diff --git a/.github/scripts/release-docspace.sh b/.github/scripts/release-docspace.sh new file mode 100755 index 0000000000..1c45340d9c --- /dev/null +++ b/.github/scripts/release-docspace.sh @@ -0,0 +1,89 @@ +#!/usr/bin/env bash + +set -e + +function get_colors() { + COLOR_BLUE=$'\e[34m' + COLOR_GREEN=$'\e[32m' + COLOR_RED=$'\e[31m' + COLOR_RESET=$'\e[0m' + COLOR_YELLOW=$'\e[33m' + export COLOR_BLUE + export COLOR_GREEN + export COLOR_RED + export COLOR_RESET + export COLOR_YELLOW +} + +function release_service() { + + # ex. service_source_tag=onlyoffice/4testing-docspace-service-name:2.5.1.1473 + local service_source_tag=${1} + + echo ${service_source_tag} + + # ex. service_release_tag=onlyoffice/docspace-service-name:2.5.1.1 + # NOTE: latest tag also will be updated + local service_release_tag + service_release_tag=$(echo ${service_source_tag%:*} | sed 's/4testing-//') + + # If specifyed tag look like 2.5.1.1 it will release like 3 different tags: 2.5.1 2.5.1.1 latest + # Make new image manigest and push it to stable images repository + + docker buildx imagetools create --tag ${service_release_tag}:${RELEASE_VERSION%.*} \ + --tag ${service_release_tag}:${RELEASE_VERSION} \ + --tag ${service_release_tag}:latest \ + ${service_source_tag} || local STATUS=$? + + # Make alert + if [[ ! ${STATUS} ]]; then + RELEASED_SERVICES+=("${service_release_tag}") + else + UNRELEASED_SERVICES+=("${service_release_tag}") + fi +} + +function main() { + # Import all colors + get_colors + + # Make released|unreleased array + RELEASED_SERVICES=() + UNRELEASED_SERVICES=() + + # REPO mean hub.docker repo owner ex. onlyoffice + : "${REPO:?Should be set}" + + # DOCKER_TAG mean tag from 4testing ex. 2.6.1.3123 + : "${DOCKER_TAG:?Should be set}" + + # RELEASED_VERSION mean tag for stable repo 2.6.1.1 + : "${RELEASE_VERSION:?Should be set}" + + # DOCKER_IMAGE_PREFIX mean tag prefix ex. 4testing-docspace + : "${DOCKER_IMAGE_PREFIX:?Should be set}" + + cd ${GITHUB_WORKSPACE}/install/docker + + SERVICES=($(docker buildx bake -f build.yml --print | jq -r '.target | .[] | .tags[]')) + echo ${SERVICES[@]} + for service in ${SERVICES[@]}; do + release_service ${service} + done + + # Output Result + echo "Released services" + for service in ${RELEASED_SERVICES[@]}; do + echo "${COLOR_GREEN}${service}${COLOR_RESET}" + done + + # PANIC IF SOME SERVICE WASNT RELEASE + if [[ -n ${UNRELEASED_SERVICES} ]]; then + for service in ${UNRELEASED_SERVICES[@]}; do + echo "${COLOR_RED}PANIC: Service ${service} wasn't relese!${COLOR_RED}" + done + exit 1 + fi +} + +main diff --git a/.github/workflows/ci-oci-docker-install.yml b/.github/workflows/ci-oci-docker-install.yml new file mode 100644 index 0000000000..c3f1a47cb0 --- /dev/null +++ b/.github/workflows/ci-oci-docker-install.yml @@ -0,0 +1,68 @@ +name: Install OneClickInstall Docker + +on: + pull_request: + types: [opened, reopened, synchronize] + paths: + - '.github/workflows/ci-oci-docker-install.yml' + - 'install/OneClickInstall/install-Docker.sh' + workflow_dispatch: + inputs: + script-branch: + description: 'Branch for OCI script docker' + required: true + type: string + default: master + +jobs: + Install-OneClickInstall-Docker: + runs-on: ubuntu-22.04 + steps: + - name: Test OCI docker scripts + run: | + sudo docker image prune --all --force + + BRANCH_NAME=$( + case "${{ github.event_name }}" in + pull_request) echo "${{ github.event.pull_request.head.ref }}";; + workflow_dispatch) echo "${{ github.event.inputs.script-branch }}";; + push) echo "${GITHUB_REF#refs/heads/}";; + esac + ) + + wget https://download.onlyoffice.com/docspace/docspace-install.sh + sed '/bash install-Docker.sh/i sed -i "1i set -x" install-Docker.sh' -i docspace-install.sh + sudo bash docspace-install.sh docker -skiphc true -noni true $([ $BRANCH_NAME != "master" ] && echo "-gb $BRANCH_NAME -s 4testing-") || exit $? + + echo -n "Waiting for all containers to start..." + timeout 300 bash -c 'while docker ps | grep -q "starting"; do sleep 5; done' && echo "OK" || echo "container_status=timeout" >> $GITHUB_ENV + + - name: Check container status + run: | + docker ps --all --format "{{.Names}}" | xargs -I {} sh -c ' + status=$(docker inspect --format="{{if .State.Health}}{{.State.Health.Status}}{{else}}no healthcheck{{end}}" {}); + case "$status" in + healthy) color="\033[0;32m" ;; # green + "no healthcheck") color="\033[0;33m" ;; # yellow + *) color="\033[0;31m"; echo "container_status=red" >> $GITHUB_ENV ;; # red + esac; + printf "%-30s ${color}%s\033[0m\n" "{}:" "$status"; + ' + + - name: Print logs for crashed container + run: | + docker ps --all --format "{{.Names}}" | xargs -I {} sh -c ' + status=$(docker inspect --format="{{if .State.Health}}{{.State.Health.Status}}{{else}}no healthcheck{{end}}" {}); + case "$status" in + healthy | "no healthcheck") ;; + *) + echo "Logs for container {}:"; + docker logs --tail 30 {} | sed "s/^/\t/g"; + ;; + esac; + ' + case "${{ env.container_status }}" in + timeout) echo "Timeout reached. Not all containers are running."; exit 1 ;; + red) echo "One or more containers have status 'red'. Job will fail."; exit 1 ;; + esac + diff --git a/.github/workflows/ci-oci-install.yml b/.github/workflows/ci-oci-install.yml index bc536fab03..fa6708b84b 100644 --- a/.github/workflows/ci-oci-install.yml +++ b/.github/workflows/ci-oci-install.yml @@ -4,9 +4,11 @@ on: pull_request: types: [opened, reopened, synchronize] paths: - - 'install/OneClickInstall/**' - - '!install/OneClickInstall/install-Docker.sh' - - '!install/OneClickInstall/docspace-install.sh' + - '.github/workflows/ci-oci-install.yml' + - 'install/OneClickInstall/install-Debian/**' + - 'install/OneClickInstall/install-RedHat/**' + - 'install/OneClickInstall/install-Debian.sh' + - 'install/OneClickInstall/install-RedHat.sh' schedule: - cron: '00 20 * * 6' # At 23:00 on Saturday. @@ -37,6 +39,18 @@ on: type: boolean description: 'Ubuntu 22.04' default: true + ubuntu2404: + type: boolean + description: 'Ubuntu 24.04' + default: true + fedora39: + type: boolean + description: 'Fedora 39' + default: true + fedora40: + type: boolean + description: 'Fedora 40' + default: true jobs: prepare: @@ -44,6 +58,19 @@ jobs: outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} steps: + - name: Checkout code + if: github.event_name == 'pull_request' + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Determine affected distributions + id: determine-distros + if: github.event_name == 'pull_request' + run: | + CHANGED_FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }}) + echo "debian_changed=$(echo "$CHANGED_FILES" | grep -q 'install-Debian' && echo true || echo false)" >> $GITHUB_ENV + echo "redhat_changed=$(echo "$CHANGED_FILES" | grep -q 'install-RedHat' && echo true || echo false)" >> $GITHUB_ENV - name: Set matrix names id: set-matrix @@ -55,9 +82,21 @@ jobs: {"execute": '${{ github.event.inputs.debian11 || true }}', "name": "Debian11", "os": "debian11", "distr": "generic"}, {"execute": '${{ github.event.inputs.debian12 || true }}', "name": "Debian12", "os": "debian12", "distr": "generic"}, {"execute": '${{ github.event.inputs.ubuntu2004 || true }}', "name": "Ubuntu20.04", "os": "ubuntu2004", "distr": "generic"}, - {"execute": '${{ github.event.inputs.ubuntu2204 || true }}', "name": "Ubuntu22.04", "os": "ubuntu2204", "distr": "generic"} + {"execute": '${{ github.event.inputs.ubuntu2204 || true }}', "name": "Ubuntu22.04", "os": "ubuntu2204", "distr": "generic"}, + {"execute": '${{ github.event.inputs.ubuntu2404 || true }}', "name": "Ubuntu24.04", "os": "ubuntu-24.04", "distr": "bento"}, + {"execute": '${{ github.event.inputs.fedora39 || true }}', "name": "Fedora39", "os": "39-cloud-base", "distr": "fedora"}, + {"execute": '${{ github.event.inputs.fedora40 || true }}', "name": "Fedora40", "os": "fedora-40", "distr": "bento"} ] - }' | jq -c '{include: [.include[] | select(.execute == true)]}') + }' | jq -c '.include') + + matrix=$(jq -c --arg REDHAT_CHANGED "${{ env.redhat_changed }}" --arg DEBIAN_CHANGED "${{ env.debian_changed }}" ' + { include: [.[] | select( + ($REDHAT_CHANGED == "true" and $DEBIAN_CHANGED == "true" and .execute == true) or + ($REDHAT_CHANGED == "true" and (.name | test("CentOS|Fedora"))) or + ($DEBIAN_CHANGED == "true" and (.name | test("Debian|Ubuntu"))) or + ($REDHAT_CHANGED == "false" and $DEBIAN_CHANGED == "false" and .execute == true))] + }' <<< "$matrix") + echo "matrix=${matrix}" >> $GITHUB_OUTPUT vagrant-up: @@ -104,7 +143,7 @@ jobs: DOWNLOAD_SCRIPT='-ds true' \ RAM='5100' \ CPU='3' \ - ARGUMENTS="-arg '--skiphardwarecheck true --makeswap false'" \ + ARGUMENTS="-arg '--skiphardwarecheck true'" \ vagrant up on_retry_command: | echo "RUN CLEAN UP: Destroy vagrant and one more try" @@ -129,7 +168,7 @@ jobs: CPU='3' \ DOWNLOAD_SCRIPT='-ds false' \ TEST_REPO='-tr true' \ - ARGUMENTS="-arg '--skiphardwarecheck true --makeswap false --localscripts true'" \ + ARGUMENTS="-arg '--skiphardwarecheck true --localscripts true'" \ vagrant up on_retry_command: | echo "RUN CLEAN UP: Destroy vagrant and one more try" diff --git a/.github/workflows/oci-release.yml b/.github/workflows/oci-release.yml new file mode 100644 index 0000000000..a9afa977fd --- /dev/null +++ b/.github/workflows/oci-release.yml @@ -0,0 +1,75 @@ +name: Upload OneСlickInstall scripts on S3 + +on: + push: + branches: + - master + paths: + - 'install/docker/*.yml' + - 'install/docker/*.env' + - 'install/docker/config/**' + - 'install/OneClickInstall/**' + workflow_dispatch: + +env: + PRODUCT: docspace + +jobs: + release: + name: Scripts release + runs-on: ubuntu-latest + env: + DOCKER_DIR: "${{ github.workspace }}/install/docker" + SCRIPT_DIR: "${{ github.workspace }}/install/OneClickInstall" + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Creating an enterprise script + run: | + cp ${{ env.SCRIPT_DIR }}/${{ env.PRODUCT }}-install.sh ${{ env.SCRIPT_DIR }}/${{ env.PRODUCT }}-enterprise-install.sh + sed -i 's/\(PARAMETERS -it\).*";/\1 ENTERPRISE";/' ${{ env.SCRIPT_DIR }}/${{ env.PRODUCT }}-enterprise-install.sh + + - name: Create Docker Tarball + run: | + cd ${{ env.DOCKER_DIR }} + tar -czvf ${{ env.SCRIPT_DIR }}/docker.tar.gz --exclude='config/supervisor*' *.yml .env config/ + + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_OCI }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_OCI }} + aws-region: us-east-1 + + - name: Upload scripts + run: | + cd ${{ env.SCRIPT_DIR }} + aws s3 cp . ${{ secrets.AWS_BUCKET_URL_OCI }}/ \ + --recursive \ + --acl public-read \ + --content-type application/x-sh \ + --metadata-directive REPLACE \ + --exclude '*' \ + --include="${{ env.PRODUCT }}-install.sh" \ + --include="${{ env.PRODUCT }}-enterprise-install.sh" \ + --include="install-RedHat.sh" \ + --include="install-RedHat/*" \ + --include="install-Debian.sh" \ + --include="install-Debian/*" \ + --include="install-Docker.sh" \ + --include="docker.tar.gz" + + - name: Invalidate AWS CloudFront cache + run: | + aws cloudfront create-invalidation \ + --distribution-id ${{ secrets.AWS_DISTRIBUTION_ID_OCI }} \ + --paths \ + "/${{ env.PRODUCT }}/${{ env.PRODUCT }}-install.sh" \ + "/${{ env.PRODUCT }}/${{ env.PRODUCT }}-enterprise-install.sh" \ + "/${{ env.PRODUCT }}/install-RedHat.sh" \ + "/${{ env.PRODUCT }}/install-RedHat/*" \ + "/${{ env.PRODUCT }}/install-Debian.sh" \ + "/${{ env.PRODUCT }}/install-Debian/*" \ + "/${{ env.PRODUCT }}/install-Docker.sh" \ + "/${{ env.PRODUCT }}/docker.tar.gz" diff --git a/.github/workflows/release-docspace.yaml b/.github/workflows/release-docspace.yaml new file mode 100644 index 0000000000..e4652beed4 --- /dev/null +++ b/.github/workflows/release-docspace.yaml @@ -0,0 +1,31 @@ +name: Release DocSpace + +run-name: "Release Docker-DocSpace ${{ github.event.inputs.release_version }}" + +on: + workflow_dispatch: + inputs: + repo: + description: 'hub.docker repo owner (ex. onlyoffice)' + type: string + required: true + default: 'onlyoffice' + release_version: + type: string + description: 'Tag for stable release (ex. 2.5.1.1)' + required: true + source_version: + type: string + description: '4testing tag from which the release will be created (ex. 2.5.1.2678)' + required: true + +jobs: + docker-release: + uses: ONLYOFFICE/DocSpace-buildtools/.github/workflows/reusable-docspace-release.yaml@master + with: + repo: ${{ github.event.inputs.repo }} + release_version: ${{ github.event.inputs.release_version }} + source_version: ${{ github.event.inputs.source_version }} + secrets: + docker-username: ${{ secrets.DOCKERHUB_USERNAME }} + docker-usertoken: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/reusable-docspace-release.yaml b/.github/workflows/reusable-docspace-release.yaml new file mode 100644 index 0000000000..643491cef3 --- /dev/null +++ b/.github/workflows/reusable-docspace-release.yaml @@ -0,0 +1,49 @@ +name: " release Docker-DocSpace" + +on: + workflow_call: + inputs: + repo: + type: string + required: true + description: 'hub.docker repo owner (ex. onlyoffice)' + release_version: + type: string + required: true + description: 'Tag for stable release (ex. 1.0.0.1)' + source_version: + type: string + required: true + description: '4testing tag from which the release will be created (ex. 2.5.1.5678)' + secrets: + docker-username: + required: true + description: "hub.docker username" + docker-usertoken: + description: "hub.docker token" + required: true + +jobs: + Release: + name: "Release Docker-DocSpace" + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + repository: 'ONLYOFFICE/DocSpace-buildtools' + + - name: Login to DockerHub + uses: docker/login-action@v3 + with: + username: ${{ secrets.docker-username }} + password: ${{ secrets.docker-usertoken }} + + - name: "Release Docker-DocSpace" + shell: bash + env: + REPO: ${{ inputs.repo }} + DOCKER_TAG: ${{ inputs.source_version }} + RELEASE_VERSION: ${{ inputs.release_version }} + DOCKER_IMAGE_PREFIX: "4testing-docspace" + run: | + ${GITHUB_WORKSPACE}/.github/scripts/release-docspace.sh diff --git a/build.backend.docker.py b/build.backend.docker.py index 452024ad57..bbdfe38b9d 100755 --- a/build.backend.docker.py +++ b/build.backend.docker.py @@ -11,13 +11,14 @@ def help(): # Display Help print("Build and run backend and working environment. (Use 'yarn start' to run client -> https://github.com/ONLYOFFICE/DocSpace-client)") print() - print("Syntax: available params [-h|f|s|c|d|]") + print("Syntax: available params [-h|f|s|c|d|i") print("options:") print("h Print this Help.") print("f Force rebuild base images.") print("s Run as SAAS otherwise as STANDALONE.") print("c Run as COMMUNITY otherwise ENTERPRISE.") print("d Run dnsmasq.") + print("i Run identity (oauth2).") print() @@ -37,6 +38,8 @@ if local_ip == "127.0.0.1": doceditor = f"{local_ip}:5013" login = f"{local_ip}:5011" client = f"{local_ip}:5001" +identity_auth = f"{local_ip}:8080" +identity_api = f"{local_ip}:9090" management = f"{local_ip}:5015" portal_url = f"http://{local_ip}" @@ -44,13 +47,14 @@ force = False dns = False standalone = True community = False +identity = False migration_type = "STANDALONE" # SAAS installation_type = "ENTERPRISE" document_server_image_name = "onlyoffice/documentserver-de:latest" # Get the options -opts, args = getopt.getopt(sys.argv[1:], "hfscd") +opts, args = getopt.getopt(sys.argv[1:], "hfscdi") for opt, arg in opts: if opt == "-h": help() @@ -63,6 +67,8 @@ for opt, arg in opts: community = arg if arg else True elif opt == "-d": dns = arg if arg else True + elif opt == "-i": + identity = arg if arg else True else: print("Error: Invalid '-" + opt + "' option") sys.exit() @@ -80,6 +86,7 @@ print(f"DOCSPACE_APP_URL: {portal_url}") print() print("FORCE REBUILD BASE IMAGES:", force) print("Run dnsmasq:", dns) +print("Run identity:", identity) if standalone == False: migration_type = "SAAS" @@ -182,13 +189,20 @@ os.environ["SERVICE_DOCEDITOR"] = doceditor os.environ["SERVICE_LOGIN"] = login os.environ["SERVICE_MANAGEMENT"] = management os.environ["SERVICE_CLIENT"] = client +os.environ["SERVICE_IDENTITY"] = identity_auth +os.environ["SERVICE_IDENTITY_API"] = identity_api os.environ["ROOT_DIR"] = dir os.environ["BUILD_PATH"] = "/var/www" os.environ["SRC_PATH"] = os.path.join(dir, "publish/services") os.environ["DATA_DIR"] = os.path.join(dir, "data") os.environ["APP_URL_PORTAL"] = portal_url os.environ["MIGRATION_TYPE"] = migration_type -subprocess.run(["docker-compose", "-f", os.path.join(dockerDir, "docspace.profiles.yml"), "-f", os.path.join(dockerDir, "docspace.overcome.yml"), "--profile", "migration-runner", "--profile", "backend-local", "up", "-d"]) +subprocess.run(["docker", "compose", "-f", os.path.join(dockerDir, "docspace.profiles.yml"), "-f", os.path.join( + dockerDir, "docspace.overcome.yml"), "--profile", "migration-runner", "--profile", "backend-local", "up", "-d"]) + +if identity: + print("Run identity") + subprocess.run(["docker-compose", "-f",os.path.join(dockerDir, "identity.yml"), "up", "-d" ]) print() print("Run script directory:", dir) diff --git a/build.backend.dotnet.bat b/build.backend.dotnet.bat new file mode 100644 index 0000000000..e2c64af037 --- /dev/null +++ b/build.backend.dotnet.bat @@ -0,0 +1,26 @@ +@echo off + +echo Start build backend... +echo. + +cd /D "%~dp0" +call runasadmin.bat "%~dpnx0" + +if %errorlevel% == 0 ( +call start\stop.bat nopause +dotnet build ..