sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

streamline and document examples

Browse Source
This commit is contained in:
Willy Kloucek
2020-12-07 08:27:06 +01:00
parent e8ebd1a173
commit 2b18b3526d
36 changed files with 854 additions and 1285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/examples/ocis_external_konnectd/README.md
-2
View File
@@ -1,2 +0,0 @@
Please refer to [our documentation](https://owncloud.github.io/ocis/deployment/ocis_external_konnectd/)
for instructions on how to deploy this scenario.
deployments/examples/ocis_external_konnectd/idpnode/.env
-2
View File
@@ -1,2 +0,0 @@
OCIS_DOMAIN=ocis.domain.com
IDP_DOMAIN=idp.domain.com
deployments/examples/ocis_external_konnectd/idpnode/config/identifier-registration.yml
-18
View File
@@ -1,18 +0,0 @@
---
# OpenID Connect client registry.
clients:
- id: phoenix
name: OCIS
application_type: web
insecure: yes
trusted: yes
redirect_uris:
- http://ocis.domain.com/
- https://ocis.domain.com/
- http://ocis.domain.com/oidc-callback.html
- https://ocis.domain.com/oidc-callback.html
- http://ocis.domain.com/oidc-silent-redirect.html
- https://ocis.domain.com/oidc-silent-redirect.html
origins:
- http://ocis.domain.com
- https://ocis.domain.com
deployments/examples/ocis_external_konnectd/idpnode/docker-compose.yml
-67
View File
@@ -1,67 +0,0 @@
version: '3.7'
services:
traefik:
image: "traefik:v2.2"
container_name: "traefik"
networks:
- idpnet
command:
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.idp.acme.tlschallenge=true"
- "--certificatesresolvers.idp.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.idp.acme.email=postmaster@${IDP_DOMAIN}"
- "--certificatesresolvers.idp.acme.storage=/letsencrypt/acme.json"
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- "letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
konnectd:
container_name: konnectd
image: owncloud/ocis-konnectd:latest
networks:
- idpnet
ports:
- "9130:9130"
volumes:
- ./config:/etc/ocis
environment:
OCIS_LOG_LEVEL: debug
KONNECTD_ISS: https://${IDP_DOMAIN}
KONNECTD_IDENTIFIER_REGISTRATION_CONF: "/etc/ocis/identifier-registration.yml"
KONNECTD_LOG_LEVEL: debug
KONNECTD_TLS: '0'
LDAP_URI: ldap://${OCIS_DOMAIN}:9125
LDAP_BINDDN: cn=konnectd,ou=sysusers,dc=example,dc=org
LDAP_BINDPW: konnectd
LDAP_BASEDN: ou=users,dc=example,dc=org
LDAP_SCOPE: sub
LDAP_LOGIN_ATTRIBUTE: cn
LDAP_EMAIL_ATTRIBUTE: mail
LDAP_NAME_ATTRIBUTE=: n
LDAP_UUID_ATTRIBUTE: uid
LDAP_UUID_ATTRIBUTE_TYPE: text
LDAP_FILTER: (objectClass=posixaccount)
labels:
- "traefik.enable=true"
- "traefik.http.services.idp.loadbalancer.server.port=9200"
- "traefik.docker.network=idpnet"
- "traefik.port=9130"
- "traefik.protocol=https"
# ssl config
- "traefik.http.routers.idp.rule=Host(`${IDP_DOMAIN}`)"
- "traefik.http.routers.idp.entrypoints=websecure"
- "traefik.http.routers.idp.tls.certresolver=idp"
# http -> https forwarding
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.idp-redirs.rule=Host(`${IDP_DOMAIN}`)"
- "traefik.http.routers.idp-redirs.entrypoints=web"
- "traefik.http.routers.idp-redirs.middlewares=redirect-to-https"
deployments/examples/ocis_external_konnectd/ocisnode/.env
-2
View File
@@ -1,2 +0,0 @@
OCIS_DOMAIN=ocis.domain.com
IDP_DOMAIN=idp.domain.com
deployments/examples/ocis_external_konnectd/ocisnode/docker-compose.yml
-68
View File
@@ -1,68 +0,0 @@
version: '3.7'
services:
traefik:
image: "traefik:v2.2"
container_name: "traefik"
networks:
- ocisnet
command:
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.ocis.acme.tlschallenge=true"
- "--certificatesresolvers.ocis.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.ocis.acme.email=postmaster@${OCIS_DOMAIN}"
- "--certificatesresolvers.ocis.acme.storage=/letsencrypt/acme.json"
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- "letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
ocis:
container_name: ocis
image: owncloud/ocis:latest
tty: true
privileged: true
stdin_open: true
ports:
- 9200:9200
- 9125:9125
hostname: ocis
networks:
- ocisnet
environment:
OCIS_DOMAIN: ${OCIS_DOMAIN}
PROXY_OIDC_ISSUER: https://${IDP_DOMAIN}
PROXY_OIDC_INSECURE: "true"
PROXY_TLS: "false"
GRAPH_OIDC_ENDPOINT: https://${IDP_DOMAIN}
REVA_OIDC_ISSUER: https://${IDP_DOMAIN}
REVA_LDAP_IDP: https://${IDP_DOMAIN}
PHOENIX_OIDC_AUTHORITY: https://${IDP_DOMAIN}
PHOENIX_OIDC_METADATA_URL: https://${IDP_DOMAIN}/.well-known/openid-configuration
PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN}
OCIS_LOG_LEVEL: debug
REVA_TRANSFER_EXPIRES: 86400
REVA_FRONTEND_URL: https://${OCIS_DOMAIN}
REVA_DATAGATEWAY_URL: https://${OCIS_DOMAIN}/data
labels:
- "traefik.enable=true"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
- "traefik.docker.network=ocisnet"
- "traefik.protocol=https"
# ssl config
- "traefik.http.routers.idp.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis.entrypoints=websecure"
- "traefik.http.routers.ocis.tls.certresolver=idp"
# http -> https forwarding
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.ocis-redirs.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis-redirs.entrypoints=web"
- "traefik.http.routers.ocis-redirs.middlewares=redirect-to-https"
