inital setup

2024-12-08 14:42:09 +01:00 · 2024-12-08 14:42:09 +01:00 · 335c82a982
commit 335c82a982
parent 402c9642db
7 changed files with 2684 additions and 0 deletions
--- a/.docker-compose.http.yml
+++ b/.docker-compose.http.yml
@ -0,0 +1,121 @@
+version: '3.8'
+
+services:
+  traefik-ja:
+    image: "traefik:v2.5"
+    command:
+      #- "--log.level=DEBUG"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+    networks:
+      - external
+    restart: unless-stopped
+    ports:
+      - "80:80"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+
+  websocket-ja:
+    hostname: websocket-ja
+    image: h2invent/jitsi-admin-websocket:latest
+    restart: unless-stopped
+    depends_on:
+      - traefik-ja
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/healthz"]
+      interval: 10s
+      retries: 5
+      timeout: 10s
+      start_period: 10s
+    extra_hosts:
+      - "<clientUrl>:<hostIp>"
+    env_file:
+      - .env.local
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.websocket-ja.rule=Host(`<clientUrl>`) && PathPrefix(`/ws`)"
+      - "traefik.http.routers.websocket-ja.entrypoints=web"
+      - "traefik.http.services.websocket-ja.loadbalancer.server.port=3000"
+    networks:
+      - external
+      - internal
+
+  #Here is the Jitsi-Admin app
+  app-ja:
+    depends_on:
+      db-ja:
+        condition: service_healthy
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "curl", "-s", "-f", "-i", "http://localhost:80/health/check" ]
+      interval: 20s
+      timeout: 10s
+      start_period: 30s
+      retries: 10
+    env_file:
+      - .env.local
+    extra_hosts:
+      - "<clientUrl>:<hostIp>"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app-ja.rule=Host(`<clientUrl>`)"
+      - "traefik.http.routers.app-ja.entrypoints=web"
+      - "traefik.http.services.app-ja.loadbalancer.server.port=8080"
+    volumes:
+      - theme_data:/var/www/html/theme
+      - image_upload:/var/www/html/public/uploads/images
+      - theme_assests_data:/var/www/html/public/theme
+    networks:
+      - external
+      - internal
+
+  db-ja:
+    image: mariadb:latest
+    hostname: db-ja
+    healthcheck:
+      test: [ "CMD", "mariadb-admin" ,"ping", "-h", "localhost","-ptest" ]
+      timeout: 20s
+      retries: 10
+    restart: unless-stopped
+    env_file:
+      - .env.local
+    volumes:
+      - mariadb:/var/lib/mysql
+      - ./mysql-initdb:/docker-entrypoint-initdb.d
+    networks:
+      - internal
+
+  keycloak-ja:
+    image: quay.io/keycloak/keycloak:22.0.3
+    depends_on:
+      app-ja:
+        condition: service_healthy
+    env_file:
+      - .env.local
+    restart: unless-stopped
+    command:
+      - start-dev
+      - --import-realm
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.keycloak-ja.rule=Host(`<clientUrl>`) && PathPrefix(`/keycloak`)"
+      - "traefik.http.routers.keycloak-ja.entrypoints=web"
+      - "traefik.http.services.keycloak-ja.loadbalancer.server.port=8080"
+    volumes:
+      - ./keycloak/:/opt/keycloak/data/import
+    networks:
+      - external
+      - internal
+
+networks:
+  external:
+  internal:
+
+volumes:
+  mariadb:
+  image_upload:
+  theme_data:
+  theme_assests_data:
--- a/.docker-compose.https.yml
+++ b/.docker-compose.https.yml
@ -0,0 +1,236 @@
+version: '3.8'
+
+x-app-common: &jitsi_admin_app
+  image: h2invent/jitsi-admin-main:latest
+#  build: .