\server\asc.web.slnf /fl1 /flp1:logfile=asc.web.log;verbosity=normal +echo. +) + +if %errorlevel% == 0 ( +call start\start.bat nopause +) + +echo. + +if "%1"=="nopause" goto end +pause + + + +:end \ No newline at end of file diff --git a/clear.backend.docker.py b/clear.backend.docker.py index 8daff0a126..ce126bdf94 100755 --- a/clear.backend.docker.py +++ b/clear.backend.docker.py @@ -31,6 +31,10 @@ if containers or images: db_command = f"docker compose -f {os.path.join(docker_dir, 'db.yml')} down --volumes" subprocess.run(db_command, shell=True) + print("Remove docker contatiners 'Identity'") + identity_command = f"docker compose -f {os.path.join(docker_dir, 'identity.yml')} down --volumes" + subprocess.run(identity_command, shell=True) + print("Remove docker volumes") volumes_command = f"docker volume prune -fa" subprocess.run(volumes_command, shell=True) diff --git a/config/apisystem.json b/config/apisystem.json index a3174134c0..b87e02f32a 100644 --- a/config/apisystem.json +++ b/config/apisystem.json @@ -30,6 +30,9 @@ "ios": "" } }, + "hcaptcha" : { + "private-key" : "" + }, "auth" : { "allowskip" : { "default" : false, diff --git a/config/appsettings.json b/config/appsettings.json index ca10545471..30ce2debda 100644 --- a/config/appsettings.json +++ b/config/appsettings.json @@ -38,7 +38,10 @@ }, "themelimit": "9", "oidc": { - "authority": "" + "authority": "", + "disableValidateToken": "true", + "requireHttps": "false", + "showPII": "true" }, "server-root": "", "username": { @@ -71,7 +74,7 @@ "files": { "thirdparty": { "enable": ["box", "dropboxv2", "docusign", "google", "onedrive", "nextcloud", "owncloud", "webdav", "kdrive" ] }, "docservice": { - "coauthor-docs": [ ".csv", ".docm", ".docx", ".docxf", ".dotm", ".dotx", ".oform", ".potm", ".potx", ".ppsm", ".pptm", ".ppsx", ".pptx", ".txt", ".xlsm", ".xlsx", ".xltm", ".xltx" ], + "coauthor-docs": [ ".csv", ".docm", ".docx", ".docxf", ".dotm", ".dotx", ".oform", ".pdf", ".potm", ".potx", ".ppsm", ".pptm", ".ppsx", ".pptx", ".txt", ".xlsm", ".xlsx", ".xltm", ".xltx" ], "commented-docs": [ ".docm", ".docx", ".docxf", ".dotm", ".dotx", ".potm", ".potx", ".ppsm", ".pptm", ".ppsx", ".pptx", ".xlsm", ".xlsx", ".xltm", ".xltx" ], "convert-docs": [ ".doc", ".dot", ".dps", ".dpt", ".epub", ".et", ".ett", ".fb2", ".fodp", ".fods", ".fodt", ".htm", ".html", ".mht", ".mhtml", ".odp", ".ods", ".odt", ".otp", ".ots", ".ott", ".pot", ".pps", ".ppt", ".rtf", ".stw", ".sxc", ".sxi", ".sxw", ".wps", ".wpt", ".xls", ".xlsb", ".xlt", ".xml" ], "edited-docs": [ ".csv", ".doc", ".docm", ".docx", ".docxf", ".dot", ".dotm", ".dotx", ".dps", ".dpt", ".epub", ".et", ".ett", ".fb2", ".fodp", ".fods", ".fodt", ".htm", ".html", ".mht", ".mhtml", ".odp", ".ods", ".odt", ".oform", ".otp", ".ots", ".ott", ".pdf", ".pot", ".potm", ".potx", ".pps", ".ppsm", ".ppsx", ".ppt", ".pptm", ".pptx", ".rtf", ".stw", ".sxc", ".sxi", ".sxw", ".txt", ".wps", ".wpt", ".xls", ".xlsb", ".xlsm", ".xlsx", ".xlt", ".xltm", ".xltx", ".xml" ], @@ -104,13 +107,14 @@ "oform": { "domain": "https://cmsoforms.teamlab.info", "path": "/api/oforms/", - "ext": ".oform", + "ext": ".pdf", "upload": { "domain": "https://oforms.teamlab.info", "path": "/api/upload", - "ext": ".docxf", + "ext": ".pdf", "dashboard": "/dashboard/api" - } + }, + "signature": "ONLYOFFICEFORM" } }, "web": { @@ -122,12 +126,15 @@ "api-system": "", "api-cache": "", "images": "static/images", - "hide-settings": "Monitoring,LdapSettings,DocService,MailService,PublicPortal,ProxyHttpContent,SpamSubscription,FullTextSearch", + "hide-settings": "Monitoring,LdapSettings,DocService,MailService,PublicPortal,ProxyHttpContent,SpamSubscription,FullTextSearch,IdentityServer", "hub": { "url": "/socket.io", "internal": "http://localhost:9899/" }, - "cultures": "az,bg,cs,de,el-GR,en-GB,en-US,es,fi,fr,hy-AM,it,lv,nl,pl,pt,pt-BR,ro,ru,sk,sl,sr-Latn-RS,vi,tr,uk-UA,ar-SA,lo-LA,ja-JP,zh-CN,ko-KR", + "cultures": "az,cs,de,en-GB,en-US,es,fr,it,lv,nl,pl,pt-BR,pt,ro,sk,sl,fi,vi,tr,el-GR,bg,ru,sr-Cyrl-RS,sr-Latn-RS,uk-UA,hy-AM,ar-SA,si,lo-LA,zh-CN,ja-JP,ko-KR", + "logo": { + "custom-cultures": ["zh-CN"] + }, "controlpanel": { "url": "" }, @@ -156,6 +163,10 @@ "recaptcha": { "public-key": "", "private-key": "" + }, + "hcaptcha" : { + "public-key": "", + "private-key": "" } }, "ConnectionStrings": { @@ -219,16 +230,8 @@ "thumbnail": { "maxDegreeOfParallelism": 1, "sizes": [ - { "height": 156, "width": 216 }, - { "height": 156, "width": 240 }, - { "height": 156, "width": 264 }, - { "height": 156, "width": 288 }, - { "height": 156, "width": 312 }, - { "height": 156, "width": 336 }, - { "height": 156, "width": 360 }, - { "height": 156, "width": 400 }, - { "height": 156, "width": 440 }, - { "height": 720, "width": 1280, "resizeMode": "Max" } + { "height": 720, "width": 1280, "resizeMode": "Manual" }, + { "height": 2160, "width": 3840, "resizeMode": "Manual" } ] }, "csp": { @@ -257,6 +260,12 @@ "oform": { "img": ["static-oforms.teamlab.info"], "connect": ["cmsoforms.teamlab.info", "oforms.teamlab.info"] + }, + "captcha": { + "script": ["*.google.com", "*.gstatic.com", "hcaptcha.com", "*.hcaptcha.com"], + "style": ["hcaptcha.com", "*.hcaptcha.com"], + "frame": ["*.google.com", "hcaptcha.com", "*.hcaptcha.com"], + "connect": ["hcaptcha.com", "*.hcaptcha.com"] } }, "logocolors": [ @@ -324,5 +333,9 @@ "asc.files": "/openapi/asc.files/common.yaml", "asc.data.backup": "/openapi/asc.data.backup/common.yaml" } + }, + "urlShortener":{ + "length": 15, + "alphabet": "5XzpDt6wZRdsTrJkSY_cgPyxN4j-fnb9WKBF8vh3GH72QqmLVCM" } } diff --git a/config/dnsmasq.conf b/config/dnsmasq.conf index 4f8b518bd0..9ac086211b 100644 --- a/config/dnsmasq.conf +++ b/config/dnsmasq.conf @@ -9,6 +9,6 @@ server=8.8.4.4 server=8.8.8.8 strict-order #serve all .company queries using a specific nameserver -server=/site/127.0.0.1 +server=/site/192.168.0.18 #explicitly define host-ip mappings -address=/docspace.site/127.0.0.1 \ No newline at end of file +address=/docspace.site/192.168.0.18 \ No newline at end of file diff --git a/config/nginx/includes/server-dashboards.conf b/config/nginx/includes/server-dashboards.conf new file mode 100644 index 0000000000..f338271b03 --- /dev/null +++ b/config/nginx/includes/server-dashboards.conf @@ -0,0 +1,12 @@ +location ^~ /dashboards/ { + auth_basic "Restricted Access"; + auth_basic_user_file /etc/nginx/.htpasswd_dashboards; + + rewrite ^/dashboards(/.*)$ $1 break; + proxy_pass http://127.0.0.1:5601; + proxy_redirect off; + proxy_buffering off; + + proxy_set_header Connection "Keep-Alive"; + proxy_set_header Proxy-Connection "Keep-Alive"; +} diff --git a/config/nginx/onlyoffice.conf b/config/nginx/onlyoffice.conf index 5431e23098..642dc404b3 100644 --- a/config/nginx/onlyoffice.conf +++ b/config/nginx/onlyoffice.conf @@ -46,7 +46,7 @@ map $request_uri $cache_control { default "no-cache, no-store, no-transform"; ~*\/(filehandler\.ashx\?action=(thumb|preview))|\/(storage\/room_logos\/root\/.*\?hash.*|storage\/userPhotos\/root\/.*\?hash.*|storage\/whitelabel\/root\/.*\?hash.*|storage\/static_partnerdata\/root\/.*\?hash.*) "must-revalidate, no-transform, immutable, max-age=31536000"; ~*\/(api\/2\.0.*|storage|login\.ashx|filehandler\.ashx|ChunkedUploader.ashx|ThirdPartyAppHandler|apisystem|sh|remoteEntry\.js|debuginfo\.md|static\/scripts\/api\.js|static\/scripts\/sdk\/.*|static\/scripts\/api\.poly\.js) "no-cache, no-store, no-transform"; - ~*\/(static\/images\/.*)|\.(js|woff|woff2|css)|(locales.*\.json) "must-revalidate, no-transform, immutable, max-age=31536000"; + ~*\/(static\/images\/.*)|\/(_next\/public\/images\/.*)|\.(js|woff|woff2|css)|(locales.*\.json) "must-revalidate, no-transform, immutable, max-age=31536000"; } map $request_uri $content_security_policy { @@ -54,6 +54,13 @@ map $request_uri $content_security_policy { ~*\/(ds-vpath)\/ "default-src *; script-src * 'unsafe-inline' 'unsafe-eval'; script-src-elem * 'unsafe-inline'; img-src * data:; style-src * 'unsafe-inline' data:; font-src * data:; frame-src * ascdesktop:; object-src; connect-src * ascdesktop:;"; } +map $request_time $request_time_ms { + ~^0\.000$ 0; + ~^0\.(?:0*)([^0].*)$ $1; + ~^([^0][^.]*)\.(.*)$ $1$2; +} + + include /etc/nginx/includes/onlyoffice-*.conf; server_names_hash_bucket_size 128; @@ -102,7 +109,8 @@ server { set $csp ""; access_by_lua ' local accept_header = ngx.req.get_headers()["Accept"] - if ngx.req.get_method() == "GET" and accept_header ~= nil and string.find(accept_header, "html") and not ngx.re.match(ngx.var.request_uri, "ds-vpath") then + if ngx.req.get_method() == "GET" and accept_header ~= nil and string.find(accept_header, "html") and not ngx.re.match(ngx.var.request_uri, "ds-vpath|/api/") then + local key = string.format("csp:%s",ngx.var.host) local redis = require "resty.redis" local red = redis:new() @@ -157,18 +165,7 @@ server { } - location ^~ /dashboards/ { - auth_basic "Restricted Access"; - auth_basic_user_file /etc/nginx/.htpasswd_dashboards; - - rewrite ^/dashboards(/.*)$ $1 break; - proxy_pass http://127.0.0.1:5601; - proxy_redirect off; - proxy_buffering off; - - proxy_set_header Connection "Keep-Alive"; - proxy_set_header Proxy-Connection "Keep-Alive"; - } + include /etc/nginx/includes/server-*.conf; location / { proxy_pass http://127.0.0.1:5001; @@ -229,17 +226,9 @@ server { proxy_pass http://127.0.0.1:5011; proxy_redirect off; - location ~* /static/favicon.ico { - try_files /$basename /index.html =404; - } - - location ~* /static/images/(.*)$ { + location ~* /_next/public/images/(.*)$ { try_files /images/$1 /index.html =404; } - - location ~* /static/css/ { - try_files /css/$basename /index.html =404; - } } location /management { @@ -285,6 +274,9 @@ server { } location /api/2.0 { + add_header Trailer Server-Timing; + add_header Server-Timing "proxy-request-time;dur=${request_time_ms}"; + location ~* /(files|privacyroom) { proxy_pass http://127.0.0.1:5007; } @@ -320,7 +312,26 @@ server { location ~* /migration { proxy_pass http://127.0.0.1:5034; } + + location ~* /(clients|scopes) { + proxy_pass http://127.0.0.1:9090; + } + + location ~* /oauth2 { + rewrite api/2.0/(.*) /$1 break; + proxy_redirect off; + proxy_pass http://127.0.0.1:8080; + } } + + location /oauth2/.well-known/openid-configuration { + rewrite oauth2/(.*) /$1 break; + proxy_pass http://127.0.0.1:8080; + } + + location /oauth2 { + proxy_pass http://127.0.0.1:8080; + } location /sso { rewrite sso/(.*) /$1 break; diff --git a/config/nlog.config b/config/nlog.config index 4c87bbc44c..662ca7efe2 100644 --- a/config/nlog.config +++ b/config/nlog.config @@ -13,10 +13,10 @@ - + - + diff --git a/config/storage.json b/config/storage.json index 8577be2e2e..59c4c5042c 100644 --- a/config/storage.json +++ b/config/storage.json @@ -87,7 +87,8 @@ "type": "disc", "path": "$STORAGE_ROOT\\Studio\\{0}\\CoBranding", "virtualpath": "~/studio/{0}/cobranding", - "public": true + "public": true, + "contentAsAttachment": true }, { "name": "static_partnerdata", diff --git a/install/OneClickInstall/docspace-install.sh b/install/OneClickInstall/docspace-install.sh index 4ab24ee409..b54796a3c2 100644 --- a/install/OneClickInstall/docspace-install.sh +++ b/install/OneClickInstall/docspace-install.sh @@ -156,27 +156,27 @@ fi if [ "$DOCKER" == "true" ]; then if [ "$LOCAL_SCRIPTS" == "true" ]; then - bash install-Docker.sh ${PARAMETERS} + bash install-Docker.sh ${PARAMETERS} || EXIT_CODE=$? else curl -s -O ${DOWNLOAD_URL_PREFIX}/install-Docker.sh - bash install-Docker.sh ${PARAMETERS} + bash install-Docker.sh ${PARAMETERS} || EXIT_CODE=$? rm install-Docker.sh fi else if [ -f /etc/redhat-release ] ; then if [ "$LOCAL_SCRIPTS" == "true" ]; then - bash install-RedHat.sh ${PARAMETERS} + bash install-RedHat.sh ${PARAMETERS} || EXIT_CODE=$? else curl -s -O ${DOWNLOAD_URL_PREFIX}/install-RedHat.sh - bash install-RedHat.sh ${PARAMETERS} + bash install-RedHat.sh ${PARAMETERS} || EXIT_CODE=$? rm install-RedHat.sh fi elif [ -f /etc/debian_version ] ; then if [ "$LOCAL_SCRIPTS" == "true" ]; then - bash install-Debian.sh ${PARAMETERS} + bash install-Debian.sh ${PARAMETERS} || EXIT_CODE=$? else curl -s -O ${DOWNLOAD_URL_PREFIX}/install-Debian.sh - bash install-Debian.sh ${PARAMETERS} + bash install-Debian.sh ${PARAMETERS} || EXIT_CODE=$? rm install-Debian.sh fi else @@ -184,3 +184,5 @@ else exit 1; fi fi + +exit ${EXIT_CODE:-0} diff --git a/install/OneClickInstall/install-Debian/install-app.sh b/install/OneClickInstall/install-Debian/install-app.sh index c8705b76d2..9427847a31 100644 --- a/install/OneClickInstall/install-Debian/install-app.sh +++ b/install/OneClickInstall/install-Debian/install-app.sh @@ -85,8 +85,6 @@ elif [ "$UPDATE" = "true" ] && [ "$PRODUCT_INSTALLED" = "true" ]; then fi fi -hold_package_version dotnet-host opensearch redis-server rabbitmq-server opensearch-dashboards fluent-bit - if [ "$MAKESWAP" == "true" ]; then make_swap fi diff --git a/install/OneClickInstall/install-Debian/install-preq.sh b/install/OneClickInstall/install-Debian/install-preq.sh index 04402de4ba..42d2c7ca9a 100644 --- a/install/OneClickInstall/install-Debian/install-preq.sh +++ b/install/OneClickInstall/install-Debian/install-preq.sh @@ -10,6 +10,8 @@ cat<> /etc/apt/sources.list echo "deb-src http://ftp.uk.debian.org/debian/ $DISTRIB_CODENAME main contrib" >> /etc/apt/sources.list @@ -33,13 +35,13 @@ locale-gen en_US.UTF-8 # add opensearch repo curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring -echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" >> /etc/apt/sources.list.d/opensearch-2.x.list +echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" > /etc/apt/sources.list.d/opensearch-2.x.list ELASTIC_VERSION="2.11.1" #add opensearch dashboards repo if [ ${INSTALL_FLUENT_BIT} == "true" ]; then curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring - echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" >> /etc/apt/sources.list.d/opensearch-dashboards-2.x.list + echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" > /etc/apt/sources.list.d/opensearch-dashboards-2.x.list DASHBOARDS_VERSION="2.11.1" fi @@ -48,9 +50,13 @@ NODE_VERSION="18" curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - #add dotnet repo -curl https://packages.microsoft.com/config/$DIST/$REV/packages-microsoft-prod.deb -O -echo -e "Package: *\nPin: origin \"packages.microsoft.com\"\nPin-Priority: 1002" | tee /etc/apt/preferences.d/99microsoft-prod.pref -dpkg -i packages-microsoft-prod.deb && rm packages-microsoft-prod.deb +if [ "$DIST" = "debian" ] || [ "$DISTRIB_CODENAME" = "focal" ]; then + curl https://packages.microsoft.com/config/$DIST/$REV/packages-microsoft-prod.deb -O + echo -e "Package: *\nPin: origin \"packages.microsoft.com\"\nPin-Priority: 1002" | tee /etc/apt/preferences.d/99microsoft-prod.pref + dpkg -i packages-microsoft-prod.deb && rm packages-microsoft-prod.deb +elif dpkg -l | grep -q packages-microsoft-prod; then + apt-get purge -y packages-microsoft-prod +fi MYSQL_REPO_VERSION="$(curl https://repo.mysql.com | grep -oP 'mysql-apt-config_\K.*' | grep -o '^[^_]*' | sort --version-sort --field-separator=. | tail -n1)" MYSQL_PACKAGE_NAME="mysql-apt-config_${MYSQL_REPO_VERSION}_all.deb" @@ -61,19 +67,19 @@ if ! dpkg -l | grep -q "mysql-server"; then MYSQL_SERVER_USER=${MYSQL_SERVER_USER:-"root"} MYSQL_SERVER_PASS=${MYSQL_SERVER_PASS:-"$(cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 12)"} - # setup mysql 8.0 package + # setup mysql 8.4 package curl -OL http://repo.mysql.com/${MYSQL_PACKAGE_NAME} echo "mysql-apt-config mysql-apt-config/repo-codename select $DISTRIB_CODENAME" | debconf-set-selections echo "mysql-apt-config mysql-apt-config/repo-distro select $DIST" | debconf-set-selections - echo "mysql-apt-config mysql-apt-config/select-server select mysql-8.0" | debconf-set-selections + echo "mysql-apt-config mysql-apt-config/select-server select mysql-8.4-lts" | debconf-set-selections DEBIAN_FRONTEND=noninteractive dpkg -i ${MYSQL_PACKAGE_NAME} rm -f ${MYSQL_PACKAGE_NAME} echo mysql-community-server mysql-community-server/root-pass password ${MYSQL_SERVER_PASS} | debconf-set-selections echo mysql-community-server mysql-community-server/re-root-pass password ${MYSQL_SERVER_PASS} | debconf-set-selections echo mysql-community-server mysql-server/default-auth-override select "Use Strong Password Encryption (RECOMMENDED)" | debconf-set-selections - echo mysql-server-8.0 mysql-server/root_password password ${MYSQL_SERVER_PASS} | debconf-set-selections - echo mysql-server-8.0 mysql-server/root_password_again password ${MYSQL_SERVER_PASS} | debconf-set-selections + echo mysql-server mysql-server/root_password password ${MYSQL_SERVER_PASS} | debconf-set-selections + echo mysql-server mysql-server/root_password_again password ${MYSQL_SERVER_PASS} | debconf-set-selections elif dpkg -l | grep -q "mysql-apt-config" && [ "$(apt-cache policy mysql-apt-config | awk 'NR==2{print $2}')" != "${MYSQL_REPO_VERSION}" ]; then curl -OL http://repo.mysql.com/${MYSQL_PACKAGE_NAME} @@ -81,31 +87,27 @@ elif dpkg -l | grep -q "mysql-apt-config" && [ "$(apt-cache policy mysql-apt-con rm -f ${MYSQL_PACKAGE_NAME} fi -if ! grep -q "mysql-innovation" /etc/apt/sources.list.d/mysql.list; then - echo "deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/${DIST} ${DISTRIB_CODENAME} mysql-innovation" | sudo tee -a /etc/apt/sources.list.d/mysql.list - - if apt-get -y update 2>&1 | grep -q "^W: .