Komodo initial commit

docker/compose/ferretdb.yaml

@@ -0,0 +1,23 @@
+services:
+  ferretdb:
+    container_name: ${FERRETDB_CONTAINER_NAME}
+    image: ${FERRETDB_IMAGE}
+    restart: ${FERRETDB_RESTART_POLICY}
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      - "komodo.skip=" # Prevent Komodo from stopping with StopAllContainers            
+    #depends_on:
+    #  - postgres
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    networks:
+      - komodo
+    # ports:
+    #   - 27017:27017
+    env_file: ../env/komodo.env
+    environment:
+      #- FERRETDB_POSTGRESQL_URL=postgres://komodo:komodo@10.0.6.178/komodo?sslmode=disable
+      - FERRETDB_POSTGRESQL_URL=postgres://${PSQL_HOST}:${PSQL_PORT}/${KOMODO_DATABASE_DB_NAME:-komodo}?sslmode=disable
+#networks:
+#  komodo: {}

docker/compose/komodo-core.yaml

@@ -0,0 +1,64 @@
+secrets:
+  komodo_passkey:
+    file: ${SECRETSDIR}/komodo/komodo_passkey
+  komodo_webhook_secret:
+    file: ${SECRETSDIR}/komodo/komodo_webhook_secret
+  komodo_jwt_secret:
+    file: ${SECRETSDIR}/komodo/komodo_jwt_secret
+  komodo_oidc_client_id:
+    file: ${SECRETSDIR}/komodo/komodo_oidc_client_id
+  komodo_oidc_client_secret:
+    file: ${SECRETSDIR}/komodo/komodo_oidc_client_secret
+services:
+  core:
+    container_name: ${KOMODO_CORE_CONTAINER_NAME}
+    image: ${KOMODO_CORE_IMAGE}:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
+    restart: ${KOMODO_RESTART_POLICY}
+    secrets:      
+      - komodo_passkey
+      - komodo_webhook_secret
+      - komodo_jwt_secret
+      - komodo_oidc_client_id
+      - komodo_oidc_client_secret
+    labels:                
+      - "komodo.skip=" # Prevent Komodo from stopping with StopAllContainers            
+      - "traefik.enable=true"
+      ## HTTP Routers
+      - "traefik.http.routers.${KOMODO_HOSTNAME}-rtr.entrypoints=https"
+      - "traefik.http.routers.${KOMODO_HOSTNAME}-rtr.rule=(`${KOMODO_HOSTNAME}.${DOMAINNAME1}`)"
+      ## Middlewares
+#      - "traefik.http.routers.${PRIVATEBIN_HOSTNAME}-rtr.middlewares=chain-authelia@file"
+      - "traefik.http.routers.${KOMODO_HOSTNAME}-rtr.middlewares=chain-no-auth@file"
+      ## HTTP Services
+      - "traefik.http.routers.${KOMODO_HOSTNAME}-rtr.service=${KOMODO_HOSTNAME}-svc"
+      - "traefik.http.services.${KOMODO_HOSTNAME}-svc.loadbalancer.server.port=9120"
+    depends_on:
+      - ferretdb
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    networks:
+      - ${KOMODO_NETWORk_ID}
+      - komodo      
+    ports:
+      - 9120:9120
+    env_file: ../env/komodo.env
+    environment:
+      KOMODO_DATABASE_URI: mongodb://${KOMODO_DB_USERNAME}:${KOMODO_DB_PASSWORD}@ferretdb:27017/${KOMODO_DATABASE_DB_NAME:-komodo}?authMechanism=PLAIN      
+    volumes:
+      ## Core cache for repos for latest commit hash / contents
+      - repo-cache:/repo-cache
+      ## Store sync files on server
+      # - /path/to/syncs:/syncs
+      ## Optionally mount a custom core.config.toml
+      # - /path/to/core.config.toml:/config/config.toml
+    ## Allows for systemd Periphery connection at 
+    ## "http://host.docker.internal:8120"
+    # extra_hosts:
+    #   - host.docker.internal:host-gateway
+volumes:
+  # Core
+  repo-cache:
+#networks:
+#  komodo: {}
+#  proxy: 
+#    external: true

