TAI/TA-Deployment-Broker
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add pvelabs

Browse Source
This commit is contained in:
David Schroeder
2026-08-26 18:01:49 -05:00
parent f519b2cedf
commit 29c7cae404
9 changed files with 211 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manage.sh
+60 -7
View File
@@ -59,6 +59,11 @@ select_compose_stack() {
else
COMPOSE_FILES+=(-f compose.tls.yaml)
fi
if [[ "$EXTERNAL_GUACAMOLE_ENABLED" == "true" ]]; then
[[ "$SSL_MODE" != "none" ]] ||
fail "EXTERNAL_GUACAMOLE_ENABLED requires TLS; run ./manage.sh set-ssl letsencrypt first"
COMPOSE_FILES+=(-f compose.external-guacamole.tls.yaml)
fi
}
compose_stack() {
@@ -86,6 +91,12 @@ require_stack_files() {
require_regular_file compose.tls.yaml
require_regular_file deploy/nginx/templates/tls.conf.template
fi
if [[ "$EXTERNAL_GUACAMOLE_ENABLED" == "true" ]]; then
require_regular_file compose.external-guacamole.bootstrap.yaml
require_regular_file compose.external-guacamole.tls.yaml
require_regular_file deploy/nginx/templates/external-guacamole-bootstrap.conf.template
require_regular_file deploy/nginx/templates/external-guacamole-tls.conf.template
fi
}
broker_config_ready() {
@@ -123,6 +134,38 @@ require_tls_certificate() {
fail "TLS certificate key was not found at ${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_KEY_FILE}; run ./manage.sh bootstrap"
}
valid_hostname() {
[[ "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$ &&
"$1" != *..* ]]
}
valid_http_origin() {
[[ "$1" =~ ^http://[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?(:[0-9]{1,5})?$ ]]
}
bootstrap_stack() {
local -a bootstrap_files=(-f compose.yaml)
if [[ "$EXTERNAL_GUACAMOLE_ENABLED" == "true" ]]; then
bootstrap_files+=(-f compose.external-guacamole.bootstrap.yaml)
fi
docker compose "${bootstrap_files[@]}" "$@"
}
issue_letsencrypt_certificate() {
local -a domain_args=(-d "$BROKER_DOMAIN" -d "$GITEA_DOMAIN")
if [[ "$EXTERNAL_GUACAMOLE_ENABLED" == "true" ]]; then
domain_args+=(-d "$EXTERNAL_GUACAMOLE_DOMAIN")
fi
docker compose --profile tools run --rm certbot certonly \
--webroot --webroot-path /var/www/certbot \
--non-interactive --agree-tos --expand \
--email "$LETSENCRYPT_EMAIL" \
--cert-name "$BROKER_DOMAIN" \
"${domain_args[@]}"
}
require_env() {
[[ -f .env ]] || fail "copy .env.example to .env and configure it first"
BROKER_DOMAIN="$(read_env_setting BROKER_DOMAIN)"
@@ -134,12 +177,26 @@ require_env() {
SSL_CERTIFICATE_DIR="$(read_env_setting SSL_CERTIFICATE_DIR)"
SSL_CERTIFICATE_FILE="$(read_env_setting SSL_CERTIFICATE_FILE)"
SSL_CERTIFICATE_KEY_FILE="$(read_env_setting SSL_CERTIFICATE_KEY_FILE)"
EXTERNAL_GUACAMOLE_ENABLED="$(read_env_setting EXTERNAL_GUACAMOLE_ENABLED)"
EXTERNAL_GUACAMOLE_DOMAIN="$(read_env_setting EXTERNAL_GUACAMOLE_DOMAIN)"
EXTERNAL_GUACAMOLE_UPSTREAM="$(read_env_setting EXTERNAL_GUACAMOLE_UPSTREAM)"
EXTERNAL_GUACAMOLE_ENABLED="${EXTERNAL_GUACAMOLE_ENABLED:-false}"
SSL_CERTIFICATE_FILE="${SSL_CERTIFICATE_FILE:-fullchain.pem}"
SSL_CERTIFICATE_KEY_FILE="${SSL_CERTIFICATE_KEY_FILE:-privkey.pem}"
: "${BROKER_DOMAIN:?BROKER_DOMAIN is required}"
: "${GITEA_DOMAIN:?GITEA_DOMAIN is required}"
[[ "$BROKER_DOMAIN" != "$GITEA_DOMAIN" ]] ||
fail "BROKER_DOMAIN and GITEA_DOMAIN must be different hostnames"
case "$EXTERNAL_GUACAMOLE_ENABLED" in
true)
valid_hostname "$EXTERNAL_GUACAMOLE_DOMAIN" ||
fail "EXTERNAL_GUACAMOLE_DOMAIN must be a valid hostname"
valid_http_origin "$EXTERNAL_GUACAMOLE_UPSTREAM" ||
fail "EXTERNAL_GUACAMOLE_UPSTREAM must be an HTTP origin such as http://10.241.2.219:8080"
;;
false) ;;
*) fail "EXTERNAL_GUACAMOLE_ENABLED must be true or false" ;;
esac
if [[ -z "$GITEA_PUBLIC_URL" ]]; then
if [[ "$SSL_MODE" == "none" ]]; then
http_port="$(read_env_setting HTTP_PORT)"
@@ -186,6 +243,7 @@ require_env() {
;;
esac
export GITEA_PUBLIC_URL SSL_CERTIFICATE_DIR SSL_CERTIFICATE_FILE SSL_CERTIFICATE_KEY_FILE
export EXTERNAL_GUACAMOLE_ENABLED EXTERNAL_GUACAMOLE_DOMAIN EXTERNAL_GUACAMOLE_UPSTREAM
select_compose_stack
require_stack_files
}
@@ -219,13 +277,8 @@ bootstrap)
if [[ "$SSL_MODE" == "none" ]]; then
compose_stack up -d gitea nginx
elif [[ "$SSL_MODE" == "letsencrypt" ]]; then
docker compose up -d gitea nginx
docker compose --profile tools run --rm certbot certonly \
--webroot --webroot-path /var/www/certbot \
--non-interactive --agree-tos \
--email "$LETSENCRYPT_EMAIL" \
--cert-name "$BROKER_DOMAIN" \
-d "$BROKER_DOMAIN" -d "$GITEA_DOMAIN"
bootstrap_stack up -d gitea nginx
issue_letsencrypt_certificate
require_tls_certificate
compose_stack up -d gitea nginx
else