Improved one-click deployment with cloud-init

mrabbehassan · Jun 24, 2021 · d6b5da7 · d6b5da7
1 parent ee712ca
commit d6b5da7
Show file tree

Hide file tree

Showing 6 changed files with 29 additions and 19 deletions.
diff --git a/etc/private_key b/etc/private_key
@@ -0,0 +1 @@
+changeit
diff --git a/operator/cloud-config.txt b/operator/cloud-config.txt
@@ -26,15 +26,14 @@ runcmd:
  # ATTENTION!
  # If you have a domain, you can replace the public IP with it. 
  # For example, in our development server we use API_INGRESS_URL=https://api.fonoster.net
- # Also, you should update ingress URL with a secured one
 
  - echo "API_INGRESS_URL=http://$(netdiscover -field publicv4):50051" >> /opt/fonos/operator/.env
- - mkdir -p /opt/fonos/config/certs
- - cp fonos/etc/{config,rbac.json,log4j2.yml,redis.conf,bootstrap.yml} /opt/fonos/config
- - cp fonos/etc/{certs/ca-key.pem} /opt/fonos/config/certs
+ - mkdir -p /opt/fonos/config
+ - touch /opt/fonos/config/config && touch /opt/fonos/config/admin_token
+ - cp fonos/etc/{private_key,rbac.json,log4j2.yml,redis.conf,bootstrap.yml} /opt/fonos/config
  - rm -rf fonos
  - cd /opt/fonos/operator
- - docker-compose -f init.yml up -d
- - docker-compose --env-file .env -f 00_config.yml -f 01_api.yml -f 02_sipnet.yml -f extras/datasource.yml -f extras/fs.yml -f noencypt.yml up -d
+ - docker-compose -f init.yml up service_token admin_token
+ - docker-compose --env-file .env -f 00_config.yml -f 01_api.yml -f 02_sipnet.yml -f extras/datasource.yml -f extras/fs.yml -f noencrypt.yml up -d
 
 final_message: "Cloud init is done!"
diff --git a/operator/compose/02_sipnet.yml b/operator/compose/02_sipnet.yml
@@ -60,7 +60,7 @@ services:
     volumes:
       - data1-1:/home/fonos
       # TODO: Update image to add user fonos
-      - ${CONFIG}/config:/root/.fonos/config
+      - ${CONFIG}/config:/root/.fonos/config:ro
     logging:
       options:
         tag: ${LOG_OPT_TAG_PREFIX}.${COMPOSE_PROJECT_NAME}.mediaserver

diff --git a/operator/compose/api-common.yml b/operator/compose/api-common.yml
@@ -55,7 +55,7 @@ services:
       fonos:
     volumes:
       - ${CONFIG}/config:/home/fonos/.fonos/config
-      - ${CONFIG}/certs/ca-key.pem:/home/fonos/.fonos/jwt.salt
+      - ${CONFIG}/private_key:/home/fonos/.fonos/jwt.salt
     logging:
       options:
         tag: ${LOG_OPT_TAG_PREFIX}.${COMPOSE_PROJECT_NAME}.api

diff --git a/operator/compose/extras/datasource.yml b/operator/compose/extras/datasource.yml
@@ -28,5 +28,5 @@ services:
         aliases: 
           - ${DS_HOST}
     volumes: 
-      - ${CONFIG}/redis.conf:/etc/redis/redis.conf
+      - ${CONFIG}/redis.conf:/etc/redis/redis.conf:ro
       - datasource:/data
diff --git a/operator/compose/init.yml b/operator/compose/init.yml
@@ -37,21 +37,31 @@ services:
       fonos:
 
   service_token:
-    image: fonoster/jwt-helper
+    image: fonoster/jwthelper
     environment:
       ACCESS_KEY_ID: internal
-      PRINT_ACCESS_INFO: "true"
       ROLE: SERVICE
-    networks:
-      fonos:
+      EXPIRATION: 1y
+    volumes:
+      - type: bind
+        source: ${CONFIG}/private_key
+        target: /home/fonos/private_key
+        read_only: true
+      - type: bind
+        source: ${CONFIG}/config
+        target: /home/fonos/config
 
   admin_token:
-    image: fonoster/jwt-helper
+    image: fonoster/jwthelper
     environment:
       ACCESS_KEY_ID: admin
-      PRINT_ACCESS_INFO: "true"
-      ROLE: ADMIN
+      ROLE: USER
+      EXPIRATION: 1y
     volumes:
-      - ${CONFIG}/private.key:/home/fonos/.fonos/jwt.salt
-    networks:
-      fonos:
+      - type: bind
+        source: ${CONFIG}/private_key
+        target: /home/fonos/private_key
+        read_only: true
+      - type: bind
+        source: ${CONFIG}/admin_token
+        target: /home/fonos/config