+  environment:
+    APACHE_DOCUMENT_ROOT: "public/"
+    PHP_EXTENSION_XDEBUG: "1"
+    PHP_INI_MEMORY_LIMIT: "1G"
+    PHP_EXTENSION_LDAP: 1
+    PHP_EXTENSION_INTL: 1
+
+services:
+  traefik-ja:
+    image: "traefik:v2.5"
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    command:
+      #- "--log.level=DEBUG"
+      - "--api.insecure=false"
+      - "--providers.docker=true"
+      #- "--api.dashboard=true"
+
+      - "--providers.docker.exposedbydefault=false"
+
+      - "--entrypoints.unsecure.address=:80"
+      - "--entrypoints.web.address=:443"
+      # Global HTTP -> HTTPS
+      - "--entrypoints.unsecure.http.redirections.entryPoint.to=web"
+      - "--entrypoints.unsecure.http.redirections.entryPoint.scheme=https"
+      # SSL configuration
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=unsecure"
+      - "--certificatesresolvers.letsencrypt.acme.email=${registerEmailAdress}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
+      - "traefik.http.routers.http-catchall.entrypoints=unsecure"
+      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https@docker"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+      - "traefik.http.routers.traefik-ja.rule=Host(`traefik.${PUBLIC_URL}`)"
+      - "traefik.http.routers.traefik-ja.entrypoints=web"
+      - "traefik.http.routers.traefik-ja.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.traefik-ja.service=api@internal"
+      - "traefik.http.routers.traefik-ja.middlewares=traefik-auth"
+      - "traefik.http.middlewares.traefik-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/" # test:test
+
+    networks:
+      - external
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      -  ./data/letsencrypt:/letsencrypt
+      - ./tools/traefik/config.yml:/etc/traefik/dynamic_conf/conf.yml:ro
+
+  #Here is the websocket hub
+  websocket-ja:
+    hostname: websocket-ja
+    image: h2invent/jitsi-admin-websocket:latest
+#    build: nodejs
+    restart: unless-stopped
+    depends_on:
+      - traefik-ja
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/healthz"]
+      interval: 10s
+      retries: 5
+      timeout: 10s
+      start_period: 10s
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.websocket-ja.rule=Host(`${PUBLIC_URL}`) && PathPrefix(`/ws`)"
+      - "traefik.http.routers.websocket-ja.entrypoints=web"
+      - "traefik.http.routers.websocket-ja.tls=true"
+      - "traefik.http.services.websocket-ja.loadbalancer.server.port=3000"
+      - "traefik.http.routers.websocket-ja.tls.certresolver=letsencrypt"
+      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=http"
+      - "traefik.http.routers.app-secure.middlewares=sslheader@docker"
+    networks:
+      - external
+      - internal
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+
+  #Here is the Jitsi-Admin app
+  app-ja:
+    <<: *jitsi_admin_app
+    depends_on:
+      db-ja:
+        condition: service_healthy
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "curl", "-s", "-f", "-i", "http://localhost:80/health/check" ]
+      interval: 20s
+      timeout: 10s
+      start_period: 30s
+      retries: 10
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    environment:
+      APACHE_DOCUMENT_ROOT: "public/"
+      PHP_EXTENSION_XDEBUG: "1"
+      PHP_INI_MEMORY_LIMIT: "1G"
+      PHP_EXTENSION_LDAP: 1
+      PHP_EXTENSION_INTL: 1
+      PHP_INI_UPLOAD_MAX_FILESIZE: 8M
+      PHP_INI_POST_MAX_SIZE: 8M
+      MAILER_TRANSPORT: smtp
+      OAUTH_KEYCLOAK_CLIENT_ID: jitsiadmin
+      OAUTH_KEYCLOAK_REALM: jitsiadmin
+      input_settings_allow_timezone: 1
+      allowTimeZoneSwitch: 1
+      CRON_USER_1: root
+      CRON_SCHEDULE_1: "* * * * *"
+      CRON_COMMAND_1: "php /var/www/html/bin/console cron:run"
+
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app-ja.tls=true"
+      - "traefik.http.routers.app-ja.rule=Host(`${PUBLIC_URL}`)"
+      - "traefik.http.routers.app-ja.entrypoints=web"
+      - "traefik.http.services.app-ja.loadbalancer.server.port=80"
+      - "traefik.http.routers.app-ja.tls.certresolver=letsencrypt"
+      - "traefik.http.services.app-ja.loadbalancer.sticky=true"
+      - "traefik.http.services.app-ja.loadbalancer.sticky.cookie.name=jad"
+      - "traefik.http.services.app-ja.loadbalancer.sticky.cookie.secure=true"
+    volumes:
+      - theme_data:/var/www/html/theme
