#!/bin/sh if [ ! -d "custom" ]; then echo "You need to copy custom.sample to custom folder and adapt it to your needs." && exit 1; fi if [ ! -f "digitaldemocratic.conf" ]; then echo "You need to copy digitaldemocratic.conf.sample to .sample to custom folder and adapt" && exit 1; fi OPERATION="$1" if [ -z "$OPERATION" ]; then set +x echo "Missing command." echo " Example: ./dd.ctl [operation]" echo " Update repository: ./dd-ctl repo-update [branch-name] (defaults to master)" echo " Bring the current project up: ./dd-ctl all" echo " Build the compose files: ./dd-ctl build" echo " Start the project when stopped: ./dd-ctl up" echo " Stop the project when started: ./dd-ctl down" echo " Apply customizations: ./dd-ctl customize" echo " Update SAML certificates: ./dd-ctl saml" echo " Upgrade plugins: ./dd-ctl upgrade-plugins" echo " Branding (custom/img, custom/menu): ./dd-ctl branding" exit 1 fi BRANCH="$2" if [ -z "$BRANCH" ]; then BRANCH="master" fi cp digitaldemocratic.conf .env CUSTOM_PATH=$(pwd) . ./.env update_repo(){ git fetch && git reset --hard origin/$BRANCH git submodule update --init --recursive cd isard-apps && git fetch && git reset --hard origin/$BRANCH && cd .. cd isard-sso && git fetch && git reset --hard origin/$BRANCH && cd .. } build(){ ## Prepare apps environment cp .env isard-apps/.env echo "CUSTOM_PATH=$CUSTOM_PATH" >> isard-apps/.env echo "BUILD_ROOT_PATH=$CUSTOM_PATH/isard-apps" >> isard-apps/.env cp isard-apps/.env isard-apps/docker/postgresql && \ cp isard-apps/.env isard-apps/docker/mariadb && \ cp isard-apps/.env isard-apps/docker/moodle && \ cp isard-apps/.env isard-apps/docker/nextcloud && \ cp isard-apps/.env isard-apps/docker/wordpress && \ cp isard-apps/.env isard-apps/docker/etherpad ## Prepare sso environment cp .env isard-sso/.env echo "CUSTOM_PATH=$CUSTOM_PATH" >> isard-sso/.env echo "BUILD_ROOT_PATH=$CUSTOM_PATH/isard-sso" >> isard-sso/.env cp isard-sso/.env isard-sso/docker-compose-parts/.env mkdir -p custom/system/keycloak cp -R isard-sso/docker/keycloak/themes custom/system/keycloak/ cp custom/login/logo.png custom/system/keycloak/themes/liiibrelite/login/resources/img/logo.png cp custom/login/background.png custom/system/keycloak/themes/liiibrelite/login/resources/img/loginBG.png cp custom/login/background.png custom/system/keycloak/themes/liiibrelite/login/resources/img/loginBG2.png cp custom/login/style.css custom/system/keycloak/themes/liiibrelite/login/resources/css/ # Build compose ymls echo CUSTOM_PATH=$CUSTOM_PATH > .env echo BUILD_ROOT_PATH=$CUSTOM_PATH/isard-sso >> .env docker-compose -f isard-sso/docker-compose-parts/haproxy.yml \ -f isard-sso/docker-compose-parts/api.yml \ -f isard-sso/docker-compose-parts/keycloak.yml \ -f isard-sso/docker-compose-parts/avatars.yml \ -f isard-apps/docker/postgresql/postgresql.yml \ -f isard-sso/docker-compose-parts/admin.yml \ -f isard-sso/docker-compose-parts/backup.yml \ config > sso.yml #-f isard-sso/docker-compose-parts/freeipa.yml echo BUILD_ROOT_PATH=$CUSTOM_PATH/isard-apps > .env docker-compose -f isard-apps/docker/moodle/moodle.yml \ -f isard-apps/docker/nextcloud/nextcloud.yml \ -f isard-apps/docker/wordpress/wordpress.yml \ -f isard-apps/docker/etherpad/etherpad.yml \ -f isard-apps/docker/onlyoffice/onlyoffice.yml \ -f isard-apps/docker/redis/redis.yml \ -f isard-apps/docker/postgresql/postgresql.yml \ -f isard-apps/docker/mariadb/mariadb.yml \ -f isard-apps/docker/network.yml \ config > apps.yml docker-compose -f sso.yml -f apps.yml config > docker-compose.yml rm sso.yml apps.yml docker-compose build } up(){ docker-compose up -d } down(){ docker-compose down } setup_nextcloud(){ echo " --> Applying custom settings in nextcloud" # docker exec -u www-data isard-apps-nextcloud-app sh -c 'export OC_PASS=$DDADMIN_PASSWORD && php occ user:add --password-from-env --display-name="DD Admin" --group="admin" $DDADMIN_USER' # docker exec -u www-data isard-apps-nextcloud-app sh -c 'export OC_PASS=admin && php occ user:delete admin' # docker exec -u www-data isard-apps-nextcloud-app sh -c 'export OC_PASS=LostAdminGroup && php occ user:add --password-from-env --display-name="Admin" --group="admin" admin' #cp -R $BUILD_ROOT_PATH/isard-apps/docker/nextcloud/themes/* $DATA_FOLDER/nextcloud/themes/ docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:system:set default_language --value="ca" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:system:set skeletondirectory --value='' docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:disable firstrunwizard docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:disable recommendations docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:install forms docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:install polls docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:install calendar docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:install spreed docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:system:set theme --value=digitaldemocratic docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:system:set allow_local_remote_servers --value=true docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings maintenance:theme:update docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:disable dashboard'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:install mail'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:enable mail'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:install user_saml'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:enable user_saml'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:install ownpad'" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "/ownpad_cfg.sh" docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ app:enable ownpad'" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:app:set ownpad ownpad_etherpad_enable --value="yes" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:app:set ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings app:install onlyoffice docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:app:set onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:app:set onlyoffice jwt_secret --value="secret" docker exec -u www-data isard-apps-nextcloud-app php occ --no-warnings config:app:set onlyoffice jwt_header --value="Authorization" # Allow nextcloud into other apps iframes # Content-Security-Policy: frame-ancestors 'self' *.$DOMAIN; docker exec -ti isard-apps-nextcloud-app sed -ie "/protected \\\$allowedFrameAncestors = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php # Content-Security-Policy: connect-src 'self' *.$DOMAIN; docker exec -ti isard-apps-nextcloud-app sed -ie "/protected \\\$allowedConnectDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php # Content-Security-Policy: img-src 'self' *.$DOMAIN; docker exec -ti isard-apps-nextcloud-app sed -ie "/protected \\\$allowedImageDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php # Content-Security-Policy: style-src 'self' *.$DOMAIN; docker exec -ti isard-apps-nextcloud-app sed -ie "/protected \\\$allowedStyleDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php # Content-Security-Policy: font-src 'self' *.