Skip to content

Commit 10ced59

Browse files
wkloucekwkloucek
authored
Merge pull request #2302 from owncloud/add_migration_deployment
add migration deployment
2 parents 14f2b20 + 4bb5d00 commit 10ced59

28 files changed

+3738
-0
lines changed

‎deployments/continuous-deployment-config/oc10_ocis_parallel/latest.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
- name: continuous-deployment-oc10-ocis-parallel
3+
server:
4+
server_type: cx21
5+
image: ubuntu-20.04
6+
location: nbg1
7+
initial_ssh_key_names:
8+
- [email protected]
9+
labels:
10+
owner: wkloucek
11+
for: oCIS-continuous-deployment-examples
12+
rebuild: $REBUILD
13+
rebuild_carry_paths:
14+
- /var/lib/docker/volumes/ocis_certs
15+
16+
domains:
17+
- "*.oc10-ocis-parallel.latest.owncloud.works"
18+
19+
vars:
20+
ssh_authorized_keys:
21+
- https://github.com/butonic.keys
22+
- https://github.com/C0rby.keys
23+
- https://github.com/fschade.keys
24+
- https://github.com/kulmann.keys
25+
- https://github.com/micbar.keys
26+
- https://github.com/pascalwengerter.keys
27+
- https://github.com/paulcod3.keys
28+
- https://github.com/refs.keys
29+
- https://github.com/wkloucek.keys
30+
docker_compose_projects:
31+
- name: ocis
32+
git_url: https://github.com/owncloud/ocis.git
33+
ref: master
34+
docker_compose_path: deployments/examples/oc10_ocis_parallel
35+
env:
36+
INSECURE: "false"
37+
TRAEFIK_ACME_MAIL: [email protected]
38+
OCIS_DOCKER_TAG: latest
39+
CLOUD_DOMAIN: cloud.oc10-ocis-parallel.latest.owncloud.works
40+
KEYCLOAK_DOMAIN: keycloak.oc10-ocis-parallel.latest.owncloud.works
41+
LDAP_MANAGER_DOMAIN: ldap.oc10-ocis-parallel.latest.owncloud.works
42+
COMPOSE_FILE: docker-compose.yml:monitoring_tracing/docker-compose-additions.yml
43+
- name: monitoring
44+
git_url: https://github.com/owncloud-devops/monitoring-tracing-client.git
45+
ref: master
46+
env:
47+
NETWORK_NAME: ocis-net
48+
TELEMETRY_SERVE_DOMAIN: telemetry.oc10-ocis-parallel.latest.owncloud.works
49+
JAEGER_COLLECTOR: jaeger-collector.infra.owncloud.works:443
50+
TELEGRAF_SPECIFIC_CONFIG: ocis_single_container
51+
OCIS_URL: cloud.oc10-ocis-parallel.latest.owncloud.works
52+
OCIS_DEPLOYMENT_ID: continuous-deployment-oc10-ocis-parallel-latest

‎deployments/examples/oc10_ocis_parallel/.env

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# If you're on a internet facing server please comment out following line.
2+
# It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
3+
INSECURE=true
4+
5+
### Traefik settings ###
6+
TRAEFIK_LOG_LEVEL=
7+
# Serve Treafik dashboard. Defaults to "false".
8+
TRAEFIK_DASHBOARD=
9+
# Domain of Traefik, where you can find the dashboard. Defaults to "traefik.owncloud.test"
10+
TRAEFIK_DOMAIN=
11+
# Basic authentication for the dashboard. Defaults to user "admin" and password "admin"
12+
TRAEFIK_BASIC_AUTH_USERS=
13+
# Email address for obtaining LetsEncrypt certificates, needs only be changed if this is a public facing server
14+
TRAEFIK_ACME_MAIL=
15+
16+
### shared oCIS / oC10 settings ###
17+
# Domain of oCIS / oC10, where you can find the frontend. Defaults to "cloud.owncloud.test"
18+
CLOUD_DOMAIN=
19+
20+
### oCIS settings ###
21+
# oCIS version. Defaults to "latest"
22+
OCIS_DOCKER_TAG=
23+
# JWT secret which is used for the storage provider. Must be changed in order to have a secure oCIS. Defaults to "Pive-Fumkiu4"
24+
OCIS_JWT_SECRET=
25+
# JWT secret which is used for uploads to create transfer tokens. Must be changed in order to have a secure oCIS. Defaults to "replace-me-with-a-transfer-secret"
26+
STORAGE_TRANSFER_SECRET=
27+
28+
### oCIS settings ###
29+
# oC10 version. Defaults to "latest"
30+
OC10_DOCKER_TAG=
31+
# client secret which the openidconnect app uses to authenticate to Keycloak. Defaults to "oc10-oidc-secret"
32+
OC10_OIDC_CLIENT_SECRET=
33+
# app which will be shown when opening the ownCloud 10 UI. Defaults to "files" but also could be set to "web"
34+
OWNCLOUD_DEFAULT_APP=
35+
# if set to "false" (default) links will be opened in the classic UI, if set to "true" ownCloud Web is used
36+
OWNCLOUD_WEB_REWRITE_LINKS=
37+
38+
### LDAP settings ###
39+
# password for the LDAP admin user "cn=admin,dc=owncloud,dc=com", defaults to "admin"
40+
LDAP_ADMIN_PASSWORD=
41+
# Domain of the LDAP management frontend. Defaults to "ldap.owncloud.test"
42+
LDAP_MANAGER_DOMAIN=
43+
44+
### Keycloak ###
45+
# Domain of Keycloak, where you can find the managment and authentication frontend. Defaults to "keycloak.owncloud.test"
46+
KEYCLOAK_DOMAIN=
47+
# Realm which to be used with oCIS. Defaults to "oCIS"
48+
KEYCLOAK_REALM=
49+
# Admin user login name. Defaults to "admin"
50+
KEYCLOAK_ADMIN_USER=
51+
# Admin user login password. Defaults to "admin"
52+
KEYCLOAK_ADMIN_PASSWORD=
53+
54+
55+
# If you want to use debugging and tracing with this stack,
56+
# you need uncomment following line. Please see documentation at
57+
# https://owncloud.dev/ocis/deployment/monitoring-tracing/
58+
#COMPOSE_FILE=docker-compose.yml:monitoring_tracing/docker-compose-additions.yml

