recipe-maintainers/lasuite-drive
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lasuite-docs as starting point

Browse Source
This commit is contained in:
notplants
2025-12-18 15:09:45 -05:00
parent 09afff17ce
commit 9c5f767cb8
9 changed files with 603 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
.drone.yml Normal file
View File

@ -0,0 +1,39 @@
---
kind: pipeline
name: deploy to swarm-test.autonomic.zone
steps:
- name: deployment
image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
settings:
host: swarm-test.autonomic.zone
stack: example_com # UPDATE ME
generate_secrets: true
purge: true
deploy_key:
from_secret: drone_ssh_swarm_test
networks:
- proxy
environment:
DOMAIN: example.swarm-test.autonomic.zone # UPDATE ME
STACK_NAME: example_com # UPDATE ME
LETS_ENCRYPT_ENV: staging
# Also set any config versions from abra.sh
trigger:
branch:
- main
---
kind: pipeline
name: generate recipe catalogue
steps:
- name: release a new version
image: plugins/downstream
settings:
server: https://build.coopcloud.tech
token:
from_secret: drone_abra-bot_token
fork: true
repositories:
- toolshed/auto-recipes-catalogue-json
trigger:
event: tag

67
.env.sample Normal file
View File

@ -0,0 +1,67 @@
TYPE=lasuite-docs
DOMAIN=lasuite-docs.example.com
## Domain aliases
#EXTRA_DOMAINS=', `www.lasuite-docs.example.com`'
LETS_ENCRYPT_ENV=production
##############################################################################
# SECRETS
##############################################################################
# abbreviations are to fit abra 12 char secret recommendation
# DJANGO_SECRET_KEY
SECRET_DJANGO_SK_VERSION=v1
# ODIC_RP_CLIENT_SECRET
SECRET_OIDC_RPCS_VERSION=v1
# DJANGO_SUPERUSER_PASSWORD
SECRET_DJANGO_SP_VERSION=v1
# MINIO_ROOT_PASSWORD
SECRET_MINIO_RP_VERSION=v1
# MINIO_ROOT_USER
SECRET_MINIO_RU_VERSION=v1
# COLLABORATION_SERVER_SECRET
SECRET_COLLAB_SS_VERSION=v1
# POSTGRES_PASSWORD
SECRET_POSTGRES_P_VERSION=v1
# Y_PROVIDER_API_KEY
SECRET_Y_API_KEY_VERSION=v1
# DJANGO_HOST_EMAIL_PASSWORD
SECRET_EMAIL_PASS_VERSION=v1
##############################################################################
# EMAIL
##############################################################################
DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
DJANGO_EMAIL_HOST="mail.example.com"
DJANGO_EMAIL_LOGO_IMG="http://$DOMAIN/assets/logo-suite-numerique.png"
DJANGO_EMAIL_PORT=1025
DJANGO_EMAIL_USE_SSL=True
DJANGO_EMAIL_USE_TLS=False
DJANGO_EMAIL_FROM=mail@example.com
##############################################################################
# SINGLE SIGN ON
##############################################################################
# NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README
OIDC_REALM=yourkeycloakrealm
OIDC_OP_JWKS_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
OIDC_OP_AUTHORIZATION_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
OIDC_OP_TOKEN_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
OIDC_OP_USER_ENDPOINT=https://auth.${DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
OIDC_RP_CLIENT_ID=yourkeycloakclientid
OIDC_RP_SIGN_ALGO=RS256
OIDC_RP_SCOPES="openid email"
LOGIN_REDIRECT_URL=https://${DOMAIN}
LOGIN_REDIRECT_URL_FAILURE=https://${DOMAIN}
LOGOUT_REDIRECT_URL=https://${DOMAIN}
OIDC_REDIRECT_ALLOWED_HOSTS='["https://auth.${DOMAIN}", "https://${DOMAIN}"]'
OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
##############################################################################
# LOGGING
##############################################################################
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
LOGGING_LEVEL_LOGGERS_ROOT=INFO
LOGGING_LEVEL_LOGGERS_APP=INFO

