add release notes

Reviewed-on: https://git.coopcloud.tech/coop-cloud/lasuite-docs/pulls/10

.env.sample

@@ -46,10 +46,11 @@ DJANGO_EMAIL_FROM=mail@example.com
 ##############################################################################
 # NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README
 OIDC_REALM=yourkeycloakrealm
-OIDC_OP_JWKS_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
-OIDC_OP_AUTHORIZATION_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
-OIDC_OP_TOKEN_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
-OIDC_OP_USER_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
+AUTH_DOMAIN=yourkeycloakdomain
+OIDC_OP_JWKS_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
+OIDC_OP_AUTHORIZATION_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
+OIDC_OP_TOKEN_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
+OIDC_OP_USER_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
 OIDC_RP_CLIENT_ID=yourkeycloakclientid
 OIDC_RP_SIGN_ALGO=RS256
 OIDC_RP_SCOPES="openid email"

README.md

@@ -17,15 +17,66 @@
 
 ## Quick start
 
-* Deploy Single Sign On (see [Authentication](#authentication) below)
 * `abra app new lasuite-docs --secrets`
 * `abra app config <app-name>`
 * `abra app deploy <app-name>`
 * `abra app cmd <app-name> backend migrate`
 * `abra app restart <app-name> minio-bootstrap` (Note: this will appear to fail, but probably worked! Check `abra app logs <app-name> minio-bootstrap`)
 
-For more, see [`docs.coopcloud.tech`](https://docs.coopcloud.tech).
+You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section). 
 
-## Authentication
 
-Docs **requires** an OpenID Connect (OIDC) single sign-on provider; we recommend [Authentik](https://git.coopcloud.tech/coop-cloud/authentik) or [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), both of which are installable using Co-op Cloud.
+## Configure Authentication
+
+lasuite-docs **requires** an OpenID Connect (OIDC) single sign-on provider; deployment has been tested with [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), which we recommend, or you could also try [Authentik](https://git.coopcloud.tech/coop-cloud/authentik), both of which are installable using Co-op Cloud.
+
+Instructions for integrating keycloak with docs after deploying it, are below. 
+
+* In keycloak, create a realm (save the name of this realm, you will need it later)
+* Within that realm, create a client
+    * during client creation, ensure:
+        - Standard flow: True
+        - Direct access grants: True
+        - Authorization: True
+        - Client authentication: True
+        - PKCE method: none
+* Within the client tab, for your client, click on "Credentials". Click on the the copy button to copy "Client Secret" so you can insert this into your coop cloud deployment in the next step. 
+* `abra app secret insert <app-name> oidc_rpcs v2 <yoursecret>`
+* `abra app config <app-name>` # set SECRET_OIDC_RPCS_VERSION=v2
+
+* Now create a user for this client within keycloak. Within the Users tab, click "Add User". Any username and password works. Save this info.
+
+You then additionally need to modify the config of docs to point to your keycloak deployment.
+
+* `abra app config <app-name>`
+```
+OIDC_REALM=<the realm you configured in keycloak>
+AUTH_DOMAIN=<the domain of your keycloak instance>
+OIDC_RP_CLIENT_ID=<yourkeycloakclientid>
+```
+
+then redeploy docs:
+`abra app deploy <app-name> --force`
+
+at this point, when you go to your docs url, you shoud then be able to click "login" and login with the username and password for the user you created in keycloak.
+
+you can make additional users in keycloak for this "client" and they will all be able to login to docs and collaborate. 
+
+## Configure E-Mail
+
+Using `abra app config <app-name>` you need to set the following for your smtp server:
+
+```
+DJANGO_EMAIL_HOST="yourmailserver.com"
+DJANGO_EMAIL_PORT=1025
+DJANGO_EMAIL_FROM=noreply@example.com
+```
+
+You then need to insert the password for your smtp server as a secret:
+
+* `abra app secret insert <app-name> email_pass v2 <youremailpass>`
+* `abra app config <app-name>` # set SECRET_EMAIL_PASS_VERSION=v2
+
+Then redeploy the app, and automated e-mail sending should work:
+
+`abra app deploy <app-name> --force`

abra.sh

@@ -1,6 +1,6 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export ABRA_ENTRYPOINT_VERSION=v4
+export ABRA_ENTRYPOINT_VERSION=v5
 export NGINX_CONF_VERSION=v3
 export PG_BACKUP_VERSION=v3
 

compose.yml

@@ -1,4 +1,5 @@
----
+
+
 
 # NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/
 
@@ -83,14 +84,15 @@ x-minio-env: &minio-env
 
 services:
   app:
-    image: lasuite/impress-frontend:v3.4.2
+    image: lasuite/impress-frontend:v4.4.0
     networks:
       - backend
     deploy:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.2.1+v3.4.2"
+        - "coop-cloud.${STACK_NAME}.version=0.2.5+v4.4.0"
+    user: "${DOCKER_USER:-1000}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080"]
       interval: 15s
@@ -99,7 +101,7 @@ services:
       start_period: 10s
 
   backend:
-    image: lasuite/impress-backend:v3.4.2
+    image: lasuite/impress-backend:v4.4.0
     networks:
       - backend 
     environment:
@@ -110,6 +112,7 @@ services:
       timeout: 30s
       retries: 20
       start_period: 10s
+    user: "${DOCKER_USER:-1000}"
     command: ["gunicorn", "-c", "/usr/local/etc/gunicorn/impress.py", "impress.wsgi:application"]
     entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
     configs:
@@ -128,9 +131,10 @@ services:
       - email_pass
 
   celery:
-    image: lasuite/impress-backend:v3.4.2
+    image: lasuite/impress-backend:v4.4.0
     networks:
-      - backend 
+      - backend
+    user: "${DOCKER_USER:-1000}"
     command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
     environment:
       <<: [*common-env, *postgres-env, *yprovider-env]
@@ -151,10 +155,11 @@ services:
 
 
   y-provider:
-    image: lasuite/impress-y-provider:v3.4.2
+    image: lasuite/impress-y-provider:v4.4.0
     networks:
       - backend 
     environment: *yprovider-env
+    user: "${DOCKER_USER:-1000}"
     entrypoint: >
       sh -c "export Y_PROVIDER_API_KEY=\"$$(cat /run/secrets/y_api_key)\" && exec /usr/local/bin/entrypoint \"$$@\"" --
     command: ["yarn", "start"]
@@ -226,7 +231,7 @@ services:
       timeout: 20s
       retries: 300
     networks:
-      - backend 
+      - backend
     command: minio server /data
     entrypoint: ["/usr/bin/docker-entrypoint.sh"]
     volumes:

release/0.2.5+v4.4.0

@@ -0,0 +1,8 @@
+after upgrading to this version, its necessary to run the data migration again, via:
+
+`abra app cmd <app-name> backend migrate`
+
+this release updates to a new version that fixes a security vulnerability,
+in addition to adding new features
+
+