forked from Deuxfleurs/infrastructure
Compare commits
61 commits
feature/up
...
main
Author | SHA1 | Date | |
---|---|---|---|
Quentin | 88a7c04cee | ||
Quentin | 136d176176 | ||
Quentin | 2a0610658d | ||
Quentin | 6db8495bbf | ||
Quentin | 4ea2494bd5 | ||
Quentin | acd46fde80 | ||
Quentin | 6716687fd7 | ||
Quentin | a2a25e2ea4 | ||
Quentin | e74bda617c | ||
Quentin | 2dfd006dc5 | ||
Alex | 9c4f78619d | ||
Quentin | 8fe0a78b0c | ||
Quentin | e66b1c2c54 | ||
Quentin | d40c41004d | ||
Quentin | 09269e8497 | ||
darkgallium | e26f57c8eb | ||
Alex | d25f4d18aa | ||
Alex | b8470be123 | ||
Alex | 9d5b490fd9 | ||
Quentin | 9304997d84 | ||
Alex | 2f37aaaf76 | ||
Alex | 69f063e406 | ||
Quentin | 8302595f65 | ||
Quentin | 4fdc4a5144 | ||
Quentin | 2b39a896a7 | ||
Quentin | e97496e09d | ||
Quentin | 2670c8f8f1 | ||
Quentin | 0a6ffcacd2 | ||
Quentin | 2d61f1449d | ||
Quentin | 80c2f1f701 | ||
Quentin | e640f82eb8 | ||
Alex | 455e4db784 | ||
Quentin | 576ac2772e | ||
Quentin | 1277d94bec | ||
Quentin | b9f0f012bd | ||
Quentin | 4b68522721 | ||
Quentin | 3c8cd4ca1c | ||
Quentin | 784efbcc9b | ||
Quentin | 2d30e1a9c7 | ||
Quentin | 42c020e00b | ||
Quentin | 7e82b0d94d | ||
Quentin | efcdef7856 | ||
Alex | 62fa15390b | ||
Alex | a26d41259a | ||
Quentin | 73d30b9aa5 | ||
Quentin | 8c213bc7ba | ||
Quentin | 1edc5f37a2 | ||
Quentin | 4f506422e3 | ||
Quentin | 3bb2cf9e93 | ||
Alex | 1f15d29eab | ||
Quentin | 6754cfef81 | ||
Quentin | 3df53eaa94 | ||
Quentin | 51b5295ba8 | ||
Alex | 925639b678 | ||
Quentin | 68575d2654 | ||
Quentin | 338a8ec7da | ||
Quentin | 3135c38505 | ||
Quentin | 87303033d1 | ||
Quentin | 9dfff86cd2 | ||
Quentin | b851ca0c95 | ||
Quentin | fae36c7ef6 |
|
@ -14,9 +14,22 @@ Host backuphost
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
echo "export sql"
|
echo "export sql"
|
||||||
# note, -Fc means that postgresql compresses the output
|
export PGPASSWORD=$REPL_PSQL_PWD
|
||||||
export PGPASSWORD=$MATRIX_PSQL_PWD
|
pg_basebackup \
|
||||||
pg_dump -v -Fc -U $MATRIX_PSQL_USER -h psql-proxy.service.2.cluster.deuxfleurs.fr $MATRIX_PSQL_DB | \
|
--pgdata=- \
|
||||||
|
--format=tar \
|
||||||
|
--max-rate=1M \
|
||||||
|
--no-slot \
|
||||||
|
--wal-method=none \
|
||||||
|
--gzip \
|
||||||
|
--compress=8 \
|
||||||
|
--checkpoint=spread \
|
||||||
|
--progress \
|
||||||
|
--verbose \
|
||||||
|
--status-interval=10 \
|
||||||
|
--username=$REPL_PSQL_USER \
|
||||||
|
--port=5432 \
|
||||||
|
--host=psql-proxy.service.2.cluster.deuxfleurs.fr | \
|
||||||
age -r "$(cat /root/.ssh/id_ed25519.pub)" | \
|
age -r "$(cat /root/.ssh/id_ed25519.pub)" | \
|
||||||
ssh backuphost "cat > $TARGET_SSH_DIR/matrix/db-$(date --iso-8601=minute).gz.age"
|
ssh backuphost "cat > $TARGET_SSH_DIR/matrix/db-$(date --iso-8601=minute).gz.age"
|
||||||
|
|
||||||
|
|
|
@ -7,7 +7,7 @@ job "backup_manual_matrix" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/backup_matrix:2"
|
image = "superboum/backup_matrix:4"
|
||||||
volumes = [
|
volumes = [
|
||||||
"secrets/id_ed25519:/root/.ssh/id_ed25519",
|
"secrets/id_ed25519:/root/.ssh/id_ed25519",
|
||||||
"secrets/id_ed25519.pub:/root/.ssh/id_ed25519.pub",
|
"secrets/id_ed25519.pub:/root/.ssh/id_ed25519.pub",
|
||||||
|
@ -27,9 +27,8 @@ TARGET_SSH_USER={{ key "secrets/backup/target_ssh_user" }}
|
||||||
TARGET_SSH_PORT={{ key "secrets/backup/target_ssh_port" }}
|
TARGET_SSH_PORT={{ key "secrets/backup/target_ssh_port" }}
|
||||||
TARGET_SSH_HOST={{ key "secrets/backup/target_ssh_host" }}
|
TARGET_SSH_HOST={{ key "secrets/backup/target_ssh_host" }}
|
||||||
TARGET_SSH_DIR={{ key "secrets/backup/target_ssh_dir" }}
|
TARGET_SSH_DIR={{ key "secrets/backup/target_ssh_dir" }}
|
||||||
MATRIX_PSQL_DB={{ key "secrets/chat/synapse/postgres_db" }}
|
REPL_PSQL_USER={{ key "secrets/postgres/keeper/pg_repl_username" }}
|
||||||
MATRIX_PSQL_USER={{ key "secrets/chat/synapse/postgres_user" }}
|
REPL_PSQL_PWD={{ key "secrets/postgres/keeper/pg_repl_pwd" }}
|
||||||
MATRIX_PSQL_PWD={{ key "secrets/chat/synapse/postgres_pwd" }}
|
|
||||||
EOH
|
EOH
|
||||||
|
|
||||||
destination = "secrets/env_vars"
|
destination = "secrets/env_vars"
|
||||||
|
|
|
@ -1,45 +1,46 @@
|
||||||
job "science" {
|
job "bagage" {
|
||||||
datacenters = ["dc1"]
|
datacenters = ["dc1"]
|
||||||
type = "service"
|
type = "service"
|
||||||
priority = 10
|
priority = 90
|
||||||
|
|
||||||
constraint {
|
constraint {
|
||||||
attribute = "${attr.cpu.arch}"
|
attribute = "${attr.cpu.arch}"
|
||||||
value = "amd64"
|
value = "amd64"
|
||||||
}
|
}
|
||||||
|
|
||||||
group "diagnet" {
|
group "main" {
|
||||||
|
count = 1
|
||||||
|
|
||||||
network {
|
network {
|
||||||
port "web_port" { to = 8000 }
|
port "web_port" { to = 8080 }
|
||||||
}
|
}
|
||||||
|
|
||||||
task "main" {
|
task "server" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "lesterpig/diagnet-landmark:latest"
|
image = "superboum/amd64_bagage:v8"
|
||||||
args = [
|
readonly_rootfs = true
|
||||||
"-name", "landmark-deuxfleurs",
|
|
||||||
"-chrome", "-chrome-interval", "60m",
|
|
||||||
"-http", ":8000"
|
|
||||||
]
|
|
||||||
ports = [ "web_port" ]
|
ports = [ "web_port" ]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
BAGAGE_LDAP_ENDPOINT = "bottin2.service.2.cluster.deuxfleurs.fr:389"
|
||||||
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
cpu = 100
|
memory = 500
|
||||||
memory = 250
|
|
||||||
}
|
}
|
||||||
|
|
||||||
service {
|
service {
|
||||||
|
name = "bagage"
|
||||||
tags = [
|
tags = [
|
||||||
"diagnet",
|
"bagage",
|
||||||
"traefik.enable=true",
|
"traefik.enable=true",
|
||||||
"traefik.frontend.entryPoints=https,http",
|
"traefik.frontend.entryPoints=https,http",
|
||||||
"traefik.frontend.rule=Host:diagnet.science.deuxfleurs.fr;PathPrefix:/"
|
"traefik.frontend.rule=Host:bagage.deuxfleurs.fr",
|
||||||
]
|
]
|
||||||
port = "web_port"
|
port = "web_port"
|
||||||
address_mode = "host"
|
address_mode = "host"
|
||||||
name = "diagnet"
|
|
||||||
check {
|
check {
|
||||||
type = "tcp"
|
type = "tcp"
|
||||||
port = "web_port"
|
port = "web_port"
|
|
@ -1,44 +1,51 @@
|
||||||
job "core" {
|
job "core" {
|
||||||
datacenters = ["dc1"]
|
datacenters = ["dc1"]
|
||||||
type = "system"
|
type = "system"
|
||||||
priority = 90
|
priority = 90
|
||||||
|
|
||||||
constraint {
|
constraint {
|
||||||
attribute = "${attr.cpu.arch}"
|
attribute = "${attr.cpu.arch}"
|
||||||
value = "amd64"
|
value = "amd64"
|
||||||
}
|
}
|
||||||
|
|
||||||
update {
|
update {
|
||||||
max_parallel = 1
|
max_parallel = 1
|
||||||
stagger = "1m"
|
stagger = "1m"
|
||||||
}
|
}
|
||||||
|
|
||||||
group "network" {
|
group "network" {
|
||||||
task "diplonat" {
|
task "diplonat" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "darkgallium/amd64_diplonat:v2"
|
image = "darkgallium/amd64_diplonat:v3"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = true
|
readonly_rootfs = true
|
||||||
privileged = true
|
privileged = true
|
||||||
}
|
}
|
||||||
|
|
||||||
template {
|
restart {
|
||||||
data = <<EOH
|
interval = "30m"
|
||||||
|
attempts = 2
|
||||||
|
delay = "15s"
|
||||||
|
mode = "delay"
|
||||||
|
}
|
||||||
|
|
||||||
|
template {
|
||||||
|
data = <<EOH
|
||||||
DIPLONAT_PRIVATE_IP={{ env "attr.unique.network.ip-address" }}
|
DIPLONAT_PRIVATE_IP={{ env "attr.unique.network.ip-address" }}
|
||||||
DIPLONAT_REFRESH_TIME=60
|
DIPLONAT_REFRESH_TIME=60
|
||||||
DIPLONAT_EXPIRATION_TIME=300
|
DIPLONAT_EXPIRATION_TIME=300
|
||||||
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
|
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
|
||||||
RUST_LOG=debug
|
RUST_LOG=debug
|
||||||
EOH
|
EOH
|
||||||
destination = "secrets/env"
|
destination = "secrets/env"
|
||||||
env = true
|
env = true
|
||||||
}
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
memory = 40
|
memory = 40
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -12,9 +12,7 @@
|
||||||
"invitation_name_attr": "cn",
|
"invitation_name_attr": "cn",
|
||||||
"invited_mail_format": "{}@deuxfleurs.fr",
|
"invited_mail_format": "{}@deuxfleurs.fr",
|
||||||
"invited_auto_groups": [
|
"invited_auto_groups": [
|
||||||
"cn=email,ou=groups,dc=deuxfleurs,dc=fr",
|
"cn=email,ou=groups,dc=deuxfleurs,dc=fr"
|
||||||
"cn=seafile,ou=groups,dc=deuxfleurs,dc=fr",
|
|
||||||
"cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr"
|
|
||||||
],
|
],
|
||||||
|
|
||||||
"web_address": "https://guichet.deuxfleurs.fr",
|
"web_address": "https://guichet.deuxfleurs.fr",
|
||||||
|
@ -25,6 +23,12 @@
|
||||||
|
|
||||||
"admin_account": "cn=admin,dc=deuxfleurs,dc=fr",
|
"admin_account": "cn=admin,dc=deuxfleurs,dc=fr",
|
||||||
"group_can_admin": "cn=admin,ou=groups,dc=deuxfleurs,dc=fr",
|
"group_can_admin": "cn=admin,ou=groups,dc=deuxfleurs,dc=fr",
|
||||||
"group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr"
|
"group_can_invite": "cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr",
|
||||||
|
|
||||||
|
"s3_endpoint": "garage.deuxfleurs.fr",
|
||||||
|
"s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}",
|
||||||
|
"s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}",
|
||||||
|
"s3_region": "garage",
|
||||||
|
"s3_bucket": "bottin-pictures"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -21,7 +21,7 @@ job "directory" {
|
||||||
task "bottin" {
|
task "bottin" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "lxpz/bottin_amd64:21"
|