+      - image_upload:/var/www/html/public/uploads/images
+      - theme_assests_data:/var/www/html/public/theme
+    networks:
+      - external
+      - internal
+
+  app-queu:
+    <<: *jitsi_admin_app
+
+    restart: unless-stopped
+    deploy:
+      mode: replicated
+      replicas: 2
+
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    depends_on:
+      app-ja:
+        condition: service_healthy
+    command: php /var/www/html/bin/console messenger:consume async --memory-limit=126m
+    volumes:
+      - theme_data:/var/www/html/theme
+    networks:
+      - internal
+
+  db-ja:
+    image: mariadb:latest
+    hostname: db-ja
+    healthcheck:
+      test: [ "CMD", "mariadb-admin" ,"ping", "-h", "localhost","-ptest" ]
+      timeout: 20s
+      retries: 10
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    restart: unless-stopped
+    environment:
+      MARIADB_ROOT_PASSWORD: test
+    volumes:
+      - mariadb:/var/lib/mysql
+      - ./docker/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
+    networks:
+      - internal
+
+  keycloak-ja:
+    image: quay.io/keycloak/keycloak:22.0.3
+    depends_on:
+      app-ja:
+        condition: service_healthy
+    env_file:
+      - ./.env
+      - ./.env.local
+      - ./.env.custom
+    environment:
+      KEYCLOAK_ADMIN: admin
+      KC_DB: mariadb
+      KC_DB_USERNAME: keycloak
+      KC_HTTP_RELATIVE_PATH: /keycloak
+      KC_PROXY: passthrough
+    restart: unless-stopped
+    command:
+      - start-dev
+      - --import-realm
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.keycloak-ja.tls=true"
+      - "traefik.http.routers.keycloak-ja.rule=Host(`${PUBLIC_URL}`) && PathPrefix(`/keycloak`)"
+      - "traefik.http.routers.keycloak-ja.entrypoints=web"
+      - "traefik.http.services.keycloak-ja.loadbalancer.server.port=8080"
+      - "traefik.http.routers.keycloak-ja.tls.certresolver=letsencrypt"
+
+    volumes:
+      - ./docker/keycloak/:/opt/keycloak/data/import
+    networks:
+      - external
+      - internal
+
+networks:
+  external:
+  internal:
+
+volumes:
+  mariadb:
+  caddy_data:
+  caddy_config:
+  image_upload:
+  theme_data:
+  theme_assests_data:
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,12 @@
+# Ignore Local Docker Config
+docker.conf
+.env.local
+
+# Ignore Custom Keycloak Realm
+keycloak/realm-export.json
+
+# Ignore Custom init-userdb
+mysql-initdb/init-userdb.sql
+
+# Ignore Custom docker-compose
+docker-compose.yml
--- a/installDocker.sh
+++ b/installDocker.sh
@ -0,0 +1,23 @@
+#!/bin/bsh
+
+sudo apt-get remove docker docker-engine docker.io containerd runc
+
+sudo apt-get update
+sudo apt upgrade -y
+sudo apt-get install ca-certificates curl gnupg -y
+
+sudo install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+sudo chmod a+r /etc/apt/keyrings/docker.gpg
+
+echo \
+ "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
+ "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
+ sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+sudo apt-get update
+sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin -y
+
+sudo wget https://github.com/docker/compose/releases/download/v2.29.1/docker-compose-linux-x86_64 -O /usr/local/bin/docker-compose
+sudo chmod +x  /usr/local/bin/docker-compose
+docker-compose -v
--- a/keycloak/.realm-export.json
+++ b/keycloak/.realm-export.json
--- a/mysql-initdb/.init-userdb.sql
+++ b/mysql-initdb/.init-userdb.sql
@ -0,0 +1,7 @@
+CREATE USER 'jitsiadmin'@'%' IDENTIFIED BY '<jitsi-admin-pw>';
+CREATE DATABASE jitsiadmin;
+GRANT ALL PRIVILEGES ON jitsiadmin.* TO 'jitsiadmin'@'%';
+CREATE USER 'keycloak'@'%' IDENTIFIED BY '<keycloak-pw>';
+CREATE DATABASE keycloak;
+GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'%';
+FLUSH PRIVILEGES;
--- a/setup.sh
+++ b/setup.sh
@ -0,0 +1,148 @@
+#!/bin/bash
+
+echo "Welcome to the Docker Installer:"
+echo ""
+
+echo ""
+echo "1. The installer will update all Repos"
+apt update 
+
+echo ""
+echo "2. The installer will install CURL and GIT"
+apt install curl git -y
+
+
+
+echo ""
+echo "3. The installer will clone the Docker-Compose Repository"
+HOME_DIR=/opt/jitsi-admin
+if [ -d $HOME_DIR ]
+then
+  cd $HOME_DIR
+  git add . && git stash && git pull
+else
+  mkdir $HOME_DIR && cd $HOME_DIR
+  git clone https://git.h2-invent.com/meetling/docker-compose.git .