deployments/examples/ocis_keycloak/.env
+27 -23
View File
@@ -1,25 +1,29 @@
### traefik settings ###
# domain of treafik, where you can find the admin panel. defaults to trefik.owncloud.local
#TRAEFIK_DOMAIN=
# basic authentication for the treafik admin panel. defaults to admin:admin
#TRAEFIK_BASIC_AUTH_USERS=
# email address for obtaining letsencrypt certificates, needs only be changed if this is a public facing server
#TRAEFIK_ACME_MAIL=
# If you're on a internet facing server please comment out following line.
# It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
INSECURE=true
### ocis settings ###
# ocis version, defaults to latest
#OCIS_DOCKER_TAG=
# domain of ocis, where you can find ocis. defaults to ocis.owncloud.local
#OCIS_DOMAIN=
# ocis openid connect client id. defaults to ocis-phoenix
#OCIS_OIDC_CLIENT_ID=
### Traefik settings ###
# Domain of Traefik, where you can find the dashboard. Defaults to "traefik.owncloud.test"
TRAEFIK_DOMAIN=
# Basic authentication for the dashboard. Defaults to user "admin" and password "admin"
TRAEFIK_BASIC_AUTH_USERS=
# Email address for obtaining LetsEncrypt certificates, needs only be changed if this is a public facing server
TRAEFIK_ACME_MAIL=
### keycloak ###
# domain of keycloak, where you can find keycloak. defaults to keycloak.owncloud.local
#KEYCLOAK_DOMAIN=
# realm which to be used with ocis. defaults to master
#KEYCLOAK_REALM=
# admin user. defaults to admin
#KEYCLOAK_ADMIN_USER=
# admin password. defaults to admin
#KEYCLOAK_ADMIN_PASSWORD=
### oCIS settings ###
# oCIS version. Defaults to "latest"
OCIS_DOCKER_TAG=
# Domain of oCIS, where you can find the frontend. Defaults to "ocis.owncloud.test"
OCIS_DOMAIN=
# oCIS web openid connect client id. Defaults to "ocis-phoenix"
OCIS_OIDC_CLIENT_ID=
### Keycloak ###
# Domain of Keycloak, where you can find the managment and authentication frontend. Defaults to "keycloak.owncloud.test"
KEYCLOAK_DOMAIN=
# Realm which to be used with oCIS. Defaults to "master"
KEYCLOAK_REALM=
# Admin user login name. Defaults to "admin"
KEYCLOAK_ADMIN_USER=
# Admin user login password. Defaults to "admin"
KEYCLOAK_ADMIN_PASSWORD=
deployments/examples/ocis_keycloak/README.md
+5 -42
View File
@@ -1,43 +1,6 @@
# ocis with keycloak as identity provider
---
document this deployment example in docs/ocis/deployment/ocis_keycloak.md
---
## set up DNS / hostnames
If you only want to start the example on your local computer, please add following lines to your hosts file (`/etc/hosts):
```
127.0.0.1 traefik.owncloud.test
127.0.0.1 ocis.owncloud.test
127.0.0.1 keycloak.owncloud.test
```
For a deployment of the example on a internet facing server please set up dns entries pointing to your server.
## configure the deployment example
If you are deploying the example on your local computer, you don't have to change anything in the `.env` file. Please continue with starting the stack.
For a internet facing server you must change at least the domains according to your dns setup:
- `TRAEFIK_DOMAIN`
- `OCIS_DOMAIN`
- `KEYCLOAK_DOMAIN`
In order to receive ssl certificates with letsencrypt change `TRAEFIK_ACME_MAIL` to a valid email address
For security reasons please change credentials
- `TRAEFIK_BASIC_AUTH_USERS`
- `KEYCLOAK_ADMIN_USER` and `KEYCLOAK_ADMIN_PASSWORD`
Please also note that there might be default users in ocis, depending on the version you are using.
## starting the stack
just run `docker-compose up`
## set up keycloak
1. go to http://keycloak.owncloud.test (https://KEYCLOAK_DOMAIN) and log in as `admin` (password is `admin`).
2. go to clients settings and add a client. The client id is `ocis-phoenix` ($OCIS_OIDC_CLIENT_ID). The client protocol is openid-connect. Insert `https://ocis.owncloud.test` (https://OCIS_DOMAIN) as root url. Then save the client.
3. you can now add users in the users section.
## test ocis
you now can login with your users configured in keycloak
Please refer to [our documentation](https://owncloud.github.io/ocis/deployment/ocis_keycloak/)
for instructions on how to deploy this scenario.