image = "superboum/bottin_amd64:22"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = true
|
readonly_rootfs = true
|
||||||
ports = [ "ldap_port" ]
|
ports = [ "ldap_port" ]
|
||||||
|
@ -69,7 +69,7 @@ job "directory" {
|
||||||
task "guichet" {
|
task "guichet" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "lxpz/guichet_amd64:10"
|
image = "superboum/guichet_amd64:15"
|
||||||
readonly_rootfs = true
|
readonly_rootfs = true
|
||||||
ports = [ "web_port" ]
|
ports = [ "web_port" ]
|
||||||
volumes = [
|
volumes = [
|
||||||
|
|
1
app/directory/secrets/directory/guichet/s3_access_key
Normal file
1
app/directory/secrets/directory/guichet/s3_access_key
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER Garage access key for Guichet profile pictures
|
1
app/directory/secrets/directory/guichet/s3_secret_key
Normal file
1
app/directory/secrets/directory/guichet/s3_secret_key
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER Garage secret key for Guichet profile pictures
|
1
app/directory/secrets/directory/guichet/smtp_pass
Normal file
1
app/directory/secrets/directory/guichet/smtp_pass
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER SMTP password
|
1
app/directory/secrets/directory/guichet/smtp_user
Normal file
1
app/directory/secrets/directory/guichet/smtp_user
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER SMTP username
|
|
@ -1,29 +1,24 @@
|
||||||
version: '3.4'
|
version: '3.4'
|
||||||
services:
|
services:
|
||||||
|
|
||||||
mariadb:
|
|
||||||
build:
|
|
||||||
context: ./seafile/build/mariadb
|
|
||||||
args:
|
|
||||||
VERSION: 4 # fake for now
|
|
||||||
image: superboum/amd64_mariadb:v4
|
|
||||||
|
|
||||||
# Instant Messaging
|
# Instant Messaging
|
||||||
riot:
|
riot:
|
||||||
build:
|
build:
|
||||||
context: ./im/build/riotweb
|
context: ./im/build/riotweb
|
||||||
args:
|
args:
|
||||||
# https://github.com/vector-im/riot-web/releases
|
# https://github.com/vector-im/riot-web/releases
|
||||||
VERSION: 1.7.22
|
VERSION: 1.8.4
|
||||||
image: superboum/amd64_riotweb:v21
|
image: superboum/amd64_riotweb:v24
|
||||||
|
|
||||||
synapse:
|
synapse:
|
||||||
build:
|
build:
|
||||||
context: ./im/build/matrix-synapse
|
context: ./im/build/matrix-synapse
|
||||||
args:
|
args:
|
||||||
# https://github.com/matrix-org/synapse/releases
|
# https://github.com/matrix-org/synapse/releases
|
||||||
VERSION: 1.28.0
|
VERSION: 1.42.0
|
||||||
image: superboum/amd64_synapse:v42
|
# https://github.com/matrix-org/synapse-s3-storage-provider/commits/main
|
||||||
|
S3_VERSION: 3c3fafd6a2624f05fd396d9e003501bf8bef7b2e
|
||||||
|
image: superboum/amd64_synapse:v47
|
||||||
|
|
||||||
# Email
|
# Email
|
||||||
sogo:
|
sogo:
|
||||||
|
@ -41,6 +36,11 @@ services:
|
||||||
VERSION: 9bafa64b9d
|
VERSION: 9bafa64b9d
|
||||||
image: superboum/amd64_alps:v1
|
image: superboum/amd64_alps:v1
|
||||||
|
|
||||||
|
dovecot:
|
||||||
|
build:
|
||||||
|
context: ./email/build/dovecot
|
||||||
|
image: superboum/amd64_dovecot:v6
|
||||||
|
|
||||||
# VoIP
|
# VoIP
|
||||||
jitsi-meet:
|
jitsi-meet:
|
||||||
build:
|
build:
|
||||||
|
@ -79,8 +79,8 @@ services:
|
||||||
build:
|
build:
|
||||||
context: ./plume/build/plume
|
context: ./plume/build/plume
|
||||||
args:
|
args:
|
||||||
VERSION: 0.6.0
|
VERSION: 8c372aa6fcd05083601903d83b0fcb4915585a95
|
||||||
image: superboum/plume:v2
|
image: superboum/plume:v4
|
||||||
|
|
||||||
postfix:
|
postfix:
|
||||||
build:
|
build:
|
||||||
|
@ -94,11 +94,9 @@ services:
|
||||||
build:
|
build:
|
||||||
args:
|
args:
|
||||||
# https://github.com/sorintlab/stolon/releases
|
# https://github.com/sorintlab/stolon/releases
|
||||||
STOLON_VERSION: 2d0b8e516a4eaec01f3a9509cdc50a1d4ce8709c
|
STOLON_VERSION: 057389f7e484ee1d5c1e1a7020256020e7413c87
|
||||||
# https://packages.debian.org/fr/stretch/postgresql-all
|
|
||||||
PG_VERSION: 9.6+181+deb9u3
|
|
||||||
context: ./postgres/build/postgres
|
context: ./postgres/build/postgres
|
||||||
image: superboum/amd64_postgres:v4
|
image: superboum/amd64_postgres:v9
|
||||||
|
|
||||||
backup-consul:
|
backup-consul:
|
||||||
build:
|
build:
|
||||||
|
@ -108,4 +106,4 @@ services:
|
||||||
backup-matrix:
|
backup-matrix:
|
||||||
build:
|
build:
|
||||||
context: ./backup/build/backup-matrix
|
context: ./backup/build/backup-matrix
|
||||||
image: superboum/backup_matrix:2
|
image: superboum/backup_matrix:4
|
||||||
|
|
|
@ -14,7 +14,7 @@ job "drone-ci" {
|
||||||
task "drone_server" {
|
task "drone_server" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "drone/drone:latest"
|
image = "drone/drone:2.0.4"
|
||||||
ports = [ "web_port" ]
|
ports = [ "web_port" ]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
FROM amd64/debian:stretch
|
FROM amd64/debian:bullseye
|
||||||
|
|
||||||
RUN apt-get update && \
|
RUN apt-get update && \
|
||||||
apt-get install -y \
|
apt-get install -y \
|
||||||
|
@ -11,7 +11,6 @@ RUN apt-get update && \
|
||||||
dovecot-lmtpd && \
|
dovecot-lmtpd && \
|
||||||
rm -rf /etc/dovecot/*
|
rm -rf /etc/dovecot/*
|
||||||
RUN useradd mailstore
|
RUN useradd mailstore
|
||||||
COPY ./conf/* /etc/dovecot/
|
|
||||||
COPY entrypoint.sh /usr/local/bin/entrypoint
|
COPY entrypoint.sh /usr/local/bin/entrypoint
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/entrypoint"]
|
ENTRYPOINT ["/usr/local/bin/entrypoint"]
|
||||||
|
|
|
@ -5,4 +5,8 @@ base = dc=deuxfleurs,dc=fr
|
||||||
scope = subtree
|
scope = subtree
|
||||||
user_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
|
user_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
|
||||||
pass_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
|
pass_filter = (&(mail=%u)(&(objectClass=inetOrgPerson)(memberOf=cn=email,ou=groups,dc=deuxfleurs,dc=fr)))
|
||||||
user_attrs = mail=/var/mail/%{ldap:mail}
|
user_attrs = \
|
||||||
|
=user=%{ldap:cn}, \
|
||||||
|
=mail=maildir:/var/mail/%{ldap:cn}, \
|
||||||
|
=uid=1000, \
|
||||||
|
=gid=1000
|
||||||
|
|
|
@ -19,10 +19,7 @@ service auth {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
passdb {
|
|
||||||
args = /etc/dovecot/dovecot-ldap.conf
|
|
||||||
driver = ldap
|
|
||||||
}
|
|
||||||
|
|
||||||
service lmtp {
|
service lmtp {
|
||||||
inet_listener lmtp {
|
inet_listener lmtp {
|
||||||
|
@ -31,7 +28,23 @@ service lmtp {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# https://doc.dovecot.org/configuration_manual/authentication/ldap_authentication/
|
||||||
|
passdb {
|
||||||
|
args = /etc/dovecot/dovecot-ldap.conf
|
||||||
|
driver = ldap
|
||||||
|
}
|
||||||
|
userdb {
|
||||||
|
driver = prefetch
|
||||||
|
}
|
||||||
|
userdb {
|
||||||
|
args = /etc/dovecot/dovecot-ldap.conf
|
||||||
|
driver = ldap
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
service imap-login {
|
service imap-login {
|
||||||
|
service_count = 0 # performance mode. set to 1 for secure mode
|
||||||
|
process_min_avail = 1
|
||||||
inet_listener imap {
|
inet_listener imap {
|
||||||
port = 143
|
port = 143
|
||||||
}
|
}
|
||||||
|
@ -40,11 +53,6 @@ service imap-login {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
userdb {
|
|
||||||
args = uid=mailstore gid=mailstore home=/var/mail/%u
|
|
||||||
driver = static
|
|
||||||
}
|
|
||||||
|
|
||||||
protocol imap {
|
protocol imap {
|
||||||
mail_plugins = $mail_plugins imap_sieve
|
mail_plugins = $mail_plugins imap_sieve
|
||||||
}
|
}
|
|
@ -29,7 +29,7 @@ job "email" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_dovecot:v2"
|
image = "superboum/amd64_dovecot:v6"
|
||||||
readonly_rootfs = false
|
readonly_rootfs = false
|
||||||
ports = [ "zauthentication_port", "imaps_port", "imap_port", "lmtp_port" ]
|
ports = [ "zauthentication_port", "imaps_port", "imap_port", "lmtp_port" ]
|
||||||
command = "dovecot"
|
command = "dovecot"
|
||||||
|
@ -37,7 +37,7 @@ job "email" {
|
||||||
volumes = [
|
volumes = [
|
||||||
"secrets/ssl/certs:/etc/ssl/certs",
|
"secrets/ssl/certs:/etc/ssl/certs",
|
||||||
"secrets/ssl/private:/etc/ssl/private",
|
"secrets/ssl/private:/etc/ssl/private",
|
||||||
"secrets/conf/dovecot-ldap.conf:/etc/dovecot/dovecot-ldap.conf",
|
"secrets/conf/:/etc/dovecot/",
|
||||||
"/mnt/glusterfs/email/mail:/var/mail/",
|
"/mnt/glusterfs/email/mail:/var/mail/",
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
@ -135,6 +135,11 @@ job "email" {
|
||||||
destination = "secrets/conf/dovecot-ldap.conf"
|
destination = "secrets/conf/dovecot-ldap.conf"
|
||||||
perms = "400"
|
perms = "400"
|
||||||
}
|
}
|
||||||
|
template {
|
||||||
|
data = file("../config/dovecot/dovecot.conf")
|
||||||
|
destination = "secrets/conf/dovecot.conf"
|
||||||
|
perms = "400"
|
||||||
|
}
|
||||||
|
|
||||||
# ----- secrets ------
|
# ----- secrets ------
|
||||||
template {
|
template {
|
||||||
|
|
|
@ -3,6 +3,8 @@ block_size = 1048576
|
||||||
metadata_dir = "/garage/meta"
|
metadata_dir = "/garage/meta"
|
||||||
data_dir = "/garage/data"
|
data_dir = "/garage/data"
|
||||||
|
|
||||||
|
replication_mode = "3"
|
||||||
|
|
||||||
rpc_bind_addr = "[::]:3901"
|
rpc_bind_addr = "[::]:3901"
|
||||||
|
|
||||||
consul_host = "consul.service.2.cluster.deuxfleurs.fr:8500"
|
consul_host = "consul.service.2.cluster.deuxfleurs.fr:8500"
|
||||||
|
@ -11,9 +13,6 @@ consul_service_name = "garage-rpc"
|
||||||
bootstrap_peers = []
|
bootstrap_peers = []
|
||||||
|
|
||||||
max_concurrent_rpc_requests = 12
|
max_concurrent_rpc_requests = 12
|
||||||