$DOMAIN; docker exec -ti isard-apps-nextcloud-app sed -ie "/protected \\\$allowedFontDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php # Fix onlyoffice size with custom navbar docker exec isard-apps-nextcloud-app sed -ie 's/\(\s\+min-height: calc(100% - \)50\(px);\)/\175\2/' /var/www/html/custom_apps/onlyoffice/css/editor.css # Fix nextcloud bbb "segudos" typo # https://github.com/sualko/cloud_bbb/pull/181 docker exec isard-apps-nextcloud-app sed -i.orig -e 's/segudos/segundos/' /var/www/html/custom_apps/bbb/l10n/es.json /var/www/html/custom_apps/bbb/l10n/es.js # Fix nextcloud files_external "segudos" typo # https://github.com/nextcloud/server/pull/28990 docker exec isard-apps-nextcloud-app sed -i.orig -e 's/segudos/segundos/' /var/www/html/apps/files_external/l10n/es_*.js } nextcloud_scan(){ # The folders shown as 'not writeable' are empty user folders. Not a problem. docker exec -ti isard-apps-nextcloud-app /bin/sh -c "su - www-data -s /bin/sh -c 'PHP_MEMORY_LIMIT=512M php /var/www/html/occ files:scan --all'" } setup_moodle(){ echo " --> Applying custom settings in moodle" docker exec -ti isard-apps-moodle php7 admin/cli/cfg.php --name=guestloginbutton --set=0 docker exec -ti isard-apps-moodle php7 admin/cli/cfg.php --name=enrol_plugins_enabled --set=manual docker exec -ti isard-apps-moodle php7 admin/cli/cfg.php --name=enablemobilewebservice --set=0 docker exec -ti isard-apps-moodle php7 admin/cli/cfg.php --name=enablebadges --set=0 docker exec -ti isard-apps-moodle php7 admin/cli/purge_caches.php } setup_wordpress(){ echo " --> Applying custom settings in wordpress" ## Multisite docker exec -ti isard-apps-wordpress /bin/sh -c "/multisite.sh" # docker exec -ti isard-apps-wordpress /bin/sh -c "if [ ! -d /var/www/html/wp-content/plugins/saml/onelogin-saml-sso ]; then cp -R /plugins/saml/onelogin-saml-sso /var/www/html/wp-content/plugins/; fi" # docker exec -ti isard-apps-wordpress /bin/sh -c "if [ ! -d /var/www/html/wp-content/mu-plugins ]; then cp -R /plugins/mu-plugins /var/www/html/wp-content/; fi" docker-compose run --user=33 isard-apps-wordpress-cli /bin/bash -c 'wp plugin install onelogin-saml-sso --activate' # docker-compose run isard-apps-wordpress-cli /bin/bash -c 'wp plugin activate onelogin-saml-sso --network' } setup_keycloak(){ # Add dd admin user (NOT USED, done in isard-sso-admin) # docker exec isard-sso-keycloak /opt/jboss/keycloak/bin/add-user-keycloak.sh -u $DDADMIN_USER -p $DDADMIN_PASSWORD # docker restart isard-sso-keycloak sleep 10 } saml_certificates(){ wait_for_moodle echo " --> Setting up SAML for moodle" docker exec -ti isard-sso-admin sh -c "export PYTHONWARNINGS='ignore:Unverified HTTPS request' && cd /admin/ && python3 moodle_saml.py" docker exec -ti isard-apps-moodle php7 admin/cli/purge_caches.php # CERTIFICATES FOR SAML echo " --> Generating certificates for nextcloud and wordpress" docker exec -ti isard-sso-admin /bin/sh -c "/admin/generate_certificates.sh" # SAML PLUGIN NEXTCLOUD echo " --> Setting up SAML for nextcloud" docker exec -ti isard-sso-admin sh -c "export PYTHONWARNINGS='ignore:Unverified HTTPS request' && cd /admin/ && python3 nextcloud_saml.py" # SAML PLUGIN WORDPRESS echo " --> Setting up SAML for wordpress" docker exec -ti isard-sso-admin sh -c "export PYTHONWARNINGS='ignore:Unverified HTTPS request' && cd /admin/ && python3 wordpress_saml.py" # SAML PLUGIN MOODLE # echo "To add SAML to moodle:" # echo "1.-Activate SAML plugin in moodle extensions, regenerate certificate, lock certificate" # echo "2.-Then run: docker exec -ti isard-sso-admin python3 /admin/nextcloud_saml.py" # echo "3.