docker/compose/komodo-periphery.yaml

@@ -0,0 +1,39 @@
+secrets:
+  komodo_passkey:
+    file: ${SECRETSDIR}/komodo/komodo_passkey
+services:
+  ## Deploy Periphery container using this block,
+  ## or deploy the Periphery binary with systemd using 
+  ## https://github.com/mbecker20/komodo/tree/main/scripts
+  periphery:
+    container_name: ${KOMODO_PERTIPHERY_CONTAINER_NAME}
+    image: ${KOMODO_PERTIPHERY_IMAGE}:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
+    restart: ${KOMODO_RESTART_POLICY}    
+    labels:
+      - "komodo.skip=" # Prevent Komodo from stopping with StopAllContainers                  
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    networks:
+      - komodo
+    env_file: ../env/komodo.env
+    environment:
+      PERIPHERY_REPO_DIR: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/repos
+      PERIPHERY_STACK_DIR: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/stacks
+      PERIPHERY_SSL_KEY_FILE: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/ssl/key.pem
+      PERIPHERY_SSL_CERT_FILE: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/ssl/cert.pem
+    volumes:
+      ## Mount external docker socket
+      - /var/run/docker.sock:/var/run/docker.sock
+      ## Allow Periphery to see processes outside of container
+      - /proc:/proc
+      ## Specify the Periphery agent root directory.
+      ## Must be the same inside and outside the container,
+      ## or docker will get confused. See https://github.com/mbecker20/komodo/discussions/180.
+      ## Default: /etc/komodo.
+      - ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}:${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}
+    secrets:
+      - komodo_passkey
+#networks:
+#  komodo: {}
+#  proxy: 
+#    external: true

docker/compose/networks/komodo.yaml

@@ -0,0 +1,4 @@
+networks:
+  komodo:
+    name: komodo
+    driver: bridge

docker/env/komodo-stack.env

@@ -0,0 +1,17 @@
+KOMODO_NETWORk_ID=proxy
+KOMODO_HOSTNAME=komodo
+
+KOMODO_RESTART_POLICY=unless-stopped
+
+##### Komodo Core Container
+KOMODO_CORE_CONTAINER_NAME=komodo-core
+KOMODO_CORE_IMAGE=ghcr.io/mbecker20/komodo
+
+##### Komodo Periphery Container
+KOMODO_PERTIPHERY_CONTAINER_NAME=komodo-periphery
+KOMODO_PERTIPHERY_IMAGE=ghcr.io/mbecker20/periphery
+
+##### FerretDB Core Container
+FERRETDB_CONTAINER_NAME=komodo-ferretdb
+FERRETDB_IMAGE=ghcr.io/ferretdb/ferretdb
+FERRETDB_RESTART_POLICY=${KOMODO_RESTART_POLICY}