data_replication_factor = 3
|
|
||||||
meta_replication_factor = 3
|
|
||||||
meta_epidemic_fanout = 3
|
|
||||||
|
|
||||||
[rpc_tls]
|
[rpc_tls]
|
||||||
ca_cert = "/garage/garage-ca.crt"
|
ca_cert = "/garage/garage-ca.crt"
|
||||||
|
|
|
@ -25,7 +25,7 @@ job "garage" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
advertise_ipv6_address = true
|
advertise_ipv6_address = true
|
||||||
image = "lxpz/garage_amd64:v0.2.1.4"
|
image = "lxpz/garage_amd64:v0.3.0.1"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
volumes = [
|
volumes = [
|
||||||
"/mnt/storage/garage/data:/garage/data",
|
"/mnt/storage/garage/data:/garage/data",
|
||||||
|
@ -35,6 +35,9 @@ job "garage" {
|
||||||
"secrets/garage.crt:/garage/garage.crt",
|
"secrets/garage.crt:/garage/garage.crt",
|
||||||
"secrets/garage.key:/garage/garage.key",
|
"secrets/garage.key:/garage/garage.key",
|
||||||
]
|
]
|
||||||
|
logging {
|
||||||
|
type = "journald"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
template {
|
template {
|
||||||
|
@ -57,12 +60,12 @@ job "garage" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
memory = 500
|
memory = 800
|
||||||
cpu = 1000
|
cpu = 1000
|
||||||
}
|
}
|
||||||
|
|
||||||
kill_signal = "SIGINT"
|
kill_signal = "SIGINT"
|
||||||
kill_timeout = "20s"
|
kill_timeout = "20s"
|
||||||
|
|
||||||
service {
|
service {
|
||||||
tags = [
|
tags = [
|
||||||
|
@ -106,6 +109,13 @@ job "garage" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
restart {
|
||||||
|
interval = "30m"
|
||||||
|
attempts = 10
|
||||||
|
delay = "15s"
|
||||||
|
mode = "delay"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
FROM amd64/debian:buster as builder
|
FROM amd64/debian:buster as builder
|
||||||
|
|
||||||
ARG VERSION
|
ARG VERSION
|
||||||
|
ARG S3_VERSION
|
||||||
RUN apt-get update && \
|
RUN apt-get update && \
|
||||||
apt-get -qq -y full-upgrade && \
|
apt-get -qq -y full-upgrade && \
|
||||||
apt-get install -y \
|
apt-get install -y \
|
||||||
|
@ -18,11 +19,14 @@ RUN apt-get update && \
|
||||||
# postgresql-dev \
|
# postgresql-dev \
|
||||||
libpq-dev \
|
libpq-dev \
|
||||||
virtualenv \
|
virtualenv \
|
||||||
libxslt1-dev && \
|
libxslt1-dev \
|
||||||
|
git && \
|
||||||
virtualenv /root/matrix-env -p /usr/bin/python3 && \
|
virtualenv /root/matrix-env -p /usr/bin/python3 && \
|
||||||
. /root/matrix-env/bin/activate && \
|
. /root/matrix-env/bin/activate && \
|
||||||
pip3 install \
|
pip3 install \
|
||||||
https://github.com/matrix-org/synapse/archive/v${VERSION}.tar.gz#egg=matrix-synapse[matrix-synapse-ldap3,postgres,resources.consent,saml2,url_preview]
|
https://github.com/matrix-org/synapse/archive/v${VERSION}.tar.gz#egg=matrix-synapse[matrix-synapse-ldap3,postgres,resources.consent,saml2,url_preview] && \
|
||||||
|
pip3 install \
|
||||||
|
git+https://github.com/matrix-org/synapse-s3-storage-provider.git@${S3_VERSION}
|
||||||
|
|
||||||
FROM amd64/debian:buster
|
FROM amd64/debian:buster
|
||||||
|
|
||||||
|
@ -42,6 +46,7 @@ RUN apt-get update && \
|
||||||
|
|
||||||
ENV LD_PRELOAD /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
|
ENV LD_PRELOAD /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
|
||||||
COPY --from=builder /root/matrix-env /root/matrix-env
|
COPY --from=builder /root/matrix-env /root/matrix-env
|
||||||
|
COPY matrix-s3-async /usr/local/bin/matrix-s3-async
|
||||||
COPY entrypoint.sh /usr/local/bin/entrypoint
|
COPY entrypoint.sh /usr/local/bin/entrypoint
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/entrypoint"]
|
ENTRYPOINT ["/usr/local/bin/entrypoint"]
|
||||||
|
|
16
app/im/build/matrix-synapse/matrix-s3-async
Executable file
16
app/im/build/matrix-synapse/matrix-s3-async
Executable file
|
@ -0,0 +1,16 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
cat > database.yaml <<EOF
|
||||||
|
user: $PG_USER
|
||||||
|
password: $PG_PASS
|
||||||
|
database: $PG_DB
|
||||||
|
host: $PG_HOST
|
||||||
|
port: $PG_PORT
|
||||||
|
EOF
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
/root/matrix-env/bin/s3_media_upload update-db 0d
|
||||||
|
/root/matrix-env/bin/s3_media_upload --no-progress check-deleted /var/lib/matrix-synapse/media
|
||||||
|
/root/matrix-env/bin/s3_media_upload --no-progress upload /var/lib/matrix-synapse/media matrix --delete --endpoint-url https://garage.deuxfleurs.fr
|
||||||
|
sleep 600
|
||||||
|
done
|
|
@ -1,133 +0,0 @@
|
||||||
# Homeserver details
|
|
||||||
homeserver:
|
|
||||||
# The address that this appservice can use to connect to the homeserver.
|
|
||||||
address: https://im.deuxfleurs.fr
|
|
||||||
# The domain of the homeserver (for MXIDs, etc).
|
|
||||||
domain: deuxfleurs.fr
|
|
||||||
# Whether or not to verify the SSL certificate of the homeserver.
|
|
||||||
# Only applies if address starts with https://
|
|
||||||
verify_ssl: true
|
|
||||||
|
|
||||||
# Application service host/registration related details
|
|
||||||
# Changing these values requires regeneration of the registration.
|
|
||||||
appservice:
|
|
||||||
# The address that the homeserver can use to connect to this appservice.
|
|
||||||
address: http://fb2mx.service.2.cluster.deuxfleurs.fr:29319
|
|
||||||
|
|
||||||
# The hostname and port where this appservice should listen.
|
|
||||||
hostname: 0.0.0.0
|
|
||||||
port: 29319
|
|
||||||
# The maximum body size of appservice API requests (from the homeserver) in mebibytes
|
|
||||||
# Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
|
|
||||||
max_body_size: 1
|
|
||||||
|
|
||||||
# The full URI to the database. SQLite and Postgres are fully supported.
|
|
||||||
# Other DBMSes supported by SQLAlchemy may or may not work.
|
|
||||||
# Format examples:
|
|
||||||
# SQLite: sqlite:///filename.db
|
|
||||||
# Postgres: postgres://username:password@hostname/dbname
|
|
||||||
database: '{{ key "secrets/chat/fb2mx/db_url" | trimSpace }}'
|
|
||||||
|
|
||||||
# The unique ID of this appservice.
|
|
||||||
id: facebook
|
|
||||||
# Username of the appservice bot.
|
|
||||||
bot_username: facebookbot
|
|
||||||
# Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
|
|
||||||
# to leave display name/avatar as-is.
|
|
||||||
bot_displayname: Facebook bridge bot
|
|
||||||
bot_avatar: mxc://maunium.net/ddtNPZSKMNqaUzqrHuWvUADv
|
|
||||||
|
|
||||||
# Community ID for bridged users (changes registration file) and rooms.
|
|
||||||
# Must be created manually.
|
|
||||||
community_id: "+fbusers:deuxfleurs.fr"
|
|
||||||
|
|
||||||
# Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
|
|
||||||
as_token: '{{ key "secrets/chat/fb2mx/as_token" | trimSpace }}'
|
|
||||||
hs_token: '{{ key "secrets/chat/fb2mx/hs_token" | trimSpace }}'
|
|
||||||
|
|
||||||
# Bridge config
|
|
||||||
bridge:
|
|
||||||
# Localpart template of MXIDs for Facebook users.
|
|
||||||
# {userid} is replaced with the user ID of the Facebook user.
|
|
||||||
username_template: "facebook_{userid}"
|
|
||||||
# Localpart template for per-user room grouping community IDs.
|
|
||||||
# The bridge will create these communities and add all of the specific user's portals to the community.
|
|
||||||
# {localpart} is the MXID localpart and {server} is the MXID server part of the user.
|
|
||||||
#
|
|
||||||
# `facebook_{localpart}={server}` is a good value.
|
|
||||||
community_template: "facebook_{localpart}={server}"
|
|
||||||
# Displayname template for Facebook users.
|
|
||||||
# {displayname} is replaced with the display name of the Facebook user
|
|
||||||
# as defined below in displayname_preference.
|
|
||||||
# Keys available for displayname_preference are also available here.
|
|
||||||
displayname_template: "{displayname} (FB)"
|
|
||||||
# Available keys:
|
|
||||||
# "name" (full name)
|
|
||||||
# "first_name"
|
|
||||||
# "last_name"
|
|
||||||
# "nickname"
|
|
||||||
# "own_nickname" (user-specific!)
|
|
||||||
displayname_preference:
|
|
||||||
- name
|
|
||||||
|
|
||||||
# The prefix for commands. Only required in non-management rooms.
|
|
||||||
command_prefix: "!fb"
|
|
||||||
|
|
||||||
# Number of chats to sync (and create portals for) on startup/login.
|
|
||||||
# Maximum 20, set 0 to disable automatic syncing.
|
|
||||||
initial_chat_sync: 10
|
|
||||||
# Whether or not the Facebook users of logged in Matrix users should be
|
|
||||||
# invited to private chats when the user sends a message from another client.
|
|
||||||
invite_own_puppet_to_pm: false
|
|
||||||
# Whether or not to use /sync to get presence, read receipts and typing notifications when using
|
|
||||||
# your own Matrix account as the Matrix puppet for your Facebook account.
|
|
||||||
sync_with_custom_puppets: true
|
|
||||||
# Whether or not to bridge presence in both directions. Facebook allows users not to broadcast
|
|
||||||
# presence, but then it won't send other users' presence to the client.
|
|
||||||
presence: true
|
|
||||||
# Whether or not to update avatars when syncing all contacts at startup.
|
|
||||||
update_avatar_initial_sync: true
|
|
||||||
|
|
||||||
# Permissions for using the bridge.
|
|
||||||
# Permitted values:
|
|
||||||
# user - Use the bridge with puppeting.
|
|
||||||
# admin - Use and administrate the bridge.
|
|
||||||
# Permitted keys:
|
|
||||||
# * - All Matrix users
|
|
||||||
# domain - All users on that homeserver
|
|
||||||
# mxid - Specific user
|
|
||||||
permissions:
|
|
||||||
"deuxfleurs.fr": "user"
