diff --git a/deployments/examples/ocis_external_konnectd/README.md b/deployments/examples/ocis_external_konnectd/README.md index df15492f4..b2b299711 100644 --- a/deployments/examples/ocis_external_konnectd/README.md +++ b/deployments/examples/ocis_external_konnectd/README.md @@ -2,53 +2,52 @@ ## Setup on ocis server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example sub folder for ocisnode to /opt +* Copy example sub folder for ocisnode to /opt `cp deployment/examples/ocis_external_konnectd/ocisnode /opt/` -- Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com +* Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocisnode/.env` `sed -i 's/idp.domain.com/your-idp.domain.com/g' /opt/ocisnode/.env` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocisnode` -- Start application stack +* Start application stack `docker-compose up -d` ## Setup on idp server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example sub folder for idpnode to /opt +* Copy example sub folder for idpnode to /opt `cp deployment/examples/ocis_external_konnectd/idpnode /opt/` -- Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com +* Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/.env` `sed -i 's/idp.domain.com/your-idp.domain.com/g' /opt/idpnode/.env` -- Overwrite redirect uri with your-ocis.domain.com in identifier-registration.yml +* Overwrite redirect uri with your-ocis.domain.com in identifier-registration.yml - `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/config/identifier-registration.yml - ` + `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/config/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/idpnode` -- Start application stack +* Start application stack `docker-compose up -d` diff --git a/deployments/examples/ocis_oc10_backend/README.md b/deployments/examples/ocis_oc10_backend/README.md index 235ce9fea..d44c32577 100644 --- a/deployments/examples/ocis_oc10_backend/README.md +++ b/deployments/examples/ocis_oc10_backend/README.md @@ -2,29 +2,29 @@ ## Setup on server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example folder to /opt +* Copy example folder to /opt `cp deployment/examples/ocis_oc10_backend /opt/` -- Overwrite OCIS_DOMAIN and OC10_DOMAIN in .env with your-ocis.domain.com and your-oc10.domain.com +* Overwrite OCIS_DOMAIN and OC10_DOMAIN in .env with your-ocis.domain.com and your-oc10.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocis_oc10_backend/.env` `sed -i 's/oc10.domain.com/your-oc10.domain.com/g' /opt/ocis_oc10_backend/.env` -- Overwrite redirect uris with your-ocis.domain.com and your-oc10.domain.com in identifier-registration.yml +* Overwrite redirect uris with your-ocis.domain.com and your-oc10.domain.com in identifier-registration.yml `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocis_oc10_backend/ocis/identifier-registration.yml` `sed -i 's/oc10.domain.com/your-oc10.domain.com/g' /opt/ocis_oc10_backend/ocis/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocis_oc10_backend` -- Start application stack +* Start application stack `docker-compose up -d` diff --git a/deployments/examples/ocis_traefik/README.md b/deployments/examples/ocis_traefik/README.md index e8c804b87..a30d9807b 100644 --- a/deployments/examples/ocis_traefik/README.md +++ b/deployments/examples/ocis_traefik/README.md @@ -2,26 +2,26 @@ ## Setup on server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example folder to /opt +* Copy example folder to /opt `cp deployment/examples/ocis_traefik /opt/` -- Overwrite OCIS_DOMAIN in .env with your.domain.com +* Overwrite OCIS_DOMAIN in .env with your.domain.com `sed -i 's/ocis.domain.com/your.domain.com/g' /opt/ocis_traefik/.env` -- Overwrite redirect uri with your.domain.com in identifier-registration.yml +* Overwrite redirect uri with your.domain.com in identifier-registration.yml `sed -i 's/ocis.domain.com/your.domain.com/g' /opt/ocis_traefik/config/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocis_traefik` -- Start application stack +* Start application stack `docker-compose up -d` diff --git a/docs/ocis/deployment/ocis_external_konnectd.md b/docs/ocis/deployment/ocis_external_konnectd.md index 5d079c4f1..6f8b2eb64 100644 --- a/docs/ocis/deployment/ocis_external_konnectd.md +++ b/docs/ocis/deployment/ocis_external_konnectd.md @@ -9,15 +9,11 @@ geekdocFilePath: ocis_external_konnectd.md {{< toc >}} - -# ocis