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.envrc

17
abra-entrypoint.sh Normal file
View File

@ -0,0 +1,17 @@
#!/bin/sh
set -e
[ -f /run/secrets/postgres_p ] && export DB_PASSWORD="$(cat /run/secrets/postgres_p)"
[ -f /run/secrets/django_sk ] && export DJANGO_SECRET_KEY="$(cat /run/secrets/django_sk)"
[ -f /run/secrets/minio_rp ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/minio_rp)"
[ -f /run/secrets/minio_ru ] && export AWS_S3_ACCESS_KEY_ID="$(cat /run/secrets/minio_ru)"
[ -f /run/secrets/django_sp ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_sp)"
[ -f /run/secrets/oidc_rpcs ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rpcs)"
[ -f /run/secrets/collab_ss ] && export COLLABORATION_SERVER_SECRET="$(cat /run/secrets/collab_ss)"
[ -f /run/secrets/y_api_key ] && export Y_PROVIDER_API_KEY="$(cat /run/secrets/y_api_key)"
[ -f /run/secrets/email_pass ] && export DJANGO_EMAIL_HOST_PASSWORD="$(cat /run/secrets/email_pass)"
# if not in "env" mode, then execute the original entrypoint and command
if [ ! "$1" = "-e" ]; then
exec "$@"
fi

15
abra.sh Executable file
View File

@ -0,0 +1,15 @@
# Set any config versions here
# Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
export ABRA_ENTRYPOINT_VERSION=v5
export NGINX_CONF_VERSION=v3
export PG_BACKUP_VERSION=v3
environment() {
# this exports all the secrets as environment variables
source /abra-entrypoint.sh -e
}
migrate() {
environment
python manage.py migrate --noinput
}

