Ubuntu
3 years ago
parent
45cae54638
commit
05e87eb945
@ -0,0 +1,2 @@
|
||||
.*.swp
|
||||
data
|
||||
@ -0,0 +1,7 @@
|
||||
DOMAIN_NAME=example.com
|
||||
REALM=spacestation
|
||||
|
||||
KEYCLOAK_HOSTNAME=login.${DOMAIN_NAME}
|
||||
HEDGEDOC_HOSTNAME=docs.${DOMAIN_NAME}
|
||||
MASTODON_HOSTNAME=social.${DOMAIN_NAME}
|
||||
NEXTCLOUD_HOSTNAME=cloud.${DOMAIN_NAME}
|
||||
@ -0,0 +1,2 @@
|
||||
CMD_OAUTH2_CLIENT_SECRET=abcdef1234
|
||||
CMD_SESSION_SECRET=abcdef1234
|
||||
@ -0,0 +1,40 @@
|
||||
#!/bin/bash
|
||||
die() { echo >&2 "$@" ; exit 1 ; }
|
||||
|
||||
DIRNAME="$(dirname $0)"
|
||||
cd "$DIRNAME"
|
||||
[ -r env.production ] && source env.production
|
||||
[ -r ../env.production ] && source ../env.production
|
||||
|
||||
cd ../keycloak
|
||||
|
||||
sudo docker-compose exec -T keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
create clients \
|
||||
-r "$REALM" \
|
||||
-f - <<EOF || die "unable to create hedgedoc client"
|
||||
{
|
||||
"clientId": "hedgedoc",
|
||||
"rootUrl": "https://$HEDGEDOC_HOSTNAME",
|
||||
"adminUrl": "https://$HEDGEDOC_HOSTNAME",
|
||||
"redirectUris": [ "https://$HEDGEDOC_HOSTNAME/*" ],
|
||||
"webOrigins": [ "https://$HEDGEDOC_HOSTNAME" ],
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "$CMD_OAUTH2_CLIENT_SECRET",
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"acr",
|
||||
"profile",
|
||||
"roles",
|
||||
"id",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
@ -0,0 +1 @@
|
||||
KEYCLOAK_ADMIN_PASSWORD=abcd@1234!
|
||||
@ -0,0 +1,73 @@
|
||||
#!/bin/bash
|
||||
die() { echo >&2 "ERROR: $@" ; exit 1 ; }
|
||||
info() { echo >&2 "$@" ; }
|
||||
|
||||
DIRNAME="$(dirname $0)"
|
||||
cd "$DIRNAME"
|
||||
source ../env.production
|
||||
source ./env.production
|
||||
|
||||
info "logging into server"
|
||||
sudo docker-compose exec keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
config credentials \
|
||||
--server http://localhost:8080/ \
|
||||
--user admin \
|
||||
--password "$KEYCLOAK_ADMIN_PASSWORD" \
|
||||
--realm master \
|
||||
|| die "unable to login"
|
||||
|
||||
|
||||
info "Create a new realm for '$REALM'"
|
||||
sudo docker-compose exec keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
create realms \
|
||||
-s "realm=$REALM" \
|
||||
-s enabled=true \
|
||||
|| die "unable to create realm"
|
||||
|
||||
|
||||
# https://github.com/hedgedoc/hedgedoc/issues/56
|
||||
info "Fix up a id bug"
|
||||
sudo docker-compose exec -T keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
create client-scopes \
|
||||
-r "$REALM" \
|
||||
-f - <<EOF || die "unable to create mapping"
|
||||
{
|
||||
"name": "id",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "id",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "id",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"jsonType.label": "String",
|
||||
"userinfo.token.claim": "true"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
|
||||
info "Create an admin user in realm"
|
||||
sudo docker-compose exec -T keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
create users \
|
||||
-o \
|
||||
--fields id,username \
|
||||
-r "$REALM" \
|
||||
-s username=admin \
|
||||
-s enabled=true \
|
||||
-s 'credentials=[{"type":"'$KEYCLOAK_ADMIN_PASSWORD'","value":"admin","temporary":false}]' \
|
||||
|| die "$REALM: unable to create admin user"
|
||||
@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
die() { echo >&2 "ERROR: $@" ; exit 1 ; }
|
||||
info() { echo >&2 "$@" ; }
|
||||
|
||||
DIRNAME="$(dirname $0)"
|
||||
cd "$DIRNAME"
|
||||
source ../env.production
|
||||
source ./env.production
|
||||
|
||||
info "configuring mastodon"
|
||||
sudo docker-compose run web \
|
||||
rails db:setup \
|
||||
|| die "unable to login"
|
||||
|
||||
@ -0,0 +1,35 @@
|
||||
Enable SSO:
|
||||
|
||||
```
|
||||
( cd ../keycloak ; sudo docker-compose exec -T keycloak \
|
||||
/opt/keycloak/bin/kcadm.sh \
|
||||
create clients \
|
||||
--realm master --user admin --password admin \
|
||||
-r spacestation \
|
||||
-f - ) <<EOF
|
||||
{
|
||||
"clientId": "nextcloud",
|
||||
"rootUrl": "http://spacestation:9000/",
|
||||
"adminUrl": "http://spacestation:9000/",
|
||||
"redirectUris": [ "http://spacestation:9000/*" ],
|
||||
"webOrigins": [ "http://spacestation:9000" ],
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "nextcloud-secret"
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
and configure the social login app:
|
||||
|
||||
```
|
||||
sudo docker-compose exec -u www-data -T nextcloud \
|
||||
./occ app:install sociallogin \
|
||||
&& sudo docker-compose exec -u www-data -T nextcloud \
|
||||
./occ config:app:set sociallogin prevent_create_email_exists --value=1 \
|
||||
&& sudo docker-compose exec -u www-data -T nextcloud \
|
||||
./occ config:app:set sociallogin update_profile_on_login --value=1 \
|
||||
&& sudo docker-compose exec -u www-data -T nextcloud \
|
||||
./occ config:app:set \
|
||||
sociallogin custom_providers \
|
||||
--value='{"custom_oidc":[{"name":"keycloak","title":"Keycloak","authorizeUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/auth","tokenUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/token","displayNameClaim":"","userInfoUrl":"http://spacestation:8080/realms/spacestation/protocol/openid-connect/userinfo","logoutUrl":"","clientId":"nextcloud","clientSecret":"nextcloud-secret","scope":"openid","groupsClaim":"roles","style":"keycloak","defaultGroup":""}]}'
|
||||
```
|
||||
@ -0,0 +1 @@
|
||||
NEXTCLOUD_ADMIN_PASSWORD=admin
|
||||
@ -0,0 +1,59 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name ${HEDGEDOC_HOSTNAME};
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name ${HEDGEDOC_HOSTNAME}
|
||||
client_max_body_size 128m;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
#include /etc/nginx/mime.types;
|
||||
#default_type application/octet-stream;
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
|
||||
proxy_read_timeout 1800s;
|
||||
|
||||
# required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486)
|
||||
chunked_transfer_encoding on;
|
||||
|
||||
location / {
|
||||
proxy_pass http://spacestation:3000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /socket.io/ {
|
||||
proxy_pass http://spacestation:3000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
}
|
||||
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
}
|
||||
|
||||
|
||||
Loading…
Reference in new issue