with konnectd on external node deployment scenario - This scenario shows how to setup ocis with konnectd as idp running on a separate node. Both node are having separate domains pointing on the servers. -# ocis traefik deployment scenario - ## Overview -ocis and konnectd running on linux nodes behind traefik as reverse proxy + +* ocis and konnectd running on linux nodes behind traefik as reverse proxy * Cloudflare DNS is resolving the domains * Letsencrypt provides ssl certificates for the domains * Traefik docker container terminates ssl and forwards http requests to the services @@ -25,6 +21,7 @@ ocis and konnectd running on linux nodes behind traefik as reverse proxy ## Nodes ### Requirements + * Server running Ubuntu 20.04 is public availible with a static ip address * Two A-records for both domains are pointing on the servers ip address * Create user @@ -58,66 +55,65 @@ ocis and konnectd running on linux nodes behind traefik as reverse proxy ### Setup on ocis server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example sub folder for ocisnode to /opt +* Copy example sub folder for ocisnode to /opt `cp deployment/examples/ocis_external_konnectd/ocisnode /opt/` -- Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com +* Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocisnode/.env` `sed -i 's/idp.domain.com/your-idp.domain.com/g' /opt/ocisnode/.env` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocisnode` -- Start application stack +* Start application stack `docker-compose up -d` ### Setup on idp server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example sub folder for idpnode to /opt +* Copy example sub folder for idpnode to /opt `cp deployment/examples/ocis_external_konnectd/idpnode /opt/` -- Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com +* Overwrite OCIS_DOMAIN and IDP_DOMAIN in .env with your-ocis.domain.com and your-idp.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/.env` `sed -i 's/idp.domain.com/your-idp.domain.com/g' /opt/idpnode/.env` -- Overwrite redirect uri with your-ocis.domain.com in identifier-registration.yml +* Overwrite redirect uri with your-ocis.domain.com in identifier-registration.yml - `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/config/identifier-registration.yml - ` + `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/idpnode/config/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/idpnode` -- Start application stack +* Start application stack `docker-compose up -d` - ### Stack + On both nodes, a traefik dokcer container is terminating ssl and forwards the http requests to the services. The nodes are named according to their services. ### Config #### Repository structure -``` +```bash ocis_external_konnectd # rootfolder └───ocisnode │ │ docker-compose.yml @@ -140,7 +136,8 @@ The certificate resolvers are named similar to their services and behave exactly #### Konnectd Konnectd as Openid provider needs the redirect url's to point to ocis. -``` + +```yaml --- # OpenID Connect client registry. clients: @@ -163,13 +160,13 @@ clients: Behind traefik, http is used to communicate between the services. Setting KONNECTD_TLS enforces it. -``` +```yaml KONNECTD_TLS: '0' ``` In order to resolve users from glauth service on ocis node, Konnectd needs ldap settings to work properly. -``` +```yaml LDAP_URI: ldap://${OCIS_DOMAIN}:9125 LDAP_BINDDN: cn=konnectd,ou=sysusers,dc=example,dc=org LDAP_BINDPW: konnectd @@ -187,11 +184,11 @@ In order to resolve users from glauth service on ocis node, Konnectd needs ldap On the ocis node, the setting is following a standard scenario, except, that port 9125 needs to be exposed for the idp node to resolve ldap querries from Konnectd. -``` +```yaml ocis: ... ports: - 9200:9200 - 9125:9125 ... -``` \ No newline at end of file +``` diff --git a/docs/ocis/deployment/ocis_oc10_backend.md b/docs/ocis/deployment/ocis_oc10_backend.md index 15b945f14..762011f80 100644 --- a/docs/ocis/deployment/ocis_oc10_backend.md +++ b/docs/ocis/deployment/ocis_oc10_backend.md @@ -9,21 +9,21 @@ geekdocFilePath: ocis_frontend_oc10_backend.md {{< toc >}} - -# ocis frontend with oc10 backend deployment scenario - This deployment scenario shows how to use ocis as frontend for a existing owncloud 10 installation. ocis will allow owncloud 10 users to log in and work with their files. ## Overview + ### Node Setup -ocis and