322
compose.yml Normal file
View File

@ -0,0 +1,322 @@
# NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/
x-common-env: &common-env
DJANGO_CONFIGURATION: Production
DJANGO_ALLOWED_HOSTS: "*"
# DJANGO_SECRET_KEY supplied via secrets
DJANGO_SETTINGS_MODULE: impress.settings
# DJANGO_SUPERUSER_PASSWORD supplied via secrets
# Logging
# Set to DEBUG level for dev only
LOGGING_LEVEL_HANDLERS_CONSOLE:
LOGGING_LEVEL_LOGGERS_ROOT:
LOGGING_LEVEL_LOGGERS_APP:
# Python
PYTHONPATH: /app
# Mail
DJANGO_EMAIL_BRAND_NAME:
DJANGO_EMAIL_HOST:
DJANGO_EMAIL_LOGO_IMG:
DJANGO_EMAIL_PORT:
DJANGO_EMAIL_HOST_USER:
# DJANGO_EMAIL_HOST_PASSWORD supplied via secret
DJANGO_EMAIL_USE_SSL:
DJANGO_EMAIL_USE_TLS:
DJANGO_EMAIL_FROM:
# Backend url
IMPRESS_BASE_URL: "https://${DOMAIN}"
# Media
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
AWS_S3_ENDPOINT_URL: http://minio:9000
# AWS_S3_ACCESS_KEY_ID supplied via secret (this is same MINIO_ROOT_USER)
# AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as MINIO_ROOT_PASSWORD)
MEDIA_BASE_URL: https://${DOMAIN}
AWS_STORAGE_BUCKET_NAME: docs-media-storage
# OIDC - settings from .env, see .env.sample
OIDC_OP_JWKS_ENDPOINT:
OIDC_OP_AUTHORIZATION_ENDPOINT:
OIDC_OP_TOKEN_ENDPOINT:
OIDC_OP_USER_ENDPOINT:
OIDC_RP_CLIENT_ID:
# OIDC_RP_CLIENT_SECRET supplied via secrets
OIDC_RP_SIGN_ALGO:
OIDC_RP_SCOPES:
LOGIN_REDIRECT_URL:
LOGIN_REDIRECT_URL_FAILURE:
LOGOUT_REDIRECT_URL:
OIDC_REDIRECT_ALLOWED_HOSTS:
OIDC_AUTH_REQUEST_EXTRA_PARAMS:
# AI (Fixme: remove?)
AI_FEATURE_ENABLED: "false"
AI_BASE_URL: https://openaiendpoint.com
AI_API_KEY: password
AI_MODEL: llama
# Collaboration
COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
x-postgres-env: &postgres-env
# Postgresql db container configuration
POSTGRES_DB: docs
POSTGRES_USER: docs
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_p
# App database configuration
DB_HOST: db
DB_NAME: docs
DB_USER: docs
DB_PORT: 5432
# DB_PASSWORD supplied via secrets (this is same as POSTGRES_PASSWORD)
x-yprovider-env: &yprovider-env
COLLABORATION_LOGGING: "true"
# Y_PROVIDER_API_KEY supplied via secrets
COLLABORATION_API_URL: http://y-provider:4444/api/
COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
# COLLABORATION_SERVER_SECRET supplied via secrets
COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/
x-minio-env: &minio-env
MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp
services:
app:
image: lasuite/impress-frontend:v4.0.0
networks:
- backend
deploy:
labels:
- "traefik.enable=false"
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
- "coop-cloud.${STACK_NAME}.version=0.2.4+v4.0.0"
user: "${DOCKER_USER:-1000}"
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080"]
interval: 15s
timeout: 30s
retries: 20
start_period: 10s
backend:
image: lasuite/impress-backend:v4.0.0
networks:
- backend
environment:
<<: [*common-env, *postgres-env, *yprovider-env]
healthcheck:
test: ["CMD", "/abra-entrypoint.sh", "python", "manage.py", "check"]
interval: 15s
timeout: 30s
retries: 20
start_period: 10s
user: "${DOCKER_USER:-1000}"
command: ["gunicorn", "-c", "/usr/local/etc/gunicorn/impress.py", "impress.wsgi:application"]
entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
configs:
- source: abra_entrypoint
target: /abra-entrypoint.sh
mode: 0555
secrets:
- django_sk
- django_sp
- oidc_rpcs
- collab_ss
- minio_rp
- minio_ru
- postgres_p
- y_api_key
- email_pass
celery:
image: lasuite/impress-backend:v4.0.0
networks:
- backend
user: "${DOCKER_USER:-1000}"
command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
environment:
<<: [*common-env, *postgres-env, *yprovider-env]
entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
configs:
- source: abra_entrypoint
target: /abra-entrypoint.sh
mode: 0555
secrets:
- django_sk
- django_sp
- oidc_rpcs
- collab_ss
- minio_rp
- postgres_p
- y_api_key
- email_pass
y-provider:
image: lasuite/impress-y-provider:v4.0.0
networks:
- backend
environment: *yprovider-env
user: "${DOCKER_USER:-1000}"
entrypoint: >
sh -c "export Y_PROVIDER_API_KEY=\"$$(cat /run/secrets/y_api_key)\" && exec /usr/local/bin/entrypoint \"$$@\"" --
command: ["yarn", "start"]
# NOTE: healthcheck - `wget` is available in the container, but `wget http://localhost:4444` gives a 403
secrets:
- y_api_key
db:
image: postgres:16
networks:
- backend
healthcheck:
test: ["CMD", "pg_isready", "-q", "-U", "docs", "-d", "docs"]
interval: 1s
timeout: 2s
retries: 300
environment:
<<: *postgres-env
PGDATA: var/lib/postgresql/data/pgdata
volumes:
- postgres:/var/lib/postgresql/data/pgdata
deploy:
labels:
backupbot.backup: "${ENABLE_BACKUPS:-true}"
backupbot.backup.pre-hook: "/pg_backup.sh backup"
backupbot.backup.volumes.postgres.path: "backup.sql"
backupbot.restore.post-hook: '/pg_backup.sh restore'
configs:
- source: pg_backup
target: /pg_backup.sh
mode: 0555
secrets:
- postgres_p
redis:
image: redis:8
networks:
- backend
minio-bootstrap:
# NOTE: Not started by default, only run with a manual `abra app restart` / `docker service scale`
image: minio/mc:RELEASE.2025-05-21T01-59-54Z
environment: *minio-env
networks:
- backend
entrypoint: >
sh -c "
MINIO_ROOT_USER=\"\$$(cat /run/secrets/minio_ru)\" &&
MINIO_ROOT_PASSWORD=\"\$$(cat /run/secrets/minio_rp)\" &&
/usr/bin/mc alias set docs http://minio:9000 \$${MINIO_ROOT_USER} \"\$${MINIO_ROOT_PASSWORD}\" &&
/usr/bin/mc mb --ignore-existing docs/docs-media-storage &&
/usr/bin/mc version enable docs/docs-media-storage &&
exit 0"
deploy:
mode: replicated
replicas: 0
restart_policy:
condition: none
secrets:
- minio_rp
- minio_ru
minio:
image: minio/minio:RELEASE.2025-05-24T17-08-30Z
environment: *minio-env
healthcheck:
test: ["CMD", "mc", "ready", "local"]
interval: 1s
timeout: 20s
retries: 300
networks:
- backend
command: minio server /data
entrypoint: ["/usr/bin/docker-entrypoint.sh"]
volumes:
- minio:/data
deploy:
labels:
backupbot.backup: "${ENABLE_BACKUPS:-true}"
entrypoint: /abra-entrypoint.sh
configs:
- source: abra_entrypoint
target: /abra-entrypoint.sh
mode: 0555
secrets:
- minio_rp
- minio_ru
web:
image: nginx:1.29
configs:
- source: nginx_conf
target: /etc/nginx/conf.d/default.conf
networks:
proxy:
backend:
depends_on:
- backend
- app
environment:
- STACK_NAME
deploy:
labels:
- "traefik.enable=true"
- "traefik.docker.network=proxy"
- "traefik.http.routers.${STACK_NAME}.tls=true"
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083"
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
networks:
proxy:
external: true
backend:
volumes:
postgres:
minio:
configs:
nginx_conf:
name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
file: nginx.conf.tmpl
template_driver: golang
pg_backup:
name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
file: pg_backup.sh
abra_entrypoint:
name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION}
file: abra-entrypoint.sh
secrets:
django_sk:
external: true
name: ${STACK_NAME}_django_sk_${SECRET_DJANGO_SK_VERSION}
oidc_rpcs:
external: true
name: ${STACK_NAME}_oidc_rpcs_${SECRET_OIDC_RPCS_VERSION}
django_sp:
external: true
name: ${STACK_NAME}_django_sp_${SECRET_DJANGO_SP_VERSION}
postgres_p:
external: true
name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
collab_ss:
external: true
name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION}
minio_rp:
external: true
name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
minio_ru:
external: true
name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RP_VERSION}
y_api_key:
external: true
name: ${STACK_NAME}_y_api_key_${SECRET_Y_API_KEY_VERSION}
email_pass:
external: true
name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}