deployments/examples/ocis_keycloak/docker-compose.yml
+30 -13
View File
@@ -1,5 +1,5 @@
---
version: "3.4"
version: "3.7"
services:
traefik:
@@ -38,6 +38,7 @@ services:
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api@internal"
restart: always
ocis:
image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
@@ -46,22 +47,33 @@ services:
environment:
# general config
OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test}
#OCIS_LOG_LEVEL: debug
OCIS_LOG_LEVEL: error
# proxy config
PROXY_TLS: "false"
PROXY_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}
PROXY_OIDC_INSECURE: "true"
PROXY_AUTOPROVISION_ACCOUNTS: "true"
PROXY_OIDC_INSECURE: "${INSECURE:-false}"
PROXY_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}
PROXY_TLS: "false"
# phoenix config
PHOENIX_OIDC_CLIENT_ID: ${OCIS_OIDC_CLIENT_ID:-ocis-phoenix}
PHOENIX_OIDC_AUTHORITY: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}
PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
PHOENIX_OIDC_CLIENT_ID: ${OCIS_OIDC_CLIENT_ID:-ocis-phoenix}
PHOENIX_OIDC_METADATA_URL: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}/.well-known/openid-configuration
PHOENIX_WEB_CONFIG_APPS: files,draw-io,markdown-editor,media-viewer
PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
# storage config
STORAGE_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}
STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/data
STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/
STORAGE_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}
STORAGE_METADATA_ROOT: /opt/ocis-metadata
STORAGE_DRIVER_OCIS_ROOT: /opt/ocis-storage
# store config
STORE_DATA_PATH: /opt/ocis-store
# settings config
SETTINGS_DATA_PATH: /opt/ocis-settings
volumes:
- ocis-storage:/opt/ocis-storage
- ocis-metadata:/opt/ocis-metadata
- ocis-store:/opt/ocis-store
- ocis-settings:/opt/ocis-settings
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocis.entrypoints=http"
@@ -74,15 +86,17 @@ services:
- "traefik.http.routers.ocis-secure.tls.certresolver=http"
- "traefik.http.routers.ocis-secure.service=ocis"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
restart: always
postgres:
image: postgres
image: postgres:alpine
volumes:
- keycloak_postgres_data:/var/lib/postgresql/data
environment:
POSTGRES_DB: keycloak
POSTGRES_USER: keycloak
POSTGRES_PASSWORD: password
POSTGRES_PASSWORD: keycloak
restart: always
keycloak:
image: quay.io/keycloak/keycloak:latest
@@ -92,12 +106,10 @@ services:
DB_DATABASE: keycloak
DB_USER: keycloak
DB_SCHEMA: public
DB_PASSWORD: password
DB_PASSWORD: keycloak
KEYCLOAK_USER: ${KEYCLOAK_ADMIN_USER:-admin}
KEYCLOAK_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
PROXY_ADDRESS_FORWARDING: "true"
ports:
- 8080:8080
labels:
- "traefik.enable=true"
- "traefik.http.routers.keycloak.entrypoints=http"
@@ -113,7 +125,12 @@ services:
- "traefik.http.services.keycloak.loadbalancer.server.scheme=http"
depends_on:
- postgres
restart: always
volumes:
certs:
ocis-storage:
ocis-metadata:
ocis-store:
ocis-settings:
keycloak_postgres_data:
deployments/examples/ocis_oc10_backend/.env
-4
View File
@@ -1,4 +0,0 @@
COMPOSE_PROJECT_NAME=bridge
OCIS_DOMAIN=ocis.example.org
OC10_DOMAIN=oc10.example.org
INSECURE=false
deployments/examples/ocis_oc10_backend/docker-compose.yml
-186
View File
@@ -1,186 +0,0 @@
version: '3.7'
volumes:
files:
driver: local
mysql:
driver: local
backup:
driver: local
redis:
driver: local
tmp:
driver: local
letsencrypt:
driver: local
services:
traefik:
image: "traefik:v2.2"
container_name: "traefik"
command:
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--serverstransport.insecureskipverify=true"
# Ocis certificate resolver
- "--certificatesresolvers.ocis.acme.tlschallenge=true"
- "--certificatesresolvers.ocis.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.ocis.acme.email=user@${OCIS_DOMAIN}"
- "--certificatesresolvers.ocis.acme.storage=/letsencrypt/acme-ocis.json"
# OC10 certificate resolver
- "--certificatesresolvers.oc10.acme.tlschallenge=true"
- "--certificatesresolvers.oc10.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.oc10.acme.email=user@${OCIS_DOMAIN}"
- "--certificatesresolvers.oc10.acme.storage=/letsencrypt/acme-oc10.json"
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- "letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
networks:
default:
aliases:
- ${OC10_DOMAIN}
- ${OCIS_DOMAIN}
owncloud:
build:
context: ./oc10
dockerfile: Dockerfile
expose:
- "8080"
depends_on:
- db
- redis
environment:
OCIS_DOMAIN: ${OCIS_DOMAIN}
PROXY_LOG_LEVEL: debug
OWNCLOUD_DOMAIN: ${OC10_DOMAIN}
OWNCLOUD_DB_TYPE: mysql
OWNCLOUD_DB_NAME: owncloud
OWNCLOUD_DB_USERNAME: owncloud
OWNCLOUD_DB_PASSWORD: owncloud
OWNCLOUD_DB_HOST: db
OWNCLOUD_ADMIN_USERNAME: admin
OWNCLOUD_ADMIN_PASSWORD: admin
OWNCLOUD_MYSQL_UTF8MB4: "true"
OWNCLOUD_REDIS_ENABLED: "true"
OWNCLOUD_REDIS_HOST: redis
OWNCLOUD_TRUSTED_PROXIES: ${OC10_DOMAIN}
OWNCLOUD_OVERWRITE_PROTOCOL: https
OWNCLOUD_OVERWRITE_HOST: ${OC10_DOMAIN}
OWNCLOUD_APPS_ENABLE: "openidconnect,oauth2,user_ldap,graphapi"
OWNCLOUD_LOG_LEVEL: 0
volumes:
- files:/mnt/data
- tmp:/tmp/shared
labels:
- "traefik.enable=true"
- "traefik.http.services.oc10.loadbalancer.server.port=8080"
- "traefik.docker.network=ocisnet"
- "traefik.protocol=https"
# ssl config
- "traefik.http.routers.oc10.rule=Host(`${OC10_DOMAIN}`)"
- "traefik.http.routers.oc10.entrypoints=websecure"
- "traefik.http.routers.oc10.tls.certresolver=oc10"
# http -> https forwarding
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.oc10-redirs.rule=Host(`${OC10_DOMAIN}`)"
- "traefik.http.routers.oc10-redirs.entrypoints=web"
- "traefik.http.routers.oc10-redirs.middlewares=redirect-to-https"