oc10 running as docker containers behind traefik as reverse proxy + +* ocis and oc10 running as docker containers behind traefik as reverse proxy * Cloudflare DNS is resolving one domain for ocis and one for oc10 * Letsencrypt is providing valid ssl certificate for both domains ## Node Deployment ### Requirements + * Server running Ubuntu 20.04 is public availible with a static ip address * Two A-records for both domains are pointing on the servers ip address * Create user @@ -57,35 +57,35 @@ ocis and oc10 running as docker containers behind traefik as reverse proxy ### Setup on server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example folder to /opt +* Copy example folder to /opt `cp deployment/examples/ocis_oc10_backend /opt/` -- Overwrite OCIS_DOMAIN and OC10_DOMAIN in .env with your-ocis.domain.com and your-oc10.domain.com +* Overwrite OCIS_DOMAIN and OC10_DOMAIN in .env with your-ocis.domain.com and your-oc10.domain.com `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocis_oc10_backend/.env` `sed -i 's/oc10.domain.com/your-oc10.domain.com/g' /opt/ocis_oc10_backend/.env` -- Overwrite redirect uris with your-ocis.domain.com and your-oc10.domain.com in identifier-registration.yml +* Overwrite redirect uris with your-ocis.domain.com and your-oc10.domain.com in identifier-registration.yml `sed -i 's/ocis.domain.com/your-ocis.domain.com/g' /opt/ocis_oc10_backend/ocis/identifier-registration.yml` `sed -i 's/oc10.domain.com/your-oc10.domain.com/g' /opt/ocis_oc10_backend/ocis/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocis_oc10_backend` -- Start application stack +* Start application stack `docker-compose up -d` - ### Stack + The application stack is separated in docker containers. One is a traefik proxy which is terminating ssl and forwards the https requests to the internal docker network. Additional, traefik is creating two certificates that are stored in the file `letsencrypt/acme.json` of the users home directory. In a local setup, this traefik is not included. The next container is the ocis server which is exposing the webservice on port 9200 to traefic and provides the oidc provider konnectd to owncloud. oc10 is running as a three container setup out of owncloud-server, a db container and a redis container as memcache storage. @@ -94,7 +94,7 @@ oc10 is running as a three container setup out of owncloud-server, a db containe #### Repository structure -``` +```bash ocis_oc10_backend # rootfolder │ .env │ docker-compose.yml @@ -114,8 +114,7 @@ ocis_oc10_backend # rootfolder In this deployment scenario, traefik requests letsencrypt to issue 2 ssl certificates, so two certificate resolver are needed. These are named according to the services, ocis for the ocis container and oc10 for the oc10 container. - -``` +```yaml ... traefik: image: "traefik:v2.2" @@ -134,8 +133,10 @@ In this deployment scenario, traefik requests letsencrypt to issue 2 ssl certifi - "--certificatesresolvers.oc10.acme.storage=/letsencrypt/acme-oc10.json" ... ``` + Both container's traefik labels have to match with the correct resolvers and domains -``` + +```yaml ocis: ... labels: @@ -143,7 +144,8 @@ Both container's traefik labels have to match with the correct resolvers and dom - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)" ... ``` -``` + +```yaml oc10: ... labels: @@ -162,7 +164,7 @@ Since ssl shall be terminated from traefik and inside of the docker network the For ocis 2 config files are provided. -``` +```bash │ └───ocis #ocis related config files │ │ identifier-registration.yml @@ -172,7 +174,7 @@ For ocis 2 config files are provided. Changes need to be done in identifier-registration.yml to match the domains Phoenix client needs the redirects uri's set to the ocis domain while oc10 client needs them to point on the owncloud domain -``` +```yaml --- # OpenID Connect client registry. clients: @@ -208,7 +210,7 @@ clients: The second file is proxy-config.json which configures the ocis internal service proxy routes. The policy_selector selector needs to be changed to forward to the related backend. ocis proxy makes the decision in this scenario to which backend the request needs to be forwarded based on the user storage. -``` +```yaml { "HTTP": { "Namespace": "works.owncloud" @@ -233,7 +235,7 @@ The second file is proxy-config.json which configures the ocis internal service Glauth needs to be configured