*mysql-innovation"; then - sudo sed -i '/mysql-innovation/d' /etc/apt/sources.list.d/mysql.list - fi -fi - -# add redis repo +# add redis repo --- temporary fix for complete installation on Ubuntu 24.04. REDIS_DIST_CODENAME change to DISTRIB_CODENAME if [ "$DIST" = "ubuntu" ]; then + [[ "$DISTRIB_CODENAME" =~ noble ]] && REDIS_DIST_CODENAME="jammy" || REDIS_DIST_CODENAME="${DISTRIB_CODENAME}" curl -fsSL https://packages.redis.io/gpg | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/redis.gpg --import - echo "deb [signed-by=/usr/share/keyrings/redis.gpg] https://packages.redis.io/deb $DISTRIB_CODENAME main" | tee /etc/apt/sources.list.d/redis.list + echo "deb [signed-by=/usr/share/keyrings/redis.gpg] https://packages.redis.io/deb $REDIS_DIST_CODENAME main" | tee /etc/apt/sources.list.d/redis.list chmod 644 /usr/share/keyrings/redis.gpg fi #add nginx repo -curl -s http://nginx.org/keys/nginx_signing.key | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/nginx.gpg --import -echo "deb [signed-by=/usr/share/keyrings/nginx.gpg] http://nginx.org/packages/$DIST/ $DISTRIB_CODENAME nginx" | tee /etc/apt/sources.list.d/nginx.list -chmod 644 /usr/share/keyrings/nginx.gpg -#f for missing nginx repository for debian bookworm +if [[ "$DISTRIB_CODENAME" != noble ]]; then + curl -s http://nginx.org/keys/nginx_signing.key | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/nginx.gpg --import + echo "deb [signed-by=/usr/share/keyrings/nginx.gpg] http://nginx.org/packages/$DIST/ $DISTRIB_CODENAME nginx" | tee /etc/apt/sources.list.d/nginx.list + chmod 644 /usr/share/keyrings/nginx.gpg +fi +# Fix for missing nginx repository for debian bookworm [ "$DISTRIB_CODENAME" = "bookworm" ] && sed -i "s/$DISTRIB_CODENAME/buster/g" /etc/apt/sources.list.d/nginx.list -#add openresty repo +#add openresty repo --- temporary fix for complete installation on Ubuntu 24.04: OPENRESTY_DIST_CODENAME change to DISTRIB_CODENAME +[[ "$DISTRIB_CODENAME" =~ noble ]] && OPENRESTY_DIST_CODENAME="jammy" || OPENRESTY_DIST_CODENAME="${DISTRIB_CODENAME}" curl -fsSL https://openresty.org/package/pubkey.gpg | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/openresty.gpg --import -echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/$DIST $DISTRIB_CODENAME $([ "$DIST" = "ubuntu" ] && echo "main" || echo "openresty" )" | tee /etc/apt/sources.list.d/openresty.list +echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/$DIST $OPENRESTY_DIST_CODENAME $([ "$DIST" = "ubuntu" ] && echo "main" || echo "openresty" )" | tee /etc/apt/sources.list.d/openresty.list chmod 644 /usr/share/keyrings/openresty.gpg # setup msttcorefonts @@ -132,8 +134,11 @@ if ! dpkg -l | grep -q "opensearch"; then fi if [ ${INSTALL_FLUENT_BIT} == "true" ]; then - apt-get install -yq opensearch-dashboards=${DASHBOARDS_VERSION} - curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh + [[ "$DISTRIB_CODENAME" =~ noble ]] && FLUENTBIT_DIST_CODENAME="jammy" || FLUENTBIT_DIST_CODENAME="${DISTRIB_CODENAME}" + curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg + echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/$DIST/$FLUENTBIT_DIST_CODENAME $FLUENTBIT_DIST_CODENAME main" | tee /etc/apt/sources.list.d/fluent-bit.list + apt update + apt-get install -yq opensearch-dashboards=${DASHBOARDS_VERSION} fluent-bit fi # disable apparmor for mysql diff --git a/install/OneClickInstall/install-Debian/tools.sh b/install/OneClickInstall/install-Debian/tools.sh index 35ea566aed..e1265b2522 100644 --- a/install/OneClickInstall/install-Debian/tools.sh +++ b/install/OneClickInstall/install-Debian/tools.sh @@ -5,7 +5,7 @@ set -e make_swap () { DISK_REQUIREMENTS=6144; #6Gb free space MEMORY_REQUIREMENTS=12000; #RAM ~12Gb - SWAPFILE="/${PRODUCT}_swapfile"; + SWAPFILE="/${product}_swapfile"; AVAILABLE_DISK_SPACE=$(df -m / | tail -1 | awk '{ print $4 }'); TOTAL_MEMORY=$(free --mega | grep -oP '\d+' | head -n 1); @@ -26,14 +26,23 @@ command_exists () { # Function to prevent package auto-update hold_package_version() { - for package in "$@"; do - if command -v apt-mark >/dev/null 2>&1 && - dpkg -s "$package" >/dev/null 2>&1 && - ! apt-mark showhold | grep -q "$package" >/dev/null 2>&1 - then - apt-mark hold "$package" - fi - done + packages=("dotnet-*" "aspnetcore-*" opensearch redis-server rabbitmq-server opensearch-dashboards fluent-bit) + for package in "${packages[@]}"; do + command -v apt-mark >/dev/null 2>&1 && apt-mark showhold | grep -q "^$package" && apt-mark unhold "$package" + done + + UNATTENDED_UPGRADES_FILE="/etc/apt/apt.conf.d/50unattended-upgrades" + if [ -f ${UNATTENDED_UPGRADES_FILE} ] && grep -q "Package-Blacklist" ${UNATTENDED_UPGRADES_FILE}; then + for package in "${packages[@]}"; do + if ! grep -q "$package" ${UNATTENDED_UPGRADES_FILE}; then + sed -i "/Package-Blacklist/a \\\t\"$package\";" ${UNATTENDED_UPGRADES_FILE} + fi + done + + if systemctl list-units --type=service --state=running | grep -q "unattended-upgrades"; then + systemctl restart unattended-upgrades + fi + fi } check_hardware () { diff --git a/install/OneClickInstall/install-Docker.sh b/install/OneClickInstall/install-Docker.sh index bb3a95578c..92c58036d4 100644 --- a/install/OneClickInstall/install-Docker.sh +++ b/install/OneClickInstall/install-Docker.sh @@ -675,8 +675,8 @@ get_os_info () { fi fi - DIST=$(trim $DIST); REV=$(trim $REV); + DIST=$(trim "$DIST") fi } @@ -863,13 +863,22 @@ install_docker () { systemctl start docker systemctl enable docker - elif [ "${DIST}" == "Red Hat Enterprise Linux Server" ]; then + elif [[ "${DIST}" == Red\ Hat\ Enterprise\ Linux* ]]; then - echo "" - echo "Your operating system does not allow Docker CE installation." - echo "You can install Docker EE using the manual here - https://docs.docker.com/engine/installation/linux/rhel/" - echo "" - exit 1; + if [[ "${REV}" -gt "7" ]]; then + yum remove -y docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine podman runc > null + yum install -y yum-utils + yum-config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo + yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin + systemctl start docker + systemctl enable docker + else + echo "" + echo "Your operating system does not allow Docker CE installation." + echo "You can install Docker EE using the manual here - https://docs.docker.com/engine/installation/linux/rhel/" + echo "" + exit 1; + fi elif [ "${DIST}" == "SuSe" ]; then @@ -1315,33 +1324,32 @@ install_elasticsearch () { install_fluent_bit () { if [ "$INSTALL_FLUENT_BIT" == "true" ]; then - curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh - - if systemctl list-unit-files --type=service | grep -q "fluent-bit.service"; then - sed -i "s/OPENSEARCH_SCHEME/$(get_env_parameter "ELK_SHEME")/g" "${BASE_DIR}/config/fluent-bit.conf" - sed -i "s/OPENSEARCH_HOST/${ELK_HOST:-127.0.0.1}/g" "${BASE_DIR}/config/fluent-bit.conf" - sed -i "s/OPENSEARCH_PORT/$(get_env_parameter "ELK_PORT")/g" ${BASE_DIR}/config/fluent-bit.conf - sed -i "s/OPENSEARCH_INDEX/${OPENSEARCH_INDEX:-"${PACKAGE_SYSNAME}-fluent-bit"}/g" ${BASE_DIR}/config/fluent-bit.conf - [ ! -z "${ELK_HOST}" ] && sed -i "s/ELK_CONTAINER_NAME/ELK_HOST/g" ${BASE_DIR}/dashboards.yml - cp -rf ${BASE_DIR}/config/fluent-bit.conf /etc/fluent-bit/fluent-bit.conf - systemctl restart fluent-bit - - DOCKER_DAEMON_FILE="/etc/docker/daemon.json" - if [[ ! -f "${DOCKER_DAEMON_FILE}" ]]; then - echo "{\"log-driver\": \"fluentd\", \"log-opts\": { \"fluentd-address\": \"127.0.0.1:24224\" }}" > "${DOCKER_DAEMON_FILE}" - systemctl restart docker - elif ! grep -q "log-driver" ${DOCKER_DAEMON_FILE}; then - sed -i 's!{!& "log-driver": "fluentd", "log-opts": { "fluentd-address": "127.0.0.1:24224" },!' "${DOCKER_DAEMON_FILE}" - systemctl restart docker + if ! command_exists crontab; then + if command_exists apt-get; then + install_service crontab cron + elif command_exists yum; then + install_service crontab cronie fi - - reconfigure DASHBOARDS_USERNAME "${DASHBOARDS_USERNAME:-"onlyoffice"}" - reconfigure DASHBOARDS_PASSWORD "${DASHBOARDS_PASSWORD:-$(get_random_str 20)}" - - docker-compose -f ${BASE_DIR}/dashboards.yml up -d - else - echo "The installation of the fluent-bit service was unsuccessful." fi + + [ ! -z "$ELK_HOST" ] && sed -i "s/ELK_CONTAINER_NAME/ELK_HOST/g" $BASE_DIR/fluent.yml ${BASE_DIR}/dashboards.yml + + OPENSEARCH_INDEX="${OPENSEARCH_INDEX:-"${PACKAGE_SYSNAME}-fluent-bit"}" + if crontab -l | grep -q "${OPENSEARCH_INDEX}"; then + crontab < <(crontab -l | grep -v "${OPENSEARCH_INDEX}") + fi + (crontab -l 2>/dev/null; echo "0 0 */1 * * curl -s -X POST "$(get_env_parameter 'ELK_SHEME')"://${ELK_HOST:-127.0.0.1}:$(get_env_parameter 'ELK_PORT')/${OPENSEARCH_INDEX}/_delete_by_query -H 'Content-Type: application/json' -d '{\"query\": {\"range\": {\"@timestamp\": {\"lt\": \"now-30d\"}}}}'") | crontab - + + sed -i "s/OPENSEARCH_HOST/${ELK_HOST:-"${PACKAGE_SYSNAME}-opensearch"}/g" "${BASE_DIR}/config/fluent-bit.conf" + sed -i "s/OPENSEARCH_PORT/$(get_env_parameter "ELK_PORT")/g" ${BASE_DIR}/config/fluent-bit.conf + sed -i "s/OPENSEARCH_INDEX/${OPENSEARCH_INDEX}/g" ${BASE_DIR}/config/fluent-bit.conf + + reconfigure DASHBOARDS_USERNAME "${DASHBOARDS_USERNAME:-"${PACKAGE_SYSNAME}"}" + reconfigure DASHBOARDS_PASSWORD "${DASHBOARDS_PASSWORD:-$(get_random_str 20)}" + + docker-compose -f ${BASE_DIR}/fluent.yml -f ${BASE_DIR}/dashboards.yml up -d + elif [ "$INSTALL_FLUENT_BIT" == "pull" ]; then + docker-compose -f ${BASE_DIR}/fluent.yml -f ${BASE_DIR}/dashboards.yml pull fi } @@ -1363,14 +1371,20 @@ install_product () { reconfigure APP_URL_PORTAL "${APP_URL_PORTAL:-"http://${PACKAGE_SYSNAME}-router:8092"}" reconfigure EXTERNAL_PORT ${EXTERNAL_PORT} + if [[ -z ${MYSQL_HOST} ]] && [ "$INSTALL_MYSQL_SERVER" == "true" ]; then + echo -n "Waiting for MySQL container to become healthy..." + (timeout 30 bash -c "while ! docker inspect --format '{{json .State.Health.Status }}' ${PACKAGE_SYSNAME}-mysql-server | grep -q 'healthy'; do sleep 1; done") && echo "OK" || (echo "FAILED") + fi + docker-compose -f $BASE_DIR/migration-runner.yml up -d - docker wait ${PACKAGE_SYSNAME}-migration-runner + echo -n "Waiting for database migration to complete..." && docker wait ${PACKAGE_SYSNAME}-migration-runner && echo "OK" docker-compose -f $BASE_DIR/${PRODUCT}.yml up -d docker-compose -f ${PROXY_YML} up -d docker-compose -f $BASE_DIR/notify.yml up -d docker-compose -f $BASE_DIR/healthchecks.yml up -d if [[ -n "${PREVIOUS_ELK_VERSION}" && "$(get_env_parameter "ELK_VERSION")" != "${PREVIOUS_ELK_VERSION}" ]]; then + docker ps -q -f name=${PACKAGE_SYSNAME}-elasticsearch | xargs -r docker stop MYSQL_TAG=$(docker images --format "{{.Tag}}" mysql | head -n1) MYSQL_CONTAINER_NAME=$(get_env_parameter "MYSQL_CONTAINER_NAME" | sed "s/\${CONTAINER_PREFIX}/${PACKAGE_SYSNAME}-/g") docker run --rm --network="$(get_env_parameter "NETWORK_NAME")" mysql:${MYSQL_TAG:-latest} mysql -h "${MYSQL_HOST:-${MYSQL_CONTAINER_NAME}}" -P "${MYSQL_PORT:-3306}" -u "${MYSQL_USER}" -p"${MYSQL_PASSWORD}" "${MYSQL_DATABASE}" -e "TRUNCATE webstudio_index;" diff --git a/install/OneClickInstall/install-RedHat/install-preq.sh b/install/OneClickInstall/install-RedHat/install-preq.sh index 965c87db17..5f63f8d5a1 100644 --- a/install/OneClickInstall/install-RedHat/install-preq.sh +++ b/install/OneClickInstall/install-RedHat/install-preq.sh @@ -37,12 +37,9 @@ fi rpm -ivh https://rpms.remirepo.net/$REMI_DISTR_NAME/remi-release-$REV.rpm || true yum localinstall -y --nogpgcheck https://download1.rpmfusion.org/free/$RPMFUSION_DISTR_NAME/rpmfusion-free-release-$REV.noarch.rpm -[ "$REV" = "9" ] && update-crypto-policies --set DEFAULT:SHA1 -if [ "$DIST" == "centos" ]; then - [ "$REV" = "9" ] && TESTING_REPO="--enablerepo=crb" || POWERTOOLS_REPO="--enablerepo=powertools" -elif [ "$DIST" == "redhat" ]; then - /usr/bin/crb enable -fi +[ "$REV" = "9" ] && update-crypto-policies --set DEFAULT:SHA1 && ${package_manager} -y install xorg-x11-font-utils +[ "$DIST" = "centos" ] && TESTING_REPO="--enablerepo=$( [ "$REV" = "9" ] && echo "crb" || echo "powertools" )" +[ "$DIST" = "redhat" ] && { /usr/bin/crb enable && yum repolist enabled | grep -qi -e crb -e codeready || echo "Failed to enable or verify CRB repository."; exit 1; } #add rabbitmq & erlang repo curl -s https://packagecloud.io/install/repositories/rabbitmq/rabbitmq-server/script.rpm.sh | bash @@ -54,12 +51,8 @@ curl -fsSL https://rpm.nodesource.com/setup_${NODE_VERSION}.x | sed '/update -y/ #add mysql repo dnf remove -y @mysql && dnf module -y reset mysql && dnf module -y disable mysql -MYSQL_REPO_VERSION="$(curl https://repo.mysql.com | grep -oP "mysql80-community-release-${MYSQL_DISTR_NAME}${REV}-\K.*" | grep -o '^[^.]*' | sort | tail -n1)" -yum localinstall -y https://repo.mysql.com/mysql80-community-release-${MYSQL_DISTR_NAME}${REV}-${MYSQL_REPO_VERSION}.noarch.rpm || true - -if ! yum repolist enabled | grep -q mysql-innovation-community; then - sudo yum-config-manager --enable mysql-innovation-community -fi +MYSQL_REPO_VERSION="$(curl https://repo.mysql.com | grep -oP "mysql84-community-release-${MYSQL_DISTR_NAME}${REV}-\K.*" | grep -o '^[^.]*' | sort | tail -n1)" +yum localinstall -y https://repo.mysql.com/mysql84-community-release-${MYSQL_DISTR_NAME}${REV}-${MYSQL_REPO_VERSION}.noarch.rpm || true if ! rpm -q mysql-community-server; then MYSQL_FIRST_TIME_INSTALL="true"; diff --git a/install/OneClickInstall/install-RedHat/tools.sh b/install/OneClickInstall/install-RedHat/tools.sh index 5a91b51650..7116e7ee01 100644 --- a/install/OneClickInstall/install-RedHat/tools.sh +++ b/install/OneClickInstall/install-RedHat/tools.sh @@ -5,17 +5,22 @@ set -e function make_swap () { local DISK_REQUIREMENTS=6144; #6Gb free space local MEMORY_REQUIREMENTS=12000; #RAM ~12Gb - SWAPFILE="/${PRODUCT}_swapfile"; + SWAPFILE="/${product}_swapfile"; local AVAILABLE_DISK_SPACE=$(df -m / | tail -1 | awk '{ print $4 }'); local TOTAL_MEMORY=$(free --mega | grep -oP '\d+' | head -n 1); local EXIST=$(swapon -s | awk '{ print $1 }' | { grep -x ${SWAPFILE} || true; }); if [[ -z $EXIST ]] && [ ${TOTAL_MEMORY} -lt ${MEMORY_REQUIREMENTS} ] && [ ${AVAILABLE_DISK_SPACE} -gt ${DISK_REQUIREMENTS} ]; then - dd if=/dev/zero of=${SWAPFILE} count=6144 bs=1MiB - chmod 600 ${SWAPFILE} - mkswap ${SWAPFILE} - swapon ${SWAPFILE} + touch "$SWAPFILE" + # No Copy-on-Write - no compression + [[ "$DIST" == "fedora" ]] && chattr +C "$SWAPFILE" + # Allocate 6 GB, much faster than: dd if=/dev/zero of=${SWAPFILE} count=6144 bs=1MiB + fallocate -l 6G "$SWAPFILE" + chmod 600 "$SWAPFILE" + mkswap "$SWAPFILE" + # Activate, enable upon system boot + swapon "$SWAPFILE" echo "$SWAPFILE none swap sw 0 0" >> /etc/fstab fi } @@ -66,8 +71,9 @@ read_unsupported_installation () { esac } -DIST=$(rpm -q --queryformat '%{NAME}' centos-release redhat-release fedora-release | awk -F'[- ]|package' '{print tolower($1)}' | tr -cd '[:alpha:]') -[ -z $DIST ] && DIST=$(cat /etc/redhat-release | awk -F 'Linux|release| ' '{print tolower($1)}') +DIST=$(rpm -qa --queryformat '%{NAME}\n' | grep -E 'centos-release|redhat-release|fedora-release' | awk -F '-' '{print $1}' | head -n 1) +DIST=${DIST:-$(awk -F= '/^ID=/ {gsub(/"/, "", $2); print tolower($2)}' /etc/os-release)}; +[[ "$DIST" =~ ^(centos|redhat|fedora)$ ]] || DIST="centos" REV=$(sed -n 's/.*release\ \([0-9]*\).*/\1/p' /etc/redhat-release) REV=${REV:-"7"} diff --git a/install/common/logrotate/product-common b/install/common/logrotate/product-common deleted file mode 100644 index 66a81ce9ab..0000000000 --- a/install/common/logrotate/product-common +++ /dev/null @@ -1,16 +0,0 @@ -/var/log/onlyoffice/docspace/*.log { - daily - missingok - rotate 30 - compress - dateext - delaycompress - notifempty - nocreate - sharedscripts - postrotate - if pgrep -x ""systemd"" >/dev/null; then - systemctl restart docspace* > /dev/null - fi - endscript -} diff --git a/install/common/product-configuration b/install/common/product-configuration index 04d397eb3f..e51196f361 100644 --- a/install/common/product-configuration +++ b/install/common/product-configuration @@ -26,7 +26,7 @@ APP_PORT="80" ELK_SHEME="http" ELK_HOST="localhost" ELK_PORT="9200" -OPENSEARCH_INDEX="${PACKAGE_SYSNAME}-${PRODUCT}-logs" +OPENSEARCH_INDEX="${PACKAGE_SYSNAME}-fluent-bit" RABBITMQ_HOST="localhost" RABBITMQ_USER="guest" @@ -249,9 +249,9 @@ set_core_machinekey () { fi save_undefined_param "${USER_CONF}" "core.machinekey" "${CORE_MACHINEKEY}" - save_undefined_param "${USER_CONF}" "core['base-domain']" "${APP_HOST}" + save_undefined_param "${USER_CONF}" "core['base-domain']" "${APP_HOST}" "rewrite" save_undefined_param "${APP_DIR}/apisystem.${ENVIRONMENT}.json" "core.machinekey" "${CORE_MACHINEKEY}" - save_undefined_param "${APP_DIR}/apisystem.${ENVIRONMENT}.json" "core['base-domain']" "${APP_HOST}" + save_undefined_param "${APP_DIR}/apisystem.${ENVIRONMENT}.json" "core['base-domain']" "${APP_HOST}" "rewrite" sed "s^\(machine_key\)\s*=.*^\1 = ${CORE_MACHINEKEY}^g" -i $APP_DIR/radicale.config } @@ -295,7 +295,7 @@ restart_services() { echo -n "Restarting services... " for SVC in login api socket studio-notify notify \ - people-server files files-services studio backup \ + people-server files files-services studio backup api-system \ clear-events backup-background ssoauth doceditor healthchecks do systemctl enable ${PRODUCT}-$SVC >/dev/null 2>&1 @@ -346,7 +346,7 @@ establish_mysql_conn(){ $MYSQL -e ";" >/dev/null 2>&1 ERRCODE=$? if [ $ERRCODE -ne 0 ]; then - systemctl ${MYSQL_PACKAGE} start >/dev/null 2>&1 + systemctl start ${MYSQL_PACKAGE} >/dev/null 2>&1 $MYSQL -e ";" >/dev/null 2>&1 || { echo "FAILURE"; exit 1; } fi @@ -446,14 +446,9 @@ change_mysql_config(){ else sed "s/collation_server.*/collation_server = utf8_general_ci/" -i ${CNF_PATH} || true # ignore errors fi - - MYSQL_AUTHENTICATION_PLUGIN=$($MYSQL -e "SHOW VARIABLES LIKE 'default_authentication_plugin';" -s | awk '{print $2}' >/dev/null 2>&1) - MYSQL_AUTHENTICATION_PLUGIN=${MYSQL_AUTHENTICATION_PLUGIN:-caching_sha2_password} - if ! grep -q "^default-authentication-plugin" ${CNF_PATH}; then - sed "/\[mysqld\]/a default-authentication-plugin = ${MYSQL_AUTHENTICATION_PLUGIN}" -i ${CNF_PATH} - else - sed "s/default-authentication-plugin.