ocis:
build:
context: ./ocis
dockerfile: Dockerfile
args:
OCIS_DOMAIN: ${OCIS_DOMAIN}
OC10_DOMAIN: ${OC10_DOMAIN}
ports:
- 9200:9200
environment:
OCIS_LOG_LEVEL: debug
# proxy
PROXY_CONFIG_FILE: "/config/proxy-config.json"
PROXY_TLS: "false"
PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN}
PROXY_AUTOPROVISION_ACCOUNTS: "true"
PROXY_OIDC_INSECURE: "${INSECURE}"
PROXY_ENABLE_PRESIGNEDURLS: "false"
# konnectd - binddn must exist as oc10 admin user
KONNECTD_ISS: https://${OCIS_DOMAIN}
KONNECTD_IDENTIFIER_REGISTRATION_CONF: "/config/identifier-registration.yaml"
KONNECTD_TLS: 0
KONNECTD_SIGNING_KID: super
KONNECTD_INSECURE: "${INSECURE}"
LDAP_URI: ldap://localhost:9125
LDAP_BINDDN: "cn=admin,dc=example,dc=org"
LDAP_BINDPW: "admin"
LDAP_BASEDN: "dc=example,dc=org"
LDAP_SCOPE: sub
LDAP_LOGIN_ATTRIBUTE: uid
LDAP_EMAIL_ATTRIBUTE: mail
LDAP_NAME_ATTRIBUTE: givenName
LDAP_UUID_ATTRIBUTE: uid
LDAP_UUID_ATTRIBUTE_TYPE: text
LDAP_FILTER: "(objectClass=posixaccount)"
# glauth
GLAUTH_BACKEND_DATASTORE: owncloud
GLAUTH_BACKEND_SERVERS: https://${OC10_DOMAIN}/apps/graphapi/v1.0
GLAUTH_BACKEND_INSECURE: "${INSECURE}"
# graph
GRAPH_OIDC_ENDPOINT: https://${OC10_DOMAIN}/apps/graphapi/v1.0
# web ui
PHOENIX_WEB_CONFIG: "/config/web/config.json"
# storage - although not used, yet
STORAGE_OIDC_ISSUER: https://${OCIS_DOMAIN}
STORAGE_OIDC_INSECURE: "${INSECURE}"
STORAGE_TRANSFER_EXPIRES: 86400
STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN}
STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN}/data
STORAGE_LDAP_IDP: https://${OCIS_DOMAIN}
volumes:
- ./ocis/config/proxy-config.json:/etc/ocis/proxy.json
labels:
- "traefik.enable=true"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
- "traefik.docker.network=ocisnet"
- "traefik.protocol=https"
# ssl config
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis.entrypoints=websecure"
- "traefik.http.routers.ocis.tls.certresolver=ocis"
# http -> https forwarding
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.ocis-redirs.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis-redirs.entrypoints=web"
- "traefik.http.routers.ocis-redirs.middlewares=redirect-to-https"
db:
image: webhippie/mariadb:latest
restart: always
environment:
MARIADB_ROOT_PASSWORD: owncloud
MARIADB_USERNAME: owncloud
MARIADB_PASSWORD: owncloud
MARIADB_DATABASE: owncloud
MARIADB_MAX_ALLOWED_PACKET: 128M
MARIADB_INNODB_LOG_FILE_SIZE: 256M
healthcheck:
test: ["CMD", "/usr/bin/healthcheck"]
interval: 30s
timeout: 10s
retries: 5
volumes:
- mysql:/var/lib/mysql
- backup:/var/lib/backup
redis:
image: webhippie/redis:latest
environment:
- REDIS_DATABASES=1
volumes:
- redis:/var/lib/redis
deployments/examples/ocis_oc10_backend/oc10/Dockerfile
-3
View File
@@ -1,3 +0,0 @@
FROM owncloud/server:10.6.0-beta1
ADD apps/graphapi-0.1.0.tar.gz /var/www/owncloud/apps/
COPY overlay /
deployments/examples/ocis_oc10_backend/oc10/apps/graphapi-0.1.0.tar.gz
BIN
View File
Binary file not shown.
deployments/examples/ocis_oc10_backend/ocis/Dockerfile
-11
View File
@@ -1,11 +0,0 @@
FROM owncloud/ocis:latest
ARG OCIS_DOMAIN
ENV OCIS_DOMAIN $OCIS_DOMAIN
ARG OC10_DOMAIN
ENV OC10_DOMAIN $OC10_DOMAIN
ADD config /config
RUN sed -i "s/ocis.example.org/${OCIS_DOMAIN}/g" /config/web/config.json \
&& sed -i "s/ocis.example.org/${OCIS_DOMAIN}/g" /config/identifier-registration.yaml \
&& sed -i "s/oc10.example.org/${OC10_DOMAIN}/g" /config/identifier-registration.yaml \
deployments/examples/ocis_oc10_backend/ocis/config/identifier-registration.yaml
-122
View File
@@ -1,122 +0,0 @@
---
# OpenID Connect client registry.
clients:
- id: phoenix
name: OCIS
application_type: web
insecure: yes
trusted: yes
redirect_uris:
- https://ocis.example.org/
- https://ocis.example.org/oidc-callback.html
- https://ocis.example.org/oidc-silent-redirect.html
origins:
- https://ocis.example.org
- id: oc10
name: OC10
application_type: web
secret: super
insecure: yes
trusted: yes
redirect_uris:
- https://oc10.example.org/
- https://oc10.example.org/apps/openidconnect/redirect
origins:
- https://oc10.example.org
- id: ocis-explorer.js
name: OCIS Graph Explorer
trusted: yes
application_type: web
insecure: yes
- id: xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69
secret: UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh
application_type: native
insecure: true
- id: e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD
secret: dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD
application_type: native
redirect_uris:
- oc://android.owncloud.com
- id: mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1
secret: KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx
application_type: native
redirect_uris:
- oc://ios.owncloud.com
- oc.ios://ios.owncloud.com
# - id: playground-trusted.js
# name: Trusted OIDC Playground
# trusted: yes
# application_type: web
# redirect_uris:
# - https://my-host:8509/
# origins:
# - https://my-host:8509
# - id: playground-trusted.js
# name: Trusted Insecure OIDC Playground
# trusted: yes
# application_type: web
# insecure: yes
# - id: client-with-keys
# secret: super
# application_type: native
# redirect_uris:
# - http://localhost
# trusted_scopes:
# - konnect/guestok
# - kopano/kwm
# jwks:
# keys:
# - kty: EC
# use: sig
# kid: client-with-keys-key-1
# crv: P-256
# x: RTZpWoRbjwX1YavmSHVBj6Cy3Yzdkkp6QLvTGB22D0c
# y: jeavjwcX0xlDSchFcBMzXSU7wGs2VPpNxWCwmxFvmF0
# request_object_signing_alg: ES256
# - id: first
# secret: lala
# application_type: native
# redirect_uris:
# - my://app
# - id: second
# secret: lulu
# application_type: native
# redirect_uris:
# - http://localhost
# External authority registry.
authorities:
# - id: my-univention
# name: Univention
# client_id: kopano-konnect
# authority_type: oidc
# jwks:
# keys:
# - kty: EC
# use: sig
# kid: example-key-1
# crv: P-256
# x: RTZpWoRbjwX1YavmSHVBj6Cy3Yzdkkp6QLvTGB22D0c
# y: jeavjwcX0xlDSchFcBMzXSU7wGs2VPpNxWCwmxFvmF0
# default: yes
# authorization_endpoint: https://my-univention/signin/v1/identifier/_/authorize
# response_type: id_token
# scopes:
# - openid
# - profile
# identity_claim_name: preferred_username
# identity_aliases:
# external-user-a: local-user-a
# external-user-b: local-user-b
# identity_alias_required: true
deployments/examples/ocis_traefik/.env
+17 -1
View File
@@ -1 +1,17 @@
OCIS_DOMAIN=ocis.domain.com
# If you're on a internet facing server please comment out following line.
# It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
INSECURE=true
### Traefik settings ###
# Domain of Traefik, where you can find the dashboard. Defaults to "traefik.owncloud.test"
TRAEFIK_DOMAIN=
# Basic authentication for the dashboard. Defaults to user "admin" and password "admin"
TRAEFIK_BASIC_AUTH_USERS=
# Email address for obtaining LetsEncrypt certificates, needs only be changed if this is a public facing server
TRAEFIK_ACME_MAIL=
### oCIS settings ###
# oCIS version. Defaults to "latest"
OCIS_DOCKER_TAG=
# Domain of oCIS, where you can find the frontend. Defaults to "ocis.owncloud.test"
OCIS_DOMAIN=
deployments/examples/ocis_traefik/README.md
+5 -1
View File
@@ -1,2 +1,6 @@
Please refer to [our documentation](https://owncloud.github.io/ocis/deployment/ocis_traefik/)
---
document this deployment example in docs/ocis/deployment/owncloud10_with_ocis_web.md
---
Please refer to [our documentation](https://owncloud.github.io/ocis/deployment/owncloud10_with_ocis_web/)
for instructions on how to deploy this scenario.
deployments/examples/ocis_traefik/config/.gitignore
+1
View File
@@ -0,0 +1 @@
identifier-registration.yaml
deployments/examples/ocis_traefik/config/identifier-registration.dist.yaml
+41
View File
@@ -0,0 +1,41 @@
---
# OpenID Connect client registry.
clients:
- id: phoenix
name: OCIS
application_type: web
insecure: yes
trusted: yes
redirect_uris:
- https://ocis.owncloud.test/
- https://ocis.owncloud.test/oidc-callback.html
- https://ocis.owncloud.test/oidc-silent-redirect.html
origins:
- https://ocis.owncloud.test
- id: ocis-explorer.js
name: oCIS Graph Explorer
trusted: yes
insecure: yes
- id: xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69
secret: UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh
name: ownCloud desktop app
application_type: native
insecure: true
- id: e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD
secret: dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD
name: ownCloud Android app
application_type: native
redirect_uris:
- oc://android.owncloud.com
- id: mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1
secret: KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx
name: ownCloud iOS app
application_type: native
redirect_uris:
- oc://ios.owncloud.com
- oc.ios://ios.owncloud.com
deployments/examples/ocis_traefik/config/identifier-registration.yml
-18
View File
@@ -1,18 +0,0 @@
---
# OpenID Connect client registry.
clients:
- id: phoenix
name: OCIS
application_type: web
insecure: yes
trusted: yes
redirect_uris:
- http://ocis.domain.com/
- https://ocis.domain.com/
- http://ocis.domain.com/oidc-callback.html
- https://ocis.domain.com/oidc-callback.html
- http://ocis.domain.com/oidc-silent-redirect.html
- https://ocis.domain.com/oidc-silent-redirect.html
origins:
- http://ocis.domain.com
- https://ocis.domain.com
deployments/examples/ocis_traefik/docker-compose.yml
+91 -59
View File
@@ -1,73 +1,105 @@
---
version: "3.7"
services:
traefik:
image: "traefik:v2.2"
container_name: "traefik"
image: "traefik:v2.3"
networks:
- ocisnet
default:
aliases:
- ${OCIS_DOMAIN:-ocis.owncloud.test}
command:
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--serverstransport.insecureskipverify=true"
# Ocis certificate resolver
- "--certificatesresolvers.ocis.acme.tlschallenge=true"
- "--certificatesresolvers.ocis.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.ocis.acme.email=user@${OCIS_DOMAIN}"
- "--certificatesresolvers.ocis.acme.storage=/letsencrypt/acme-ocis.json"
#- "--log.level=DEBUG"
- "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL:-'example@example.org'}"
- "--certificatesResolvers.http.acme.storage=/certs/acme.json"
- "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http"
- "--api.dashboard=true"
- "--entryPoints.http.address=:80"
- "--entryPoints.https.address=:443"
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.exposedByDefault=false"
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- "letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
ocis:
container_name: ocis
image: owncloud/ocis:latest
ports:
- 9200:9200
hostname: ocis
networks:
- ocisnet
volumes:
- ./config:/etc/ocis
environment:
OCIS_DOMAIN: ${OCIS_DOMAIN}
PROXY_TLS: "false"
PROXY_HTTP_ADDR: 0.0.0.0:9200
PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN}
PROXY_OIDC_INSECURE: "true"
KONNECTD_ISS: https://${OCIS_DOMAIN}
KONNECTD_IDENTIFIER_REGISTRATION_CONF: "/etc/ocis/identifier-registration.yml"
KONNECTD_TLS: 1
GRAPH_OIDC_ENDPOINT: https://${OCIS_DOMAIN}
PHOENIX_OIDC_AUTHORITY: https://${OCIS_DOMAIN}
PHOENIX_OIDC_METADATA_URL: https://${OCIS_DOMAIN}/.well-known/openid-configuration
PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN}
STORAGE_OIDC_ISSUER: https://${OCIS_DOMAIN}
STORAGE_TRANSFER_EXPIRES: 86400
STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN}
STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN}/data
STORAGE_LDAP_IDP: https://${OCIS_DOMAIN}
- "certs:/certs"
labels:
- "traefik.enable=true"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
- "traefik.docker.network=ocisnet"
- "traefik.protocol=https"
# ssl config
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis.entrypoints=websecure"
- "traefik.http.routers.ocis.tls.certresolver=ocis"
# http -> https forwarding
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.ocis-redirs.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis-redirs.entrypoints=web"
- "traefik.http.routers.ocis-redirs.middlewares=redirect-to-https"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$apr1$4vqie50r$YQAmQdtmz5n9rEALhxJ4l.}" # defaults to admin:admin
