kasmweb: 1.12.0 -> 1.15.0 (#246777)

2024-09-11 15:08:33 +01:00 · 2024-08-29 13:03:51 +02:00 · 2024-08-29 13:03:51 +02:00 · b5e4bf3745
parent 8631ebfdda 5c1ed3ad5a
commit b5e4bf3745
3 changed files with 86 additions and 72 deletions
--- a/nixos/modules/services/web-apps/kasmweb/default.nix
+++ b/nixos/modules/services/web-apps/kasmweb/default.nix
@ -124,38 +124,31 @@ in
  };

  config = lib.mkIf cfg.enable {
-
    systemd.services = {
      "init-kasmweb" = {
        wantedBy = [
          "docker-kasm_db.service"
+          "podman-kasm_db.service"
        ];
-        before = [
-          "docker-kasm_db.service"
-          "docker-kasm_redis.service"
-          "docker-kasm_db_init.service"
-          "docker-kasm_api.service"
-          "docker-kasm_agent.service"
-          "docker-kasm_manager.service"
-          "docker-kasm_share.service"
-          "docker-kasm_guac.service"
-          "docker-kasm_proxy.service"
-        ];
+        wants = ["network-online.target"];
+        after = ["network-online.target"];
        serviceConfig = {
          Type = "oneshot";
+          TimeoutStartSec = 300;
          ExecStart = pkgs.substituteAll {
            src = ./initialize_kasmweb.sh;
            isExecutable = true;
-            binPath = lib.makeBinPath [ pkgs.docker pkgs.openssl pkgs.gnused ];
+            binPath = lib.makeBinPath [ pkgs.docker pkgs.openssl pkgs.gnused pkgs.yq-go ];
            runtimeShell = pkgs.runtimeShell;
            kasmweb = pkgs.kasmweb;
-            postgresUser = cfg.postgres.user;
-            postgresPassword = cfg.postgres.password;
+            postgresUser = "postgres";
+            postgresPassword = "postgres";
            inherit (cfg)
              datastorePath
              sslCertificate
              sslCertificateKey
              redisPassword
+              networkSubnet
              defaultUserPassword
              defaultAdminPassword
              defaultManagerToken
@ -167,12 +160,14 @@ in
    };

    virtualisation = {
+      oci-containers.backend = "docker";
      oci-containers.containers = {
        kasm_db = {
-          image = "postgres:12-alpine";
+          image = "postgres:16-alpine";
+          autoStart = true;
          environment = {
-            POSTGRES_PASSWORD = cfg.postgres.password;
-            POSTGRES_USER = cfg.postgres.user;
+            POSTGRES_PASSWORD = "postgres";
+            POSTGRES_USER = "postgres";
            POSTGRES_DB = "kasm";
          };
          volumes = [
@ -185,6 +180,7 @@ in
        kasm_db_init = {
          image = "kasmweb/api:${pkgs.kasmweb.version}";
          user = "root:root";
+          autoStart = true;
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
            "kasmweb_api_data:/tmp"
@ -197,6 +193,7 @@ in
        kasm_redis = {
          image = "redis:5-alpine";
          entrypoint = "/bin/sh";
+          autoStart = true;
          cmd = [
            "-c"
            "redis-server --requirepass ${cfg.redisPassword}"
@ -205,6 +202,7 @@ in
        };
        kasm_api = {
          image = "kasmweb/api:${pkgs.kasmweb.version}";
+          autoStart = false;
          user = "root:root";
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
@ -215,15 +213,17 @@ in
        };
        kasm_manager = {
          image = "kasmweb/manager:${pkgs.kasmweb.version}";
+          autoStart = false;
          user = "root:root";
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
          ];
-          dependsOn = [ "kasm_db" "kasm_api" ];
+          dependsOn = [ "kasm_db_init" "kasm_db" "kasm_api" ];
          extraOptions = [ "--network=kasm_default_network" "--userns=host" "--read-only"];
        };
        kasm_agent = {
          image = "kasmweb/agent:${pkgs.kasmweb.version}";
+          autoStart = false;
          user = "root:root";
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
@ -236,15 +236,17 @@ in
        };
        kasm_share = {
          image = "kasmweb/share:${pkgs.kasmweb.version}";
+          autoStart = false;
          user = "root:root";
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
          ];
-          dependsOn = [ "kasm_db" "kasm_redis" ];
+          dependsOn = [ "kasm_db_init" "kasm_db" "kasm_redis" ];
          extraOptions = [ "--network=kasm_default_network" "--userns=host" "--read-only" ];
        };
        kasm_guac = {
          image = "kasmweb/kasm-guac:${pkgs.kasmweb.version}";
+          autoStart = false;
          user = "root:root";
          volumes = [
            "${cfg.datastorePath}/:/opt/kasm/current/"
@ -254,6 +256,7 @@ in
        };
        kasm_proxy = {
          image = "kasmweb/nginx:latest";
+          autoStart = false;
          ports = [ "${cfg.listenAddress}:${toString cfg.listenPort}:443" ];
          user = "root:root";
          volumes = [
--- a/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh
+++ b/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh
@ -11,12 +11,39 @@ mkdir -p @datastorePath@/conf/nginx/containers.d
 chmod -R a+rw @datastorePath@/conf
 ln -sf @kasmweb@/www @datastorePath@