*/default-authentication-plugin = ${MYSQL_AUTHENTICATION_PLUGIN}/" -i ${CNF_PATH} || true # ignore errors + if grep -q "^default-authentication-plugin" ${CNF_PATH}; then + sed "/^default-authentication-plugin/d" -i "${CNF_PATH}" || true # ignore errors fi if [ -e ${CNF_SERVICE_PATH} ]; then @@ -553,10 +548,12 @@ setup_openresty(){ done fi - if rpm -q "firewalld"; then - firewall-cmd --permanent --zone=public --add-service=http - firewall-cmd --permanent --zone=public --add-service=https - systemctl restart firewalld.service + if $PACKAGE_MANAGER firewalld >/dev/null 2>&1; then + if [ $(systemctl is-active firewalld.service) == active ]; then + firewall-cmd --permanent --zone=public --add-service=http + firewall-cmd --permanent --zone=public --add-service=https + systemctl restart firewalld.service + fi fi elif [ "$DIST" = "Debian" ]; then if ! id "nginx" &>/dev/null; then @@ -625,13 +622,10 @@ setup_enterprise() { change_elasticsearch_config(){ systemctl stop opensearch - systemctl is-active --quiet elasticsearch && systemctl stop elasticsearch - - ELASTIC_VERSION=$(awk '/build:/{f=1} f&&/version:/{gsub(/"/,"",$2);print $2; exit}' /usr/share/opensearch/manifest.yml 2>/dev/null || echo "2.11.1") - [[ -f "$APP_DIR/.private/opensearch-version" && $(cat $APP_DIR/.private/opensearch-version) != *$ELASTIC_VERSION* ]] && $MYSQL "$DB_NAME" -e "TRUNCATE webstudio_index"; - - echo "$ELASTIC_VERSION" > $APP_DIR/.private/opensearch-version - chmod o-rwx $APP_DIR/.private/opensearch-version + if $PACKAGE_MANAGER elasticsearch >/dev/null 2>&1; then + systemctl disable elasticsearch >/dev/null 2>&1 + systemctl stop elasticsearch >/dev/null 2>&1 + fi sed -i '/^plugins\.security/d' /etc/opensearch/opensearch.yml sed -i '/CN=kirk,OU=client,O=client,L=test, C=de/d' /etc/opensearch/opensearch.yml @@ -727,8 +721,18 @@ setup_dashboards() { DASHBOARDS_CONF_PATH="/etc/opensearch-dashboards/opensearch_dashboards.yml" + if [[ -n ${DASHBOARDS_PASSWORD} ]]; then + echo "${DASHBOARDS_PASSWORD}" > ${APP_DIR}/.private/dashboards-password + elif [[ -f ${APP_DIR}/.private/dashboards-password ]]; then + DASHBOARDS_PASSWORD=$(cat ${APP_DIR}/.private/dashboards-password); + else + DASHBOARDS_PASSWORD=$(echo "$(cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 20)" | tee ${APP_DIR}/.private/dashboards-password) + fi + + chmod o-rwx $APP_DIR/.private/dashboards-password + # configure login&pass for Dashboards, used by Nginx HTTP Basic Authentication - echo "${DASHBOARDS_USERNAME:-"onlyoffice"}:$(openssl passwd -6 -stdin <<< "${DASHBOARDS_PASSWORD:-"onlyoffice"}")" > /etc/openresty/.htpasswd_dashboards + echo "${DASHBOARDS_USERNAME:-"onlyoffice"}:$(openssl passwd -6 -stdin <<< "${DASHBOARDS_PASSWORD}")" > /etc/openresty/.htpasswd_dashboards chown nginx:nginx /etc/openresty/.htpasswd_dashboards # enable connection with opensearch @@ -741,6 +745,7 @@ setup_dashboards() { # set basePath variable to get access to Dashboards from a remote host sed 's_.*\(server.basePath:\).*_\1 "/dashboards"_' -i ${DASHBOARDS_CONF_PATH} + systemctl enable opensearch-dashboards systemctl restart opensearch-dashboards echo "OK" } @@ -752,6 +757,7 @@ setup_fluentbit() { sed -i "s/OPENSEARCH_HOST/$ELK_HOST/g; s/OPENSEARCH_PORT/$ELK_PORT/g; s/OPENSEARCH_INDEX/$OPENSEARCH_INDEX/g; s/OPENSEARCH_SCHEME/$ELK_SHEME/g" ${APP_DIR}/fluent-bit.conf cp -f ${APP_DIR}/fluent-bit.conf /etc/fluent-bit/fluent-bit.conf + systemctl enable fluent-bit systemctl restart fluent-bit echo "OK" } @@ -895,3 +901,11 @@ elif $PACKAGE_MANAGER rabbitmq-server >/dev/null 2>&1; then fi restart_services + +# Truncate MySQL DB to make opensearch work with updated app. Strictly after restart_services () +if $PACKAGE_MANAGER opensearch >/dev/null 2>&1; then + ELASTIC_VERSION=$(awk '/build:/{f=1} f&&/version:/{gsub(/"/,"",$2);print $2; exit}' /usr/share/opensearch/manifest.yml 2>/dev/null || echo "2.11.1") + [[ ! -f "$APP_DIR/.private/opensearch-version" || $(cat "$APP_DIR/.private/opensearch-version") != *"$ELASTIC_VERSION"* ]] && $MYSQL "$DB_NAME" -e "TRUNCATE webstudio_index"; + echo "$ELASTIC_VERSION" > $APP_DIR/.private/opensearch-version + chmod o-rwx $APP_DIR/.private/opensearch-version +fi diff --git a/install/common/product-ssl-setup b/install/common/product-ssl-setup index 6a58fc7794..ace387a517 100644 --- a/install/common/product-ssl-setup +++ b/install/common/product-ssl-setup @@ -8,7 +8,8 @@ LETSENCRYPT="/etc/letsencrypt/live"; OPENRESTY="/etc/openresty/conf.d" DHPARAM_FILE="/etc/ssl/certs/dhparam.pem" WEBROOT_PATH="/var/www/${PRODUCT}" -SYSTEMD_DIR="/usr/lib/systemd/system" +CONFIG_DIR="/etc/onlyoffice/${PRODUCT}" +SYSTEMD_DIR=$(dirname $($(command -v dpkg-query &> /dev/null && echo "dpkg-query -L" || echo "rpm -ql") ${PRODUCT}-api | grep systemd/system/)) # Check if configuration files are present if [ ! -f "${OPENRESTY}/onlyoffice-proxy-ssl.conf.template" -a ! -f "${OPENRESTY}/onlyoffice-proxy.conf.template" ]; then @@ -47,6 +48,8 @@ case $1 in DOMAIN=$2 CERTIFICATE_FILE=$3 PRIVATEKEY_FILE=$4 + + [[ $DOMAIN =~ ^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}$ ]] || { echo "Error: domain name '$DOMAIN' is incorrect." >&2; exit 1; } else help fi @@ -59,7 +62,7 @@ case $1 in sed "s!\(worker_connections\).*;!\1 $(ulimit -n);!" -i "${OPENRESTY}/onlyoffice-proxy.conf" [[ -f "${DIR}/${PRODUCT}-renew-letsencrypt" ]] && rm -rf "${DIR}/${PRODUCT}-renew-letsencrypt" [ $(pgrep -x ""systemd"" | wc -l) -gt 0 ] && systemctl reload openresty || service openresty reload - + sed -i "s/\(\"portal\":\).*/\1 \"http:\/\/localhost:80\"/" ${CONFIG_DIR}/appsettings.$(grep -oP 'ENVIRONMENT=\K.*' ${SYSTEMD_DIR}/${PRODUCT}-api.service).json SYSTEMD_NODE_FILES=$(grep -l "NODE_EXTRA_CA_CERTS" ${SYSTEMD_DIR}/${PRODUCT}-*.service ${SYSTEMD_DIR}/ds-*.service || true) if [ -n "$SYSTEMD_NODE_FILES" ]; then sed -i '/NODE_EXTRA_CA_CERTS/d' ${SYSTEMD_NODE_FILES} @@ -91,8 +94,8 @@ case $1 in echo "Generating Let's Encrypt SSL Certificates..." # Request and generate Let's Encrypt SSL certificate - echo certbot certonly --expand --webroot -w ${WEBROOT_PATH} --cert-name ${PRODUCT} --noninteractive --agree-tos --email ${MAIL} -d ${DOMAINS[@]} > /var/log/le-start.log - certbot certonly --expand --webroot -w ${WEBROOT_PATH} --cert-name ${PRODUCT} --noninteractive --agree-tos --email ${MAIL} -d ${DOMAINS[@]} > /var/log/le-new.log + echo certbot certonly --expand --webroot -w ${WEBROOT_PATH} --key-type rsa --cert-name ${PRODUCT} --noninteractive --agree-tos --email ${MAIL} -d ${DOMAINS[@]} > /var/log/le-start.log + certbot certonly --expand --webroot -w ${WEBROOT_PATH} --key-type rsa --cert-name ${PRODUCT} --noninteractive --agree-tos --email ${MAIL} -d ${DOMAINS[@]} > /var/log/le-new.log else help fi @@ -106,10 +109,7 @@ PRIVATEKEY_FILE="${PRIVATEKEY_FILE:-"${LETSENCRYPT}/${PRODUCT}/privkey.pem"}" if [ -f "${CERTIFICATE_FILE}" ]; then if [ -f "${PRIVATEKEY_FILE}" ]; then cp -f ${OPENRESTY}/onlyoffice-proxy-ssl.conf.template ${OPENRESTY}/onlyoffice-proxy.conf - - PACKAGE_FILE_CHECKER=$(command -v dpkg-query &> /dev/null && echo "dpkg-query -L" || echo "rpm -ql") - ENVIRONMENT=$(grep -oP 'ENVIRONMENT=\K.*' $(dirname $(${PACKAGE_FILE_CHECKER} ${PRODUCT}-api | grep systemd/system/))/${PRODUCT}-api.service) - sed -i "s/\(\"portal\":\).*/\1 \"https:\/\/${DOMAIN}\"/" /etc/onlyoffice/docspace/appsettings.$ENVIRONMENT.json + sed -i "s/\(\"portal\":\).*/\1 \"https:\/\/${DOMAIN}\"/" ${CONFIG_DIR}/appsettings.$(grep -oP 'ENVIRONMENT=\K.*' ${SYSTEMD_DIR}/${PRODUCT}-api.service).json sed -i "s~\(ssl_certificate \).*;~\1${CERTIFICATE_FILE};~g" ${OPENRESTY}/onlyoffice-proxy.conf sed -i "s~\(ssl_certificate_key \).*;~\1${PRIVATEKEY_FILE};~g" ${OPENRESTY}/onlyoffice-proxy.conf sed -i "s~\(ssl_dhparam \).*;~\1${DHPARAM_FILE};~g" ${OPENRESTY}/onlyoffice-proxy.conf diff --git a/install/deb/debian/control b/install/deb/debian/control index 9412cbd08f..18e9b1fcd8 100644 --- a/install/deb/debian/control +++ b/install/deb/debian/control @@ -11,7 +11,7 @@ Multi-Arch: foreign Package: {{product}} Architecture: all Multi-Arch: foreign -Depends: debconf, +Depends: debconf, openssl, ${misc:Depends}, ${shlibs:Depends}, {{product}}-api (= {{package_header_tag_version}}), {{product}}-api-system (= {{package_header_tag_version}}), @@ -40,7 +40,7 @@ Description: {{product}} Package: {{product}}-common Architecture: all Multi-Arch: foreign -Depends: adduser, logrotate, ${misc:Depends}, ${shlibs:Depends} +Depends: adduser, ${misc:Depends}, ${shlibs:Depends} Recommends: default-mysql-client Description: {{product}}-common A package containing configs and scripts diff --git a/install/deb/debian/product-common.install b/install/deb/debian/product-common.install index 2f3a5de1c7..60aaa49f2e 100644 --- a/install/deb/debian/product-common.install +++ b/install/deb/debian/product-common.install @@ -1,5 +1,4 @@ debian/build/buildtools/config/*.json etc/onlyoffice/{{product}} debian/build/buildtools/config/*.config etc/onlyoffice/{{product}} debian/build/buildtools/install/common/{{product}}-configuration usr/bin -debian/build/buildtools/install/common/logrotate/{{product}}-common etc/logrotate.d debian/build/buildtools/install/docker/config/fluent-bit.conf etc/onlyoffice/{{product}} diff --git a/install/deb/debian/rules b/install/deb/debian/rules index 07d8104bc7..c189c93fae 100644 --- a/install/deb/debian/rules +++ b/install/deb/debian/rules @@ -79,13 +79,17 @@ override_dh_auto_build: check_archives sed -E 's_(http://)[^:]+(:5601)_\1localhost\2_g' -i ${BUILDTOOLS_PATH}/config/nginx/onlyoffice.conf sed 's/teamlab.info/onlyoffice.com/g' -i ${BUILDTOOLS_PATH}/config/autofac.consumers.json json -I -f ${CLENT_PATH}/public/scripts/config.json -e "this.wrongPortalNameUrl=\"\"" - sed -e 's/$$router_host/127.0.0.1/g' -e 's/this_host\|proxy_x_forwarded_host/host/g' -e 's/proxy_x_forwarded_proto/scheme/g' -e 's/proxy_x_forwarded_port/server_port/g' -e 's_includes_/etc/openresty/includes_g' -i ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy*.conf + sed -e 's/$$router_host/127.0.0.1/g' -e 's/this_host\|proxy_x_forwarded_host/host/g' -e 's/proxy_x_forwarded_proto/scheme/g' -e 's/proxy_x_forwarded_port/server_port/g' -e 's_includes_/etc/openresty/includes_g' -e '/quic\|alt-svc/Id' -i ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy*.conf sed "s_\(.*root\).*;_\1 \"/var/www/${PRODUCT}\";_g" -i ${BUILDTOOLS_PATH}/install/docker/config/nginx/letsencrypt.conf sed -e '/.pid/d' -e '/temp_path/d' -e 's_etc/nginx_etc/openresty_g' -e 's/\.log/-openresty.log/g' -i ${BUILDTOOLS_PATH}/install/docker/config/nginx/templates/nginx.conf.template mv -f ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy-ssl.conf ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy-ssl.conf.template cp -rf ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy.conf ${BUILDTOOLS_PATH}/install/docker/config/nginx/onlyoffice-proxy.conf.template - sed -i '/^\s*Name\s\+forward\s*/d; /^\s*Listen\s\+127\.0\.0\.1\s*/d; /^\s*Port\s\+24224\s*/d' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf - sed -i '0,/\[INPUT\]/ s/\(\[INPUT\]\)/\1\n Name tail\n Path \/var\/log\/onlyoffice\/${PRODUCT}\/*.log\n Path_Key filename/' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i "s#\(/var/log/onlyoffice/\)#\1${PRODUCT}/#" ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i '/^\[OUTPUT\]/i\[INPUT]' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i '/^\[OUTPUT\]/i\ Name exec' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i '/^\[OUTPUT\]/i\ Interval_Sec 86400' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i '/^\[OUTPUT\]/i\ Command curl -s -X POST OPENSEARCH_SCHEME://OPENSEARCH_HOST:OPENSEARCH_PORT/OPENSEARCH_INDEX/_delete_by_query -H '\''Content-Type: application/json'\'' -d '\''{"query": {"range": {"@timestamp": {"lt": "now-30d"}}}}'\''' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf + sed -i '/^\[OUTPUT\]/i\\' ${BUILDTOOLS_PATH}/install/docker/config/fluent-bit.conf for i in ${PRODUCT} $$(ls ${CURDIR}/debian/*.install | grep -oP 'debian/\K.*' | grep -o '^[^.]*'); do \ cp ${CURDIR}/debian/source/lintian-overrides ${CURDIR}/debian/$$i.lintian-overrides; \ diff --git a/install/deb/debian/source/lintian-overrides b/install/deb/debian/source/lintian-overrides index 0c20c13e87..8386cd8f21 100644 --- a/install/deb/debian/source/lintian-overrides +++ b/install/deb/debian/source/lintian-overrides @@ -1,13 +1,15 @@ # Ignoring node_modules errors due to lack of ability to influence them -embedded-javascript-library var/www/{{product}}/services/*/node_modules/* +embedded-javascript-library var/www/{{product}}/*/node_modules/* # Ignoring node_modules errors due to lack of ability to influence them -executable-not-elf-or-script var/www/{{product}}/services/*/node_modules/* +executable-not-elf-or-script var/www/{{product}}/*/node_modules/* # Ignoring node_modules errors due to lack of ability to influence them -privacy-breach-generic var/www/{{product}}/services/*/node_modules/* +privacy-breach-generic var/www/{{product}}/*/node_modules/* # Ignoring node_modules errors due to lack of ability to influence them -script-not-executable var/www/{{product}}/services/*/node_modules/* +script-not-executable var/www/{{product}}/*/node_modules/* # Ignoring node_modules errors due to lack of ability to influence them unusual-interpreter */node_modules/* +# Ignoring node_modules errors due to lack of ability to influence them +statically-linked-binary var/www/{{product}}/*/node_modules/* # The use of the /var/www directory is caused by its past history as the default document root dir-or-file-in-var-www diff --git a/install/docker/.env b/install/docker/.env index a010cb2d35..b95b71c206 100644 --- a/install/docker/.env +++ b/install/docker/.env @@ -1,125 +1,148 @@ -# docker-compose tags # - PRODUCT=onlyoffice - REPO=${PRODUCT} - INSTALLATION_TYPE=COMMUNITY - STATUS="" - DOCKER_IMAGE_PREFIX=${STATUS}docspace - DOCKER_TAG=latest - CONTAINER_PREFIX=${PRODUCT}- - MYSQL_VERSION=8.3.0 - MYSQL_IMAGE=mysql:${MYSQL_VERSION} - SERVICE_PORT=5050 - DOCUMENT_SERVER_IMAGE_NAME=onlyoffice/4testing-documentserver-ee:latest - DOCKERFILE=Dockerfile.app - APP_DOTNET_ENV="" - EXTERNAL_PORT="80" - -# opensearch stack # - ELK_VERSION=2.11.1 - ELK_CONTAINER_NAME=${CONTAINER_PREFIX}opensearch - ELK_SHEME=http - ELK_HOST="" - ELK_PORT=9200 - DASHBOARDS_VERSION=2.11.1 - DASHBOARDS_CONTAINER_NAME=${CONTAINER_PREFIX}opensearch-dashboards - DASHBOARDS_USERNAME=onlyoffice - DASHBOARDS_PASSWORD=onlyoffice - -# app service environment # - ENV_EXTENSION=none - APP_CORE_BASE_DOMAIN=localhost - APP_URL_PORTAL="http://localhost:8092" - OAUTH_REDIRECT_URL="https://service.onlyoffice.com/oauth2.aspx" - WRONG_PORTAL_NAME_URL="" - LOG_LEVEL="Warning" - DEBUG_INFO="false" - - APP_KNOWN_PROXIES="" - APP_KNOWN_NETWORKS="" - APP_CORE_MACHINEKEY=your_core_machinekey - - CERTIFICATE_PATH="" - CERTIFICATE_KEY_PATH="" - DHPARAM_PATH="" - -# docs # - DOCUMENT_CONTAINER_NAME=${CONTAINER_PREFIX}document-server - DOCUMENT_SERVER_URL_EXTERNAL="" - DOCUMENT_SERVER_JWT_SECRET=your_jwt_secret - DOCUMENT_SERVER_JWT_HEADER=AuthorizationJwt - DOCUMENT_SERVER_URL_PUBLIC=/ds-vpath/ - -# redis # - REDIS_CONTAINER_NAME=${CONTAINER_PREFIX}redis - REDIS_HOST="" - REDIS_PORT=6379 - REDIS_USER_NAME="" - REDIS_PASSWORD="" - -# rabbitmq # - RABBIT_CONTAINER_NAME=${CONTAINER_PREFIX}rabbitmq - RABBIT_HOST="" - RABBIT_PORT=5672 - RABBIT_VIRTUAL_HOST=/ - RABBIT_USER_NAME=guest - RABBIT_PASSWORD=guest - -# mysql # - MYSQL_CONTAINER_NAME=${CONTAINER_PREFIX}mysql-server - MYSQL_HOST="" - MYSQL_PORT=3306 - MYSQL_ROOT_PASSWORD=my-secret-pw - MYSQL_DATABASE=docspace - MYSQL_USER=${PRODUCT}_user - MYSQL_PASSWORD=${PRODUCT}_pass - DATABASE_MIGRATION=false - MIGRATION_TYPE="SAAS" - -# service host # - API_SYSTEM_HOST=${CONTAINER_PREFIX}api-system - BACKUP_HOST=${CONTAINER_PREFIX}backup - BACKUP_BACKGRUOND_TASKS_HOST=${CONTAINER_PREFIX}backup-background-tasks - CLEAR_EVENTS_HOST=${CONTAINER_PREFIX}clear-events - FILES_HOST=${CONTAINER_PREFIX}files - FILES_SERVICES_HOST=${CONTAINER_PREFIX}files-services - STORAGE_MIGRATION_HOST=${CONTAINER_PREFIX}storage-migration - NOTIFY_HOST=${CONTAINER_PREFIX}notify - PEOPLE_SERVER_HOST=${CONTAINER_PREFIX}people-server - SOCKET_HOST=${CONTAINER_PREFIX}socket - STUDIO_NOTIFY_HOST=${CONTAINER_PREFIX}studio-notify - API_HOST=${CONTAINER_PREFIX}api - STUDIO_HOST=${CONTAINER_PREFIX}studio - SSOAUTH_HOST=${CONTAINER_PREFIX}ssoauth - TELEGRAMREPORTS_HOST=${CONTAINER_PREFIX}telegramreports - MIGRATION_RUNNER_HOST=${CONTAINER_PREFIX}migration-runner - PROXY_HOST=${CONTAINER_PREFIX}proxy - ROUTER_HOST=${CONTAINER_PREFIX}router - DOCEDITOR_HOST=${CONTAINER_PREFIX}doceditor - LOGIN_HOST=${CONTAINER_PREFIX}login - MANAGEMENT_HOST={CONTAINER_PREFIX}management - HELTHCHECKS_HOST=${CONTAINER_PREFIX}healthchecks - -# router upstream environment # - SERVICE_API_SYSTEM=${API_SYSTEM_HOST}:${SERVICE_PORT} - SERVICE_BACKUP=${BACKUP_HOST}:${SERVICE_PORT} - SERVICE_BACKUP_BACKGRUOND_TASKS=${BACKUP_BACKGRUOND_TASKS_HOST}:${SERVICE_PORT} - SERVICE_CLEAR_EVENTS=${CLEAR_EVENTS_HOST}:${SERVICE_PORT} - SERVICE_FILES=${FILES_HOST}:${SERVICE_PORT} - SERVICE_FILES_SERVICES=${FILES_SERVICES_HOST}:${SERVICE_PORT} - SERVICE_STORAGE_MIGRATION=${STORAGE_MIGRATION_HOST}:${SERVICE_PORT} - SERVICE_NOTIFY=${NOTIFY_HOST}:${SERVICE_PORT} - SERVICE_PEOPLE_SERVER=${PEOPLE_SERVER_HOST}:${SERVICE_PORT} - SERVICE_SOCKET=${SOCKET_HOST}:${SERVICE_PORT} - SERVICE_STUDIO_NOTIFY=${STUDIO_NOTIFY_HOST}:${SERVICE_PORT} - SERVICE_API=${API_HOST}:${SERVICE_PORT} - SERVICE_STUDIO=${STUDIO_HOST}:${SERVICE_PORT} - SERVICE_SSOAUTH=${SSOAUTH_HOST}:${SERVICE_PORT} - SERVICE_TELEGRAMREPORTS=${TELEGRAMREPORTS_HOST}:${SERVICE_PORT} - SERVICE_DOCEDITOR=${DOCEDITOR_HOST}:5013 - SERVICE_LOGIN=${LOGIN_HOST}:5011 - SERVICE_MANAGEMENT={MANAGEMENT_HOST}:${SERVICE_PORT} - SERVICE_HELTHCHECKS=${HELTHCHECKS_HOST}:${SERVICE_PORT} - - NETWORK_NAME=${PRODUCT} - - COMPOSE_IGNORE_ORPHANS=True +# docker-compose tags # + PRODUCT=onlyoffice + REPO=${PRODUCT} + INSTALLATION_TYPE=COMMUNITY + STATUS="" + DOCKER_IMAGE_PREFIX=${STATUS}docspace + DOCKER_TAG=latest + CONTAINER_PREFIX=${PRODUCT}- + MYSQL_VERSION=8.3.0 + MYSQL_IMAGE=mysql:${MYSQL_VERSION} + SERVICE_PORT=5050 + DOCUMENT_SERVER_IMAGE_NAME=onlyoffice/4testing-documentserver-ee:latest + DOCKERFILE=Dockerfile.app + APP_DOTNET_ENV="" + EXTERNAL_PORT="80" + UID="root" + GID="root" +# opensearch stack # + ELK_VERSION=2.11.1 + ELK_CONTAINER_NAME=${CONTAINER_PREFIX}opensearch + ELK_SHEME=http + ELK_HOST="" + ELK_PORT=9200 + DASHBOARDS_VERSION=2.11.1 + DASHBOARDS_CONTAINER_NAME=${CONTAINER_PREFIX}opensearch-dashboards + DASHBOARDS_USERNAME=onlyoffice + DASHBOARDS_PASSWORD=onlyoffice + FLUENT_BIT_VERSION=3.0.2 + FLUENT_BIT_CONTAINER_NAME=${CONTAINER_PREFIX}fluent-bit + +# app service environment # + ENV_EXTENSION=none + APP_CORE_BASE_DOMAIN=localhost + APP_URL_PORTAL="http://localhost:8092" + OAUTH_REDIRECT_URL="https://service.onlyoffice.com/oauth2.aspx" + WRONG_PORTAL_NAME_URL="" + LOG_LEVEL="Warning" + DEBUG_INFO="false" + + APP_KNOWN_PROXIES="" + APP_KNOWN_NETWORKS="" + APP_CORE_MACHINEKEY=your_core_machinekey + + CERTIFICATE_PATH="" + CERTIFICATE_KEY_PATH="" + DHPARAM_PATH="" + +# docs # + DOCUMENT_CONTAINER_NAME=${CONTAINER_PREFIX}document-server + DOCUMENT_SERVER_URL_EXTERNAL="" + DOCUMENT_SERVER_JWT_SECRET=your_jwt_secret + DOCUMENT_SERVER_JWT_HEADER=AuthorizationJwt + DOCUMENT_SERVER_URL_PUBLIC=/ds-vpath/ + +# redis # + REDIS_CONTAINER_NAME=${CONTAINER_PREFIX}redis + REDIS_HOST="" + REDIS_PORT=6379 + REDIS_USER_NAME="" + REDIS_PASSWORD="" + +# rabbitmq # + RABBIT_CONTAINER_NAME=${CONTAINER_PREFIX}rabbitmq + RABBIT_HOST="" + RABBIT_PORT=5672 + RABBIT_VIRTUAL_HOST=/ + RABBIT_USER_NAME=guest + RABBIT_PASSWORD=guest + +# mysql # + MYSQL_CONTAINER_NAME=${CONTAINER_PREFIX}mysql-server + MYSQL_HOST="" + MYSQL_PORT=3306 + MYSQL_ROOT_PASSWORD=my-secret-pw + MYSQL_DATABASE=docspace + MYSQL_USER=${PRODUCT}_user + MYSQL_PASSWORD=${PRODUCT}_pass + DATABASE_MIGRATION=false + MIGRATION_TYPE="SAAS" + +# service host # + API_SYSTEM_HOST=${CONTAINER_PREFIX}api-system + BACKUP_HOST=${CONTAINER_PREFIX}backup + BACKUP_BACKGRUOND_TASKS_HOST=${CONTAINER_PREFIX}backup-background-tasks + CLEAR_EVENTS_HOST=${CONTAINER_PREFIX}clear-events + FILES_HOST=${CONTAINER_PREFIX}files + FILES_SERVICES_HOST=${CONTAINER_PREFIX}files-services + STORAGE_MIGRATION_HOST=${CONTAINER_PREFIX}storage-migration + NOTIFY_HOST=${CONTAINER_PREFIX}notify + PEOPLE_SERVER_HOST=${CONTAINER_PREFIX}people-server + SOCKET_HOST=${CONTAINER_PREFIX}socket + STUDIO_NOTIFY_HOST=${CONTAINER_PREFIX}studio-notify + API_HOST=${CONTAINER_PREFIX}api + STUDIO_HOST=${CONTAINER_PREFIX}studio + SSOAUTH_HOST=${CONTAINER_PREFIX}ssoauth + TELEGRAMREPORTS_HOST=${CONTAINER_PREFIX}telegramreports + MIGRATION_RUNNER_HOST=${CONTAINER_PREFIX}migration-runner + PROXY_HOST=${CONTAINER_PREFIX}proxy + ROUTER_HOST=${CONTAINER_PREFIX}router + DOCEDITOR_HOST=${CONTAINER_PREFIX}doceditor + LOGIN_HOST=${CONTAINER_PREFIX}login + MANAGEMENT_HOST={CONTAINER_PREFIX}management + HELTHCHECKS_HOST=${CONTAINER_PREFIX}healthchecks + +# identity # + IDENTITY_DOCKERFILE=/Dockerfile + + JDBC_USER_NAME=root + JDBC_PASSWORD=${MYSQL_ROOT_PASSWORD} + JDBC_URL=${MYSQL_CONTAINER_NAME} + JDBC_DATABASE=${MYSQL_DATABASE} + + IDENTITY_PROFILE="dev" + + IDENTITY_MIGRATION_CONTAINER_NAME=${CONTAINER_PREFIX}identity_migration + IDENTITY_MIGRATION_SERVER_PORT=8081 + IDENTITY_AUTHORIZATION_CONTAINER_NAME=${CONTAINER_PREFIX}identity-authorization + IDENTITY_AUTHORIZATION_SERVER_PORT=8080 + IDENTITY_API_CONTAINER_NAME=${CONTAINER_PREFIX}identity-api + IDENTITY_API_SERVER_PORT=9090 + + REDIS_ADDRESSES=redis://onlyoffice-redis:6379 +# router upstream environment # + SERVICE_API_SYSTEM=${API_SYSTEM_HOST}:${SERVICE_PORT} + SERVICE_BACKUP=${BACKUP_HOST}:${SERVICE_PORT} + SERVICE_BACKUP_BACKGRUOND_TASKS=${BACKUP_BACKGRUOND_TASKS_HOST}:${SERVICE_PORT} + SERVICE_CLEAR_EVENTS=${CLEAR_EVENTS_HOST}:${SERVICE_PORT} + SERVICE_FILES=${FILES_HOST}:${SERVICE_PORT} + SERVICE_FILES_SERVICES=${FILES_SERVICES_HOST}:${SERVICE_PORT} + SERVICE_STORAGE_MIGRATION=${STORAGE_MIGRATION_HOST}:${SERVICE_PORT} + SERVICE_NOTIFY=${NOTIFY_HOST}:${SERVICE_PORT} + SERVICE_PEOPLE_SERVER=${PEOPLE_SERVER_HOST}:${SERVICE_PORT} + SERVICE_SOCKET=${SOCKET_HOST}:${SERVICE_PORT} + SERVICE_STUDIO_NOTIFY=${STUDIO_NOTIFY_HOST}:${SERVICE_PORT} + SERVICE_API=${API_HOST}:${SERVICE_PORT} + SERVICE_STUDIO=${STUDIO_HOST}:${SERVICE_PORT} + SERVICE_SSOAUTH=${SSOAUTH_HOST}:${SERVICE_PORT} + SERVICE_TELEGRAMREPORTS=${TELEGRAMREPORTS_HOST}:${SERVICE_PORT} + SERVICE_DOCEDITOR=${DOCEDITOR_HOST}:5013 + SERVICE_LOGIN=${LOGIN_HOST}:5011 + SERVICE_MANAGEMENT={MANAGEMENT_HOST}:${SERVICE_PORT} + SERVICE_HELTHCHECKS=${HELTHCHECKS_HOST}:${SERVICE_PORT} + SERVICE_IDENTITY_API=${IDENTITY_API_CONTAINER_NAME}:${IDENTITY_API_SERVER_PORT} + SERVICE_IDENTITY=${IDENTITY_AUTHORIZATION_CONTAINER_NAME}:${IDENTITY_AUTHORIZATION_SERVER_PORT} + + NETWORK_NAME=${PRODUCT} + + COMPOSE_IGNORE_ORPHANS=True diff --git a/install/docker/Dockerfile b/install/docker/Dockerfile index a88dea2d1b..0167719b6e 100644 --- a/install/docker/Dockerfile +++ b/install/docker/Dockerfile @@ -28,7 +28,7 @@ ARG PRODUCT_VERSION=0.0.0 ARG BUILD_NUMBER=0 LABEL onlyoffice.appserver.release-date="${RELEASE_DATE}" \ - maintainer="Ascensio System SIA " + maintainer="Ascensio System SIA " ENV LANG=en_US.UTF-8 \ LANGUAGE=en_US:en \ @@ -40,10 +40,10 @@ COPY . . RUN apt-get -y update && \ apt-get install -yq \ - sudo \ - locales \ - git \ - npm && \ + sudo \ + locales \ + git \ + npm && \ locale-gen en_US.UTF-8 && \ npm install --global yarn && \ echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_18.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ @@ -81,7 +81,7 @@ RUN mkdir -p /app/onlyoffice/ && \ rm -rf ${SRC_PATH}/products/ASC.Files/Service/* && \ rm -rf ${SRC_PATH}/products/ASC.Files/Server/* && \ rm -rf ${SRC_PATH}/products/ASC.People/Server/* - + FROM $DOTNET_RUN as dotnetrun ARG BUILD_PATH ARG SRC_PATH @@ -98,16 +98,16 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - python3-pip \ - nano \ - curl \ - vim \ - libgdiplus && \ + python3-pip \ + nano \ + curl \ + vim \ + libgdiplus && \ pip3 install --upgrade jsonpath-ng multipledispatch netaddr netifaces && \ rm -rf /var/lib/apt/lists/* COPY --from=base --chown=onlyoffice:onlyoffice /app/onlyoffice/config/* /app/onlyoffice/config/ - + #USER onlyoffice EXPOSE 5050 ENTRYPOINT ["python3", "docker-entrypoint.py"] @@ -127,10 +127,10 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - nano \ - curl \ - vim \ - python3-pip && \ + nano \ + curl \ + vim \ + python3-pip && \ pip3 install --upgrade jsonpath-ng multipledispatch netaddr netifaces --break-system-packages && \ rm -rf /var/lib/apt/lists/* @@ -176,6 +176,8 @@ RUN chown nginx:nginx /etc/nginx/* -R && \ sed -i 's/127.0.0.1:9834/$service_sso/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5013/$service_doceditor/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5011/$service_login/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:9090/$service_identity_api/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:8080/$service_identity/' /etc/nginx/conf.d/onlyoffice.conf && \ if [[ -z "${SERVICE_CLIENT}" ]] ; then sed -i 's/127.0.0.1:5001/$service_client/' /etc/nginx/conf.d/onlyoffice.conf; fi && \ if [[ -z "${SERVICE_MANAGEMENT}" ]] ; then sed -i 's/127.0.0.1:5015/$service_management/' /etc/nginx/conf.d/onlyoffice.conf; fi && \ sed -i 's/127.0.0.1:5033/$service_healthchecks/' /etc/nginx/conf.d/onlyoffice.conf && \ diff --git a/install/docker/Dockerfile.app b/install/docker/Dockerfile.app index 5e0d49bf2d..f60b96381b 100644 --- a/install/docker/Dockerfile.app +++ b/install/docker/Dockerfile.app @@ -17,7 +17,7 @@ ARG DEBUG_INFO="true" ARG PUBLISH_CNF="Release" LABEL onlyoffice.appserver.release-date="${RELEASE_DATE}" \ - maintainer="Ascensio System SIA " + maintainer="Ascensio System SIA " ENV LANG=en_US.UTF-8 \ LANGUAGE=en_US:en \ @@ -25,11 +25,11 @@ ENV LANG=en_US.UTF-8 \ RUN apt-get -y update && \ apt-get install -yq \ - sudo \ - locales \ - git \ - python3-pip \ - npm && \ + sudo \ + locales \ + git \ + python3-pip \ + npm && \ locale-gen en_US.UTF-8 && \ npm install --global yarn && \ echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ @@ -52,7 +52,7 @@ RUN cd ${SRC_PATH} && \ cd ${SRC_PATH} && \ cp buildtools/config/*.config /app/onlyoffice/config/ && \ mkdir -p /etc/nginx/conf.d && cp -f buildtools/config/nginx/onlyoffice*.conf /etc/nginx/conf.d/ && \ - mkdir -p /etc/nginx/includes/ && cp -f buildtools/config/nginx/includes/onlyoffice*.conf /etc/nginx/includes/ && \ + mkdir -p /etc/nginx/includes/ && cp -f buildtools/config/nginx/includes/onlyoffice*.conf /etc/nginx/includes/ && cp -f buildtools/config/nginx/includes/server-*.conf /etc/nginx/includes/ && \ sed -i "s/\"number\".*,/\"number\": \"${PRODUCT_VERSION}.${BUILD_NUMBER}\",/g" /app/onlyoffice/config/appsettings.json && \ sed -e 's/#//' -i /etc/nginx/conf.d/onlyoffice.conf && \ cd ${SRC_PATH}/buildtools/install/common/ && \ @@ -66,8 +66,8 @@ RUN cd ${SRC_PATH} && \ rm -rf ${SRC_PATH}/server/products/ASC.Files/Server/* && \ rm -rf ${SRC_PATH}/server/products/ASC.Files/Service/* && \ rm -rf ${SRC_PATH}/server/products/ASC.People/Server/* - -COPY config/mysql/conf.d/mysql.cnf /etc/mysql/conf.d/mysql.cnf + +COPY --chown=onlyoffice:onlyoffice config/mysql/conf.d/mysql.cnf /etc/mysql/conf.d/mysql.cnf FROM $DOTNET_RUN as dotnetrun ARG BUILD_PATH @@ -85,18 +85,18 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - sudo \ - nano \ - curl \ - vim \ - python3-pip \ - libgdiplus && \ + sudo \ + nano \ + curl \ + vim \ + python3-pip \ + libgdiplus && \ pip3 install --upgrade --break-system-packages jsonpath-ng multipledispatch netaddr netifaces && \ rm -rf /var/lib/apt/lists/* COPY --from=base --chown=onlyoffice:onlyoffice /app/onlyoffice/config/* /app/onlyoffice/config/ - -#USER onlyoffice + +USER onlyoffice EXPOSE 5050 ENTRYPOINT ["python3", "docker-entrypoint.py"] @@ -115,16 +115,16 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - sudo \ - nano \ - curl \ - vim \ - python3-pip && \ - pip3 install --upgrade --break-system-packages jsonpath-ng multipledispatch netaddr netifaces && \ + sudo \ + nano \ + curl \ + vim \ + python3-pip && \ + pip3 install --upgrade --break-system-packages jsonpath-ng multipledispatch netaddr netifaces && \ rm -rf /var/lib/apt/lists/* COPY --from=base --chown=onlyoffice:onlyoffice /app/onlyoffice/config/* /app/onlyoffice/config/ - +USER onlyoffice EXPOSE 5050 ENTRYPOINT ["python3", "docker-entrypoint.py"] @@ -139,25 +139,32 @@ ENV DNS_NAMESERVER=127.0.0.11 \ RUN apt-get -y update && \ apt-get install -yq vim && \ + mkdir -p /var/log/nginx/ && \ addgroup --system --gid 107 onlyoffice && \ adduser -uid 104 --quiet --home /var/www/onlyoffice --system --gid 107 onlyoffice && \ rm -rf /var/lib/apt/lists/* && \ - rm -rf /usr/share/nginx/html/* + rm -rf /usr/share/nginx/html/* && \ + chown -R onlyoffice:onlyoffice /etc/nginx/ && \ + chown -R onlyoffice:onlyoffice /var/ && \ + chown -R onlyoffice:onlyoffice /usr/ && \ + chown -R onlyoffice:onlyoffice /run/ && \ + chown -R onlyoffice:onlyoffice /var/log/nginx/ # copy static services files and config values -COPY --from=base /etc/nginx/conf.d /etc/nginx/conf.d -COPY --from=base /etc/nginx/includes /etc/nginx/includes -COPY --from=base ${SRC_PATH}/publish/web/client ${BUILD_PATH}/client -COPY --from=base ${SRC_PATH}/publish/web/public ${BUILD_PATH}/public -COPY --from=base ${SRC_PATH}/campaigns/src/campaigns ${BUILD_PATH}/public/campaigns -COPY --from=base ${SRC_PATH}/publish/web/management ${BUILD_PATH}/management -COPY --from=base ${SRC_PATH}/buildtools/install/docker/config/nginx/docker-entrypoint.d /docker-entrypoint.d -COPY --from=base ${SRC_PATH}/buildtools/install/docker/config/nginx/templates/upstream.conf.template /etc/nginx/templates/upstream.conf.template -COPY --from=base ${SRC_PATH}/buildtools/install/docker/config/nginx/templates/nginx.conf.template /etc/nginx/nginx.conf.template -COPY --from=base ${SRC_PATH}/buildtools/config/nginx/html /etc/nginx/html -COPY --from=base ${SRC_PATH}/buildtools/install/docker/prepare-nginx-router.sh /docker-entrypoint.d/prepare-nginx-router.sh -COPY --from=base ${SRC_PATH}/buildtools/install/docker/config/nginx/docker-entrypoint.sh /docker-entrypoint.sh +COPY --from=base --chown=onlyoffice:onlyoffice /etc/nginx/conf.d /etc/nginx/conf.d +COPY --from=base --chown=onlyoffice:onlyoffice /etc/nginx/includes /etc/nginx/includes +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/publish/web/client ${BUILD_PATH}/client +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/publish/web/public ${BUILD_PATH}/public +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/campaigns/src/campaigns ${BUILD_PATH}/public/campaigns +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/publish/web/management ${BUILD_PATH}/management +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/install/docker/config/nginx/docker-entrypoint.d /docker-entrypoint.d +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/install/docker/config/nginx/templates/upstream.conf.template /etc/nginx/templates/upstream.conf.template +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/install/docker/config/nginx/templates/nginx.conf.template /etc/nginx/nginx.conf.template +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/config/nginx/html /etc/nginx/html +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/install/docker/prepare-nginx-router.sh /docker-entrypoint.d/prepare-nginx-router.sh +COPY --from=base --chown=onlyoffice:onlyoffice ${SRC_PATH}/buildtools/install/docker/config/nginx/docker-entrypoint.sh /docker-entrypoint.sh +USER onlyoffice # changes for upstream configure RUN sed -i 's/127.0.0.1:5010/$service_api_system/' /etc/nginx/conf.d/onlyoffice.conf && \ @@ -170,10 +177,12 @@ RUN sed -i 's/127.0.0.1:5010/$service_api_system/' /etc/nginx/conf.d/onlyoffice. sed -i 's/127.0.0.1:9834/$service_sso/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5013/$service_doceditor/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5011/$service_login/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:9090/$service_identity_api/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:8080/$service_identity/' /etc/nginx/conf.d/onlyoffice.conf && \ if [[ -z "${SERVICE_CLIENT}" ]] ; then sed -i 's/127.0.0.1:5001/$service_client/' /etc/nginx/conf.d/onlyoffice.conf; fi && \ if [[ -z "${SERVICE_MANAGEMENT}" ]] ; then sed -i 's/127.0.0.1:5015/$service_management/' /etc/nginx/conf.d/onlyoffice.conf; fi && \ sed -i 's/127.0.0.1:5033/$service_healthchecks/' /etc/nginx/conf.d/onlyoffice.conf && \ - sed -i 's/127.0.0.1:5601/$dashboards_host:5601/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:5601/$dashboards_host:5601/' /etc/nginx/includes/server-dashboards.conf && \ sed -i 's/$public_root/\/var\/www\/public\//' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/http:\/\/172.