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api@internal"
restart: always
networks:
ocisnet:
ocis:
image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
entrypoint:
- /bin/sh
- -c
- | # as long as https://github.com/owncloud/product/issues/15 is open we need this step to template konnectd config
cp /config/identifier-registration.dist.yaml /config/identifier-registration.yaml
sed -i 's/ocis.owncloud.test/${OCIS_DOMAIN:-ocis.owncloud.test}/g' /config/identifier-registration.yaml
ocis server
networks:
default:
environment:
# general config
OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test}
OCIS_LOG_LEVEL: error
# proxy config
PROXY_AUTOPROVISION_ACCOUNTS: "true"
PROXY_OIDC_INSECURE: "${INSECURE:-false}"
PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
PROXY_TLS: "false"
# phoenix config
PHOENIX_OIDC_AUTHORITY: https://${OCIS_DOMAIN:-ocis.owncloud.test}
PHOENIX_OIDC_METADATA_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/.well-known/openid-configuration
PHOENIX_WEB_CONFIG_APPS: files,draw-io,markdown-editor,media-viewer
PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
# storage config
STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/data
STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/
STORAGE_OIDC_ISSUER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
STORAGE_METADATA_ROOT: /opt/ocis-metadata
STORAGE_DRIVER_OCIS_ROOT: /opt/ocis-storage
# store config
STORE_DATA_PATH: /opt/ocis-store
# settings config
SETTINGS_DATA_PATH: /opt/ocis-settings
# idp config
KONNECTD_ISS: https://${OCIS_DOMAIN:-ocis.owncloud.test}
KONNECTD_TLS: 'false'
volumes:
- ./config:/config
- ocis-storage:/opt/ocis-storage
- ocis-metadata:/opt/ocis-metadata
- ocis-store:/opt/ocis-store
- ocis-settings:/opt/ocis-settings
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocis.entrypoints=http"
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
- "traefik.http.middlewares.ocis-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.ocis.middlewares=ocis-https-redirect"
- "traefik.http.routers.ocis-secure.entrypoints=https"
- "traefik.http.routers.ocis-secure.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
- "traefik.http.routers.ocis-secure.tls=true"
- "traefik.http.routers.ocis-secure.tls.certresolver=http"
- "traefik.http.routers.ocis-secure.service=ocis"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
restart: always
volumes:
certs:
ocis-storage:
ocis-metadata:
ocis-store:
ocis-settings:
deployments/examples/owncloud10_with_ocis_web/.env
+21
View File
@@ -0,0 +1,21 @@
# If you're on a internet facing server please comment out following line.
# It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
INSECURE=true
### Traefik settings ###
# Domain of Traefik, where you can find the dashboard. Defaults to "traefik.owncloud.test"
TRAEFIK_DOMAIN=
# Basic authentication for the dashboard. Defaults to user "admin" and password "admin"
TRAEFIK_BASIC_AUTH_USERS=
# Email address for obtaining LetsEncrypt certificates, needs only be changed if this is a public facing server
TRAEFIK_ACME_MAIL=
### oCIS settings ###
# oCIS version. Defaults to "latest"
OCIS_DOCKER_TAG=
# Domain of oCIS, where you can find the frontend. Defaults to "ocis.owncloud.test"
OCIS_DOMAIN=
### oC10 ###
# Domain of ownCloud 10, where you can find the frontend. Defaults to "oc10.owncloud.test"
#OC10_DOMAIN=
deployments/examples/ocis_oc10_backend/README.md → deployments/examples/owncloud10_with_ocis_web/README.md
+4
View File
@@ -1,2 +1,6 @@
---
document this deployment example in docs/ocis/deployment/ocis_oc10_backend.md
---
Please refer to [our documentation](https://owncloud.github.io/ocis/deployment/ocis_oc10_backend/)
for instructions on how to deploy this scenario.
deployments/examples/ocis_oc10_backend/oc10/overlay/etc/templates/config.php → deployments/examples/owncloud10_with_ocis_web/config/oc10/config.php
+4 -4
View File
@@ -32,7 +32,7 @@ function getConfigFromEnv() {
0 => $domain
],
'openid-connect' => [
'provider-url' => 'https://' . getenv('OCIS_DOMAIN'),
'provider-url' => getenv('OCIS_DOMAIN'),
'client-id' => 'oc10',
'client-secret' => 'super',
'loginButtonName' => 'OpenId Connect',
@@ -40,7 +40,7 @@ function getConfigFromEnv() {
'mode' => 'userid',
'autoRedirectOnLoginPage' => true,
'insecure' => true,
'post_logout_redirect_uri' => 'https://' . getenv('OWNCLOUD_DOMAIN') . '/',
'post_logout_redirect_uri' => getenv('OWNCLOUD_DOMAIN') . '/',
],
'datadirectory' => getenv('OWNCLOUD_VOLUME_FILES'),
'dbtype' => getenv('OWNCLOUD_DB_TYPE'),
@@ -50,8 +50,8 @@ function getConfigFromEnv() {
'dbpassword' => getenv('OWNCLOUD_DB_PASSWORD'),
'dbtableprefix' => getenv('OWNCLOUD_DB_PREFIX'),
'phoenix.baseUrl' => 'https://'. getenv('OCIS_DOMAIN'),
'cors.allowed-domains' => ['https://'. getenv('OCIS_DOMAIN')],
'phoenix.baseUrl' => getenv('OCIS_DOMAIN'),
'cors.allowed-domains' => [getenv('OCIS_DOMAIN')],
'log_type' => 'owncloud',
deployments/examples/owncloud10_with_ocis_web/config/ocis/.gitignore
+3
View File
@@ -0,0 +1,3 @@
config.json
identifier-registration.yaml
proxy-config.json
deployments/examples/ocis_oc10_backend/ocis/config/web/config.json → deployments/examples/owncloud10_with_ocis_web/config/ocis/config.dist.json
+6 -11
View File
@@ -1,10 +1,10 @@
{
"server": "https://ocis.example.org",
"server": "https://ocis.owncloud.test",
"theme": "owncloud",
"version": "0.1.0",
"openIdConnect": {
"metadata_url": "https://ocis.example.org/.well-known/openid-configuration",
"authority": "https://ocis.example.org",
"metadata_url": "https://ocis.owncloud.test/.well-known/openid-configuration",
"authority": "https://ocis.owncloud.test",
"client_id": "phoenix",
"response_type": "code",
"scope": "openid profile email"
@@ -16,7 +16,7 @@
"de": "Klassisches ownCloud"
},
"icon": "switch_ui",
"url": "https://oc10.example.org",
"url": "https://oc10.owncloud.test",
"target": "_self"
},
{
@@ -25,15 +25,10 @@
"de": "Einstellungen"
},
"icon": "application",
"url": "https://oc10.example.org/index.php/settings/personal",
"url": "https://oc10.owncloud.test/index.php/settings/personal",
"target": "_self",
"menu": "user"
}
],
"apps": [
"files",
"draw-io",
"markdown-editor",
"media-viewer"
]
"apps": ["files", "draw-io", "markdown-editor", "media-viewer"]
}
deployments/examples/owncloud10_with_ocis_web/config/ocis/identifier-registration.dist.yaml