+cat >@datastorePath@/init_seeds.sh <<EOF
+#!/bin/bash
+if [ ! -e /opt/kasm/current/.done_initing_data ]; then
+  while true; do
+      sleep 15;
+      /usr/bin/kasm_server.so --initialize-database --cfg \
+        /opt/kasm/current/conf/app/api.app.config.yaml \
+        --seed-file \
+        /opt/kasm/current/conf/database/seed_data/default_properties.yaml \
+        --populate-production \
+        && break
+  done  && /usr/bin/kasm_server.so --cfg \
+    /opt/kasm/current/conf/app/api.app.config.yaml \
+    --populate-production \
+    --seed-file \
+    /opt/kasm/current/conf/database/seed_data/default_agents.yaml \
+  && /usr/bin/kasm_server.so --cfg \
+    /opt/kasm/current/conf/app/api.app.config.yaml \
+    --populate-production \
+    --seed-file \
+    /opt/kasm/current/conf/database/seed_data/default_images_amd64.yaml \
+  && touch /opt/kasm/current/.done_initing_data
+
+  while true; do sleep 10 ; done
+else
+ echo "skipping database init"
+  while true; do sleep 10 ; done
+fi
+EOF

 docker network inspect kasm_default_network >/dev/null || docker network create kasm_default_network --subnet @networkSubnet@
-if docker volume inspect kasmweb_db >/dev/null; then
+if [ -e @datastorePath@/ids.env ]; then
    source @datastorePath@/ids.env
-    echo 'echo "skipping database init"' > @datastorePath@/init_seeds.sh
-    echo 'while true; do sleep 10 ; done' >> @datastorePath@/init_seeds.sh
 else
    API_SERVER_ID=$(cat /proc/sys/kernel/random/uuid)
    MANAGER_ID=$(cat /proc/sys/kernel/random/uuid)
@ -30,43 +57,10 @@ else
    mkdir -p @datastorePath@/certs
    openssl req -x509 -nodes -days 1825 -newkey rsa:2048 -keyout @datastorePath@/certs/kasm_nginx.key -out @datastorePath@/certs/kasm_nginx.crt -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=$(hostname)/emailAddress=none@none.none" 2> /dev/null

-    docker volume create kasmweb_db
+    mkdir -p @datastorePath@/file_mappings
+
+    docker volume create kasmweb_db || true
    rm @datastorePath@/.done_initing_data
-    cat >@datastorePath@/init_seeds.sh <<EOF
-#!/bin/bash
-if [ ! -e /opt/kasm/current/.done_initing_data ]; then
-  sleep 4
-  /usr/bin/kasm_server.so --initialize-database --cfg \
-    /opt/kasm/current/conf/app/api.app.config.yaml \
-    --populate-production \
-    --seed-file \
-    /opt/kasm/current/conf/database/seed_data/default_properties.yaml \
-    2>&1 | grep -v UserWarning
-  /usr/bin/kasm_server.so --cfg \
-    /opt/kasm/current/conf/app/api.app.config.yaml \
-    --populate-production \
-    --seed-file \
-    /opt/kasm/current/conf/database/seed_data/default_agents.yaml \
-    2>&1 | grep -v UserWarning
-  /usr/bin/kasm_server.so --cfg \
-    /opt/kasm/current/conf/app/api.app.config.yaml \
-    --populate-production \
-    --seed-file \
-    /opt/kasm/current/conf/database/seed_data/default_connection_proxies.yaml \
-    2>&1 | grep -v UserWarning
-  /usr/bin/kasm_server.so --cfg \
-    /opt/kasm/current/conf/app/api.app.config.yaml \
-    --populate-production \
-    --seed-file \
-    /opt/kasm/current/conf/database/seed_data/default_images_amd64.yaml \
-    2>&1 | grep -v UserWarning
-  touch /opt/kasm/current/.done_initing_data
-  while true; do sleep 10 ; done
-else
- echo "skipping database init"
-  while true; do sleep 10 ; done
-fi
-EOF
 fi

 chmod +x @datastorePath@/init_seeds.sh
@ -77,11 +71,14 @@ if [ -e @sslCertificate@ ]; then
    cp @sslCertificateKey@ @datastorePath@/certs/kasm_nginx.key
 fi