docker/env/komodo.env

@@ -0,0 +1,133 @@
+####################################
+# 🦎 KOMODO COMPOSE - VARIABLES 🦎 #
+####################################
+## These compose variables can be used with all Komodo deployment options.
+## Pass these variables to the compose up command using `--env-file komodo/compose.env`.
+## Additionally, they are passed to both Komodo Core and Komodo Periphery with `env_file: ./compose.env`,
+## so you can pass any additional environment variables to Core / Periphery directly in this file as well.
+
+PSQL_HOST=10.0.6.178
+PSQL_PORT=5432
+## Stick to a specific version, or use `latest`
+COMPOSE_KOMODO_IMAGE_TAG=latest
+
+## Note: 🚨 Podman does NOT support local logging driver 🚨. See Podman options here:
+## `https://docs.podman.io/en/v4.6.1/markdown/podman-run.1.html#log-driver-driver`
+COMPOSE_LOGGING_DRIVER=local # Enable log rotation with the local driver.
+
+## DB credentials - Ignored for Sqlite
+KOMODO_DB_USERNAME=komodo
+KOMODO_DB_PASSWORD=komodo
+
+## Configure a secure passkey to authenticate between Core / Periphery.
+KOMODO_PASSKEY_FILE=/run/secrets/komodo_passkey
+
+#=-------------------------=#
+#= Komodo Core Environment =#
+#=-------------------------=#
+
+## Full variable list + descriptions are available here:
+## 🦎 https://github.com/mbecker20/komodo/blob/main/config/core.config.toml 🦎
+
+## Note. Secret variables also support `${VARIABLE}_FILE` syntax to pass docker compose secrets.
+## Docs: https://docs.docker.com/compose/how-tos/use-secrets/#examples
+
+## Used for Oauth / Webhook url suggestion / Caddy reverse proxy.
+KOMODO_HOST=https://komodo.lab.gurulandia.eu
+
+## Displayed in the browser tab.
+KOMODO_TITLE=Komodo by Gurulandia
+#Komodo
+## Create a server matching this address as the "first server".
+## Use `https://host.docker.internal:8120` when using systemd-managed Periphery.
+KOMODO_FIRST_SERVER=https://periphery:8120
+## Make all buttons just double-click, rather than the full confirmation dialog.
+KOMODO_DISABLE_CONFIRM_DIALOG=true
+
+## Rate Komodo polls your servers for
+## status / container status / system stats / alerting.
+## Options: 1-sec, 5-sec, 15-sec, 1-min, 5-min.
+## Default: 15-sec
+KOMODO_MONITORING_INTERVAL="15-sec"
+## Rate Komodo polls Resources for updates,
+## like outdated commit hash.
+## Options: 1-min, 5-min, 15-min, 30-min, 1-hr.
+## Default: 5-min
+KOMODO_RESOURCE_POLL_INTERVAL="5-min"
+
+## Used to auth incoming webhooks. Alt: KOMODO_WEBHOOK_SECRET_FILE
+KOMODO_WEBHOOK_SECRET_FILE=/run/secrets/komodo_webhook_secret
+## Used to generate jwt. Alt: KOMODO_JWT_SECRET_FILE
+KOMODO_JWT_SECRET_FILE=/run/secrets/komodo_jwt_secret
+
+## Enable login with username + password.
+KOMODO_LOCAL_AUTH=true
+## Disable new user signups.
+KOMODO_DISABLE_USER_REGISTRATION=false
+## All new logins are auto enabled
+KOMODO_ENABLE_NEW_USERS=true
+## Disable non-admins from creating new resources.
+KOMODO_DISABLE_NON_ADMIN_CREATE=false
+## Allows all users to have Read level access to all resources.
+KOMODO_TRANSPARENT_MODE=false
+
+## Time to live for jwt tokens.
+## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk
+KOMODO_JWT_TTL="1-day"
+
+## OIDC Login
+KOMODO_OIDC_ENABLED=true
+## Must reachable from Komodo Core container
+KOMODO_OIDC_PROVIDER=https://authentik.lab.gurulandia.eu/application/o/komodo/
+## Change the host to one reachable be reachable by users (optional if it is the same as above).
+## DO NOT include the `path` part of the URL.
+KOMODO_OIDC_REDIRECT_HOST=https://authentik.lab.gurulandia.eu
+## Your client credentials
+KOMODO_OIDC_CLIENT_ID_FILE=/run/secrets/komodo_oidc_client_id
+KOMODO_OIDC_CLIENT_SECRET_FILE=/run/secrets/komodo_oidc_client_secret
+## Make usernames the full email.
+KOMODO_OIDC_USE_FULL_EMAIL=true
+## Add additional trusted audiences for token claims verification.
+## Supports comma separated list, and passing with _FILE (for compose secrets).
+# KOMODO_OIDC_ADDITIONAL_AUDIENCES=abc,123 # Alt: KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
+
+## Github Oauth
+KOMODO_GITHUB_OAUTH_ENABLED=false
+# KOMODO_GITHUB_OAUTH_ID= # Alt: KOMODO_GITHUB_OAUTH_ID_FILE
+# KOMODO_GITHUB_OAUTH_SECRET= # Alt: KOMODO_GITHUB_OAUTH_SECRET_FILE
+
+## Google Oauth
+KOMODO_GOOGLE_OAUTH_ENABLED=false
+# KOMODO_GOOGLE_OAUTH_ID= # Alt: KOMODO_GOOGLE_OAUTH_ID_FILE
+# KOMODO_GOOGLE_OAUTH_SECRET= # Alt: KOMODO_GOOGLE_OAUTH_SECRET_FILE
+
+## Aws - Used to launch Builder instances and ServerTemplate instances.
+KOMODO_AWS_ACCESS_KEY_ID= # Alt: KOMODO_AWS_ACCESS_KEY_ID_FILE
+KOMODO_AWS_SECRET_ACCESS_KEY= # Alt: KOMODO_AWS_SECRET_ACCESS_KEY_FILE
+
+## Hetzner - Used to launch ServerTemplate instances
+## Hetzner Builder not supported due to Hetzner pay-by-the-hour pricing model
+KOMODO_HETZNER_TOKEN= # Alt: KOMODO_HETZNER_TOKEN_FILE
+
+#=------------------------------=#
+#= Komodo Periphery Environment =#
+#=------------------------------=#
+
+## Full variable list + descriptions are available here:
+## 🦎 https://github.com/mbecker20/komodo/blob/main/config/periphery.config.toml 🦎
+
+## Periphery passkeys must include KOMODO_PASSKEY to authenticate.
+PERIPHERY_PASSKEYS_FILE=/run/secrets/komodo_passkey
+## Specify the root directory used by Periphery agent.
+PERIPHERY_ROOT_DIRECTORY=/etc/komodo
+
+## Enable SSL using self signed certificates.
+## Connect to Periphery at https://address:8120.
+PERIPHERY_SSL_ENABLED=true
+
+## If the disk size is overreporting, can use one of these to 
+## whitelist / blacklist the disks to filter them, whichever is easier.
+## Accepts comma separated list of paths.
+## Usually whitelisting just /etc/hostname gives correct size.
+PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname
+# PERIPHERY_EXCLUDE_DISK_MOUNTS=/snap,/etc/repos

docker/komodo/deploy.sh

@@ -0,0 +1,5 @@
+docker compose \
+--env-file ../env/komodo-stack.env \
+--env-file ../env/komodo.env \
+--env-file ../env/common.env \
+$1