+50
View File
@@ -0,0 +1,50 @@
---
# OpenID Connect client registry.
clients:
- id: phoenix
name: OCIS
application_type: web
insecure: yes
trusted: yes
redirect_uris:
- https://ocis.owncloud.test/
- https://ocis.owncloud.test/oidc-callback.html
- https://ocis.owncloud.test/oidc-silent-redirect.html
origins:
- https://ocis.owncloud.test
- id: oc10
name: OC10
application_type: web
secret: super
insecure: yes
trusted: yes
redirect_uris:
- https://oc10.owncloud.test/
- https://oc10.owncloud.test/apps/openidconnect/redirect
origins:
- https://oc10.owncloud.test
- id: ocis-explorer.js
name: OCIS Graph Explorer
trusted: yes
application_type: web
insecure: yes
- id: xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69
secret: UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh
application_type: native
insecure: true
- id: e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD
secret: dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD
application_type: native
redirect_uris:
- oc://android.owncloud.com
- id: mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1
secret: KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx
application_type: native
redirect_uris:
- oc://ios.owncloud.com
- oc.ios://ios.owncloud.com
deployments/examples/ocis_oc10_backend/ocis/config/proxy-config.json → deployments/examples/owncloud10_with_ocis_web/config/ocis/proxy-config.dist.json
+11 -9
View File
@@ -1,15 +1,15 @@
{
"HTTP": {
"Namespace": "works.owncloud"
"Namespace": "ocis_oc10_backend"
},
"policy_selector": {
"static": {
"policy": "oc10"
"policy": "ocis_oc10_backend"
}
},
"policies": [
{
"name": "oc10",
"name": "ocis_oc10_backend",
"routes": [
{
"endpoint": "/",
@@ -29,31 +29,33 @@
},
{
"endpoint": "/ocs/",
"backend": "http://owncloud:8080",
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
},
{
"endpoint": "/remote.php/",
"backend": "http://owncloud:8080",
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
},
{
"endpoint": "/dav/",
"backend": "http://owncloud:8080",
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
},
{
"endpoint": "/webdav/",
"backend": "http://owncloud:8080",
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
},
{
"endpoint": "/status.php",
"backend": "http://owncloud:8080"
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
},
{
"endpoint": "/index.php/",
"backend": "http://owncloud:8080"
"backend": "https://oc10.owncloud.test",
"apache-vhost": true
}
]
}
deployments/examples/owncloud10_with_ocis_web/docker-compose.yml
+220
View File
@@ -0,0 +1,220 @@
---
version: "3.7"
services:
traefik:
image: "traefik:v2.3"
networks:
default:
aliases:
- ${OCIS_DOMAIN:-ocis.owncloud.test}
- ${OC10_DOMAIN:-oc10.owncloud.test}
command:
#- "--log.level=DEBUG"
- "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL:-'example@example.org'}"
- "--certificatesResolvers.http.acme.storage=/certs/acme.json"
- "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http"
- "--api.dashboard=true"
- "--entryPoints.http.address=:80"
- "--entryPoints.https.address=:443"
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.exposedByDefault=false"
ports:
- "80:80"
- "443:443"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "certs:/certs"
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$apr1$4vqie50r$YQAmQdtmz5n9rEALhxJ4l.}" # defaults to admin:admin
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api@internal"
restart: always
ocis:
image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
entrypoint:
- /bin/sh
- -c
- |
cp /config/identifier-registration.dist.yaml /config/identifier-registration.yaml
sed -i 's/ocis.owncloud.test/${OCIS_DOMAIN:-ocis.owncloud.test}/g' /config/identifier-registration.yaml
sed -i 's/oc10.owncloud.test/${OC10_DOMAIN:-oc10.owncloud.test}/g' /config/identifier-registration.yaml
cp /config/config.dist.json /config/config.json
sed -i 's/ocis.owncloud.test/${OCIS_DOMAIN:-ocis.owncloud.test}/g' /config/config.json
sed -i 's/oc10.owncloud.test/${OC10_DOMAIN:-oc10.owncloud.test}/g' /config/config.json
cp /config/proxy-config.dist.json /config/proxy-config.json
sed -i 's/ocis.owncloud.test/${OCIS_DOMAIN:-ocis.owncloud.test}/g' /config/proxy-config.json
sed -i 's/oc10.owncloud.test/${OC10_DOMAIN:-oc10.owncloud.test}/g' /config/proxy-config.json
ocis server
networks:
default:
environment:
# general config
OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test}
OCIS_LOG_LEVEL: error
# proxy
PROXY_AUTOPROVISION_ACCOUNTS: "true"
PROXY_INSECURE_BACKENDS: "${INSECURE:-false}"
PROXY_OIDC_INSECURE: "${INSECURE:-false}"