|
|
||||||
|
|
||||||
# Python logging configuration.
|
|
||||||
#
|
|
||||||
# See section 16.7.2 of the Python documentation for more info:
|
|
||||||
# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
|
|
||||||
logging:
|
|
||||||
version: 1
|
|
||||||
formatters:
|
|
||||||
colored:
|
|
||||||
(): mautrix_facebook.util.ColorFormatter
|
|
||||||
format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
|
|
||||||
normal:
|
|
||||||
format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
|
|
||||||
handlers:
|
|
||||||
file:
|
|
||||||
class: logging.handlers.RotatingFileHandler
|
|
||||||
formatter: normal
|
|
||||||
filename: ./mautrix-facebook.log
|
|
||||||
maxBytes: 10485760
|
|
||||||
backupCount: 10
|
|
||||||
console:
|
|
||||||
class: logging.StreamHandler
|
|
||||||
formatter: colored
|
|
||||||
loggers:
|
|
||||||
mau:
|
|
||||||
level: DEBUG
|
|
||||||
fbchat:
|
|
||||||
level: DEBUG
|
|
||||||
aiohttp:
|
|
||||||
level: INFO
|
|
||||||
root:
|
|
||||||
level: DEBUG
|
|
||||||
handlers: [file, console]
|
|
|
@ -1,11 +0,0 @@
|
||||||
id: facebook
|
|
||||||
as_token: '{{ key "secrets/chat/fb2mx/as_token" | trimSpace }}'
|
|
||||||
hs_token: '{{ key "secrets/chat/fb2mx/hs_token" | trimSpace }}'
|
|
||||||
namespaces:
|
|
||||||
users:
|
|
||||||
- exclusive: true
|
|
||||||
regex: '@facebook_.+:deuxfleurs.fr'
|
|
||||||
group_id: '+fbusers:deuxfleurs.fr'
|
|
||||||
url: http://fb2mx.service.2.cluster.deuxfleurs.fr:29319
|
|
||||||
sender_localpart: facebookbot
|
|
||||||
rate_limited: false
|
|
|
@ -137,6 +137,29 @@ federation_rc_concurrent: 3
|
||||||
media_store_path: "/var/lib/matrix-synapse/media"
|
media_store_path: "/var/lib/matrix-synapse/media"
|
||||||
uploads_path: "/var/lib/matrix-synapse/uploads"
|
uploads_path: "/var/lib/matrix-synapse/uploads"
|
||||||
|
|
||||||
|
media_storage_providers:
|
||||||
|
- module: s3_storage_provider.S3StorageProviderBackend
|
||||||
|
store_local: True
|
||||||
|
store_remote: True
|
||||||
|
store_synchronous: True
|
||||||
|
config:
|
||||||
|
bucket: matrix
|
||||||
|
# All of the below options are optional, for use with non-AWS S3-like
|
||||||
|
# services, or to specify access tokens here instead of some external method.
|
||||||
|
region_name: garage
|
||||||
|
endpoint_url: https://garage.deuxfleurs.fr
|
||||||
|
access_key_id: {{ key "secrets/chat/synapse/s3_access_key" | trimSpace }}
|
||||||
|
secret_access_key: {{ key "secrets/chat/synapse/s3_secret_key" | trimSpace }}
|
||||||
|
|
||||||
|
# The object storage class used when uploading files to the bucket.
|
||||||
|
# Default is STANDARD.
|
||||||
|
#storage_class: "STANDARD_IA"
|
||||||
|
|
||||||
|
# The maximum number of concurrent threads which will be used to connect
|
||||||
|
# to S3. Each thread manages a single connection. Default is 40.
|
||||||
|
#
|
||||||
|
#threadpool_size: 20
|
||||||
|
|
||||||
# The largest allowed upload size in bytes
|
# The largest allowed upload size in bytes
|
||||||
max_upload_size: "100M"
|
max_upload_size: "100M"
|
||||||
|
|
||||||
|
@ -291,7 +314,7 @@ bcrypt_rounds: 12
|
||||||
# Allows users to register as guests without a password/email/etc, and
|
# Allows users to register as guests without a password/email/etc, and
|
||||||
# participate in rooms hosted on this server which have been made
|
# participate in rooms hosted on this server which have been made
|
||||||
# accessible to anonymous users.
|
# accessible to anonymous users.
|
||||||
allow_guest_access: True
|
allow_guest_access: False
|
||||||
|
|
||||||
# The list of identity servers trusted to verify third party
|
# The list of identity servers trusted to verify third party
|
||||||
# identifiers by this server.
|
# identifiers by this server.
|
||||||
|
@ -308,11 +331,38 @@ enable_metrics: False
|
||||||
## API Configuration ##
|
## API Configuration ##
|
||||||
|
|
||||||
# A list of event types that will be included in the room_invite_state
|
# A list of event types that will be included in the room_invite_state
|
||||||
room_invite_state_types:
|
#room_invite_state_types:
|
||||||
- "m.room.join_rules"
|
# - "m.room.join_rules"
|
||||||
- "m.room.canonical_alias"
|
# - "m.room.canonical_alias"
|
||||||
- "m.room.avatar"
|
# - "m.room.avatar"
|
||||||
- "m.room.name"
|
# - "m.room.name"
|
||||||
|
|
||||||
|
# Controls for the state that is shared with users who receive an invite
|
||||||
|
# to a room
|
||||||
|
#
|
||||||
|
room_prejoin_state:
|
||||||
|
# By default, the following state event types are shared with users who
|
||||||
|
# receive invites to the room:
|
||||||
|
#
|
||||||
|
# - m.room.join_rules
|
||||||
|
# - m.room.canonical_alias
|
||||||
|
# - m.room.avatar
|
||||||
|
# - m.room.encryption
|
||||||
|
# - m.room.name
|
||||||
|
# - m.room.create
|
||||||
|
#
|
||||||
|
# Uncomment the following to disable these defaults (so that only the event
|
||||||
|
# types listed in 'additional_event_types' are shared). Defaults to 'false'.
|
||||||
|
#
|
||||||
|
#disable_default_event_types: true
|
||||||
|
|
||||||
|
# Additional state event types to share with users when they are invited
|
||||||
|
# to a room.
|
||||||
|
#
|
||||||
|
# By default, this list is empty (so only the default event types are shared).
|
||||||
|
#
|
||||||
|
#additional_event_types:
|
||||||
|
# - org.example.custom.event.type
|
||||||
|
|
||||||
|
|
||||||
# A list of application service config file to use
|
# A list of application service config file to use
|
||||||
|
@ -418,3 +468,21 @@ password_config:
|
||||||
report_stats: false
|
report_stats: false
|
||||||
suppress_key_server_warning: true
|
suppress_key_server_warning: true
|
||||||
enable_group_creation: true
|
enable_group_creation: true
|
||||||
|
|
||||||
|
#experimental_features:
|
||||||
|
# spaces_enabled: true
|
||||||
|
|
||||||
|
presence:
|
||||||
|
enabled: false
|
||||||
|
limit_remote_rooms:
|
||||||
|
enabled: true
|
||||||
|
complexity: 3.0
|
||||||
|
complexity_error: "Ce salon de discussion a trop d'activité, le serveur n'est pas assez puissant pour le rejoindre. N'hésitez pas à remonter l'information à l'équipe technique, nous pourrons ajuster la limitation au besoin."
|
||||||
|
admins_can_join: false
|
||||||
|
retention:
|
||||||
|
enabled: true
|
||||||
|
# no default policy for now, this is intended.
|
||||||
|
# DO NOT ADD ONE BECAUSE THIS IS DANGEROUS AND WILL DELETE CONTENT WE WANT TO KEEP!
|
||||||
|
purge_jobs:
|
||||||
|
- interval: 1d
|
||||||
|
|
||||||
|
|
|
@ -15,7 +15,7 @@ job "im" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_synapse:v42"
|
image = "superboum/amd64_synapse:v47"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = true
|
readonly_rootfs = true
|
||||||
ports = [ "client_port", "federation_port" ]
|
ports = [ "client_port", "federation_port" ]
|
||||||
|
@ -27,13 +27,13 @@ job "im" {
|
||||||
]
|
]
|
||||||
volumes = [
|
volumes = [
|
||||||
"secrets/conf:/etc/matrix-synapse",
|
"secrets/conf:/etc/matrix-synapse",
|
||||||
"/mnt/glusterfs/chat/matrix/synapse/media:/var/lib/matrix-synapse/media",
|
"/tmp/synapse-media:/var/lib/matrix-synapse/media",
|
||||||
"/mnt/glusterfs/chat/matrix/synapse/uploads:/var/lib/matrix-synapse/uploads",
|
"/tmp/synapse-uploads:/var/lib/matrix-synapse/uploads",
|
||||||
"/tmp/synapse-logs:/var/log/matrix-synapse",
|
"/tmp/synapse-logs:/var/log/matrix-synapse",
|
||||||
"/tmp/synapse:/tmp"
|
"/tmp/synapse:/tmp"
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
template {
|
template {
|
||||||
data = file("../config/synapse/homeserver.yaml")
|
data = file("../config/synapse/homeserver.yaml")
|
||||||
destination = "secrets/conf/homeserver.yaml"
|
destination = "secrets/conf/homeserver.yaml"
|
||||||
|
@ -86,7 +86,7 @@ job "im" {
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
cpu = 1000
|
cpu = 1000
|
||||||
memory = 4000
|
memory = 2000
|
||||||
}
|
}
|
||||||
|
|
||||||
service {
|
service {
|
||||||
|
@ -97,7 +97,7 @@ job "im" {
|
||||||
"matrix",
|
"matrix",
|
||||||
"traefik.enable=true",
|
"traefik.enable=true",
|
||||||
"traefik.frontend.entryPoints=https",
|
"traefik.frontend.entryPoints=https",
|
||||||
"traefik.frontend.rule=Host:im.deuxfleurs.fr;PathPrefix:/_matrix",
|
"traefik.frontend.rule=Host:im.deuxfleurs.fr;PathPrefix:/_matrix,/_synapse",
|
||||||
"traefik.frontend.headers.customResponseHeaders=Access-Control-Allow-Origin: *",
|
"traefik.frontend.headers.customResponseHeaders=Access-Control-Allow-Origin: *",
|
||||||
"traefik.frontend.priority=100"
|
"traefik.frontend.priority=100"
|
||||||
]
|
]
|
||||||
|
@ -127,87 +127,44 @@ job "im" {
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
group "easybridge" {
|
|
||||||
count = 1
|
|
||||||
|
|
||||||
network {
|
task "media-async-upload" {
|
||||||
port "api_port" {
|
|
||||||
static = 8321
|
|
||||||
to = 8321
|
|
||||||
}
|
|
||||||
port "web_port" { to = 8281 }
|
|
||||||
}
|
|
||||||
|
|
||||||
task "easybridge" {
|
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "lxpz/easybridge_amd64:33"
|
image = "superboum/amd64_synapse:v47"
|
||||||
ports = [ "api_port", "web_port" ]
|
readonly_rootfs = true
|
||||||
|
command = "/usr/local/bin/matrix-s3-async"
|
||||||
|
work_dir = "/tmp"
|
||||||
volumes = [
|
volumes = [
|
||||||
"secrets/conf:/data"
|
"/tmp/synapse-media:/var/lib/matrix-synapse/media",
|
||||||
|
"/tmp/synapse-uploads:/var/lib/matrix-synapse/uploads",
|
||||||
|
"/tmp/synapse:/tmp"
|
||||||
]
|
]
|
||||||
args = [ "./easybridge", "-config", "/data/config.json" ]
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/easybridge/registration.yaml.tpl")
|
|
||||||
destination = "secrets/conf/registration.yaml"
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/easybridge/config.json.tpl")
|
|
||||||
destination = "secrets/conf/config.json"
|
|
||||||
}
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
memory = 250
|
|
||||||
cpu = 100
|
cpu = 100
|
||||||
|
memory = 200
|
||||||
}
|
}
|
||||||
|
|
||||||
service {
|
template {
|
||||||
name = "easybridge-api"
|
data = <<EOH
|
||||||
tags = ["easybridge-api"]
|
AWS_ACCESS_KEY_ID={{ key "secrets/chat/synapse/s3_access_key" | trimSpace }}
|
||||||
port = "api_port"
|
AWS_SECRET_ACCESS_KEY={{ key "secrets/chat/synapse/s3_secret_key" | trimSpace }}
|
||||||
address_mode = "host"
|
AWS_DEFAULT_REGION=garage
|
||||||
check {
|
PG_USER={{ key "secrets/chat/synapse/postgres_user" | trimSpace }}
|
||||||
type = "tcp"
|
PG_PASS={{ key "secrets/chat/synapse/postgres_pwd" | trimSpace }}
|
||||||
port = "api_port"
|
PG_DB={{ key "secrets/chat/synapse/postgres_db" | trimSpace }}
|
||||||
interval = "60s"
|
PG_HOST=psql-proxy.service.2.cluster.deuxfleurs.fr
|
||||||
timeout = "5s"
|
PG_PORT=5432
|
||||||
check_restart {
|
EOH
|
||||||
limit = 3
|
destination = "secrets/env"
|
||||||
grace = "90s"
|
env = true
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
service {
|
|
||||||
name = "easybridge-web"
|
|
||||||
tags = [
|
|
||||||
"easybridge-web",
|
|
||||||
"traefik.enable=true",
|
|