*/$document_server;/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i '/client_body_temp_path/ i \ \ \ \ $MAP_HASH_BUCKET_SIZE' /etc/nginx/nginx.conf.template && \ @@ -251,14 +260,14 @@ CMD ["ASC.Files.dll", "ASC.Files"] FROM dotnetrun AS files_services ENV LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64 WORKDIR ${BUILD_PATH}/products/ASC.Files/service/ - +USER root RUN echo "deb http://security.ubuntu.com/ubuntu focal-security main" | tee /etc/apt/sources.list && \ - apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32 && \ - apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C && \ - apt-get -y update && \ - apt-get install -yq libssl1.1 && \ - rm -rf /var/lib/apt/lists/* - + apt-key adv --keyserver keys.gnupg.net --recv-keys 3B4FE6ACC0B21F32 && \ + apt-key adv --keyserver keys.gnupg.net --recv-keys 871920D1991BC93C && \ + apt-get -y update && \ + apt-get install -yq libssl1.1 && \ + rm -rf /var/lib/apt/lists/* +USER onlyoffice COPY --chown=onlyoffice:onlyoffice docker-entrypoint.py ./docker-entrypoint.py COPY --from=base --chown=onlyoffice:onlyoffice ${BUILD_PATH}/services/ASC.Files.Service/service/ . COPY --from=onlyoffice/ffvideo:6.0 --chown=onlyoffice:onlyoffice /usr/local /usr/local/ @@ -344,6 +353,9 @@ ARG BUILD_PATH ARG SRC_PATH ENV BUILD_PATH=${BUILD_PATH} ENV SRC_PATH=${SRC_PATH} +RUN addgroup --system --gid 107 onlyoffice && \ + adduser -uid 104 --quiet --home /var/www/onlyoffice --system --gid 107 onlyoffice +USER onlyoffice WORKDIR ${BUILD_PATH}/services/ASC.Migration.Runner/ COPY ./docker-migration-entrypoint.sh ./docker-migration-entrypoint.sh COPY --from=base ${SRC_PATH}/server/ASC.Migration.Runner/service/ . @@ -356,15 +368,17 @@ RUN mkdir -p /app/ASC.Files/server && \ mkdir -p /app/ASC.People/server && \ addgroup --system --gid 107 onlyoffice && \ adduser -u 104 onlyoffice --home /var/www/onlyoffice --system -G onlyoffice - -COPY bin-share-docker-entrypoint.sh /app/docker-entrypoint.sh -COPY --from=base /var/www/products/ASC.Files/server/ /app/ASC.Files/server/ -COPY --from=base /var/www/products/ASC.People/server/ /app/ASC.People/server/ +USER onlyoffice +COPY --chown=onlyoffice:onlyoffice bin-share-docker-entrypoint.sh /app/docker-entrypoint.sh +COPY --from=base --chown=onlyoffice:onlyoffice /var/www/products/ASC.Files/server/ /app/ASC.Files/server/ +COPY --from=base --chown=onlyoffice:onlyoffice /var/www/products/ASC.People/server/ /app/ASC.People/server/ ENTRYPOINT ["./app/docker-entrypoint.sh"] ## image for k8s wait-bin-share ## FROM busybox:latest AS wait_bin_share -RUN mkdir /app - -COPY wait-bin-share-docker-entrypoint.sh /app/docker-entrypoint.sh +RUN addgroup --system --gid 107 onlyoffice && \ + adduser -u 104 onlyoffice --home /var/www/onlyoffice --system -G onlyoffice && \ + mkdir /app +USER onlyoffice +COPY --chown=onlyoffice:onlyoffice wait-bin-share-docker-entrypoint.sh /app/docker-entrypoint.sh ENTRYPOINT ["./app/docker-entrypoint.sh"] diff --git a/install/docker/Dockerfile.runtime b/install/docker/Dockerfile.runtime index 1a8a023bb2..14319ff82e 100644 --- a/install/docker/Dockerfile.runtime +++ b/install/docker/Dockerfile.runtime @@ -36,11 +36,11 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - python3-pip \ - nano \ - curl \ - vim \ - libgdiplus && \ + python3-pip \ + nano \ + curl \ + vim \ + libgdiplus && \ pip3 install --upgrade jsonpath-ng multipledispatch netaddr netifaces --break-system-packages && \ rm -rf /var/lib/apt/lists/* @@ -64,10 +64,10 @@ RUN mkdir -p /var/log/onlyoffice && \ chown onlyoffice:onlyoffice /var/www -R && \ apt-get -y update && \ apt-get install -yq \ - nano \ - curl \ - vim \ - python3-pip && \ + nano \ + curl \ + vim \ + python3-pip && \ pip3 install --upgrade jsonpath-ng multipledispatch netaddr netifaces --break-system-packages && \ rm -rf /var/lib/apt/lists/* @@ -122,6 +122,8 @@ RUN chown onlyoffice:onlyoffice /etc/nginx/* -R && \ sed -i 's/127.0.0.1:9834/$service_sso/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5013/$service_doceditor/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5011/$service_login/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:9090/$service_identity_api/' /etc/nginx/conf.d/onlyoffice.conf && \ + sed -i 's/127.0.0.1:8080/$service_identity/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5001/$service_client/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5015/$service_management/' /etc/nginx/conf.d/onlyoffice.conf && \ sed -i 's/127.0.0.1:5033/$service_healthchecks/' /etc/nginx/conf.d/onlyoffice.conf && \ diff --git a/install/docker/bin-share-docker-entrypoint.sh b/install/docker/bin-share-docker-entrypoint.sh index 2f9b5f3da5..c4c78feb8d 100755 --- a/install/docker/bin-share-docker-entrypoint.sh +++ b/install/docker/bin-share-docker-entrypoint.sh @@ -5,6 +5,5 @@ echo "##### Run preparation for launching DocSpace services #####" echo "##################################################################" cp -r /app/ASC.Files/server/* /var/www/products/ASC.Files/server/ cp -r /app/ASC.People/server/* /var/www/products/ASC.People/server/ -chown -R onlyoffice:onlyoffice /var/www/products/ echo "Ok" > /var/www/products/ASC.Files/server/status.txt echo "Preparation for launching DocSpace services is complete" diff --git a/install/docker/config/docspace-logs b/install/docker/config/docspace-logs deleted file mode 100644 index e8c34e7a3b..0000000000 --- a/install/docker/config/docspace-logs +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/bash - -set -e - -PRODUCT="docspace" -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" -DOCKERCOMPOSE=$(dirname "$DIR") - -if [ -f "${DOCKERCOMPOSE}/docspace.yml" ]; then - : -elif [ -f "/app/onlyoffice/${PRODUCT}.yml" ]; then - DOCKERCOMPOSE="/app/onlyoffice" -else - echo "Error: yml files not found." && exit 1 -fi - -FILES=("${PRODUCT}" "notify" "healthchecks" "proxy" "ds" "rabbitmq" "redis" "opensearch" "dashboards" "db") - -LOG_DIR="${DOCKERCOMPOSE}/logs" -mkdir -p ${LOG_DIR} - -echo "Creating ${PRODUCT} logs to a directory ${LOG_DIR}..." -for FILE in "${FILES[@]}"; do - SERVICE_NAMES=($(docker-compose -f ${DOCKERCOMPOSE}/${FILE}.yml config --services)) - for SERVICE_NAME in "${SERVICE_NAMES[@]}"; do - if [[ $(docker-compose -f ${DOCKERCOMPOSE}/${FILE}.yml ps -q ${SERVICE_NAME} | wc -l) -eq 1 ]]; then - docker-compose -f ${DOCKERCOMPOSE}/${FILE}.yml logs ${SERVICE_NAME} > ${LOG_DIR}/${SERVICE_NAME}.log - else - echo "The ${SERVICE_NAME} service is not running" - fi - done -done -echo "OK" diff --git a/install/docker/config/docspace-ssl-setup b/install/docker/config/docspace-ssl-setup index d8e01ce200..5521c96144 100644 --- a/install/docker/config/docspace-ssl-setup +++ b/install/docker/config/docspace-ssl-setup @@ -72,12 +72,9 @@ case $1 in fi if grep -q '${CERTIFICATE_PATH}:' ${DOCKERCOMPOSE}/docspace.yml; then - sed -i '/${CERTIFICATE_PATH}:/d' ${DOCKERCOMPOSE}/docspace.yml - docker-compose -f ${DOCKERCOMPOSE}/docspace.yml up --force-recreate -d onlyoffice-doceditor onlyoffice-login onlyoffice-socket onlyoffice-ssoauth - fi - - if grep -q 'USE_UNAUTHORIZED_STORAGE' ${DOCKERCOMPOSE}/ds.yml; then sed -i '/USE_UNAUTHORIZED_STORAGE/d' ${DOCKERCOMPOSE}/ds.yml + sed -i '/${CERTIFICATE_PATH}:/d' ${DOCKERCOMPOSE}/docspace.yml ${DOCKERCOMPOSE}/ds.yml + docker-compose -f ${DOCKERCOMPOSE}/docspace.yml up --force-recreate -d onlyoffice-doceditor onlyoffice-login onlyoffice-socket onlyoffice-ssoauth docker-compose -f ${DOCKERCOMPOSE}/ds.yml up --force-recreate -d fi @@ -112,7 +109,7 @@ case $1 in -v /var/log:/var/log \ -v onlyoffice_webroot_path:${WEBROOT_PATH} \ certbot/certbot certonly \ - --expand --webroot -w ${WEBROOT_PATH} \ + --expand --webroot -w ${WEBROOT_PATH} --key-type rsa \ --cert-name ${PRODUCT} --non-interactive --agree-tos --email ${MAIL} -d ${DOMAINS[@]} else help @@ -148,14 +145,14 @@ if [ -f "${CERTIFICATE_FILE}" ]; then echo -e "@weekly root ${DIR}/${PRODUCT}-renew-letsencrypt" | tee /etc/cron.d/${PRODUCT}-letsencrypt fi else - CERTIFICATE_SUBJECT=$(openssl x509 -subject -noout -in "${CERTIFICATE_FILE}" | sed 's/subject=//') - CERTIFICATE_ISSUER=$(openssl x509 -issuer -noout -in "${CERTIFICATE_FILE}" | sed 's/issuer=//') + CERTIFICATE_SUBJECT=$(openssl x509 -subject -noout -in "${CERTIFICATE_FILE}" | sed -n 's/^.*CN *= *\([^,]*\).*$/\1/p' | awk -F. '{print $(NF-1)"."$NF}') + CERTIFICATE_ISSUER=$(openssl x509 -issuer -noout -in "${CERTIFICATE_FILE}" | sed -n 's/^.*CN *= *\([^,]*\).*$/\1/p' | awk -F. '{print $(NF-1)"."$NF}') #Checking whether the certificate is self-signed if [[ -n "$CERTIFICATE_SUBJECT" && -n "$CERTIFICATE_ISSUER" && "$CERTIFICATE_SUBJECT" == "$CERTIFICATE_ISSUER" ]]; then sed -i '/app_data:\/.*/a \ - ${CERTIFICATE_PATH}:${CERTIFICATE_PATH}' ${DOCKERCOMPOSE}/docspace.yml docker-compose -f ${DOCKERCOMPOSE}/docspace.yml up --force-recreate -d onlyoffice-doceditor onlyoffice-login onlyoffice-socket onlyoffice-ssoauth - sed -i '/environment:/a \ - USE_UNAUTHORIZED_STORAGE=true' ${DOCKERCOMPOSE}/ds.yml + sed -i '/app_data:\/.*/a \ - ${CERTIFICATE_PATH}:/var/www/onlyoffice/Data/certs/extra-ca-certs.pem' ${DOCKERCOMPOSE}/ds.yml docker-compose -f ${DOCKERCOMPOSE}/ds.yml up --force-recreate -d fi fi diff --git a/install/docker/config/fluent-bit.conf b/install/docker/config/fluent-bit.conf index 5e9b731523..acffc677b1 100644 --- a/install/docker/config/fluent-bit.conf +++ b/install/docker/config/fluent-bit.conf @@ -4,14 +4,14 @@ Daemon off [INPUT] - Name forward - Listen 127.0.0.1 - Port 24224 - -[INPUT] - Name exec - Interval_Sec 86400 - Command curl -s -X POST 'OPENSEARCH_SCHEME://OPENSEARCH_HOST:OPENSEARCH_PORT/OPENSEARCH_INDEX/_delete_by_query' -H 'Content-Type: application/json' -d "{\"query\": {\"range\": {\"@timestamp\": {\"lt\": \"$(date -u -d '30 days ago' '+%Y-%m-%dT%H:%M:%S')\"}}}}" + Name tail + Path /var/log/onlyoffice/*.log, /var/log/onlyoffice/**/**/*.log + Exclude_Path /var/log/onlyoffice/*.sql.log + Path_Key filename + Mem_Buf_Limit 500MB + Refresh_Interval 60 + Ignore_Older 30d + Skip_Empty_Lines true [OUTPUT] Name opensearch @@ -20,6 +20,7 @@ Port OPENSEARCH_PORT Replace_Dots On Suppress_Type_Name On + Compress gzip Time_Key @timestamp Type _doc Index OPENSEARCH_INDEX diff --git a/install/docker/config/nginx/onlyoffice-proxy-ssl.conf b/install/docker/config/nginx/onlyoffice-proxy-ssl.conf index 3cf3dce2a5..1dbe016713 100644 --- a/install/docker/config/nginx/onlyoffice-proxy-ssl.conf +++ b/install/docker/config/nginx/onlyoffice-proxy-ssl.conf @@ -7,6 +7,9 @@ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_hide_header 'Server'; proxy_hide_header 'X-Powered-By'; +access_log /var/log/nginx/access-proxy.log; +error_log /var/log/nginx/error-proxy.log; + ## HTTP host server { listen 0.0.0.0:80; @@ -32,8 +35,14 @@ server { ## HTTPS host server { + # Enable HTTP/2 listen 0.0.0.0:443 ssl; listen [::]:443 ssl default_server; + + # Enable QUIC and HTTP/3. + listen 0.0.0.0:443 quic reuseport; + listen [::]:443 quic reuseport; + root /usr/share/nginx/html; client_max_body_size 4G; @@ -48,7 +57,7 @@ server { ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; - ssl_protocols TLSv1.2; + ssl_protocols TLSv1.2 TLSv1.3; ssl_session_cache builtin:1000 shared:SSL:10m; ssl_prefer_server_ciphers on; @@ -56,6 +65,7 @@ server { add_header Strict-Transport-Security max-age=31536000; # add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; + add_header alt-svc 'h3=":443"; ma=86400'; ## [Optional] If your certficate has OCSP, enable OCSP stapling to reduce the overhead and latency of running SSL. ## Replace with your ssl_trusted_certificate. For more info see: diff --git a/install/docker/config/nginx/onlyoffice-proxy.conf b/install/docker/config/nginx/onlyoffice-proxy.conf index 1180039766..bfa3d940f0 100644 --- a/install/docker/config/nginx/onlyoffice-proxy.conf +++ b/install/docker/config/nginx/onlyoffice-proxy.conf @@ -7,6 +7,9 @@ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_hide_header 'Server'; proxy_hide_header 'X-Powered-By'; +access_log /var/log/nginx/access-proxy.log; +error_log /var/log/nginx/error-proxy.log; + server { listen 0.0.0.0:80; listen [::]:80 default_server; diff --git a/install/docker/config/nginx/templates/upstream.conf.template b/install/docker/config/nginx/templates/upstream.conf.template index f19236c92e..f9755c2b6c 100644 --- a/install/docker/config/nginx/templates/upstream.conf.template +++ b/install/docker/config/nginx/templates/upstream.conf.template @@ -54,6 +54,18 @@ map $SERVICE_API $service_api { default $SERVICE_API; } +map $SERVICE_IDENTITY_API $service_identity_api { + volatile; + "" 127.0.0.1:9090; + default $SERVICE_IDENTITY_API; +} + +map $SERVICE_IDENTITY $service_identity { + volatile; + "" 127.0.0.1:8080; + default $SERVICE_IDENTITY; +} + map $SERVICE_STUDIO $service_studio { volatile; "" 127.0.0.1:5003; diff --git a/install/docker/dashboards.yml b/install/docker/dashboards.yml index ec7b0ddd74..fe18d0b2cf 100644 --- a/install/docker/dashboards.yml +++ b/install/docker/dashboards.yml @@ -1,4 +1,3 @@ -version: "3" services: onlyoffice-opensearch-dashboards: image: opensearchproject/opensearch-dashboards:${DASHBOARDS_VERSION} diff --git a/install/docker/db.yml b/install/docker/db.yml index 449ea73da6..e62ec51834 100644 --- a/install/docker/db.yml +++ b/install/docker/db.yml @@ -1,7 +1,6 @@ services: onlyoffice-mysql-server: image: ${MYSQL_IMAGE} - command: --default-authentication-plugin=caching_sha2_password cap_add: - SYS_NICE container_name: ${MYSQL_CONTAINER_NAME} @@ -17,6 +16,11 @@ services: MYSQL_DATABASE: ${MYSQL_DATABASE} MYSQL_USER: ${MYSQL_USER} MYSQL_PASSWORD: ${MYSQL_PASSWORD} + healthcheck: + test: ["CMD-SHELL", "mysqladmin ping --silent"] + interval: 10s + timeout: 5s + retries: 3 volumes: - mysql_data:/var/lib/mysql - ./config/mysql/conf.d/:/etc/mysql/conf.d diff --git a/install/docker/docker-entrypoint.py b/install/docker/docker-entrypoint.py index 137356e1b6..e1a3522623 100644 --- a/install/docker/docker-entrypoint.py +++ b/install/docker/docker-entrypoint.py @@ -200,6 +200,7 @@ writeJsonFile(filePath, jsonData) filePath = "/app/onlyoffice/config/appsettings.services.json" jsonData = openJsonFile(filePath) +updateJsonData(jsonData,"$.logPath", LOG_DIR) updateJsonData(jsonData,"$.logLevel", LOG_LEVEL) writeJsonFile(filePath, jsonData) @@ -215,13 +216,14 @@ if OAUTH_REDIRECT_URL: writeJsonFile(filePath, jsonData) -filePath = "/app/onlyoffice/config/elastic.json" -jsonData = openJsonFile(filePath) -jsonData["elastic"]["Scheme"] = ELK_SHEME -jsonData["elastic"]["Host"] = ELK_CONNECTION_HOST -jsonData["elastic"]["Port"] = ELK_PORT -jsonData["elastic"]["Threads"] = ELK_THREADS -writeJsonFile(filePath, jsonData) +if ENV_EXTENSION != "dev": + filePath = "/app/onlyoffice/config/elastic.json" + jsonData = openJsonFile(filePath) + jsonData["elastic"]["Scheme"] = ELK_SHEME + jsonData["elastic"]["Host"] = ELK_CONNECTION_HOST + jsonData["elastic"]["Port"] = ELK_PORT + jsonData["elastic"]["Threads"] = ELK_THREADS + writeJsonFile(filePath, jsonData) filePath = "/app/onlyoffice/config/socket.json" jsonData = openJsonFile(filePath) diff --git a/install/docker/docspace.overcome.yml b/install/docker/docspace.overcome.yml index f8fd748e9d..1fb2b659c4 100644 --- a/install/docker/docspace.overcome.yml +++ b/install/docker/docspace.overcome.yml @@ -149,8 +149,13 @@ services: onlyoffice-studio: <<: *x-profiles-local image: ${Baseimage_Dotnet_Run} - working_dir: ${BUILD_PATH}/studio/ASC.Web.Studio/ - command: ["ASC.Web.Studio.dll", "ASC.Web.Studio"] + working_dir: ${BUILD_PATH}/studio/ASC.Web.Studio/ + command: + [ + "ASC.Web.Studio.dll", + "ASC.Web.Studio", + "core:eventBus:subscriptionClientName=asc_event_bus_webstudio_queue", + ] volumes: - ${SRC_PATH}/ASC.Web.Studio/service:${BUILD_PATH}/studio/ASC.Web.Studio/ - ${SRC_PATH}/ASC.Files/service/:${BUILD_PATH}/products/ASC.Files/server/ diff --git a/install/docker/docspace.profiles.yml b/install/docker/docspace.profiles.yml index b6d0a7b75b..0926d1d8ac 100644 --- a/install/docker/docspace.profiles.yml +++ b/install/docker/docspace.profiles.yml @@ -264,6 +264,8 @@ services: - SERVICE_NOTIFY=${SERVICE_NOTIFY} - SERVICE_PEOPLE_SERVER=${SERVICE_PEOPLE_SERVER} - SERVICE_SOCKET=${SERVICE_SOCKET} + - SERVICE_IDENTITY_API=${SERVICE_IDENTITY_API} + - SERVICE_IDENTITY=${SERVICE_IDENTITY} - SERVICE_STUDIO_NOTIFY=${SERVICE_STUDIO_NOTIFY} - SERVICE_API=${SERVICE_API} - SERVICE_API_SYSTEM=${SERVICE_API_SYSTEM} diff --git a/install/docker/docspace.yml b/install/docker/docspace.yml index e9b4f8533a..687ff48139 100644 --- a/install/docker/docspace.yml +++ b/install/docker/docspace.yml @@ -1,5 +1,5 @@ -x-healthcheck: - &x-healthcheck +version: "3.8" +x-healthcheck: &x-healthcheck test: curl --fail http://127.0.0.1 || exit 1 interval: 60s retries: 5 @@ -8,6 +8,7 @@ x-healthcheck: x-service: &x-service-base container_name: base + user: "${UID}:${GID}" restart: always expose: - ${SERVICE_PORT} @@ -53,6 +54,7 @@ x-service: &x-service-base CERTIFICATE_PATH: ${CERTIFICATE_PATH} volumes: #- /app/onlyoffice/CommunityServer/data:/app/onlyoffice/data + - log_data:/var/log/onlyoffice - app_data:/app/onlyoffice/data - files_data:/var/www/products/ASC.Files/server/ - people_data:/var/www/products/ASC.People/server/ @@ -63,48 +65,48 @@ services: image: "${REPO}/${DOCKER_IMAGE_PREFIX}-backup-background:${DOCKER_TAG}" container_name: ${BACKUP_BACKGRUOND_TASKS_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_BACKUP_BACKGRUOND_TASKS}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_BACKUP_BACKGRUOND_TASKS}/health/ || exit 1 onlyoffice-backup: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-backup:${DOCKER_TAG}" container_name: ${BACKUP_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_BACKUP}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_BACKUP}/health/ || exit 1 onlyoffice-clear-events: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-clear-events:${DOCKER_TAG}" container_name: ${CLEAR_EVENTS_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_CLEAR_EVENTS}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_CLEAR_EVENTS}/health/ || exit 1 onlyoffice-files: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-files:${DOCKER_TAG}" container_name: ${FILES_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_FILES}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_FILES}/health/ || exit 1 onlyoffice-files-services: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-files-services:${DOCKER_TAG}" container_name: ${FILES_SERVICES_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_FILES_SERVICES}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_FILES_SERVICES}/health/ || exit 1 onlyoffice-people-server: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-people-server:${DOCKER_TAG}" container_name: ${PEOPLE_SERVER_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_PEOPLE_SERVER}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_PEOPLE_SERVER}/health/ || exit 1 onlyoffice-socket: <<: *x-service-base @@ -118,32 +120,32 @@ services: image: "${REPO}/${DOCKER_IMAGE_PREFIX}-studio-notify:${DOCKER_TAG}" container_name: ${STUDIO_NOTIFY_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_STUDIO_NOTIFY}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_STUDIO_NOTIFY}/health/ || exit 1 onlyoffice-api: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-api:${DOCKER_TAG}" container_name: ${API_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_API}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_API}/health/ || exit 1 onlyoffice-api-system: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-api-system:${DOCKER_TAG}" container_name: ${API_SYSTEM_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_API_SYSTEM}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_API_SYSTEM}/health/ || exit 1 onlyoffice-studio: <<: *x-service-base image: "${REPO}/${DOCKER_IMAGE_PREFIX}-studio:${DOCKER_TAG}" container_name: ${STUDIO_HOST} healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_STUDIO}/health/ || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_STUDIO}/health/ || exit 1 onlyoffice-ssoauth: <<: *x-service-base @@ -160,8 +162,8 @@ services: expose: - "5013" healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_DOCEDITOR}/health || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_DOCEDITOR}/doceditor/health || exit 1 onlyoffice-login: <<: *x-service-base @@ -170,16 +172,17 @@ services: expose: - "5011" healthcheck: - <<: *x-healthcheck - test: curl --fail http://${SERVICE_LOGIN}/health || exit 1 + <<: *x-healthcheck + test: curl --fail http://${SERVICE_LOGIN}/login/health || exit 1 onlyoffice-router: image: "${REPO}/${DOCKER_IMAGE_PREFIX}-router:${DOCKER_TAG}" container_name: ${ROUTER_HOST} + user: "${UID}:${GID}" restart: always healthcheck: - <<: *x-healthcheck - test: nginx -t || exit 1 + <<: *x-healthcheck + test: nginx -t || exit 1 expose: - "8081" - "8099" @@ -207,6 +210,8 @@ services: - SERVICE_NOTIFY=${SERVICE_NOTIFY} - SERVICE_PEOPLE_SERVER=${SERVICE_PEOPLE_SERVER} - SERVICE_SOCKET=${SERVICE_SOCKET} + - SERVICE_IDENTITY_API=${SERVICE_IDENTITY_API} + - SERVICE_IDENTITY=${SERVICE_IDENTITY} - SERVICE_STUDIO_NOTIFY=${SERVICE_STUDIO_NOTIFY} - SERVICE_API=${SERVICE_API} - SERVICE_API_SYSTEM=${SERVICE_API_SYSTEM} @@ -227,7 +232,7 @@ services: - DASHBOARDS_USERNAME=${DASHBOARDS_USERNAME} - DASHBOARDS_PASSWORD=${DASHBOARDS_PASSWORD} volumes: - - router_log:/var/log/nginx + - log_data:/var/log/nginx networks: default: @@ -235,7 +240,7 @@ networks: external: true volumes: - router_log: + log_data: app_data: files_data: people_data: diff --git a/install/docker/ds.yml b/install/docker/ds.yml index d5aab2d741..b64e3f6a3e 100644 --- a/install/docker/ds.yml +++ b/install/docker/ds.yml @@ -9,6 +9,7 @@ services: - JWT_HEADER=${DOCUMENT_SERVER_JWT_HEADER} - JWT_IN_BODY=true volumes: + - log_data:/var/log/onlyoffice - app_data:/var/www/onlyoffice/Data expose: - '80' @@ -22,4 +23,5 @@ networks: external: true volumes: + log_data: app_data: diff --git a/install/docker/fluent.yml b/install/docker/fluent.yml new file mode 100644 index 0000000000..6eada1fb3a --- /dev/null +++ b/install/docker/fluent.yml @@ -0,0 +1,19 @@ +services: + fluent-bit: + image: fluent/fluent-bit:${FLUENT_BIT_VERSION} + container_name: ${FLUENT_BIT_CONTAINER_NAME} + restart: always + environment: + - HOST=${ELK_CONTAINER_NAME} + - PORT=${ELK_PORT} + volumes: + - log_data:/var/log/onlyoffice + - ./config/fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf + +networks: + default: + name: ${NETWORK_NAME} + external: true + +volumes: + log_data: diff --git a/install/docker/identity.yml b/install/docker/identity.yml new file mode 100644 index 0000000000..5645b512c8 --- /dev/null +++ b/install/docker/identity.yml @@ -0,0 +1,69 @@ +version: "3.8" + +services: + onlyoffice-identity-authorization: + build: + context: ../../../server/common/ASC.Identity + dockerfile: ${IDENTITY_DOCKERFILE} + args: + - MODULE=authorization/authorization-container + container_name: ${IDENTITY_AUTHORIZATION_CONTAINER_NAME} + restart: always + ports: + - 8080:8080 + environment: + - SPRING_PROFILES_ACTIVE=${IDENTITY_PROFILE} + - SPRING_APPLICATION_NAME=ASC.Identity.Authorization + - SERVER_PORT=${IDENTITY_AUTHORIZATION_SERVER_PORT} + - JDBC_PASSWORD=${JDBC_PASSWORD} + - JDBC_URL=${JDBC_URL} + - JDBC_USER_NAME=${JDBC_USER_NAME} + - JDBC_DATABASE=${JDBC_DATABASE} + - RABBIT_HOST=onlyoffice-rabbitmq + - REDIS_HOST=onlyoffice-redis + depends_on: + - onlyoffice-identity-migration + + onlyoffice-identity-api: + build: + context: ../../../server/common/ASC.Identity + dockerfile: ${IDENTITY_DOCKERFILE} + args: + - MODULE=registration/registration-container + container_name: ${IDENTITY_API_CONTAINER_NAME} + ports: + - 9090:9090 + environment: + - SPRING_PROFILES_ACTIVE=${PROFILE} + - SPRING_APPLICATION_NAME=ASC.Identity.Registration + - SERVER_PORT=${IDENTITY_API_SERVER_PORT} + - JDBC_PASSWORD=${JDBC_PASSWORD} + - JDBC_URL=${JDBC_URL} + - JDBC_USER_NAME=${JDBC_USER_NAME} + - JDBC_DATABASE=${JDBC_DATABASE} + - RABBIT_HOST=onlyoffice-rabbitmq + - REDIS_HOST=onlyoffice-redis + depends_on: + - onlyoffice-identity-migration + + onlyoffice-identity-migration: + build: + context: ../../../server/common/ASC.Identity + dockerfile: ${IDENTITY_DOCKERFILE} + args: + - MODULE=infrastructure/infrastructure-migration-runner + container_name: ${IDENTITY_MIGRATION_CONTAINER_NAME} + restart: "no" + ports: + - 8081:8081 + environment: + - JDBC_PASSWORD=${JDBC_PASSWORD} + - JDBC_URL=${JDBC_URL} + - JDBC_USER_NAME=${JDBC_USER_NAME} + - JDBC_DATABASE=${JDBC_DATABASE} + - RABBIT_HOST=onlyoffice-rabbitmq + - REDIS_HOST=onlyoffice-redis +networks: + default: + name: ${NETWORK_NAME} + external: true diff --git a/install/docker/notify.yml b/install/docker/notify.yml index 6f21d6e4a1..870b617408 100644 --- a/install/docker/notify.yml +++ b/install/docker/notify.yml @@ -53,6 +53,7 @@ x-service: DEBUG_INFO: ${DEBUG_INFO} volumes: #- /app/onlyoffice/CommunityServer/data:/app/onlyoffice/data + - log_data:/var/log/onlyoffice - app_data:/app/onlyoffice/data - files_data:/var/www/products/ASC.Files/server/ - people_data:/var/www/products/ASC.People/server/ @@ -72,6 +73,7 @@ networks: external: true volumes: + log_data: app_data: files_data: people_data: diff --git a/install/docker/proxy-ssl.yml b/install/docker/proxy-ssl.yml index c06212bb7d..50e8aa0405 100644 --- a/install/docker/proxy-ssl.yml +++ b/install/docker/proxy-ssl.yml @@ -16,13 +16,14 @@ services: test: nginx -t || exit 1 ports: - 80:80 - - 443:443 + - 443:443/tcp + - 443:443/udp environment: - ROUTER_HOST=${ROUTER_HOST} - EXTERNAL_PORT=${EXTERNAL_PORT} volumes: - webroot_path:/letsencrypt - - proxy_log:/var/log/nginx + - log_data:/var/log/nginx - ./config/nginx/templates/nginx.conf.template:/etc/nginx/nginx.conf - ./config/nginx/letsencrypt.conf:/etc/nginx/includes/letsencrypt.conf - ./config/nginx/templates/proxy.upstream.conf.template:/etc/nginx/templates/proxy.upstream.conf.template:ro @@ -37,5 +38,5 @@ networks: external: true volumes: - proxy_log: + log_data: webroot_path: diff --git a/install/docker/proxy.yml b/install/docker/proxy.yml index d4f1255eef..6d149d5713 100644 --- a/install/docker/proxy.yml +++ b/install/docker/proxy.yml @@ -21,7 +21,7 @@ services: - EXTERNAL_PORT=${EXTERNAL_PORT} volumes: - webroot_path:/letsencrypt - - proxy_log:/var/log/nginx + - log_data:/var/log/nginx - ./config/nginx/templates/nginx.conf.template:/etc/nginx/nginx.conf - ./config/nginx/letsencrypt.conf:/etc/nginx/includes/letsencrypt.conf - ./config/nginx/templates/proxy.upstream.conf.template:/etc/nginx/templates/proxy.upstream.conf.template:ro @@ -33,5 +33,5 @@ networks: external: true volumes: - proxy_log: + log_data: webroot_path: diff --git a/install/install.bat b/install/install.bat index b03e6a86f3..84d5901467 100644 --- a/install/install.bat +++ b/install/install.bat @@ -1,5 +1,7 @@ @echo off +chcp 65001 > nul + PUSHD %~dp0.. call runasadmin.bat "%~dpnx0" diff --git a/install/rpm/SPECS/build.spec b/install/rpm/SPECS/build.spec index 08012cb81a..49dc43eb69 100644 --- a/install/rpm/SPECS/build.spec +++ b/install/rpm/SPECS/build.spec @@ -27,11 +27,15 @@ sed 's/teamlab.info/onlyoffice.com/g' -i config/autofac.consumers.json sed -e 's_etc/nginx_etc/openresty_g' -e 's/listen\s\+\([0-9]\+\);/listen 127.0.0.1:\1;/g' -i config/nginx/*.conf sed -i "s#\$public_root#/var/www/%{product}/public/#g" config/nginx/onlyoffice.conf sed -E 's_(http://)[^:]+(:5601)_\1localhost\2_g' -i config/nginx/onlyoffice.conf -sed -e 's/$router_host/127.0.0.1/g' -e 's/this_host\|proxy_x_forwarded_host/host/g' -e 's/proxy_x_forwarded_proto/scheme/g' -e 's/proxy_x_forwarded_port/server_port/g' -e 's_includes_/etc/openresty/includes_g' -i install/docker/config/nginx/onlyoffice-proxy*.conf +sed -e 's/$router_host/127.0.0.1/g' -e 's/this_host\|proxy_x_forwarded_host/host/g' -e 's/proxy_x_forwarded_proto/scheme/g' -e 's/proxy_x_forwarded_port/server_port/g' -e 's_includes_/etc/openresty/includes_g' -e '/quic\|alt-svc/Id' -i install/docker/config/nginx/onlyoffice-proxy*.conf sed -e '/.pid/d' -e '/temp_path/d' -e 's_etc/nginx_etc/openresty_g' -e 's/\.log/-openresty.log/g' -i install/docker/config/nginx/templates/nginx.conf.template sed -i "s_\(.*root\).*;_\1 \"/var/www/%{product}\";_g" -i install/docker/config/nginx/letsencrypt.conf -sed -i '/^\s*Name\s\+forward\s*$/d; /^\s*Listen\s\+127\.0\.0\.1\s*$/d; /^\s*Port\s\+24224\s*$/d' -i install/docker/config/fluent-bit.conf -sed -i "0,/\[INPUT\]/ s/\(\[INPUT\]\)/\1\n Name tail\n Path \/var\/log\/onlyoffice\/%{product}\/*.log\n Path_Key filename/" -i install/docker/config/fluent-bit.conf +sed -i "s#\(/var/log/onlyoffice/\)#\1%{product}#" install/docker/config/fluent-bit.conf +sed -i '/^\[OUTPUT\]/i\[INPUT]' install/docker/config/fluent-bit.conf +sed -i '/^\[OUTPUT\]/i\ Name exec' install/docker/config/fluent-bit.conf +sed -i '/^\[OUTPUT\]/i\ Interval_Sec 86400' install/docker/config/fluent-bit.conf +sed -i '/^\[OUTPUT\]/i\ Command curl -s -X POST OPENSEARCH_SCHEME://OPENSEARCH_HOST:OPENSEARCH_PORT/OPENSEARCH_INDEX/_delete_by_query -H '\''Content-Type: application/json'\'' -d '\''{"query": {"range": {"@timestamp": {"lt": "now-30d"}}}}'\''' install/docker/config/fluent-bit.conf +sed -i '/^\[OUTPUT\]/i\\' install/docker/config/fluent-bit.conf find %{_builddir}/server/publish/ \ %{_builddir}/server/ASC.Migration.Runner \ diff --git a/install/rpm/SPECS/files.spec b/install/rpm/SPECS/files.spec index aa8073a1ad..70b30262e3 100644 --- a/install/rpm/SPECS/files.spec +++ b/install/rpm/SPECS/files.spec @@ -34,7 +34,6 @@ %exclude %{_sysconfdir}/onlyoffice/%{product}/openresty %exclude %{_sysconfdir}/onlyoffice/%{product}/nginx %{_docdir}/%{name}-%{version}-%{release}/ -%config %{_sysconfdir}/logrotate.d/%{product}-common %{_var}/log/onlyoffice/%{product}/ %dir %{_sysconfdir}/onlyoffice/ %dir %{_sysconfdir}/onlyoffice/%{product}/ diff --git a/install/rpm/SPECS/install.spec b/install/rpm/SPECS/install.spec index e9a53680b1..6846089986 100644 --- a/install/rpm/SPECS/install.spec +++ b/install/rpm/SPECS/install.spec @@ -25,6 +25,7 @@ mkdir -p "%{buildroot}%{buildpath}/products/ASC.Files/server/DocStore/" mkdir -p "%{buildroot}%{buildpath}/products/ASC.Files/editor/" # Hidden folders are not copied when applying a mask * (only in RPM), so we explicitly copy .next directory in this way mkdir -p "%{buildroot}%{buildpath}/products/ASC.Files/editor/.next/" +mkdir -p "%{buildroot}%{buildpath}/products/ASC.Login/login/.next/" mkdir -p "%{buildroot}%{buildpath}/products/ASC.Files/client/" mkdir -p "%{buildroot}%{buildpath}/client/" mkdir -p "%{buildroot}%{buildpath}/management/" @@ -34,13 +35,13 @@ mkdir -p "%{buildroot}%{_sysconfdir}/openresty/conf.d/" mkdir -p "%{buildroot}%{_sysconfdir}/openresty/html/" mkdir -p "%{buildroot}%{_sysconfdir}/onlyoffice/%{product}/openresty" mkdir -p "%{buildroot}%{_sysconfdir}/onlyoffice/%{product}/.private/" -mkdir -p "%{buildroot}%{_sysconfdir}/logrotate.d" mkdir -p "%{buildroot}%{_sysconfdir}/fluent-bit/" mkdir -p "%{buildroot}%{_docdir}/%{name}-%{version}-%{release}/" mkdir -p "%{buildroot}%{_bindir}/" cp -rf %{_builddir}/publish/web/public/* "%{buildroot}%{buildpath}/public/" cp -rf %{_builddir}/campaigns/src/campaigns/* "%{buildroot}%{buildpath}/public/campaigns" cp -rf %{_builddir}/publish/web/login/* "%{buildroot}%{buildpath}/products/ASC.Login/login/" +cp -rf %{_builddir}/publish/web/login/.next/* "%{buildroot}%{buildpath}/products/ASC.Login/login/.next/" cp -rf %{_builddir}/publish/web/editor/* "%{buildroot}%{buildpath}/products/ASC.Files/editor/" cp -rf %{_builddir}/publish/web/editor/.next/* "%{buildroot}%{buildpath}/products/ASC.Files/editor/.next/" cp -rf %{_builddir}/server/products/ASC.Files/Server/DocStore/* "%{buildroot}%{buildpath}/products/ASC.Files/server/DocStore/" @@ -69,7 +70,6 @@ cp -rf %{_builddir}/buildtools/install/docker/config/nginx/onlyoffice-proxy.conf cp -rf %{_builddir}/buildtools/install/docker/config/nginx/onlyoffice-proxy-ssl.conf "%{buildroot}%{_sysconfdir}/openresty/conf.d/onlyoffice-proxy-ssl.conf.template" cp -rf %{_builddir}/buildtools/install/docker/config/nginx/letsencrypt.conf "%{buildroot}%{_sysconfdir}/openresty/includes/letsencrypt.conf" cp -rf %{_builddir}/buildtools/install/common/systemd/modules/* "%{buildroot}/usr/lib/systemd/system/" -cp -rf %{_builddir}/buildtools/install/common/logrotate/product-common "%{buildroot}%{_sysconfdir}/logrotate.d/%{product}-common" cp -rf %{_builddir}/buildtools/install/common/%{product}-ssl-setup "%{buildroot}%{_bindir}/%{product}-ssl-setup" cp -rf %{_builddir}/buildtools/install/common/%{product}-configuration "%{buildroot}%{_bindir}/%{product}-configuration" cp -rf %{_builddir}/buildtools/config/nginx/onlyoffice*.conf "%{buildroot}%{_sysconfdir}/openresty/conf.d/" diff --git a/install/rpm/SPECS/package.spec b/install/rpm/SPECS/package.spec index ed8879e870..767e1eae74 100644 --- a/install/rpm/SPECS/package.spec +++ b/install/rpm/SPECS/package.spec @@ -13,7 +13,6 @@ The service which handles API requests related to backup Packager: %{packager} Summary: Common Group: Applications/Internet -Requires: logrotate BuildArch: noarch %description common A package containing configure and scripts diff --git a/install/rpm/SPECS/product.spec b/install/rpm/SPECS/product.spec index 4aa9df9357..3eabd5f142 100644 --- a/install/rpm/SPECS/product.spec +++ b/install/rpm/SPECS/product.spec @@ -53,6 +53,7 @@ Requires: %name-socket = %version-%release Requires: %name-ssoauth = %version-%release Requires: %name-studio = %version-%release Requires: %name-studio-notify = %version-%release +Requires: openssl %description ONLYOFFICE DocSpace is a new way to collaborate on documents with teams, diff --git a/install/win/DocSpace.aip b/install/win/DocSpace.aip index bb98a5efcd..004329ddf5 100644 --- a/install/win/DocSpace.aip +++ b/install/win/DocSpace.aip @@ -56,7 +56,7 @@ - + @@ -113,68 +113,68 @@ - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -263,7 +263,7 @@ - + @@ -289,25 +289,25 @@ - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + @@ -366,6 +366,7 @@ + @@ -393,10 +394,12 @@ + + @@ -539,7 +542,6 @@ - @@ -1033,9 +1035,8 @@ - + - @@ -1216,7 +1217,6 @@ - @@ -1465,7 +1465,7 @@ - + @@ -1508,20 +1508,20 @@ - - - + + + - + - + - + @@ -1566,6 +1566,7 @@ + @@ -1586,6 +1587,7 @@ + @@ -1601,6 +1603,7 @@ + diff --git a/install/win/OpenSearch.aip b/install/win/OpenSearch.aip index 230753b3e6..3be40d8bcd 100644 --- a/install/win/OpenSearch.aip +++ b/install/win/OpenSearch.aip @@ -5,15 +5,17 @@ + + - + @@ -31,6 +33,7 @@ + @@ -48,7 +51,7 @@ - + @@ -71,10 +74,20 @@ + + + + + + + + + + @@ -107,9 +120,18 @@ + + + + + + + + + @@ -129,6 +151,7 @@ + @@ -140,6 +163,17 @@ + + + + + + + + + + + @@ -156,10 +190,20 @@ + + + + + + + + + + diff --git a/install/win/build-batch.bat b/install/win/build-batch.bat index c1d795b548..b8aecbc3fc 100644 --- a/install/win/build-batch.bat +++ b/install/win/build-batch.bat @@ -6,6 +6,7 @@ set "opensearch_version=2.11.1" REM echo ######## Extracting and preparing files to build ######## %sevenzip% x buildtools\install\win\opensearch-%opensearch_version%.zip -o"buildtools\install\win" -y +%sevenzip% x buildtools\install\win\ingest-attachment-%opensearch_version%.zip -o"buildtools\install\win\OpenSearch\plugins\ingest-attachment" -y xcopy "buildtools\install\win\opensearch-%opensearch_version%\plugins\opensearch-security" "buildtools\install\win\OpenSearch\plugins\opensearch-security" /s /y /b /i xcopy "buildtools\install\win\opensearch-%opensearch_version%\plugins\opensearch-job-scheduler" "buildtools\install\win\OpenSearch\plugins\opensearch-job-scheduler" /s /y /b /i xcopy "buildtools\install\win\opensearch-%opensearch_version%\plugins\opensearch-index-management" "buildtools\install\win\OpenSearch\plugins\opensearch-index-management" /s /y /b /i @@ -58,15 +59,20 @@ REM echo ######## SSL configs ######## %sed% -i "s/proxy_x_forwarded_port/server_port/g" buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf.tmpl %sed% -i "s/proxy_x_forwarded_proto/scheme/g" buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf.tmpl buildtools\install\win\Files\nginx\conf\onlyoffice-proxy-ssl.conf.tmpl %sed% -i "s/ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;/#ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;/" buildtools\install\win\Files\nginx\conf\onlyoffice-proxy-ssl.conf.tmpl +%sed% -i "/quic\|alt-svc/Id" buildtools\install\win\Files\nginx\conf\onlyoffice-proxy-ssl.conf.tmpl %sed% -i "s_\(.*root\).*;_\1 \"{APPDIR}letsencrypt\";_g" -i buildtools\install\win\Files\nginx\conf\includes\letsencrypt.conf +%sed% -i "s#/var/log/nginx/#logs/#g" buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf buildtools\install\win\Files\nginx\conf\onlyoffice-proxy.conf.tmpl buildtools\install\win\Files\nginx\conf\onlyoffice-proxy-ssl.conf.tmpl %sed% -i "s#/etc/nginx/html#conf/html#g" buildtools\install\win\Files\nginx\conf\onlyoffice.conf %sed% -i "s/\/etc\/nginx\/\.htpasswd_dashboards/\.htpasswd_dashboards/g" buildtools\install\win\Files\nginx\conf\onlyoffice.conf REM echo ######## Configure fluent-bit config for windows ######## -%sed% -i "s/forward/tail/" buildtools\install\win\Files\config\fluent-bit.conf -%sed% -i "s/Port/Path/" buildtools\install\win\Files\config\fluent-bit.conf -%sed% -i "s/24224/{APPDIR}Logs\*.log/" buildtools\install\win\Files\config\fluent-bit.conf -%sed% -i "/Listen\s*127\.0\.0\.1/d" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i -e "s|/var/log/onlyoffice/|{APPDIR}Logs\\|g" -e "s|\*\*/|\*\*\\|g" -e "s#DocSpace\Logs\**\#DocumentServer\Log\#g" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i "/^\[OUTPUT\]/i\[INPUT]" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i "/^\[OUTPUT\]/i\ Name exec" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i "/^\[OUTPUT\]/i\ Interval_Sec 86400" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i "/^\[OUTPUT\]/i\ Command curl -s -X POST OPENSEARCH_SCHEME://OPENSEARCH_HOST:OPENSEARCH_PORT/OPENSEARCH_INDEX/_delete_by_query -H 'Content-Type: application/json' -d '{\"query\": {\"range\": {\"@timestamp\": {\"lt\": \"now-30d\"}}}}'" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i -e "s/\"/\\\\\"/g" -e "s/'/\"/g" buildtools\install\win\Files\config\fluent-bit.conf +%sed% -i "/\[OUTPUT\]/i\\n" buildtools\install\win\Files\config\fluent-bit.conf REM echo ######## Delete test and dev configs ######## del /f /q buildtools\install\win\Files\config\*.test.json diff --git a/install/win/build-download-prereq.ps1 b/install/win/build-download-prereq.ps1 index b5abfd7933..9f594be796 100644 --- a/install/win/build-download-prereq.ps1 +++ b/install/win/build-download-prereq.ps1 @@ -61,6 +61,12 @@ $prerequisites = @( link = "https://artifacts.opensearch.org/releases/bundle/opensearch/${opensearch_version}/opensearch-${opensearch_version}-windows-x64.zip"; } + @{ + download_allways = $false; + name = "ingest-attachment-${opensearch_version}.zip"; + link = "https://artifacts.opensearch.org/releases/plugins/ingest-attachment/${opensearch_version}/ingest-attachment-${opensearch_version}.zip"; + } + @{ download_allways = $false; name = "WinSW.NET4new.exe"; @@ -145,14 +151,14 @@ $enterprise_prerequisites = @( @{ download_allways = $false; - name = "mysql-connector-odbc-8.0.33-win32.msi"; - link = "https://cdn.mysql.com/archives/mysql-connector-odbc-8.0/mysql-connector-odbc-8.0.33-win32.msi"; + name = "mysql-connector-odbc-8.0.37-win32.msi"; + link = "https://cdn.mysql.com/Downloads/Connector-ODBC/8.0/mysql-connector-odbc-8.0.37-win32.msi"; } @{ download_allways = $false; - name = "mysql-installer-community-8.0.33.0.msi"; - link = "https://cdn.mysql.com/archives/mysql-installer/mysql-installer-community-8.0.33.0.msi"; + name = "mysql-installer-community-8.0.37.0.msi"; + link = "https://cdn.mysql.com/Downloads/MySQLInstaller/mysql-installer-community-8.0.37.0.msi"; } @{ diff --git a/install/win/frontend-copy.bat b/install/win/frontend-copy.bat index c886672930..3f529a5003 100644 --- a/install/win/frontend-copy.bat +++ b/install/win/frontend-copy.bat @@ -18,6 +18,7 @@ if defined SecondArg ( xcopy "%PathToRepository%\publish\web\public" "%PathToAppFolder%\public" /s /y /b /i xcopy "%PathToRepository%\campaigns\src\campaigns" "%PathToAppFolder%\public\campaigns" /s /y /b /i +xcopy "%PathToRepository%\publish\web\management" "%PathToAppFolder%\management" /s /y /b /i xcopy "%PathToRepository%\publish\web\client" "%PathToAppFolder%\client" /s /y /b /i xcopy "%PathToRepository%\buildtools\config\nginx" "%PathToAppFolder%\nginx\conf" /s /y /b /i xcopy "%PathToRepository%\buildtools\config\*" "%PathToAppFolder%\config" /y /b /i diff --git a/install/win/sbin/docspace-ssl-setup.ps1 b/install/win/sbin/docspace-ssl-setup.ps1 index 264a616754..1253428f9e 100644 --- a/install/win/sbin/docspace-ssl-setup.ps1 +++ b/install/win/sbin/docspace-ssl-setup.ps1 @@ -28,6 +28,7 @@ if ( -not $certbot_path ) exit } +$product = "docspace" $letsencrypt_root_dir = "$env:SystemDrive\Certbot\live" $app = Resolve-Path -Path ".\..\" $root_dir = "${app}\letsencrypt" @@ -46,17 +47,17 @@ if ( $args.Count -ge 2 ) } else { - $letsencrypt_mail = $args[0] - $letsencrypt_domain = $args[1] + $letsencrypt_mail = $args[0] -JOIN "," + $letsencrypt_domain = $args[1] -JOIN "," [void](New-Item -ItemType "directory" -Path "${root_dir}\Logs" -Force) - "certbot certonly --expand --webroot -w `"${root_dir}`" --noninteractive --agree-tos --email ${letsencrypt_mail} -d ${letsencrypt_domain}" > "${app}\letsencrypt\Logs\le-start.log" - cmd.exe /c "certbot certonly --expand --webroot -w `"${root_dir}`" --noninteractive --agree-tos --email ${letsencrypt_mail} -d ${letsencrypt_domain}" > "${app}\letsencrypt\Logs\le-new.log" + "certbot certonly --expand --webroot -w `"${root_dir}`" --key-type rsa --cert-name ${product} --noninteractive --agree-tos --email ${letsencrypt_mail} -d ${letsencrypt_domain}" > "${app}\letsencrypt\Logs\le-start.log" + cmd.exe /c "certbot certonly --expand --webroot -w `"${root_dir}`" --key-type rsa --cert-name ${product} --noninteractive --agree-tos --email ${letsencrypt_mail} -d ${letsencrypt_domain}" > "${app}\letsencrypt\Logs\le-new.log" - pushd "${letsencrypt_root_dir}\${letsencrypt_domain}" - $ssl_cert = (Resolve-Path -Path (Get-Item "${letsencrypt_root_dir}\${letsencrypt_domain}\fullchain.pem").Target).ToString().Replace('\', '/') - $ssl_key = (Resolve-Path -Path (Get-Item "${letsencrypt_root_dir}\${letsencrypt_domain}\privkey.pem").Target).ToString().Replace('\', '/') + pushd "${letsencrypt_root_dir}\${product}" + $ssl_cert = (Resolve-Path -Path (Get-Item "${letsencrypt_root_dir}\${product}\fullchain.pem").Target).ToString().Replace('\', '/') + $ssl_key = (Resolve-Path -Path (Get-Item "${letsencrypt_root_dir}\${product}\privkey.pem").Target).ToString().Replace('\', '/') popd } @@ -68,7 +69,7 @@ if ( $args.Count -ge 2 ) if ($letsencrypt_domain) { - $acl = Get-Acl -Path "$env:SystemDrive\Certbot\archive\${letsencrypt_domain}" + $acl = Get-Acl -Path "$env:SystemDrive\Certbot\archive\${product}" $acl.SetSecurityDescriptorSddlForm('O:LAG:S-1-5-21-4011186057-2202358572-2315966083-513D:PAI(A;;0x1200a9;;;WD)(A;;FA;;;SY)(A;OI;0x1200a9;;;LS)(A;;FA;;;BA)(A;;FA;;;LA)') Set-Acl -Path $acl.path -ACLObject $acl } @@ -107,6 +108,8 @@ else Write-Output " comma to register multiple emails, ex: " Write-Output " u1@example.com,u2@example.com. " Write-Output " DOMAIN Domain name to apply " + Write-Output " Use comma to register multiple domains, ex: " + Write-Output " example.com,s1.example.com,s2.example.com. " Write-Output " " Write-Output " Using your own certificates via the -f parameter: " Write-Output " usage: " diff --git a/install/win/utils.vbs b/install/win/utils.vbs index 71f1241e21..2261204e95 100644 --- a/install/win/utils.vbs +++ b/install/win/utils.vbs @@ -202,8 +202,8 @@ Function MySQLConfigure If Err.Number <> 0 Then Err.Clear - installDir = shell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MySQL AB\MySQL Server 8.0\Location") - dataDir = shell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MySQL AB\MySQL Server 8.0\DataLocation") + installDir = shell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\MySQL AB\MySQL Server 8.0\Location") + dataDir = shell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\MySQL AB\MySQL Server 8.0\DataLocation") End If Call WriteToLog("MySQLConfigure: installDir " & installDir) diff --git a/run.translations.tests.bat b/run.translations.tests.bat index 4ec7cccfb5..4ef9257ee9 100644 --- a/run.translations.tests.bat +++ b/run.translations.tests.bat @@ -1,4 +1,5 @@ -PUSHD %~dp0\.. -set dir="%cd%" -echo %dir% -dotnet test %dir%\client\common\Tests\Frontend.Translations.Tests\Frontend.Translations.Tests.csproj --filter "TestCategory=Locales" -l:html --environment "BASE_DIR=%dir%" --results-directory "%dir%\TestsResults" \ No newline at end of file +PUSHD %~dp0\.. +set dir=%cd% +echo %dir% +dotnet test %dir%\client\common\Tests\Frontend.Translations.Tests\Frontend.Translations.Tests.csproj --filter "TestCategory=Locales" -l:html --environment "BASE_DIR=%dir%\client" --results-directory "%dir%\TestsResults" +pause \ No newline at end of file diff --git a/run/IdentityApi.xml b/run/IdentityApi.xml new file mode 100644 index 0000000000..3adcc9e8ae --- /dev/null +++ b/run/IdentityApi.xml @@ -0,0 +1,12 @@ + + OnlyofficeIdentityApi + ONLYOFFICE IdentityApi + manual + java + + + -jar ../../server/common/ASC.Identity/registration/registration-container/target/registration-container-1.0.0.jar + + true + + \ No newline at end of file diff --git a/run/IdentityMigration.xml b/run/IdentityMigration.xml new file mode 100644 index 0000000000..146753c555 --- /dev/null +++ b/run/IdentityMigration.xml @@ -0,0 +1,12 @@ + + OnlyofficeIdentityMigration + ONLYOFFICE IdentityMigration + manual + java + + + -jar ../../server/common/ASC.Identity/infrastructure/infrastructure-migration-runner/target/infrastructure-migration-runner-1.0.0.jar + + true + + \ No newline at end of file diff --git a/run/IdentityService.xml b/run/IdentityService.xml new file mode 100644 index 0000000000..07b19258d7 --- /dev/null +++ b/run/IdentityService.xml @@ -0,0 +1,13 @@ + + OnlyofficeIdentityService + ONLYOFFICE IdentityService + manual + java + + + + -jar ../../server/common/ASC.Identity/authorization/authorization-container/target/authorization-container-1.0.0.jar + + true + + \ No newline at end of file diff --git a/run/Login.xml b/run/Login.xml index 9ed5a7efda..06ba10362e 100644 --- a/run/Login.xml +++ b/run/Login.xml @@ -3,7 +3,8 @@ ONLYOFFICE Login SSR manual node - ../../publish/web/login/server.js + server.js + %BASE%\..\..\client\packages\login true diff --git a/scripts/identity.bat b/scripts/identity.bat new file mode 100644 index 0000000000..674fc1c02e --- /dev/null +++ b/scripts/identity.bat @@ -0,0 +1,28 @@ +PUSHD %~dp0.. + +cd %~dp0../../server/common/ASC.Identity/ + +echo Start build ASC.Identity project... +echo. + +echo ASC.Identity: resolves all project dependencies... +echo. + +call mvn dependency:go-offline -q + +if %errorlevel% == 0 ( + +echo ASC.Identity: take the compiled code and package it in its distributable format, such as a JAR... +call mvn package -DskipTests -q + +) + +if %errorlevel% == 0 ( + +echo ASC.Identity: build completed +echo. + +) + + +POPD \ No newline at end of file diff --git a/tests/vagrant/Vagrantfile b/tests/vagrant/Vagrantfile index 98c7b371e3..68f9f831ae 100644 --- a/tests/vagrant/Vagrantfile +++ b/tests/vagrant/Vagrantfile @@ -15,6 +15,7 @@ Vagrant.configure("2") do |config| config.vm.provision "file", source: "../../../DocSpace-buildtools/install/OneClickInstall/.", destination: "/tmp/docspace/" end + config.vm.provision "file", source: "../../../DocSpace-buildtools/install/common/systemd/build.sh", destination: "/tmp/docspace/build.sh" config.vm.provision "shell", path: './install.sh', :args => "#{ENV['DOWNLOAD_SCRIPT']} #{ENV['TEST_REPO']} #{ENV['ARGUMENTS']}" # Prevent SharedFoldersEnableSymlinksCreate errors diff --git a/tests/vagrant/install.sh b/tests/vagrant/install.sh index c5d766f268..9e45cb2ab7 100644 --- a/tests/vagrant/install.sh +++ b/tests/vagrant/install.sh @@ -1,91 +1,45 @@ #!/bin/bash -set -e +set -e while [ "$1" != "" ]; do - case $1 in + case $1 in + -ds | --download-scripts ) + if [ "$2" != "" ]; then + DOWNLOAD_SCRIPTS=$2 + shift + fi + ;; - -ds | --download-scripts ) - if [ "$2" != "" ]; then - DOWNLOAD_SCRIPTS=$2 - shift - fi - ;; + -arg | --arguments ) + if [ "$2" != "" ]; then + ARGUMENTS=$2 + shift + fi + ;; - -arg | --arguments ) - if [ "$2" != "" ]; then - ARGUMENTS=$2 - shift - fi - ;; + -li | --local-install ) + if [ "$2" != "" ]; then + LOCAL_INSTALL=$2 + shift + fi + ;; - - -pi | --production-install ) - if [ "$2" != "" ]; then - PRODUCTION_INSTALL=$2 - shift - fi - ;; - - -li | --local-install ) - if [ "$2" != "" ]; then - LOCAL_INSTALL=$2 - shift - fi - ;; - - -lu | --local-update ) - if [ "$2" != "" ]; then - LOCAL_UPDATE=$2 - shift - fi - ;; - - -tr | --test-repo ) - if [ "$2" != "" ]; then - TEST_REPO_ENABLE=$2 - shift - fi - ;; - - - esac - shift + -tr | --test-repo ) + if [ "$2" != "" ]; then + TEST_REPO_ENABLE=$2 + shift + fi + ;; + esac + shift done export TERM=xterm-256color^M -SERVICES_SYSTEMD=( - "docspace-api.service" - "docspace-doceditor.service" - "docspace-studio-notify.service" - "docspace-files.service" - "docspace-notify.service" - "docspace-studio.service" - "docspace-backup-background.service" - "docspace-files-services.service" - "docspace-people-server.service" - "docspace-backup.service" - "docspace-healthchecks.service" - "docspace-socket.service" - "docspace-clear-events.service" - "docspace-login.service" - "docspace-ssoauth.service" - "ds-converter.service" - "ds-docservice.service" - "ds-metrics.service") - function common::get_colors() { - COLOR_BLUE=$'\e[34m' - COLOR_GREEN=$'\e[32m' - COLOR_RED=$'\e[31m' - COLOR_RESET=$'\e[0m' - COLOR_YELLOW=$'\e[33m' - export COLOR_BLUE - export COLOR_GREEN - export COLOR_RED - export COLOR_RESET - export COLOR_YELLOW + export LINE_SEPARATOR="-----------------------------------------" + export COLOR_BLUE=$'\e[34m' COLOR_GREEN=$'\e[32m' COLOR_RED=$'\e[31m' COLOR_RESET=$'\e[0m' COLOR_YELLOW=$'\e[33m' } ############################################################################################# @@ -98,12 +52,35 @@ function common::get_colors() { # None ############################################################################################# function check_hw() { - local FREE_RAM=$(free -h) - local FREE_CPU=$(nproc) - echo "${COLOR_RED} ${FREE_RAM} ${COLOR_RESET}" - echo "${COLOR_RED} ${FREE_CPU} ${COLOR_RESET}" + echo "${COLOR_RED} $(free -h) ${COLOR_RESET}" + echo "${COLOR_RED} $(nproc) ${COLOR_RESET}" } +############################################################################################# +# Add nexus repositories for test packages for .deb and .rpm packages +# Globals: None +# Arguments: None +# Outputs: None +############################################################################################# +function add-repo-deb() { + mkdir -p -m 700 $HOME/.gnupg + echo "deb [signed-by=/usr/share/keyrings/onlyoffice.gpg] https://nexus.onlyoffice.com/repository/4testing-debian stable main" | \ + sudo tee /etc/apt/sources.list.d/onlyoffice4testing.list + curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | \ + gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/onlyoffice.gpg --import + chmod 644 /usr/share/keyrings/onlyoffice.gpg +} + +function add-repo-rpm() { + cat > /etc/yum.repos.d/onlyoffice4testing.repo <** ############################################################################################# function prepare_vm() { + if [ -f /etc/os-release ]; then + source /etc/os-release + case $ID in + ubuntu) + [[ "${TEST_REPO_ENABLE}" == 'true' ]] && add-repo-deb + ;; - if [ -f /etc/lsb-release ] ; then - DIST=`cat /etc/lsb-release | grep '^DISTRIB_ID' | awk -F= '{ print $2 }'` - REV=`cat /etc/lsb-release | grep '^DISTRIB_RELEASE' | awk -F= '{ print $2 }'` - DISTRIB_CODENAME=`cat /etc/lsb-release | grep '^DISTRIB_CODENAME' | awk -F= '{ print $2 }'` - DISTRIB_RELEASE=`cat /etc/lsb-release | grep '^DISTRIB_RELEASE' | awk -F= '{ print $2 }'` - elif [ -f /etc/lsb_release ] || [ -f /usr/bin/lsb_release ] ; then - DIST=`lsb_release -a 2>&1 | grep 'Distributor ID:' | awk -F ":" '{print $2 }'` - REV=`lsb_release -a 2>&1 | grep 'Release:' | awk -F ":" '{print $2 }'` - DISTRIB_CODENAME=`lsb_release -a 2>&1 | grep 'Codename:' | awk -F ":" '{print $2 }'` - DISTRIB_RELEASE=`lsb_release -a 2>&1 | grep 'Release:' | awk -F ":" '{print $2 }'` - elif [ -f /etc/os-release ] ; then - DISTRIB_CODENAME=$(grep "VERSION=" /etc/os-release |awk -F= {' print $2'}|sed s/\"//g |sed s/[0-9]//g | sed s/\)$//g |sed s/\(//g | tr -d '[:space:]') - DISTRIB_RELEASE=$(grep "VERSION_ID=" /etc/os-release |awk -F= {' print $2'}|sed s/\"//g |sed s/[0-9]//g | sed s/\)$//g |sed s/\(//g | tr -d '[:space:]') - fi + debian) + [ "$VERSION_CODENAME" == "bookworm" ] && apt-get update -y && apt install -y curl gnupg + apt-get remove postfix -y && echo "${COLOR_GREEN}☑ PREPAVE_VM: Postfix was removed${COLOR_RESET}" + [[ "${TEST_REPO_ENABLE}" == 'true' ]] && add-repo-deb + ;; - DIST=`echo "$DIST" | tr '[:upper:]' '[:lower:]' | xargs`; - DISTRIB_CODENAME=`echo "$DISTRIB_CODENAME" | tr '[:upper:]' '[:lower:]' | xargs`; - REV=`echo "$REV" | xargs`; + fedora) + [[ "${TEST_REPO_ENABLE}" == 'true' ]] && add-repo-rpm + ;; - if [ ! -f /etc/centos-release ]; then - if [ "${DIST}" = "debian" ]; then - if [ "${DISTRIB_CODENAME}" == "bookworm" ]; then - apt-get update -y - apt install -y curl gnupg - fi + centos) + [ "$VERSION_ID" == "8" ] && sed -i 's|^mirrorlist=|#&|; s|^#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|' /etc/yum.repos.d/CentOS-* + [[ "${TEST_REPO_ENABLE}" == 'true' ]] && add-repo-rpm + yum -y install centos*-release + ;; - apt-get remove postfix -y - echo "${COLOR_GREEN}☑ PREPAVE_VM: Postfix was removed${COLOR_RESET}" - fi - - if [ "${TEST_REPO_ENABLE}" == 'true' ]; then - mkdir -p -m 700 $HOME/.gnupg - echo "deb [signed-by=/usr/share/keyrings/onlyoffice.gpg] https://nexus.onlyoffice.com/repository/4testing-debian stable main" | sudo tee /etc/apt/sources.list.d/onlyoffice4testing.list - curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/onlyoffice.gpg --import - chmod 644 /usr/share/keyrings/onlyoffice.gpg - fi - fi - - if [ -f /etc/centos-release ]; then - if [ "${TEST_REPO_ENABLE}" == 'true' ]; then - cat > /etc/yum.repos.d/onlyoffice4testing.repo <