PROXY_CONFIG_FILE: "/config/proxy-config.json"
PROXY_ENABLE_PRESIGNEDURLS: "false"
PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
PROXY_TLS: "false"
# konnectd - binddn must exist as oc10 admin user
KONNECTD_IDENTIFIER_REGISTRATION_CONF: "/config/identifier-registration.yaml"
KONNECTD_INSECURE: "${INSECURE:-false}"
KONNECTD_ISS: https://${OCIS_DOMAIN:-ocis.owncloud.test}
KONNECTD_SIGNING_KID: super
KONNECTD_TLS: 0
LDAP_BASEDN: "dc=example,dc=org"
LDAP_BINDDN: "cn=admin,dc=example,dc=org"
LDAP_BINDPW: "admin"
LDAP_EMAIL_ATTRIBUTE: mail
LDAP_FILTER: "(objectClass=posixaccount)"
LDAP_LOGIN_ATTRIBUTE: uid
LDAP_NAME_ATTRIBUTE: givenName
LDAP_SCOPE: sub
LDAP_URI: ldap://localhost:9125
LDAP_UUID_ATTRIBUTE_TYPE: text
LDAP_UUID_ATTRIBUTE: uid
# glauth
GLAUTH_BACKEND_DATASTORE: owncloud
GLAUTH_BACKEND_SERVERS: https://${OC10_DOMAIN:-oc10.owncloud.test}/apps/graphapi/v1.0
GLAUTH_BACKEND_INSECURE: "${INSECURE:-false}"
# graph
GRAPH_OIDC_ENDPOINT: https://${OC10_DOMAIN:-oc10.owncloud.test}/apps/graphapi/v1.0
# web ui
PHOENIX_WEB_CONFIG: "/config/config.json"
# storage - although not used, yet
STORAGE_OIDC_ISSUER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
STORAGE_OIDC_INSECURE: "${INSECURE:-false}"
STORAGE_TRANSFER_EXPIRES: 86400
STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/data
STORAGE_LDAP_IDP: https://${OCIS_DOMAIN:-ocis.owncloud.test}
STORAGE_METADATA_ROOT: /opt/ocis-metadata
STORAGE_DRIVER_OCIS_ROOT: /opt/ocis-storage
# store config
STORE_DATA_PATH: /opt/ocis-store
# settings config
SETTINGS_DATA_PATH: /opt/ocis-settings
volumes:
- ./config/ocis:/config
- ocis-storage:/opt/ocis-storage
- ocis-metadata:/opt/ocis-metadata
- ocis-store:/opt/ocis-store
- ocis-settings:/opt/ocis-settings
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocis.entrypoints=http"
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
- "traefik.http.middlewares.ocis-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.ocis.middlewares=ocis-https-redirect"
- "traefik.http.routers.ocis-secure.entrypoints=https"
- "traefik.http.routers.ocis-secure.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
- "traefik.http.routers.ocis-secure.tls=true"
- "traefik.http.routers.ocis-secure.tls.certresolver=http"
- "traefik.http.routers.ocis-secure.service=ocis"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
restart: always
oc10:
image: owncloud/server:10.6.0-rc1
depends_on:
- db
- redis
environment:
PROXY_LOG_LEVEL: debug
OCIS_DOMAIN: https://${OCIS_DOMAIN:-ocis.owncloud.test}
OWNCLOUD_DOMAIN: ${OC10_DOMAIN:-oc10.owncloud.test}
OWNCLOUD_DB_TYPE: mysql
OWNCLOUD_DB_NAME: owncloud
OWNCLOUD_DB_USERNAME: owncloud
OWNCLOUD_DB_PASSWORD: owncloud
OWNCLOUD_DB_HOST: db
OWNCLOUD_ADMIN_USERNAME: admin
OWNCLOUD_ADMIN_PASSWORD: admin
OWNCLOUD_MYSQL_UTF8MB4: "true"
OWNCLOUD_REDIS_ENABLED: "true"
OWNCLOUD_REDIS_HOST: redis
OWNCLOUD_TRUSTED_PROXIES: ${OC10_DOMAIN:-oc10.owncloud.test}
OWNCLOUD_OVERWRITE_PROTOCOL: https
OWNCLOUD_OVERWRITE_HOST: ${OC10_DOMAIN:-oc10.owncloud.test}
OWNCLOUD_APPS_ENABLE: "openidconnect,oauth2,user_ldap,graphapi"
OWNCLOUD_LOG_LEVEL: 0
volumes:
- ./config/oc10/config.php:/etc/templates/config.php
- files:/mnt/data
- tmp:/tmp/shared
labels:
- "traefik.enable=true"
- "traefik.http.routers.oc10.entrypoints=http"
- "traefik.http.routers.oc10.rule=Host(`${OC10_DOMAIN:-oc10.owncloud.test}`)"
- "traefik.http.middlewares.oc10-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.oc10.middlewares=oc10-https-redirect"
- "traefik.http.routers.oc10-secure.entrypoints=https"
- "traefik.http.routers.oc10-secure.rule=Host(`${OC10_DOMAIN:-oc10.owncloud.test}`)"
- "traefik.http.routers.oc10-secure.tls=true"
- "traefik.http.routers.oc10-secure.tls.certresolver=http"
- "traefik.http.routers.oc10-secure.service=oc10"
- "traefik.http.services.oc10.loadbalancer.server.port=8080"
restart: always
db:
image: webhippie/mariadb:latest
environment:
MARIADB_ROOT_PASSWORD: owncloud
MARIADB_USERNAME: owncloud
MARIADB_PASSWORD: owncloud
MARIADB_DATABASE: owncloud
MARIADB_MAX_ALLOWED_PACKET: 128M
MARIADB_INNODB_LOG_FILE_SIZE: 256M
healthcheck:
test: ["CMD", "/usr/bin/healthcheck"]
interval: 30s
timeout: 10s
retries: 5
volumes:
- mysql:/var/lib/mysql
- backup:/var/lib/backup
restart: always
redis:
image: webhippie/redis:latest
environment:
- REDIS_DATABASES=1
volumes:
- redis:/var/lib/redis
restart: always
volumes:
certs:
ocis-storage:
ocis-metadata:
ocis-store:
ocis-settings:
files:
driver: local
mysql:
driver: local
backup:
driver: local
redis:
driver: local
tmp:
driver: local