feat: add GoAlert Cloudron package (Monitoring) [#633]

Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned), single Go binary + postgresql only. Native generic OIDC wired from the platform provider (GOALERT_OIDC_*), data-encryption key persisted, optional first-admin basic auth. grind-stack verified: full migration chain, serving, origin canonicalization correct. 18th package; category table reconciled to the 46-app set.
2026-09-06 18:47:20 -05:00
parent 5ba4078133
commit b9bc032d2b
10 changed files with 269 additions and 27 deletions
@@ -0,0 +1,73 @@
+#!/bin/bash
+set -euo pipefail
+
+# GoAlert runtime setup for Cloudron:
+#   1. wait for the postgresql addon (GoAlert's startup runs migrations
+#      itself, but gives up quickly if the DB is slow to accept - the
+#      /dev/tcp wait removes that race)
+#   2. persist GOALERT_DATA_ENCRYPTION_KEY (rotating it loses encrypted
+#      notification-provider credentials)
+#   3. map the Cloudron addon + platform env onto GOALERT_* vars
+#   4. exec /usr/bin/goalert (migrations + web/API on :8081)
+#
+# Authentication: OIDC via the Cloudron platform provider. OIDC users
+# are created on first login (NewUsers=true); they arrive WITHOUT
+# admin rights - an admin logs in once with basic auth (GOALERT_BASIC_AUTH
+# below, set only when the operator provides GOALERT_ADMIN_USER/PASS env)
+# or via OIDC and is promoted from the admin panel.
+
+DATA_DIR="/app/data"
+KEY_FILE="${DATA_DIR}/.data_encryption_key"
+
+mkdir -p "${DATA_DIR}"
+
+# --- 1. wait for the addon -------------------------------------------------------
+wait_tcp() {
+  local host="$1" port="$2" name="$3"
+  echo "Waiting for ${name} at ${host}:${port} ..."
+  until (exec 3<>"/dev/tcp/${host}/${port}") 2>/dev/null; do
+    echo "${name} is unavailable - sleeping"
+    sleep 2
+  done
+  echo "${name} is up"
+}
+
+DB_HOST="${CLOUDRON_POSTGRESQL_HOST:-127.0.0.1}"
+DB_PORT="${CLOUDRON_POSTGRESQL_PORT:-5432}"
+DB_NAME="${CLOUDRON_POSTGRESQL_DATABASE:-goalert}"
+DB_USER="${CLOUDRON_POSTGRESQL_USERNAME:-goalert}"
+DB_PASS="${CLOUDRON_POSTGRESQL_PASSWORD:-}"
+
+wait_tcp "${DB_HOST}" "${DB_PORT}" "PostgreSQL"
+
+# --- 2. persistent data-encryption key -------------------------------------------
+if [[ ! -s "${KEY_FILE}" ]]; then
+  ( umask 077; head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "${KEY_FILE}" )
+  echo "Generated new data encryption key"
+fi
+
+# --- 3. Cloudron -> GOALERT_* environment ----------------------------------------
+export GOALERT_DB_URL="postgres://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable"
+export GOALERT_PUBLIC_URL="${CLOUDRON_APP_ORIGIN:-http://localhost}"
+export GOALERT_DATA_ENCRYPTION_KEY="$(cat "${KEY_FILE}")"
+export GOALERT_LISTEN=":8081"
+
+# optional admin bootstrap: when GOALERT_ADMIN_USER/GOALERT_ADMIN_PASS
+# are set as app env vars, basic auth allows the first admin login
+# (promote/deactivate the account after SSO users exist)
+if [[ -n "${GOALERT_ADMIN_USER:-}" && -n "${GOALERT_ADMIN_PASS:-}" ]]; then
+  export GOALERT_BASIC_AUTH="${GOALERT_ADMIN_USER}:${GOALERT_ADMIN_PASS}"
+else
+  unset GOALERT_BASIC_AUTH || true
+fi
+
+# platform OIDC provider -> goalert oidc config
+export GOALERT_OIDC_ENABLE="${GOALERT_OIDC_ENABLE:-true}"
+export GOALERT_OIDC_ISSUER_URL="${CLOUDRON_OIDC_ISSUER:-}"
+export GOALERT_OIDC_CLIENT_ID="${CLOUDRON_OIDC_CLIENT_ID:-}"
+export GOALERT_OIDC_CLIENT_SECRET="${CLOUDRON_OIDC_CLIENT_SECRET:-}"
+export GOALERT_OIDC_NEWUSERS="${GOALERT_OIDC_NEWUSERS:-true}"
+export GOALERT_OIDC_OVERRIDE_NAME="${GOALERT_OIDC_OVERRIDE_NAME:-Cloudron}"
+
+echo "Starting GoAlert (migrations run automatically) ..."
+exec /usr/bin/goalert