||||||
"traefik.frontend.entryPoints=https,http",
|
|
||||||
"traefik.frontend.rule=Host:easybridge.deuxfleurs.fr",
|
|
||||||
]
|
|
||||||
port = "web_port"
|
|
||||||
address_mode = "host"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "web_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
group "riotweb" {
|
group "riotweb" {
|
||||||
|
@ -220,7 +177,7 @@ job "im" {
|
||||||
task "server" {
|
task "server" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_riotweb:v21"
|
image = "superboum/amd64_riotweb:v24"
|
||||||
ports = [ "web_port" ]
|
ports = [ "web_port" ]
|
||||||
volumes = [
|
volumes = [
|
||||||
"secrets/config.json:/srv/http/config.json"
|
"secrets/config.json:/srv/http/config.json"
|
||||||
|
|
1
app/im/secrets/chat/synapse/s3_access_key
Normal file
1
app/im/secrets/chat/synapse/s3_access_key
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER matrix
|
1
app/im/secrets/chat/synapse/s3_secret_key
Normal file
1
app/im/secrets/chat/synapse/s3_secret_key
Normal file
|
@ -0,0 +1 @@
|
||||||
|
USER matrix
|
|
@ -1,27 +0,0 @@
|
||||||
FROM debian:10
|
|
||||||
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get -qq -y full-upgrade
|
|
||||||
|
|
||||||
RUN apt-get install -y apache2 php php-gd php-mbstring php-pgsql php-curl php-dom php-xml php-zip \
|
|
||||||
php-intl php-ldap php-fileinfo php-exif php-apcu php-redis php-imagick unzip curl wget && \
|
|
||||||
phpenmod gd && \
|
|
||||||
phpenmod curl && \
|
|
||||||
phpenmod mbstring && \
|
|
||||||
phpenmod pgsql && \
|
|
||||||
phpenmod dom && \
|
|
||||||
phpenmod zip && \
|
|
||||||
phpenmod intl && \
|
|
||||||
phpenmod ldap && \
|
|
||||||
phpenmod fileinfo && \
|
|
||||||
phpenmod exif && \
|
|
||||||
phpenmod apcu && \
|
|
||||||
phpenmod redis && \
|
|
||||||
phpenmod imagick && \
|
|
||||||
phpenmod xml
|
|
||||||
|
|
||||||
COPY container-setup.sh /tmp
|
|
||||||
RUN /tmp/container-setup.sh
|
|
||||||
|
|
||||||
COPY entrypoint.sh /
|
|
||||||
CMD /entrypoint.sh
|
|
|
@ -1,37 +0,0 @@
|
||||||
#!/bin/sh
|
|
||||||
|
|
||||||
set -ex
|
|
||||||
|
|
||||||
curl https://download.nextcloud.com/server/releases/nextcloud-19.0.0.zip > /tmp/nextcloud.zip
|
|
||||||
cd /var/www
|
|
||||||
unzip /tmp/nextcloud.zip
|
|
||||||
rm /tmp/nextcloud.zip
|
|
||||||
mv html html.old
|
|
||||||
mv nextcloud html
|
|
||||||
|
|
||||||
cd html
|
|
||||||
mkdir data
|
|
||||||
|
|
||||||
cd apps
|
|
||||||
wget https://github.com/nextcloud/tasks/releases/download/v0.13.1/tasks.tar.gz
|
|
||||||
tar xf tasks.tar.gz
|
|
||||||
wget https://github.com/nextcloud/maps/releases/download/v0.1.6/maps-0.1.6.tar.gz
|
|
||||||
tar xf maps-0.1.6.tar.gz
|
|
||||||
wget https://github.com/nextcloud/calendar/releases/download/v2.0.3/calendar.tar.gz
|
|
||||||
tar xf calendar.tar.gz
|
|
||||||
wget https://github.com/nextcloud/news/releases/download/14.1.11/news.tar.gz
|
|
||||||
tar xf news.tar.gz
|
|
||||||
wget https://github.com/nextcloud/notes/releases/download/v3.6.0/notes.tar.gz
|
|
||||||
tar xf notes.tar.gz
|
|
||||||
wget https://github.com/nextcloud/contacts/releases/download/v3.3.0/contacts.tar.gz
|
|
||||||
tar xf contacts.tar.gz
|
|
||||||
wget https://github.com/nextcloud/mail/releases/download/v1.4.0/mail.tar.gz
|
|
||||||
tar xf mail.tar.gz
|
|
||||||
wget https://github.com/nextcloud/groupfolders/releases/download/v6.0.6/groupfolders.tar.gz
|
|
||||||
tar xf groupfolders.tar.gz
|
|
||||||
rm *.tar.gz
|
|
||||||
|
|
||||||
chown -R www-data:www-data /var/www/html
|
|
||||||
|
|
||||||
cd /var/www/html
|
|
||||||
php occ
|
|
|
@ -1,8 +0,0 @@
|
||||||
#!/bin/sh
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
|
|
||||||
chown www-data:www-data /var/www/html/config/config.php
|
|
||||||
touch /var/www/html/data/.ocdata
|
|
||||||
|
|
||||||
exec apachectl -DFOREGROUND
|
|
|
@ -1,49 +0,0 @@
|
||||||
<?php
|
|
||||||
$CONFIG = array (
|
|
||||||
'appstoreenabled' => false,
|
|
||||||
'instanceid' => '{{ key "secrets/nextcloud/instance_id" | trimSpace }}',
|
|
||||||
'passwordsalt' => '{{ key "secrets/nextcloud/password_salt" | trimSpace }}',
|
|
||||||
'secret' => '{{ key "secrets/nextcloud/secret" | trimSpace }}',
|
|
||||||
'trusted_domains' => array (
|
|
||||||
0 => 'nextcloud.deuxfleurs.fr',
|
|
||||||
),
|
|
||||||
'memcache.local' => '\\OC\\Memcache\\APCu',
|
|
||||||
|
|
||||||
'objectstore' => array(
|
|
||||||
'class' => '\\OC\\Files\\ObjectStore\\S3',
|
|
||||||
'arguments' => array(
|
|
||||||
'bucket' => 'nextcloud',
|
|
||||||
'autocreate' => false,
|
|
||||||
'key' => '{{ key "secrets/nextcloud/garage_access_key" | trimSpace }}',
|
|
||||||
'secret' => '{{ key "secrets/nextcloud/garage_secret_key" | trimSpace }}',
|
|
||||||
'hostname' => 'garage.deuxfleurs.fr',
|
|
||||||
'port' => 443,
|
|
||||||
'use_ssl' => true,
|
|
||||||
'region' => 'garage',
|
|
||||||
// required for some non Amazon S3 implementations
|
|
||||||
'use_path_style' => true
|
|
||||||
),
|
|
||||||
),
|
|
||||||
|
|
||||||
'dbtype' => 'pgsql',
|
|
||||||
'dbhost' => 'psql-proxy.service.2.cluster.deuxfleurs.fr',
|
|
||||||
'dbname' => 'nextcloud',
|
|
||||||
'dbtableprefix' => 'nc_',
|
|
||||||
'dbuser' => '{{ key "secrets/nextcloud/db_user" | trimSpace }}',
|
|
||||||
'dbpassword' => '{{ key "secrets/nextcloud/db_pass" | trimSpace }}',
|
|
||||||
|
|
||||||
'default_language' => 'fr',
|
|
||||||
'default_locale' => 'fr_FR',
|
|
||||||
|
|
||||||
'mail_domain' => 'deuxfleurs.fr',
|
|
||||||
'mail_from_address' => 'nextcloud@deuxfleurs.fr',
|
|
||||||
// TODO SMTP CONFIG
|
|
||||||
|
|
||||||
// TODO REDIS CACHE
|
|
||||||
|
|
||||||
'version' => '19.0.0.12',
|
|
||||||
'overwrite.cli.url' => 'https://nextcloud.deuxfleurs.fr',
|
|
||||||
|
|
||||||
'installed' => true,
|
|
||||||
);
|
|
||||||
|
|
|
@ -1,65 +0,0 @@
|
||||||
job "nextcloud" {
|
|
||||||
datacenters = ["dc1", "belair"]
|
|
||||||
type = "service"
|
|
||||||
priority = 40
|
|
||||||
|
|
||||||
constraint {
|
|
||||||
attribute = "${attr.cpu.arch}"
|
|
||||||
value = "amd64"
|
|
||||||
}
|
|
||||||
|
|
||||||
group "nextcloud" {
|
|
||||||
count = 1
|
|
||||||
|
|
||||||
network {
|
|
||||||
port "web_port" {
|
|
||||||
to = 80
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
task "nextcloud" {
|
|
||||||
driver = "docker"
|
|
||||||
config {
|
|
||||||
image = "lxpz/deuxfleurs_nextcloud_amd64:8"
|
|
||||||
ports = [ "web_port" ]
|
|
||||||
volumes = [
|
|
||||||
"secrets/config.php:/var/www/html/config/config.php"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/config.php.tpl")
|
|
||||||
destination = "secrets/config.php"
|
|
||||||
}
|
|
||||||
|
|
||||||
resources {
|
|
||||||
memory = 1000
|
|
||||||
cpu = 2000
|
|
||||||
}
|
|
||||||
|
|
||||||
service {
|
|
||||||
name = "nextcloud"
|
|
||||||
tags = [
|
|
||||||
"nextcloud",
|
|
||||||
"traefik.enable=true",
|
|
||||||
"traefik.frontend.entryPoints=https,http",
|
|
||||||
"traefik.frontend.rule=Host:nextcloud.deuxfleurs.fr",
|
|
||||||
]
|
|
||||||
port = "web_port"
|
|
||||||
address_mode = "host"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "web_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
|
@ -1,20 +0,0 @@
|
||||||
Install Owncloud CLI:
|
|
||||||
|
|
||||||
php ./occ \
|
|
||||||
--no-interaction \
|
|
||||||
--verbose \
|
|
||||||
maintenance:install \
|
|
||||||
--database pgsql \
|
|
||||||
--database-name nextcloud \
|
|
||||||
--database-host postgres \
|
|
||||||
--database-user nextcloud \
|
|
||||||
--database-pass nextcloud \
|
|
||||||
--admin-user nextcloud \
|
|
||||||
--admin-pass nextcloud \
|
|
||||||
--admin-email coucou@deuxfleurs.fr
|
|
||||||
|
|
||||||
Official image entrypoint:
|
|
||||||
|
|
||||||
https://github.com/nextcloud/docker/blob/master/20.0/fpm/entrypoint.sh
|
|
||||||
|
|
||||||
|
|
|
@ -1,31 +0,0 @@
|
||||||
{
|
|
||||||
"suffix": "dc=deuxfleurs,dc=fr",
|
|
||||||
"bind": "0.0.0.0:389",
|
|
||||||
"consul_host": "http://consul:8500",
|
|
||||||
"log_level": "debug",
|
|
||||||
"acl": [
|
|
||||||
"*,dc=deuxfleurs,dc=fr::read:*:* !userpassword",
|
|
||||||
"*::read modify:SELF:*",
|
|
||||||
"ANONYMOUS::bind:*,ou=users,dc=deuxfleurs,dc=fr:",
|
|
||||||
"ANONYMOUS::bind:cn=admin,dc=deuxfleurs,dc=fr:",
|
|
||||||
"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::bind:*,ou=users,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*,ou=services,ou=users,dc=deuxfleurs,dc=fr::read:*:*",
|
|
||||||
|
|
||||||
"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=invitations,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"ANONYMOUS::bind:*,ou=invitations,dc=deuxfleurs,dc=fr:",
|
|
||||||
"*,ou=invitations,dc=deuxfleurs,dc=fr::delete:SELF:*",
|
|
||||||
|
|
||||||
"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=users,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*,ou=invitations,dc=deuxfleurs,dc=fr::add:*,ou=users,dc=deuxfleurs,dc=fr:*",
|
|
||||||
|
|
||||||
"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr:*",
|
|
||||||
"*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=nextcloud,dc=deuxfleurs,dc=fr:*",
|
|
||||||
|
|
||||||
"cn=admin,dc=deuxfleurs,dc=fr::read add modify delete:*:*",
|
|
||||||
"*:cn=admin,ou=groups,dc=deuxfleurs,dc=fr:read add modify delete:*:*"
|
|
||||||
]
|
|
||||||
}
|
|
|
@ -1,27 +0,0 @@
|
||||||
version: '3.4'
|
|
||||||
services:
|
|
||||||
php:
|
|
||||||
image: lxpz/deuxfleurs_nextcloud_amd64:8
|
|
||||||
depends_on:
|
|
||||||
- bottin
|
|
||||||
- postgres
|
|
||||||
ports:
|
|
||||||
- "80:80"
|
|
||||||
|
|
||||||
postgres:
|
|
||||||
image: postgres:9.6.19
|
|
||||||
environment:
|
|
||||||
- POSTGRES_DB=nextcloud
|
|
||||||
- POSTGRES_USER=nextcloud
|
|
||||||
- POSTGRES_PASSWORD=nextcloud
|
|
||||||
|
|
||||||
bottin:
|
|
||||||
image: lxpz/bottin_amd64:14
|
|
||||||
depends_on:
|
|
||||||
- consul
|
|
||||||
volumes:
|
|
||||||
- ./bottin.json:/config.json
|
|
||||||
|
|
||||||
consul:
|
|
||||||
image: consul:1.8.4
|
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
FROM rust:1.47.0-slim-buster as builder
|
FROM rust:1.54.0-slim-bullseye as builder
|
||||||
|
|
||||||
RUN apt-get update && \
|
RUN apt-get update && \
|
||||||
apt-get install -y \
|
apt-get install -y \
|
||||||
|
@ -24,15 +24,14 @@ RUN git clone -n https://git.joinplu.me/Plume/Plume.git plume
|
||||||
WORKDIR /opt/plume
|
WORKDIR /opt/plume
|
||||||
RUN git checkout ${VERSION}
|
RUN git checkout ${VERSION}
|
||||||
|
|
||||||
RUN cargo install diesel_cli --no-default-features --features postgres --version '=1.3.0'
|
WORKDIR /opt/plume/script
|
||||||
|
RUN chmod a+x ./wasm-deps.sh && sleep 1 && ./wasm-deps.sh
|
||||||
|
|
||||||
# frontend
|
WORKDIR /opt/plume
|
||||||
RUN cargo install cargo-web
|
RUN cargo install wasm-pack
|
||||||
RUN cargo web deploy -p plume-front --release
|
RUN chmod a+x ./script/plume-front.sh && sleep 1 && ./script/plume-front.sh
|
||||||
# backend
|
RUN cargo install --path ./ --force --no-default-features --features postgres
|
||||||
RUN cargo install --no-default-features --features postgres -f --path .