+  cd $HOME_DIR
+fi
+
+
+FILE=docker.conf
+if [ -f "$FILE" ]; then
+  source $FILE
+else
+  touch $FILE
+    KEYCLOAK_PW=$(date +%s | sha256sum | base64 | head -c 32)
+    JITSI_ADMIN_PW=$(date +%s | sha256sum | base64 | head -c 32)
+    WEBSOCKET_SECRET=$(date +%s | sha256sum | base64 | head -c 32)
+    KEYCLOAK_ADMIN_PW=$(date +%s | sha256sum | base64 | head -c 32)
+    KEYCLOAK_CLIENT_SECRET=$(date +%s | sha256sum | base64 | head -c 32)
+    echo "KEYCLOAK_PW=$KEYCLOAK_PW" >> $FILE
+    echo "JITSI_ADMIN_PW=$JITSI_ADMIN_PW" >> $FILE
+    echo "WEBSOCKET_SECRET=$WEBSOCKET_SECRET" >> $FILE
+    echo "KEYCLOAK_ADMIN_PW=$KEYCLOAK_ADMIN_PW" >> $FILE
+    echo "KEYCLOAK_CLIENT_SECRET=$KEYCLOAK_CLIENT_SECRET" >> $FILE
+  source $FILE
+fi
+  ENVIRONMENT=${ENVIRONMENT:=prod}
+  read -p "Enter the environment dev/prod[$ENVIRONMENT]: " input
+  ENVIRONMENT=${input:=$ENVIRONMENT}
+  sed -i '/ENVIRONMENT/d' $FILE
+  echo "ENVIRONMENT=$ENVIRONMENT" >> $FILE
+
+  HTTP_METHOD=${HTTP_METHOD:=http}
+  read -p "Enter http/https for testing on local environment ALWAYS use http [$HTTP_METHOD]: " input
+  HTTP_METHOD=${input:=$HTTP_METHOD}
+  sed -i '/HTTP_METHOD/d' $FILE
+  echo "HTTP_METHOD=$HTTP_METHOD" >> $FILE
+
+  PUBLIC_URL=${PUBLIC_URL:=dev.domain.de}
+  read -p "Enter the url you want to enter the jitsi-admin with no protocoll (no http/https) [$PUBLIC_URL]: " input
+  PUBLIC_URL=${input:=$PUBLIC_URL}
+  sed -i '/PUBLIC_URL/d' $FILE
+  echo "PUBLIC_URL=$PUBLIC_URL" >> $FILE
+
+  default_language=${default_language:=en}
+  read -p "Which language you want to set as default allowed values: [de, en, fr, es, vi, zh, ru, ja, pt]: [$default_language] " input
+  default_language=${input:=$default_language}
+  sed -i '/default_language/d' $FILE
+  echo "default_language=$default_language" >> $FILE
+
+HOST_IP=$(ip a | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1' | head -n 1)
+
+echo ------------------------------------------------------------
+echo --- 1. Build the Keycloak ----------------------------------
+echo ------------------------------------------------------------
+echo ""
+cp keycloak/.realm-export.json keycloak/realm-export.json
+sed -i "s|<clientsecret>|$KEYCLOAK_CLIENT_SECRET|g" keycloak/realm-export.json
+sed -i "s|<clientUrl>|$HTTP_METHOD://$PUBLIC_URL|g" keycloak/realm-export.json
+
+
+echo ------------------------------------------------------------
+echo ------ 2. Build Mysql Init DB ------------------------------
+echo ------------------------------------------------------------
+echo ""
+cp mysql-initdb/.init-userdb.sql mysql-initdb/init-userdb.sql
