upstream_admin admin;
+        rewrite ^/admin/(.*)$ /$1 break;
+        proxy_pass http://$upstream_admin;
+        proxy_set_header Host $host;
+    }
+
+    location / {
+        set $upstream_portal portal;
+        proxy_pass http://$upstream_portal;
+        proxy_set_header Host $host;
+    }
+}

katalon_cli-0.1.2/src/katalon_cli/core/compose_gen.py

@@ -1,37 +0,0 @@
-"""Rendert compose.yaml aus Template + Release-Version + TLS-Modus."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-from jinja2 import Environment, PackageLoader, select_autoescape
-
-_env = Environment(
-    loader=PackageLoader("katalon_cli", "templates"),
-    autoescape=select_autoescape(disabled_extensions=(".yaml", ".j2")),
-    trim_blocks=True,
-    lstrip_blocks=True,
-)
-
-
-def render_compose(
-    *,
-    version: str,
-    base_url: str,
-    tls_mode: str,
-    registry: str = "ghcr.io/karkraeg/katalon",
-) -> str:
-    template = _env.get_template("compose.yaml.j2")
-    return template.render(
-        version=version,
-        base_url=base_url,
-        tls_mode=tls_mode,
-        registry=registry,
-    )
-
-
-def write_compose(instance_dir: Path, **kwargs) -> Path:
-    content = render_compose(**kwargs)
-    path = instance_dir / "compose.yaml"
-    path.write_text(content)
-    return path

katalon_cli-0.1.2/src/katalon_cli/templates/Caddyfile.j2

@@ -1,11 +0,0 @@
-{{ base_url_host }} {
-    handle_path /api/* {
-        reverse_proxy api:8000
-    }
-    handle_path /admin/* {
-        reverse_proxy admin:80
-    }
-    handle {
-        reverse_proxy portal:80
-    }
-}

katalon_cli-0.1.2/src/katalon_cli/templates/compose.yaml.j2

@@ -1,99 +0,0 @@
-
-services:
-  db:
-    image: postgis/postgis:16-3.4
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: katalon
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: katalon
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U katalon"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
-    restart: unless-stopped
-    environment:
-      discovery.type: single-node
-      xpack.security.enabled: "false"
-      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
-    volumes:
-      - es_data:/usr/share/elasticsearch/data
-
-  cantaloupe:
-    image: {{ registry }}-cantaloupe:{{ version }}
-    restart: unless-stopped
-    volumes:
-      - ./media:/media:ro
-
-  api:
-    image: {{ registry }}-api:{{ version }}
-    restart: unless-stopped
-    env_file: .env
-    depends_on:
-      db: { condition: service_healthy }
-    volumes:
-      - ./media:/var/lib/katalon/media
-    healthcheck:
-      test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-
-  admin:
-    image: {{ registry }}-web:{{ version }}
-    restart: unless-stopped
-    environment:
-      KATALON_WEB_MODE: admin
-
-  portal:
-    image: {{ registry }}-web:{{ version }}
-    restart: unless-stopped
-    environment:
-      KATALON_WEB_MODE: portal
-
-{% if tls_mode == "standalone" %}
-  proxy:
-    image: caddy:2-alpine
-    restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-    environment:
-      KATALON_BASE_URL: {{ base_url }}
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - caddy_data:/data
-    depends_on:
-      - api
-      - admin
-      - portal
-{% elif tls_mode == "behind-proxy" %}
-  proxy:
-    image: nginx:alpine
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8080:80"
-    volumes:
-      - ./nginx.conf:/etc/nginx/nginx.conf:ro
-    depends_on:
-      - api
-      - admin
-      - portal
-{% endif %}
-
-volumes:
-  db_data:
-  es_data:
-{% if tls_mode == "standalone" %}
-  caddy_data:
-{% endif %}