|
RUN cargo install --path plume-cli --force --no-default-features --features postgres
|
||||||
# cli
|
|
||||||
RUN cargo install --no-default-features --features postgres --path plume-cli
|
|
||||||
RUN cargo clean
|
RUN cargo clean
|
||||||
|
|
||||||
#-----------------------------
|
#-----------------------------
|
||||||
|
@ -46,7 +45,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
WORKDIR /app
|
WORKDIR /app
|
||||||
|
|
||||||
COPY --from=builder /opt/plume /app
|
COPY --from=builder /opt/plume /app
|
||||||
COPY --from=builder /usr/local/cargo/bin/diesel /usr/local/bin/
|
|
||||||
COPY --from=builder /usr/local/cargo/bin/plm /usr/local/bin/
|
COPY --from=builder /usr/local/cargo/bin/plm /usr/local/bin/
|
||||||
COPY --from=builder /usr/local/cargo/bin/plume /usr/local/bin/
|
COPY --from=builder /usr/local/cargo/bin/plume /usr/local/bin/
|
||||||
COPY plm-start /usr/local/bin/
|
COPY plm-start /usr/local/bin/
|
||||||
|
|
|
@ -28,3 +28,5 @@ LDAP_USER_NAME_ATTR=cn
|
||||||
LDAP_USER_MAIL_ATTR=mail
|
LDAP_USER_MAIL_ATTR=mail
|
||||||
LDAP_TLS=false
|
LDAP_TLS=false
|
||||||
|
|
||||||
|
RUST_BACKTRACE=1
|
||||||
|
RUST_LOG=info
|
||||||
|
|
|
@ -17,7 +17,7 @@ job "plume" {
|
||||||
task "plume" {
|
task "plume" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "superboum/plume:v2"
|
image = "superboum/plume:v4"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
ports = [ "web_port" ]
|
ports = [ "web_port" ]
|
||||||
#command = "cat"
|
#command = "cat"
|
||||||
|
@ -35,7 +35,7 @@ job "plume" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
memory = 100
|
memory = 300
|
||||||
cpu = 100
|
cpu = 100
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,25 @@
|
||||||
|
From c4e0e967752868626772a3317a17d25d181daeda Mon Sep 17 00:00:00 2001
|
||||||
|
From: Quentin Dufour <quentin@deuxfleurs.fr>
|
||||||
|
Date: Thu, 15 Apr 2021 12:35:12 +0200
|
||||||
|
Subject: [PATCH] Add max-rate to pg_basebackup
|
||||||
|
|
||||||
|
---
|
||||||
|
internal/postgresql/postgresql.go | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/internal/postgresql/postgresql.go b/internal/postgresql/postgresql.go
|
||||||
|
index 00c14bc..a37a28c 100644
|
||||||
|
--- a/internal/postgresql/postgresql.go
|
||||||
|
+++ b/internal/postgresql/postgresql.go
|
||||||
|
@@ -963,7 +963,7 @@ func (p *Manager) SyncFromFollowed(followedConnParams ConnParams, replSlot strin
|
||||||
|
|
||||||
|
log.Infow("running pg_basebackup")
|
||||||
|
name := filepath.Join(p.pgBinPath, "pg_basebackup")
|
||||||
|
- args := []string{"-R", "-v", "-P", "-Xs", "-D", p.dataDir, "-d", followedConnString}
|
||||||
|
+ args := []string{"-R", "-v", "-P", "--max-rate", "5M", "-Xs", "-D", p.dataDir, "-d", followedConnString}
|
||||||
|
if replSlot != "" {
|
||||||
|
args = append(args, "--slot", replSlot)
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
|
@ -5,12 +5,12 @@ WORKDIR /stolon
|
||||||
RUN git clone https://github.com/sorintlab/stolon .
|
RUN git clone https://github.com/sorintlab/stolon .
|
||||||
RUN git pull && git checkout ${STOLON_VERSION}
|
RUN git pull && git checkout ${STOLON_VERSION}
|
||||||
RUN go mod download
|
RUN go mod download
|
||||||
|
COPY 0001-Add-max-rate-to-pg_basebackup.patch .
|
||||||
|
RUN git apply 0001-Add-max-rate-to-pg_basebackup.patch
|
||||||
RUN make && chmod +x /stolon/bin/*
|
RUN make && chmod +x /stolon/bin/*
|
||||||
|
|
||||||
FROM amd64/debian:stretch
|
FROM postgres:13.3-buster
|
||||||
ARG PG_VERSION
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get install -y postgresql-all=${PG_VERSION}
|
|
||||||
COPY --from=builder /stolon/bin /usr/local/bin
|
COPY --from=builder /stolon/bin /usr/local/bin
|
||||||
USER postgres
|
USER postgres
|
||||||
|
ENTRYPOINT []
|
||||||
|
CMD ["/bin/bash"]
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
job "postgres9.6" {
|
job "postgres13.3" {
|
||||||
datacenters = ["dc1"]
|
datacenters = ["dc1"]
|
||||||
type = "system"
|
type = "system"
|
||||||
priority = 90
|
priority = 90
|
||||||
|
@ -20,12 +20,12 @@ job "postgres9.6" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_postgres:v4"
|
image = "superboum/amd64_postgres:v10"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = false
|
readonly_rootfs = false
|
||||||
command = "/usr/local/bin/stolon-sentinel"
|
command = "/usr/local/bin/stolon-sentinel"
|
||||||
args = [
|
args = [
|
||||||
"--cluster-name", "pissenlit",
|
"--cluster-name", "chelidoine",
|
||||||
"--store-backend", "consul",
|
"--store-backend", "consul",
|
||||||
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
||||||
]
|
]
|
||||||
|
@ -39,17 +39,17 @@ job "postgres9.6" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_postgres:v4"
|
image = "superboum/amd64_postgres:v10"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = false
|
readonly_rootfs = false
|
||||||
command = "/usr/local/bin/stolon-proxy"
|
command = "/usr/local/bin/stolon-proxy"
|
||||||
args = [
|
args = [
|
||||||
"--cluster-name", "pissenlit",
|
"--cluster-name", "chelidoine",
|
||||||
"--store-backend", "consul",
|
"--store-backend", "consul",
|
||||||
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
||||||
"--port", "${NOMAD_PORT_psql_proxy_port}",
|
"--port", "${NOMAD_PORT_psql_proxy_port}",
|
||||||
"--listen-address", "0.0.0.0",
|
"--listen-address", "0.0.0.0",
|
||||||
"--log-level", "debug"
|
"--log-level", "info"
|
||||||
]
|
]
|
||||||
ports = [ "psql_proxy_port" ]
|
ports = [ "psql_proxy_port" ]
|
||||||
}
|
}
|
||||||
|
@ -81,12 +81,12 @@ job "postgres9.6" {
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
|
|
||||||
config {
|
config {
|
||||||
image = "superboum/amd64_postgres:v4"
|
image = "superboum/amd64_postgres:v10"
|
||||||
network_mode = "host"
|
network_mode = "host"
|
||||||
readonly_rootfs = false
|
readonly_rootfs = false
|
||||||
command = "/usr/local/bin/stolon-keeper"
|
command = "/usr/local/bin/stolon-keeper"
|
||||||
args = [
|
args = [
|
||||||
"--cluster-name", "pissenlit",
|
"--cluster-name", "chelidoine",
|
||||||
"--store-backend", "consul",
|
"--store-backend", "consul",
|
||||||
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
"--store-endpoints", "http://consul.service.2.cluster.deuxfleurs.fr:8500",
|
||||||
"--data-dir", "/mnt/persist",
|
"--data-dir", "/mnt/persist",
|
||||||
|
@ -95,11 +95,12 @@ job "postgres9.6" {
|
||||||
"--pg-repl-password", "${PG_REPL_PWD}",
|
"--pg-repl-password", "${PG_REPL_PWD}",
|
||||||
"--pg-listen-address", "${attr.unique.network.ip-address}",
|
"--pg-listen-address", "${attr.unique.network.ip-address}",
|
||||||
"--pg-port", "${NOMAD_PORT_psql_port}",
|
"--pg-port", "${NOMAD_PORT_psql_port}",
|
||||||
"--pg-bin-path", "/usr/lib/postgresql/9.6/bin/"
|
"--pg-bin-path", "/usr/lib/postgresql/13/bin/"
|
||||||
]
|
]
|
||||||
ports = [ "psql_port" ]
|
ports = [ "psql_port" ]
|
||||||
volumes = [
|
volumes = [
|
||||||
"/mnt/ssd/postgres:/mnt/persist"
|
"/mnt/ssd/postgres:/mnt/persist",
|
||||||
|
"/mnt/storage/postgres_extended:/mnt/slow"
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -110,7 +111,7 @@ job "postgres9.6" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resources {
|
resources {
|
||||||
memory = 500
|
memory = 1000
|
||||||
}
|
}
|
||||||
|
|
||||||
service {
|
service {
|
||||||
|
|
|
@ -1,3 +0,0 @@
|
||||||
[mariadb]
|
|
||||||
pam_use_cleartext_plugin
|
|
||||||
bind-address = 0.0.0.0
|
|
|
@ -1,3 +0,0 @@
|
||||||
[mariadb]
|
|
||||||
plugin-load=auth_pam.so
|
|
||||||
|
|
|
@ -1,2 +0,0 @@
|
||||||
[mysqld]
|
|
||||||
bind-address = *
|
|
|
@ -1,14 +0,0 @@
|
||||||
FROM debian:stretch
|
|
||||||
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get dist-upgrade -y && \
|
|
||||||
DEBIAN_FRONTEND=noninteractive apt-get install -y mariadb-server mariadb-client libnss-ldapd
|
|
||||||
|
|
||||||
COPY 60-ldap.cnf /etc/mysql/mariadb.conf.d/60-ldap.cnf
|
|
||||||
COPY 60-remote.cnf /etc/mysql/mariadb.conf.d/60-remote.cnf
|
|
||||||
COPY 60-disable-dialog.cnf /etc/mysql/mariadb.conf.d/60-disable-dialog.cnf
|
|
||||||
COPY pam-mariadb /etc/pam.d/mariadb
|
|
||||||
COPY nsswitch.conf /etc/nsswitch.conf
|
|
||||||
COPY entrypoint.sh /usr/local/bin/entrypoint
|
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/entrypoint"]
|
|
|
@ -1,19 +0,0 @@
|
||||||
```
|
|
||||||
sudo docker build -t superboum/amd64_mariadb:v3 .
