mrcharles
b9bc032d2b
Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned), single Go binary + postgresql only. Native generic OIDC wired from the platform provider (GOALERT_OIDC_*), data-encryption key persisted, optional first-admin basic auth. grind-stack verified: full migration chain, serving, origin canonicalization correct. 18th package; category table reconciled to the 46-app set.
74 lines
3.0 KiB
Bash
Executable File
74 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# GoAlert runtime setup for Cloudron:
|
|
# 1. wait for the postgresql addon (GoAlert's startup runs migrations
|
|
# itself, but gives up quickly if the DB is slow to accept - the
|
|
# /dev/tcp wait removes that race)
|
|
# 2. persist GOALERT_DATA_ENCRYPTION_KEY (rotating it loses encrypted
|
|
# notification-provider credentials)
|
|
# 3. map the Cloudron addon + platform env onto GOALERT_* vars
|
|
# 4. exec /usr/bin/goalert (migrations + web/API on :8081)
|
|
#
|
|
# Authentication: OIDC via the Cloudron platform provider. OIDC users
|
|
# are created on first login (NewUsers=true); they arrive WITHOUT
|
|
# admin rights - an admin logs in once with basic auth (GOALERT_BASIC_AUTH
|
|
# below, set only when the operator provides GOALERT_ADMIN_USER/PASS env)
|
|
# or via OIDC and is promoted from the admin panel.
|
|
|
|
DATA_DIR="/app/data"
|
|
KEY_FILE="${DATA_DIR}/.data_encryption_key"
|
|
|
|
mkdir -p "${DATA_DIR}"
|
|
|
|
# --- 1. wait for the addon -------------------------------------------------------
|
|
wait_tcp() {
|
|
local host="$1" port="$2" name="$3"
|
|
echo "Waiting for ${name} at ${host}:${port} ..."
|
|
until (exec 3<>"/dev/tcp/${host}/${port}") 2>/dev/null; do
|
|
echo "${name} is unavailable - sleeping"
|
|
sleep 2
|
|
done
|
|
echo "${name} is up"
|
|
}
|
|
|
|
DB_HOST="${CLOUDRON_POSTGRESQL_HOST:-127.0.0.1}"
|
|
DB_PORT="${CLOUDRON_POSTGRESQL_PORT:-5432}"
|
|
DB_NAME="${CLOUDRON_POSTGRESQL_DATABASE:-goalert}"
|
|
DB_USER="${CLOUDRON_POSTGRESQL_USERNAME:-goalert}"
|
|
DB_PASS="${CLOUDRON_POSTGRESQL_PASSWORD:-}"
|
|
|
|
wait_tcp "${DB_HOST}" "${DB_PORT}" "PostgreSQL"
|
|
|
|
# --- 2. persistent data-encryption key -------------------------------------------
|
|
if [[ ! -s "${KEY_FILE}" ]]; then
|
|
( umask 077; head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "${KEY_FILE}" )
|
|
echo "Generated new data encryption key"
|
|
fi
|
|
|
|
# --- 3. Cloudron -> GOALERT_* environment ----------------------------------------
|
|
export GOALERT_DB_URL="postgres://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable"
|
|
export GOALERT_PUBLIC_URL="${CLOUDRON_APP_ORIGIN:-http://localhost}"
|
|
export GOALERT_DATA_ENCRYPTION_KEY="$(cat "${KEY_FILE}")"
|
|
export GOALERT_LISTEN=":8081"
|
|
|
|
# optional admin bootstrap: when GOALERT_ADMIN_USER/GOALERT_ADMIN_PASS
|
|
# are set as app env vars, basic auth allows the first admin login
|
|
# (promote/deactivate the account after SSO users exist)
|
|
if [[ -n "${GOALERT_ADMIN_USER:-}" && -n "${GOALERT_ADMIN_PASS:-}" ]]; then
|
|
export GOALERT_BASIC_AUTH="${GOALERT_ADMIN_USER}:${GOALERT_ADMIN_PASS}"
|
|
else
|
|
unset GOALERT_BASIC_AUTH || true
|
|
fi
|
|
|
|
# platform OIDC provider -> goalert oidc config
|
|
export GOALERT_OIDC_ENABLE="${GOALERT_OIDC_ENABLE:-true}"
|
|
export GOALERT_OIDC_ISSUER_URL="${CLOUDRON_OIDC_ISSUER:-}"
|
|
export GOALERT_OIDC_CLIENT_ID="${CLOUDRON_OIDC_CLIENT_ID:-}"
|
|
export GOALERT_OIDC_CLIENT_SECRET="${CLOUDRON_OIDC_CLIENT_SECRET:-}"
|
|
export GOALERT_OIDC_NEWUSERS="${GOALERT_OIDC_NEWUSERS:-true}"
|
|
export GOALERT_OIDC_OVERRIDE_NAME="${GOALERT_OIDC_OVERRIDE_NAME:-Cloudron}"
|
|
|
|
echo "Starting GoAlert (migrations run automatically) ..."
|
|
exec /usr/bin/goalert
|