to utilize oc10 as primary user backend. -``` +```yaml GLAUTH_BACKEND_DATASTORE: owncloud GLAUTH_BACKEND_SERVERS: https://${OC10_DOMAIN}/apps/graphapi/v1.0 GLAUTH_BACKEND_BASEDN: dc=example,dc=org @@ -244,7 +246,7 @@ ACCOUNTS_STORAGE_DISK_PATH: /var/tmp/ocis-accounts # Accounts fails to start whe To allow konnectd to glauth, ldap needs to be configured have to be set. -``` +```yaml # Konnectd ldap setup LDAP_URI: ldap://localhost:9125 LDAP_BINDDN: "cn=admin,dc=example,dc=org" @@ -263,7 +265,7 @@ LDAP_FILTER: "(objectClass=posixaccount)" Owncloud 10 needs the graph api extensions to work in this setup. This extension is needed for Glauth to get oc10 users. It's necessary to add a image build step which extends owncloud/server:latest docker image with the app. The app is provided as tarball in the folder oc10/apps -``` +```bash └───oc10 │ │ Dockerfile │ │ @@ -273,7 +275,8 @@ Owncloud 10 needs the graph api extensions to work in this setup. This extension The docker files is pretty simple -``` +```Dockerfile + # Take the latest owncloud/server image as base FROM owncloud/server:latest @@ -283,5 +286,4 @@ ADD apps/graphapi-0.1.0.tar.gz /var/www/owncloud/apps/ The build is triggered by the terminal command `docker-compose build` from the root folder. - -Constraints: In this setup it's mandatory that the user has an email adress set in oc10 \ No newline at end of file +Constraints: In this setup it's mandatory that the user has an email adress set in oc10. diff --git a/docs/ocis/deployment/ocis_traefik.md b/docs/ocis/deployment/ocis_traefik.md index 77fa68139..8a4aabfc4 100644 --- a/docs/ocis/deployment/ocis_traefik.md +++ b/docs/ocis/deployment/ocis_traefik.md @@ -9,11 +9,9 @@ geekdocFilePath: ocis_traefik.md {{< toc >}} - -# ocis traefik deployment scenario - ## Overview -ocis running on a hcloud node behind traefik as reverse proxy + +* ocis running on a hcloud node behind traefik as reverse proxy * Cloudflare DNS is resolving the domain * Letsencrypt provides a ssl certificate for the domain * Traefik docker container terminates ssl and forwards http requests to ocis @@ -21,6 +19,7 @@ ocis running on a hcloud node behind traefik as reverse proxy ## Node ### Requirements + * Server running Ubuntu 20.04 is public availible with a static ip address * Two A-records for both domains are pointing on the servers ip address * Create user @@ -54,38 +53,40 @@ ocis running on a hcloud node behind traefik as reverse proxy ### Setup on server -- Clone ocis repository +* Clone ocis repository `git clone https://github.com/owncloud/ocis.git` -- Copy example folder to /opt +* Copy example folder to /opt `cp deployment/examples/ocis_traefik /opt/` -- Overwrite OCIS_DOMAIN in .env with your.domain.com +* Overwrite OCIS_DOMAIN in .env with your.domain.com `sed -i 's/ocis.domain.com/your.domain.com/g' /opt/ocis_traefik/.env` -- Overwrite redirect uri with your.domain.com in identifier-registration.yml +* Overwrite redirect uri with your.domain.com in identifier-registration.yml `sed -i 's/ocis.domain.com/your.domain.com/g' /opt/ocis_traefik/config/identifier-registration.yml` -- Change into deployment folder +* Change into deployment folder `cd /opt/ocis_traefik` -- Start application stack +* Start application stack `docker-compose up -d` - ### Stack + The application stack contains two containers. The first one is a traefik proxy which is terminating ssl and forwards the requests to the internal docker network. Additional, traefik is creating a certificate that is stored in `acme.json` in the folder `letsencrypt` inside the users home directory. The second one is th ocis server which is exposing the webservice on port 9200 to traefic. ### Config + Edit docker-compose.yml file to fit your domain setup -``` + +```yaml ... traefik: image: "traefik:v2.2" @@ -97,7 +98,7 @@ Edit docker-compose.yml file to fit your domain setup ... ``` -``` +```yaml ocis: container_name: ocis ... @@ -113,7 +114,7 @@ In this example, ssl is terminated from traefik while inside of the docker netwo For ocis to work properly it's neccesary to provide one config file. Change identifier-registration.yml to match your domain. -``` +```yaml --- # OpenID Connect client registry. clients: @@ -136,7 +137,7 @@ clients: To make it availible for ocis inside of the container, `config` hast to be mounted as volume. -``` +```yaml ... volumes: - ./config:/etc/ocis