|
|
||||||
|
|
||||||
sudo docker run \
|
|
||||||
-t -i \
|
|
||||||
-p 3306:3306 \
|
|
||||||
-v /tmp/mysql:/var/lib/mysql \
|
|
||||||
-e LDAP_URI='ldap://bottin.service.2.cluster.deuxfleurs.fr' \
|
|
||||||
-e LDAP_BASE='ou=users,dc=deuxfleurs,dc=fr' \
|
|
||||||
-e LDAP_VERSION=3 \
|
|
||||||
-e LDAP_BIND_DN='cn=admin,dc=deuxfleurs,dc=fr' \
|
|
||||||
-e LDAP_BIND_PW='xxxx' \
|
|
||||||
-e MYSQL_PASSWORD='xxxx' \
|
|
||||||
superboum/amd64_mariadb:v1 \
|
|
||||||
tail -f /var/log/mysql/error.log
|
|
||||||
|
|
||||||
CREATE USER quentin@localhost IDENTIFIED VIA pam USING 'mariadb';
|
|
||||||
|
|
||||||
```
|
|
|
@ -1,50 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
cat > /etc/nslcd.conf <<EOF
|
|
||||||
# /etc/nslcd.conf
|
|
||||||
# nslcd configuration file. See nslcd.conf(5)
|
|
||||||
# for details.
|
|
||||||
|
|
||||||
# The user and group nslcd should run as.
|
|
||||||
uid nslcd
|
|
||||||
gid nslcd
|
|
||||||
|
|
||||||
# The location at which the LDAP server(s) should be reachable.
|
|
||||||
uri ${LDAP_URI}
|
|
||||||
|
|
||||||
# The search base that will be used for all queries.
|
|
||||||
base ${LDAP_BASE}
|
|
||||||
|
|
||||||
# The LDAP protocol version to use.
|
|
||||||
ldap_version ${LDAP_VERSION}
|
|
||||||
|
|
||||||
# The DN to bind with for normal lookups.
|
|
||||||
binddn ${LDAP_BIND_DN}
|
|
||||||
bindpw ${LDAP_BIND_PW}
|
|
||||||
|
|
||||||
# The DN used for password modifications by root.
|
|
||||||
#rootpwmoddn cn=admin,dc=example,dc=com
|
|
||||||
|
|
||||||
# SSL options
|
|
||||||
#ssl off
|
|
||||||
#tls_reqcert never
|
|
||||||
tls_cacertfile /etc/ssl/certs/ca-certificates.crt
|
|
||||||
|
|
||||||
# The search scope.
|
|
||||||
#scope sub
|
|
||||||
EOF
|
|
||||||
|
|
||||||
/usr/sbin/nslcd
|
|
||||||
|
|
||||||
chown mysql:mysql /var/lib/mysql
|
|
||||||
[ -z "$(ls -A /var/lib/mysql)" ] && mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql
|
|
||||||
|
|
||||||
/usr/bin/mysqld_safe &
|
|
||||||
|
|
||||||
until ls /var/run/mysqld/mysqld.sock; do sleep 1; done
|
|
||||||
/usr/bin/mysqladmin -u root password ${MYSQL_PASSWORD} || true
|
|
||||||
|
|
||||||
exec "$@"
|
|
||||||
|
|
|
@ -1,21 +0,0 @@
|
||||||
# /etc/nsswitch.conf
|
|
||||||
#
|
|
||||||
# Example configuration of GNU Name Service Switch functionality.
|
|
||||||
# If you have the `glibc-doc-reference' and `info' packages installed, try:
|
|
||||||
# `info libc "Name Service Switch"' for information about this file.
|
|
||||||
|
|
||||||
passwd: files ldap
|
|
||||||
group: files ldap
|
|
||||||
shadow: files ldap
|
|
||||||
gshadow: files
|
|
||||||
|
|
||||||
hosts: files dns
|
|
||||||
networks: files
|
|
||||||
|
|
||||||
protocols: db files
|
|
||||||
services: db files
|
|
||||||
ethers: db files
|
|
||||||
rpc: db files
|
|
||||||
|
|
||||||
netgroup: nis
|
|
||||||
|
|
|
@ -1,2 +0,0 @@
|
||||||
auth required pam_ldap.so
|
|
||||||
account required pam_ldap.so
|
|
|
@ -1,46 +0,0 @@
|
||||||
FROM amd64/debian:buster as builder
|
|
||||||
|
|
||||||
ENV VERSION 7.0.5
|
|
||||||
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get dist-upgrade -y && \
|
|
||||||
DEBIAN_FRONTEND=noninteractive apt-get install -y wget tar && \
|
|
||||||
wget https://download.seadrive.org/seafile-server_${VERSION}_x86-64.tar.gz -O ./seafile.tar.gz && \
|
|
||||||
tar xf ./seafile.tar.gz && \
|
|
||||||
mv seafile-server-${VERSION} seafile-server
|
|
||||||
|
|
||||||
FROM amd64/debian:buster
|
|
||||||
|
|
||||||
COPY --from=builder ./seafile-server /srv/webstore/seafile-server
|
|
||||||
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get dist-upgrade -y && \
|
|
||||||
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
|
||||||
python \
|
|
||||||
mariadb-client \
|
|
||||||
python2.7 \
|
|
||||||
libpython2.7 \
|
|
||||||
python-setuptools \
|
|
||||||
python-ldap \
|
|
||||||
python-urllib3 \
|
|
||||||
ffmpeg \
|
|
||||||
python-pip \
|
|
||||||
python-mysqldb \
|
|
||||||
python-memcache \
|
|
||||||
procps \
|
|
||||||
python-requests && \
|
|
||||||
pip install Pillow==4.3.0 && \
|
|
||||||
pip install moviepy && \
|
|
||||||
useradd -u 1000 -d /srv/webstore seauser && \
|
|
||||||
chown -R seauser:1000 /srv/webstore/
|
|
||||||
|
|
||||||
RUN mkdir -p /usr/local/lib/mariadb/plugin/ && \
|
|
||||||
ln -s /usr/lib/x86_64-linux-gnu/mariadb*/plugin/mysql_clear_password.so /usr/local/lib/mariadb/plugin/ && \
|
|
||||||
ln -s /usr/lib/x86_64-linux-gnu/mariadb*/plugin/dialog.so /usr/local/lib/mariadb/plugin/
|
|
||||||
|
|
||||||
WORKDIR /srv/webstore/seafile-server
|
|
||||||
COPY seadocker /usr/local/bin/seadocker
|
|
||||||
COPY seaenv /usr/local/bin/seaenv
|
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/seaenv"]
|
|
||||||
CMD ["/usr/local/bin/seadocker"]
|
|
|
@ -1,27 +0,0 @@
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo docker build -t superboum/amd64_seafile:v5 .
|
|
||||||
```
|
|
||||||
|
|
||||||
When upgrading, connect on a production server and run:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nomad stop seafile
|
|
||||||
sudo docker build -t superboum/amd64_seafile:v6 .
|
|
||||||
|
|
||||||
sudo docker run -t -i \
|
|
||||||
-v /mnt/glusterfs/seafile:/mnt/seafile-data \
|
|
||||||
-v /mnt/glusterfs/seaconf/conf:/srv/webstore/conf \
|
|
||||||
-v /mnt/glusterfs/seaconf/ccnet:/srv/webstore/ccnet \
|
|
||||||
superboum/amd64_seafile:v5
|
|
||||||
|
|
||||||
# See:
|
|
||||||
# * https://download.seafile.com/published/seafile-manual/deploy/upgrade.md
|
|
||||||
# * https://download.seafile.com/published/seafile-manual/changelog/server-changelog.md
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
nomad start seafile.hcl
|
|
||||||
```
|
|
||||||
|
|
||||||
when upgrading, change the command on start
|
|
|
@ -1,4 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
/srv/webstore/seafile-server/seafile.sh start
|
|
||||||
/srv/webstore/seafile-server/seahub.sh start
|
|
||||||
tail -f /srv/webstore/logs/*
|
|
|
@ -1,7 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
chown seauser /srv/webstore
|
|
||||||
chown seauser -R /srv/webstore/ccnet
|
|
||||||
chown seauser -R /srv/webstore/conf
|
|
||||||
|
|
||||||
runuser -u seauser -- "$@"
|
|
|
@ -1 +0,0 @@
|
||||||
/mnt/seafile-data/
|
|
|
@ -1,29 +0,0 @@
|
||||||
[General]
|
|
||||||
USER_NAME = deuxfleurs
|
|
||||||
ID = {{ key "secrets/seafile/ccnet/seafile_id" | trimSpace }}
|
|
||||||
NAME = deuxfleurs
|
|
||||||
SERVICE_URL = https://cloud.deuxfleurs.fr
|
|
||||||
|
|
||||||
[Network]
|
|
||||||
PORT = 10001
|
|
||||||
|
|
||||||
[Client]
|
|
||||||
PORT = 13418
|
|
||||||
|
|
||||||
[LDAP]
|
|
||||||
HOST = ldap://bottin2.service.2.cluster.deuxfleurs.fr/
|
|
||||||
BASE = ou=users,dc=deuxfleurs,dc=fr
|
|
||||||
USER_DN = {{ key "secrets/seafile/ccnet/ldap_binddn" | trimSpace }}
|
|
||||||
FILTER = memberOf=CN=seafile,OU=groups,DC=deuxfleurs,DC=fr
|
|
||||||
PASSWORD = {{ key "secrets/seafile/ccnet/ldap_bindpwd" | trimSpace }}
|
|
||||||
LOGIN_ATTR = mail
|
|
||||||
|
|
||||||
[Database]
|
|
||||||
ENGINE = mysql
|
|
||||||
HOST = mariadb.service.2.cluster.deuxfleurs.fr
|
|
||||||
PORT = 3306
|
|
||||||
USER = seafile
|
|
||||||
PASSWD = {{ key "secrets/seafile/ccnet/mysql_pwd" | trimSpace }}
|
|
||||||
DB = ccnet-db
|
|
||||||
CONNECTION_CHARSET = utf8
|
|
||||||
|
|
|
@ -1,16 +0,0 @@
|
||||||
import os
|
|
||||||
|
|
||||||
daemon = True
|
|
||||||
workers = 5
|
|
||||||
|
|
||||||
# default localhost:8000
|
|
||||||
bind = "[::]:8000"
|
|
||||||
|
|
||||||
# Pid
|
|
||||||
pids_dir = '/srv/webstore/pids'
|
|
||||||
pidfile = os.path.join(pids_dir, 'seahub.pid')
|
|
||||||
|
|
||||||
# for file upload, we need a longer timeout value (default is only 30s, too short)
|
|
||||||
timeout = 1200
|
|
||||||
|
|
||||||
limit_request_line = 8190
|
|
|
@ -1,6 +0,0 @@
|
||||||
[WEBDAV]
|
|
||||||
host = ::
|
|
||||||
enabled = true
|
|
||||||
port = 8084
|
|
||||||
fastcgi = false
|
|
||||||
share_name = /seafdav
|
|
|
@ -1,19 +0,0 @@
|
||||||
[network]
|
|
||||||
port = 12001
|
|
||||||
|
|
||||||
[fileserver]
|
|
||||||
port = 8083
|
|
||||||
max_upload_size=8192
|
|
||||||
max_download_dir_size=8192
|
|
||||||
|
|
||||||
[database]
|
|
||||||
type = mysql
|
|
||||||
host = mariadb.service.2.cluster.deuxfleurs.fr
|
|
||||||
port = 3306
|
|
||||||
user = seafile
|
|
||||||
password = {{ key "secrets/seafile/ccnet/mysql_pwd" | trimSpace }}
|
|
||||||
db_name = seafile-db
|
|
||||||
connection_charset = utf8
|
|
||||||
|
|
||||||
[quota]
|
|
||||||
default = 50
|
|
|
@ -1,21 +0,0 @@
|
||||||
SECRET_KEY = "8ep+sgi&s1-f2cq2178!ekk!0h0nw2y4z1-olbaopxmodsd8vk"
|
|
||||||
FILE_SERVER_ROOT = 'https://cloud.deuxfleurs.fr/seafhttp'
|
|
||||||
DATABASES = {
|
|
||||||
'default': {
|
|
||||||
'ENGINE': 'django.db.backends.mysql',
|
|
||||||
'NAME': 'seahub-db',
|
|
||||||
'USER': 'seafile',
|
|
||||||
'PASSWORD': '{{ key "secrets/seafile/ccnet/mysql_pwd" | trimSpace }}',
