Tomter Vel's own platform: Caddy, NATS, Kanidm and portal as containers

One host, four containers, content fetched from tomtervel/questions.
bootstrap.sh renders configs from .env and recovers the Kanidm admin;
kanidm-setup.sh creates the portal client and the desk groups. An
optional runner profile lets the content repo's reload reach this host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bootstrap.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+# First start on a fresh host. Idempotent: rerunning renders configs
+# again and skips what exists. Needs docker with the compose plugin,
+# openssl, and DNS for PORTAL_HOST and ID_HOST already pointing here.
+#
+#   cp .env.example .env   # fill in the hosts
+#   sh bootstrap.sh
+set -eu
+cd "$(dirname "$0")"
+[ -f .env ] || { echo "copy .env.example to .env and fill it in first"; exit 1; }
+. ./.env
+
+# A NATS password, once.
+if [ -z "${NATS_PASSWORD:-}" ]; then
+  NATS_PASSWORD=$(openssl rand -base64 36 | tr -d '/+=' | cut -c1-40)
+  sed -i "s|^NATS_PASSWORD=.*|NATS_PASSWORD=$NATS_PASSWORD|" .env
+  echo "NATS_PASSWORD generated into .env"
+fi
+
+# Rendered configs (gitignored).
+sed "s|\${ID_HOST}|$ID_HOST|g" kanidm/server.toml.tpl > kanidm/server.toml
+sed "s|\${NATS_PASSWORD}|$NATS_PASSWORD|g" nats/nats.conf.tpl > nats/nats.conf
+cat > portal.env <<EOF
+NATS_URL=nats://portal:$NATS_PASSWORD@nats:4222
+KANIDM_URL=https://$ID_HOST
+OAUTH2_CLIENT_ID=$OAUTH2_CLIENT_ID
+OAUTH2_CLIENT_SECRET=${OAUTH2_CLIENT_SECRET:-}
+PUBLIC_URL=https://$PORTAL_HOST
+COOKIE_SECURE=true
+CONTENT_REPO=$CONTENT_REPO
+CONTENT_BRANCH=$CONTENT_BRANCH
+SITE_NAME=$SITE_NAME
+EOF
+chmod 600 portal.env
+
+# Kanidm's internal certificate: Caddy holds the public one.
+mkdir -p certs
+if [ ! -f certs/kanidm-key.pem ]; then
+  openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+    -subj "/CN=kanidm" -addext "subjectAltName=DNS:kanidm,DNS:$ID_HOST" \
+    -keyout certs/kanidm-key.pem -out certs/kanidm-chain.pem >/dev/null 2>&1
+  chmod 600 certs/kanidm-key.pem
+  echo "internal Kanidm certificate made"
+fi
+
+docker compose up -d --build
+echo "containers up; Caddy is fetching certificates for $PORTAL_HOST and $ID_HOST"
+
+# The Kanidm admin accounts exist only after the first start; their
+# passwords are set by recovery. Do this once; the output is the
+# password, shown once.
+if [ ! -f .kanidm-recovered ]; then
+  echo
+  echo "=== Kanidm admin recovery (write these passwords down) ==="
+  docker compose exec kanidm kanidmd recover-account admin
+  docker compose exec kanidm kanidmd recover-account idm_admin
+  touch .kanidm-recovered
+fi
+
+echo
+echo "Next: sh kanidm-setup.sh   (log in as idm_admin, create the portal client and desk groups)"