+sed -i "s|<jitsi-admin-pw>|$JITSI_ADMIN_PW|g" mysql-initdb/init-userdb.sql
+sed -i "s|<keycloak-pw>|$KEYCLOAK_PW|g" mysql-initdb/init-userdb.sql
+
+
+echo ------------------------------------------------------------
+echo --------- 3. Build Docker Compose File ---------------------
+echo ------------------------------------------------------------
+echo ""
+
+if [ -f .env.local ]; then
+    rm .env.local
+fi
+
+cat <<EOL > .env.local
+MAILER_DSN='null://null'
+DATABASE_URL='mysql://jitsiadmin:${JITSI_ADMIN_PW}@db-ja:3306/jitsiadmin'
+laF_baseUrl='$HTTP_METHOD://$PUBLIC_URL'
+VICH_BASE='$HTTP_METHOD://$PUBLIC_URL'
+GIT_VERSION=$(git rev-parse --short=5 HEAD)
+PUBLIC_URL='$PUBLIC_URL'
+OAUTH_KEYCLOAK_CLIENT_SECRET=$KEYCLOAK_CLIENT_SECRET
+OAUTH_KEYCLOAK_SERVER='$HTTP_METHOD://$PUBLIC_URL/keycloak'
+OAUTH_KEYCLOAK_CLIENT_ID: jitsiadmin
+OAUTH_KEYCLOAK_REALM: jitsiadmin
+registerEmailAdress=$smtpFrom
+DEFAULT_LANGUAGE=$default_language
+
+MERCURE_URL='http://websocket-ja:3000/.well-known/mercure'
+MERCURE_PUBLIC_URL='$HTTP_METHOD://$PUBLIC_URL'
+WEBSOCKET_SECRET=$WEBSOCKET_SECRET
+
+KEYCLOAK_ADMIN: admin
+KEYCLOAK_ADMIN_PASSWORD=$KEYCLOAK_ADMIN_PW
+KC_DB=mariadb
+KC_DB_USERNAME=keycloak
+KC_DB_PASSWORD=$KEYCLOAK_PW
+KC_DB_URL='jdbc:mariadb://db-ja:3306/keycloak'
+KC_HOSTNAME_URL='$HTTP_METHOD://$PUBLIC_URL/keycloak'
+KC_HOSTNAME_PATH='$HTTP_METHOD://$PUBLIC_URL/keycloak'
+KC_HOSTNAME_ADMIN_URL='$HTTP_METHOD://$PUBLIC_URL/keycloak'
+KC_HTTP_RELATIVE_PATH: /keycloak
+KC_PROXY: passthrough
+EOL
+
+echo ".env.local Datei wurde erfolgreich erstellt."
+
+echo ------------------------------------------------------------
+echo --------- 3. Build Docker Compose File ---------------------
+echo ------------------------------------------------------------
+echo ""
+cp .docker-compose.$HTTP_METHOD.yml docker-compose.yml
+
+sed -i "s|<clientUrl>|$PUBLIC_URL|g" docker-compose.yml
+sed -i "s|<hostIp>|$HOST_IP|g" docker-compose.yml
+
+RED='\033[0;31m'
+NC='\033[0m' # No Color
+printf "Browse to ${RED}%s://%s${NC} and visit your own jitsi-admin\n" $HTTP_METHOD $PUBLIC_URL
+printf "To change any keycloak setting browse to${RED} %s://%s${NC}/keycloak (dev-environment: %s://keycloak.%s) and there the username is: admin and the password: %s\n" $HTTP_METHOD $PUBLIC_URL $HTTP_METHOD $PUBLIC_URL $KEYCLOAK_ADMIN_PW
+printf "Any settings and password can be found in the ${RED}docker.conf${NC} file\n"
+printf "To find your loadbalancer go to ${RED}%s://traefik.%s${NC} and enter the user: test and the password: test\n" $HTTP_METHOD $PUBLIC_URL
+printf "Have fun with your jitsi-admin and give us a star on github. https://github.com/H2-invent/jitsi-admin\n"