|
|
||||||
'HOST': 'mariadb.service.2.cluster.deuxfleurs.fr',
|
|
||||||
'PORT': '3306',
|
|
||||||
'OPTIONS': {
|
|
||||||
'init_command': 'SET storage_engine=INNODB',
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
FILE_PREVIEW_MAX_SIZE = 100 * 1024 * 1024
|
|
||||||
ENABLE_THUMBNAIL = True
|
|
||||||
THUMBNAIL_ROOT = '/mnt/seafile-data/thumbnail/thumb/'
|
|
||||||
THUMBNAIL_EXTENSION = 'png'
|
|
||||||
THUMBNAIL_DEFAULT_SIZE = '24'
|
|
||||||
PREVIEW_DEFAULT_SIZE = '300'
|
|
|
@ -1,6 +0,0 @@
|
||||||
LDAP_URI = "ldap://bottin2.service.2.cluster.deuxfleurs.fr"
|
|
||||||
LDAP_BASE = "ou=users,dc=deuxfleurs,dc=fr"
|
|
||||||
LDAP_VERSION = 3
|
|
||||||
LDAP_BIND_DN = "{{ key "secrets/mariadb/main/ldap_binddn" | trimSpace }}"
|
|
||||||
LDAP_BIND_PW = "{{ key "secrets/mariadb/main/ldap_bindpwd" | trimSpace }}"
|
|
||||||
MYSQL_PASSWORD = "{{ key "secrets/mariadb/main/mysql_pwd" | trimSpace }}"
|
|
|
@ -1,222 +0,0 @@
|
||||||
job "seafile" {
|
|
||||||
datacenters = ["dc1"]
|
|
||||||
type = "service"
|
|
||||||
priority = 10
|
|
||||||
|
|
||||||
constraint {
|
|
||||||
attribute = "${attr.cpu.arch}"
|
|
||||||
value = "amd64"
|
|
||||||
}
|
|
||||||
|
|
||||||
group "main" {
|
|
||||||
count = 1
|
|
||||||
|
|
||||||
network {
|
|
||||||
port "seafile-frontend_port" { static = 8000 }
|
|
||||||
port "seafile-seafhttp_port" { static = 8083 }
|
|
||||||
port "seafile-dav_port" { static = 8084 }
|
|
||||||
port "seafile-hack_port" { static = 8085 }
|
|
||||||
port "mariadb_port" { static = 3306 }
|
|
||||||
}
|
|
||||||
|
|
||||||
task "mariadb" {
|
|
||||||
driver = "docker"
|
|
||||||
config {
|
|
||||||
image = "superboum/amd64_mariadb:v4"
|
|
||||||
network_mode = "host"
|
|
||||||
command = "tail"
|
|
||||||
ports = [ "mariadb_port" ]
|
|
||||||
args = [
|
|
||||||
"-f", "/var/log/mysql/error.log",
|
|
||||||
]
|
|
||||||
volumes = [
|
|
||||||
"/mnt/glusterfs/mariadb/main/server:/var/lib/mysql",
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/mariadb/main/env.tpl")
|
|
||||||
destination = "secrets/env"
|
|
||||||
env = true
|
|
||||||
}
|
|
||||||
|
|
||||||
resources {
|
|
||||||
memory = 800
|
|
||||||
}
|
|
||||||
|
|
||||||
service {
|
|
||||||
tags = ["mariadb"]
|
|
||||||
port = "mariadb_port"
|
|
||||||
address_mode = "host"
|
|
||||||
name = "mariadb"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "mariadb_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
task "hack" {
|
|
||||||
driver = "docker"
|
|
||||||
config {
|
|
||||||
image = "alpine/socat:1.0.5"
|
|
||||||
network_mode = "host"
|
|
||||||
ports = [ "seafile-hack_port" ]
|
|
||||||
command = "tcp6-listen:8085,fork,reuseaddr"
|
|
||||||
args = [ "tcp-connect:127.0.0.1:8083" ]
|
|
||||||
}
|
|
||||||
resources {
|
|
||||||
memory = 10
|
|
||||||
}
|
|
||||||
service {
|
|
||||||
tags = [
|
|
||||||
"seafile",
|
|
||||||
"traefik.enable=true",
|
|
||||||
"traefik.frontend.entryPoints=https,http",
|
|
||||||
"traefik.frontend.rule=Host:cloud.deuxfleurs.fr;PathPrefixStrip:/seafhttp"
|
|
||||||
|
|
||||||
]
|
|
||||||
port = "seafile-hack_port"
|
|
||||||
address_mode = "host"
|
|
||||||
name = "seafhttp"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "seafile-hack_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
task "server" {
|
|
||||||
driver = "docker"
|
|
||||||
config {
|
|
||||||
image = "superboum/amd64_seafile:v6"
|
|
||||||
network_mode = "host"
|
|
||||||
ports = [ "seafile-frontend_port", "seafile-dav_port", "seafile-seafhttp_port" ]
|
|
||||||
|
|
||||||
## cmd + args are used for running an instance attachable for update
|
|
||||||
# command = "/bin/sleep"
|
|
||||||
# args = ["999999"]
|
|
||||||
|
|
||||||
mounts = [
|
|
||||||
{
|
|
||||||
type = "bind"
|
|
||||||
source = "/mnt/glusterfs/seafile"
|
|
||||||
target = "/mnt/seafile-data"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
|
|
||||||
volumes = [
|
|
||||||
"secrets/conf:/srv/webstore/conf",
|
|
||||||
"secrets/ccnet:/srv/webstore/ccnet"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
resources {
|
|
||||||
memory = 600
|
|
||||||
}
|
|
||||||
|
|
||||||
service {
|
|
||||||
tags = [
|
|
||||||
"seafile",
|
|
||||||
"traefik.enable=true",
|
|
||||||
"traefik.frontend.entryPoints=https,http",
|
|
||||||
"traefik.frontend.rule=Host:cloud.deuxfleurs.fr;PathPrefix:/"
|
|
||||||
]
|
|
||||||
port = "seafile-frontend_port"
|
|
||||||
address_mode = "host"
|
|
||||||
name = "seahub"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "seafile-frontend_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
service {
|
|
||||||
tags = [
|
|
||||||
"seafile",
|
|
||||||
"traefik.enable=true",
|
|
||||||
"traefik.frontend.entryPoints=https,http",
|
|
||||||
"traefik.frontend.rule=Host:cloud.deuxfleurs.fr;PathPrefix:/seafdav"
|
|
||||||
|
|
||||||
]
|
|
||||||
port = "seafile-dav_port"
|
|
||||||
address_mode = "host"
|
|
||||||
name = "seafdav"
|
|
||||||
check {
|
|
||||||
type = "tcp"
|
|
||||||
port = "seafile-dav_port"
|
|
||||||
interval = "60s"
|
|
||||||
timeout = "5s"
|
|
||||||
check_restart {
|
|
||||||
limit = 3
|
|
||||||
grace = "90s"
|
|
||||||
ignore_warnings = false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/conf/ccnet.conf.tpl")
|
|
||||||
destination = "secrets/conf/ccnet.conf"
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/conf/seafile.conf.tpl")
|
|
||||||
destination = "secrets/conf/seafile.conf"
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/conf/seahub_settings.py.tpl")
|
|
||||||
destination = "secrets/conf/seahub_settings.py"
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = file("../config/ccnet/seafile.ini")
|
|
||||||
destination = "secrets/ccnet/seafile.ini"
|
|
||||||
}
|
|
||||||
template {
|
|
||||||
data = file("../config/conf/seafdav.conf")
|
|
||||||
destination = "secrets/conf/seafdav.conf"
|
|
||||||
}
|
|
||||||
template {
|
|
||||||
data = file("../config/conf/gunicorn.conf")
|
|
||||||
destination = "secrets/conf/gunicorn.conf"
|
|
||||||
}
|
|
||||||
|
|
||||||
# ---- secrets ----
|
|
||||||
template {
|
|
||||||
data = "{{ key \"secrets/seafile/conf/mykey.peer\" }}"
|
|
||||||
destination = "secrets/ccnet/mykey.peer"
|
|
||||||
}
|
|
||||||
|
|
||||||
template {
|
|
||||||
data = "{{ key \"secrets/seafile/conf/mykey.peer\" }}"
|
|
||||||
destination = "secrets/conf/mykey.peer"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
|
@ -1 +0,0 @@
|
||||||
SERVICE_DN mysql MySQL/MariaDB database
|
|
|
@ -1 +0,0 @@
|
||||||
SERVICE_PASSWORD mysql
|
|
|
@ -1 +0,0 @@
|
||||||
USER mysql_pwd (what is this?)
|
|
|
@ -1 +0,0 @@
|
||||||
USER Seafile peer key
|
|
|
@ -14,6 +14,15 @@ defaultEntryPoints = ["http", "https"]
|
||||||
address = ":443"
|
address = ":443"
|
||||||
compress = true
|
compress = true
|
||||||
[entryPoints.https.tls]
|
[entryPoints.https.tls]
|
||||||
|
minVersion = "VersionTLS12"
|
||||||
|
cipherSuites = [
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
|
||||||
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||||
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
]
|
||||||
|
|
||||||
[ping]
|
[ping]
|
||||||
entrypoint = "admin"
|
entrypoint = "admin"
|
||||||
|
|
|
@ -64,3 +64,9 @@ stolonctl --cluster-name pissenlit --store-backend consul --store-endpoints http
|
||||||
```
|
```
|
||||||
stolonctl --cluster-name pissenlit --store-backend consul --store-endpoints http://consul.service.2.cluster.deuxfleurs.fr:8500 update --patch '{ "usePgrewind" : true }'
|
stolonctl --cluster-name pissenlit --store-backend consul --store-endpoints http://consul.service.2.cluster.deuxfleurs.fr:8500 update --patch '{ "usePgrewind" : true }'
|
||||||
```
|
```
|
||||||
|
|
||||||
|
- 2021-03-14 Increase proxy timeout to cope with consul latency spikes
|
||||||
|
|
||||||
|
```
|
||||||
|
stolonctl --cluster-name pissenlit --store-backend consul --store-endpoints http://consul.service.2.cluster.deuxfleurs.fr:8500 update --patch '{ "proxyTimeout" : "120s" }'
|
||||||
|
```
|
||||||
|
|
|
@ -29,6 +29,7 @@
|
||||||
- iftop
|
- iftop
|
||||||
- iotop
|
- iotop
|
||||||
- docker.io
|
- docker.io
|
||||||
|
- locales
|
||||||
- unzip
|
- unzip
|
||||||
- tar
|
- tar
|
||||||
- tcpdump
|
- tcpdump
|
||||||
|
@ -41,6 +42,7 @@
|
||||||
- sudo
|
- sudo
|
||||||
- ethtool
|
- ethtool
|
||||||
- pciutils
|
- pciutils
|
||||||
|
- pv
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: "Passwordless sudo"
|
- name: "Passwordless sudo"
|
||||||
|
|
|
@ -39,3 +39,14 @@ telemetry {
|
||||||
publish_allocation_metrics = true
|
publish_allocation_metrics = true
|
||||||
publish_node_metrics = true
|
publish_node_metrics = true
|
||||||
}
|
}
|
||||||
|
|
||||||
|
plugin "docker" {
|
||||||
|
config {
|
||||||
|
pull_activity_timeout = "15m"
|
||||||
|
volumes {
|
||||||
|
enabled = true
|
||||||
|
}
|
||||||
|
allow_privileged = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue