blandClaude Opus 5.5
b653536391
The desk groups are read from the content's qualifies: and named as it names them - this Kanidm is the vel's own - with the old tomtervel_* groups renamed in place. The onboarding account manages every desk group, since adding a member takes that right (measured: 404 without). Sign-in scopes to idm_all_persons. SEED_ADMIN_EMAIL and RESPONSIBLE_GROUP (redaktor) reach portal.env, and bootstrap no longer drops the onboarding token when it rewrites portal.env. A second OAuth2 client lets redaktor sign in to prosjekt.klingenbergbygg.no; on the Gitea host the script adds that sign-in source itself. The login page's own name and logo need the admin account; the script now says so rather than failing with 'Item not found'. .env.example quotes SITE_NAME, which has a space and broke sourcing it. Tested end to end against a local Kanidm 1.11.2, including a rerun and a legacy tomtervel_kasserer with a member. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt
70 lines
2.6 KiB
Bash
Executable File
70 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# First start on a fresh host. Idempotent: rerunning renders configs
|
|
# again and skips what exists. Needs podman + podman-compose and openssl,
|
|
# and DNS for PORTAL_HOST and ID_HOST already pointing here. Run rootful
|
|
# (as root) so Caddy can bind 80/443 and Kanidm sees a stable source IP.
|
|
#
|
|
# cp .env.example .env # fill in the hosts
|
|
# sudo sh bootstrap.sh
|
|
set -eu
|
|
cd "$(dirname "$0")"
|
|
[ -f .env ] || { echo "copy .env.example to .env and fill it in first"; exit 1; }
|
|
. ./.env
|
|
|
|
# A NATS password, once.
|
|
if [ -z "${NATS_PASSWORD:-}" ]; then
|
|
NATS_PASSWORD=$(openssl rand -base64 36 | tr -d '/+=' | cut -c1-40)
|
|
sed -i "s|^NATS_PASSWORD=.*|NATS_PASSWORD=$NATS_PASSWORD|" .env
|
|
echo "NATS_PASSWORD generated into .env"
|
|
fi
|
|
|
|
# Rendered configs (gitignored).
|
|
sed "s|\${ID_HOST}|$ID_HOST|g" kanidm/server.toml.tpl > kanidm/server.toml
|
|
sed "s|\${NATS_PASSWORD}|$NATS_PASSWORD|g" nats/nats.conf.tpl > nats/nats.conf
|
|
# The onboarding token is written by kanidm-setup.sh, once; a rerun of
|
|
# this script must not lose it, or every invite fails closed again.
|
|
kept_token=$(grep '^KANIDM_API_TOKEN=' portal.env 2>/dev/null | head -1 || true)
|
|
cat > portal.env <<EOF
|
|
NATS_URL=nats://portal:$NATS_PASSWORD@nats:4222
|
|
KANIDM_URL=https://$ID_HOST
|
|
OAUTH2_CLIENT_ID=$OAUTH2_CLIENT_ID
|
|
OAUTH2_CLIENT_SECRET=${OAUTH2_CLIENT_SECRET:-}
|
|
PUBLIC_URL=https://$PORTAL_HOST
|
|
COOKIE_SECURE=true
|
|
CONTENT_REPO=$CONTENT_REPO
|
|
CONTENT_BRANCH=$CONTENT_BRANCH
|
|
SITE_NAME=$SITE_NAME
|
|
SEED_ADMIN_EMAIL=${SEED_ADMIN_EMAIL:-}
|
|
SEED_ADMIN_NAME=${SEED_ADMIN_NAME:-}
|
|
RESPONSIBLE_GROUP=${RESPONSIBLE_GROUP:-}
|
|
EOF
|
|
[ -n "$kept_token" ] && echo "$kept_token" >> portal.env
|
|
chmod 600 portal.env
|
|
|
|
# Kanidm's internal certificate: Caddy holds the public one.
|
|
mkdir -p certs
|
|
if [ ! -f certs/kanidm-key.pem ]; then
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-subj "/CN=kanidm" -addext "subjectAltName=DNS:kanidm,DNS:$ID_HOST" \
|
|
-keyout certs/kanidm-key.pem -out certs/kanidm-chain.pem >/dev/null 2>&1
|
|
chmod 600 certs/kanidm-key.pem
|
|
echo "internal Kanidm certificate made"
|
|
fi
|
|
|
|
podman compose up -d --build
|
|
echo "containers up; Caddy is fetching certificates for $PORTAL_HOST and $ID_HOST"
|
|
|
|
# The Kanidm admin accounts exist only after the first start; their
|
|
# passwords are set by recovery. Do this once; the output is the
|
|
# password, shown once.
|
|
if [ ! -f .kanidm-recovered ]; then
|
|
echo
|
|
echo "=== Kanidm admin recovery (write these passwords down) ==="
|
|
podman compose exec kanidm kanidmd recover-account admin
|
|
podman compose exec kanidm kanidmd recover-account idm_admin
|
|
touch .kanidm-recovered
|
|
fi
|
|
|
|
echo
|
|
echo "Next: sh kanidm-setup.sh (log in as idm_admin, create the portal client and desk groups)"
|