+yq -i '.server.zone_name = "'default'"' @datastorePath@/conf/app/api.app.config.yaml
+yq -i '(.zones.[0]) .zone_name = "'default'"' @datastorePath@/conf/database/seed_data/default_properties.yaml
+
 sed -i -e "s/username.*/username: @postgresUser@/g" \
    -e "s/password.*/password: @postgresPassword@/g" \
    -e "s/host.*db/host: kasm_db/g" \
    -e "s/ssl: true/ssl: false/g" \
-    -e "s/redisPassword.*/redisPassword: @redisPassword@/g" \
+    -e "s/redis_password.*/redis_password: @redisPassword@/g" \
    -e "s/server_hostname.*/server_hostname: kasm_api/g" \
    -e "s/server_id.*/server_id: $API_SERVER_ID/g" \
    -e "s/manager_id.*/manager_id: $MANAGER_ID/g" \
@ -93,22 +90,36 @@ sed -i -e "s/ token:.*/ token: \"@defaultManagerToken@\"/g" \
    -e "s/server_id.*/server_id: $SERVER_ID/g" \
    @datastorePath@/conf/app/agent.app.config.yaml

+# Generate a salt and hash for the desired passwords. Update the yaml
+ADMIN_SALT=$(cat /proc/sys/kernel/random/uuid)
+ADMIN_HASH=$(printf @defaultAdminPassword@${ADMIN_SALT} | sha256sum | cut -c-64)
+USER_SALT=$(cat /proc/sys/kernel/random/uuid)
+USER_HASH=$(printf @defaultUserPassword@${USER_SALT} | sha256sum | cut -c-64)

-sed -i -e "s/password: admin.*/password: \"@defaultAdminPassword@\"/g" \
-    -e "s/password: user.*/password: \"@defaultUserPassword@\"/g" \
-    -e "s/default-manager-token/@defaultManagerToken@/g" \
-    -e "s/default-registration-token/@defaultRegistrationToken@/g" \
-    -e "s/upstream_auth_address:.*/upstream_auth_address: 'proxy'/g" \
+yq -i  '(.users.[] | select(.username=="admin@kasm.local") | .salt) = "'${ADMIN_SALT}'"'  @datastorePath@/conf/database/seed_data/default_properties.yaml
+yq -i  '(.users.[] | select(.username=="admin@kasm.local") | .pw_hash) = "'${ADMIN_HASH}'"'  @datastorePath@/conf/database/seed_data/default_properties.yaml
+
+yq -i  '(.users.[] | select(.username=="user@kasm.local") | .salt) = "'${USER_SALT}'"'  @datastorePath@/conf/database/seed_data/default_properties.yaml
+yq -i  '(.users.[] | select(.username=="user@kasm.local") | .pw_hash) = "'${USER_HASH}'"'  @datastorePath@/conf/database/seed_data/default_properties.yaml
+
+yq -i   '(.settings.[] | select(.name=="token") | select(.category == "manager")) .value = "'@defaultManagerToken@'"'   @datastorePath@/conf/database/seed_data/default_properties.yaml
+
+yq -i   '(.settings.[] | select(.name=="registration_token") | select(.category == "auth")) .value = "'@defaultRegistrationToken@'"'   @datastorePath@/conf/database/seed_data/default_properties.yaml
+
+sed -i -e "s/upstream_auth_address:.*/upstream_auth_address: 'proxy'/g" \
    @datastorePath@/conf/database/seed_data/default_properties.yaml

 sed -i -e "s/GUACTOKEN/@defaultGuacToken@/g" \
    -e "s/APIHOSTNAME/proxy/g" \
    @datastorePath@/conf/app/kasmguac.app.config.yaml

-sed -i -e "s/GUACTOKEN/@defaultGuacToken@/g" \
-    -e "s/APIHOSTNAME/proxy/g" \
-    @datastorePath@/conf/database/seed_data/default_connection_proxies.yaml
-
 sed -i "s/00000000-0000-0000-0000-000000000000/$SERVER_ID/g" \
    @datastorePath@/conf/database/seed_data/default_agents.yaml

+
+while [ ! -e @datastorePath@/.done_initing_data ]; do
+    sleep 10;
+done
+
+systemctl restart docker-kasm_proxy.service
+
--- a/pkgs/servers/web-apps/kasmweb/default.nix
+++ b/pkgs/servers/web-apps/kasmweb/default.nix
@ -5,12 +5,12 @@

 stdenv.mkDerivation rec {
  pname = "kasmweb";
-  version = "1.12.0";
-  build = "d4fd8a";
+  version = "1.15.0";
+  build = "06fdc8";

  src = fetchzip {
    url = "https://kasm-static-content.s3.amazonaws.com/kasm_release_${version}.${build}.tar.gz";
-    sha256 = "sha256-dCjWmI8gYtoMiMHVNgTg2ZROHXvT4ulynNvnKfMxURo=";
+    sha256 = "sha256-7z5lc4QEpQQdVGMEMc04wXlJTK5VXJ4rufZmDEflJLw=";
  };

  dontConfigure = true;