108
nginx.conf.tmpl Normal file
View File

@ -0,0 +1,108 @@
upstream docs_backend {
server {{ env "STACK_NAME" }}_backend:8000 fail_timeout=0;
}
upstream docs_frontend {
server {{ env "STACK_NAME" }}_app:8080 fail_timeout=0;
}
server {
listen 8083;
server_name localhost;
# Disables server version feedback on pages and in headers
server_tokens off;
location @proxy_to_docs_backend {
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_pass http://docs_backend;
}
location @proxy_to_docs_frontend {
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_pass http://docs_frontend;
}
location / {
try_files $uri @proxy_to_docs_frontend;
}
location /api {
try_files $uri @proxy_to_docs_backend;
}
location /admin {
try_files $uri @proxy_to_docs_backend;
}
location /static {
try_files $uri @proxy_to_docs_backend;
}
# Proxy auth for collaboration server
location /collaboration/ws/ {
# Ensure WebSocket upgrade
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
# Collaboration server
proxy_pass http://y-provider:4444;
# Set appropriate timeout for WebSocket
proxy_read_timeout 86400;
proxy_send_timeout 86400;
# Preserve original host and additional headers
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Origin $http_origin;
proxy_set_header Host $host;
}
location /collaboration/api/ {
# Collaboration server
proxy_pass http://y-provider:4444;
proxy_set_header Host $host;
}
# Proxy auth for media
location /media/ {
# Auth request configuration
auth_request /media-auth;
auth_request_set $authHeader $upstream_http_authorization;
auth_request_set $authDate $upstream_http_x_amz_date;
auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
# Pass specific headers from the auth response
proxy_set_header Authorization $authHeader;
proxy_set_header X-Amz-Date $authDate;
proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
# Get resource from Minio
proxy_pass http://minio:9000/docs-media-storage/;
proxy_set_header Host minio:9000;
}
location /media-auth {
proxy_pass http://docs_backend/api/v1.0/documents/media-auth/;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Original-URL $request_uri;
# Prevent the body from being passed
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-Method $request_method;
}
}

34
pg_backup.sh Normal file
View File

@ -0,0 +1,34 @@
#!/bin/bash
set -e
BACKUP_FILE='/var/lib/postgresql/data/pgdata/backup.sql'
function backup {
export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)
pg_dump -U ${POSTGRES_USER} ${POSTGRES_DB} > $BACKUP_FILE
}
function restore {
cd /var/lib/postgresql/data/
restore_config(){
# Restore allowed connections
cat pg_hba.conf.bak > pg_hba.conf
su postgres -c 'pg_ctl reload'
}
# Don't allow any other connections than local
cp pg_hba.conf pg_hba.conf.bak
echo "local all all trust" > pg_hba.conf
su postgres -c 'pg_ctl reload'
trap restore_config EXIT INT TERM
# Recreate Database
psql -U ${POSTGRES_USER} -d postgres -c "DROP DATABASE ${POSTGRES_DB} WITH (FORCE);"
createdb -U ${POSTGRES_USER} ${POSTGRES_DB}
psql -U ${POSTGRES_USER} -d ${POSTGRES_DB} -1 -f $BACKUP_FILE
trap - EXIT INT TERM
restore_config
}
$@

0
release/.git-keep-me Normal file
View File