-" } wait_for_moodle(){ echo "Waiting for system to be fully up before customizing... It can take some minutes..." echo " (you can monitorize install with: docker logs isard-apps-moodle --follow" while [ "`docker inspect -f {{.State.Health.Status}} isard-apps-moodle`" != "healthy" ]; do sleep 2; done } upgrade_moodle(){ docker exec -ti isard-apps-moodle php7 admin/cli/maintenance.php --enable docker exec -ti isard-apps-moodle php7 admin/cli/upgrade.php --non-interactive --allow-unstable docker exec -ti isard-apps-moodle php7 admin/cli/maintenance.php --disable } extras_adminer(){ docker-compose -f isard-apps/docker/network.yml \ -f isard-sso/docker-compose-parts/adminer.yml config > adminer.yml echo " --> Generated adminer.yml" echo " Bring it up: docker-compose -f adminer.yml up -d" echo " Connect to: https://admin.$DOMAIN/isard-sso-adminer/" echo " Parameters:" echo " - System: PostgreSQL (or Mysql for wordpress db)" echo " Server: isard-apps-postgresql (or isard-apps-mariadb for wordpress db)" echo " User/Pass/Database from digitaldemocratic.conf" } extras_pgtuner(){ docker-compose -f isard-apps/docker/network.yml \ -f isard-sso/docker-compose-parts/pgtuner.yml config > pgtuner.yml echo " --> Generated pgtuner.yml" } extras_develop(){ echo CUSTOM_PATH=$(CUSTOM_PATH) > .env echo BUILD_ROOT_PATH=$(CUSTOM_PATH)/isard-sso >> .env docker-compose -f docker-compose.yml \ -f isard-sso/docker-compose-parts/api.devel.yml \ -f isard-sso/docker-compose-parts/admin.devel.yml \ config > devel.yml } upgrade_plugins_moodle(){ wait_for_moodle rm -rf /tmp/moodle mkdir -p /tmp/moodle/mod mkdir -p /tmp/moodle/mod/assign/submission mkdir -p /tmp/moodle/auth/saml2 mkdir -p /tmp/moodle/theme/cbe mkdir -p /tmp/moodle/blocks curl --location $MOODLE_PLUGIN_JITSI > jitsi.zip unzip jitsi.zip -d /tmp/moodle/mod/ rm jitsi.zip curl --location $MOODLE_PLUGIN_BBB > bbb.zip unzip bbb.zip -d /tmp/moodle/mod/ rm bbb.zip # curl --location https://github.com/isard-vdi/moodle-auth_saml2/archive/refs/heads/role_map.zip > auth_saml2.zip # curl --location https://moodle.org/plugins/download.php/24556/auth_saml2_moodle311_2021062900.zip > auth_saml2.zip curl --location $MOODLE_PLUGIN_SAML > auth_saml2.zip unzip auth_saml2.zip -d /tmp/moodle/auth/ mv /tmp/moodle/auth/moodle-auth_saml2-role_map/* /tmp/moodle/auth/saml2/ rm -rf /tmp/moodle/auth/moodle-auth_saml2-role_map rm auth_saml2.zip curl --location $MOODLE_PLUGIN_TRESIPUNTSHARE > tresipuntshare.zip unzip tresipuntshare.zip -d /tmp/moodle/mod/ mv /tmp/moodle/mod/moodle_mod_tresipuntshare-master /tmp/moodle/mod/tresipuntshare rm tresipuntshare.zip curl --location $MOODLE_PLUGIN_TRESIPUNTVIDEO > tresipuntvideo.zip unzip tresipuntvideo.zip -d /tmp/moodle/mod/ mv /tmp/moodle/mod/moodle_mod_tresipuntvideo-master /tmp/moodle/mod/tresipuntvideo rm tresipuntvideo.zip curl --location $MOODLE_PLUGIN_TRESIPUNTAUDIO > tresipuntaudio.zip unzip tresipuntaudio.zip -d /tmp/moodle/mod/ mv /tmp/moodle/mod/moodle_mod_tresipuntaudio-master /tmp/moodle/mod/tresipuntaudio rm tresipuntaudio.zip curl --location $MOODLE_PLUGIN_ASSIGNSUBMISSION > assignsubmission_tipnc.zip unzip assignsubmission_tipnc.zip -d /tmp/moodle/mod/assign/submission/ mv /tmp/moodle/mod/assign/submission/moodle_assignsubmission_tipnc-master /tmp/moodle/mod/assign/submission/tipnc rm assignsubmission_tipnc.zip curl --location $MOODLE_PLUGIN_TRESIPUNTMODSPEND > block_tresipuntmodspend.zip unzip block_tresipuntmodspend.zip -d /tmp/moodle/blocks/ rm block_tresipuntmodspend.zip curl --location $MOODLE_THEME_CBE > tresipunt_theme_cbe.zip unzip tresipunt_theme_cbe.zip -d /tmp/moodle/theme/cbe/ mv /tmp/moodle/theme/cbe/moodle_theme_cbe-master/* /tmp/moodle/theme/cbe/ mv /tmp/moodle/theme/cbe/moodle_theme_cbe-develop/* /tmp/moodle/theme/cbe/ rm tresipunt_theme_cbe.zip mkdir -p /tmp/moodle/local/tresipuntimportgc cp -R local_plugins/moodle/tresipuntimportgc/* /tmp/moodle/local/tresipuntimportgc/ cp -R /tmp/moodle/* /opt/digitaldemocratic/src/moodle/ rm -rf /tmp/moodle } upgrade_plugins_wp(){ ## MU-PLUGINS WP docker-compose run --user=root isard-apps-wordpress-cli /bin/bash -c 'curl --location https://gitlab.com/muplugins-multiste1/muplugins-google-sites/-/archive/master/muplugins-google-sites-master.zip > muplugins.zip; \ unzip muplugins.zip; \ rm -rf /var/www/html/wp-content/mu-plugins/*; \ mkdir -p /var/www/html/wp-content/mu-plugins; \ cp -R muplugins-google-sites-master/mu-plugins/* /var/www/html/wp-content/mu-plugins/; \ chown -R 33:33 /var/www/html/wp-content/mu-plugins; \ rm muplugins.zip; \ rm muplugins-google-sites-master -rf;' } update_logos_and_menu(){ cp custom/img/logo.png custom/system/keycloak/themes/liiibrelite/login/resources/img/ cp custom/img/background.png custom/system/keycloak/themes/liiibrelite/login/resources/img/loginBG.png cp custom/img/background.png custom/system/keycloak/themes/liiibrelite/login/resources/img/loginBG2.png # docker exec -ti isard-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheThemes,value=false)'" # docker exec -ti isard-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheTemplates,value=false)'" # docker exec -ti isard-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=staticMaxAge,value=-1)'" docker exec -ti isard-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='reload'" docker-compose build isard-sso-api && docker-compose up -d isard-sso-api } if [ "$OPERATION" = "repo-update" ]; then update_repo fi if [ "$OPERATION" = "build" ]; then build fi if [ "$OPERATION" = "up" ]; then up fi if [ "$OPERATION" = "down" ]; then down fi if [ "$OPERATION" = "customize" ]; then up wait_for_moodle setup_nextcloud setup_wordpress setup_moodle fi if [ "$OPERATION" = "saml" ]; then up wait_for_moodle saml_certificates fi if [ "$OPERATION" = "all" ]; then build up wait_for_moodle upgrade_plugins_moodle upgrade_plugins_wp setup_nextcloud setup_wordpress setup_moodle saml_certificates echo "\n\n" echo " #### After install ####" echo " - SSO in moodle should be active. You can go to: https://moodle.$DOMAIN" echo " If it fails, regenerate and lock certificate in moodle SAML2 connector as a local admin." echo " After that run ./dd-ctl saml" echo " - SSO in nextcloud should be active. You can go to: https://nextcloud.$DOMAIN" echo " - SSO in wordpress should be active. You should go to https://wp.$DOMAIN/wp-admin//plugins.php " echo " and activate 'OneLogin SAML SSO' plugin" echo "\n\n" echo " #### Update customizations ####" echo " - ./dd-ctl customize" fi if [ "$OPERATION" = "branding" ]; then up wait_for_moodle update_logos_and_menu fi if [ "$OPERATION" = "upgrade-plugins" ]; then up wait_for_moodle upgrade_plugins_moodle upgrade_plugins_wp fi if [ "$OPERATION" = "adminer" ]; then extras_adminer fi if [ "$OPERATION" = "pgtuner" ]; then extras_pgtuner fi if [ "$OPERATION" = "reset-1714" ]; then echo "Resetting all but certificates" down rm -rf /opt/digitaldemocratic/backup rm -rf /opt/digitaldemocratic/data rm -rf /opt/digitaldemocratic/db rm -rf /opt/digitaldemocratic/src/avatars rm -rf /opt/digitaldemocratic/src/moodle rm -rf /opt/digitaldemocratic/src/nextcloud rm -rf /opt/digitaldemocratic/src/wordpress fi if [ "$OPERATION" = "nextcloud-scan" ]; then nextcloud_scan fi