‎deployments/examples/oc10_ocis_parallel/README.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
document this deployment example in docs/ocis/deployment/oc10_ocis_parallel.md
3+
---
4+
5+
Please refer to [our documentation](https://owncloud.dev/ocis/deployment/oc10_ocis_parallel/)
6+
for instructions on how to deploy this scenario.

‎deployments/examples/oc10_ocis_parallel/config/keycloak/clients/android_app.json

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"clientId": "e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD",
3+
"name": "ownCloud Android app",
4+
"surrogateAuthRequired": false,
5+
"enabled": true,
6+
"alwaysDisplayInConsole": false,
7+
"clientAuthenticatorType": "client-secret",
8+
"secret" : "dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD",
9+
"redirectUris": [
10+
"oc://android.owncloud.com"
11+
],
12+
"webOrigins": [],
13+
"notBefore": 0,
14+
"bearerOnly": false,
15+
"consentRequired": false,
16+
"standardFlowEnabled": true,
17+
"implicitFlowEnabled": false,
18+
"directAccessGrantsEnabled": true,
19+
"serviceAccountsEnabled": false,
20+
"publicClient": false,
21+
"frontchannelLogout": false,
22+
"protocol": "openid-connect",
23+
"attributes": {
24+
"saml.assertion.signature": "false",
25+
"saml.force.post.binding": "false",
26+
"saml.multivalued.roles": "false",
27+
"saml.encrypt": "false",
28+
"backchannel.logout.revoke.offline.tokens": "false",
29+
"saml.server.signature": "false",
30+
"saml.server.signature.keyinfo.ext": "false",
31+
"exclude.session.state.from.auth.response": "false",
32+
"backchannel.logout.session.required": "true",
33+
"client_credentials.use_refresh_token": "false",
34+
"saml_force_name_id_format": "false",
35+
"saml.client.signature": "false",
36+
"tls.client.certificate.bound.access.tokens": "false",
37+
"saml.authnstatement": "false",
38+
"display.on.consent.screen": "false",
39+
"saml.onetimeuse.condition": "false"
40+
},
41+
"authenticationFlowBindingOverrides": {},
42+
"fullScopeAllowed": true,
43+
"nodeReRegistrationTimeout": -1,
44+
"defaultClientScopes": [
45+
"web-origins",
46+
"role_list",
47+
"profile",
48+
"roles",
49+
"owncloud",
50+
"email"
51+
],
52+
"optionalClientScopes": [
53+
"address",
54+
"phone",
55+
"offline_access",
56+
"microprofile-jwt"
57+
],
58+
"access": {
59+
"view": true,
60+
"configure": true,
61+
"manage": true
62+
}
63+
}

‎deployments/examples/oc10_ocis_parallel/config/keycloak/clients/desktop_client.json

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"clientId": "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69",
3+
"name": "ownCloud desktop client",
4+
"surrogateAuthRequired": false,
5+
"enabled": true,
6+
"alwaysDisplayInConsole": false,
7+
"clientAuthenticatorType": "client-secret",
8+
"secret" : "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh",
9+
"redirectUris": [
10+
"http://127.0.0.1:*",
11+
"http://localhost:*"
12+
],
13+
"webOrigins": [],
14+
"notBefore": 0,
15+
"bearerOnly": false,
16+
"consentRequired": false,
17+
"standardFlowEnabled": true,
18+
"implicitFlowEnabled": false,
19+
"directAccessGrantsEnabled": true,
20+
"serviceAccountsEnabled": false,
21+
"publicClient": false,
22+
"frontchannelLogout": false,
23+
"protocol": "openid-connect",
24+
"attributes": {
25+
"saml.assertion.signature": "false",
26+
"saml.force.post.binding": "false",
27+
"saml.multivalued.roles": "false",
28+
"saml.encrypt": "false",
29+
"backchannel.logout.revoke.offline.tokens": "false",
30+
"saml.server.signature": "false",
31+
"saml.server.signature.keyinfo.ext": "false",
32+
"exclude.session.state.from.auth.response": "false",
33+
"backchannel.logout.session.required": "true",
34+
"client_credentials.use_refresh_token": "false",
35+
"saml_force_name_id_format": "false",
36+
"saml.client.signature": "false",
37+
"tls.client.certificate.bound.access.tokens": "false",
38+
"saml.authnstatement": "false",
39+
"display.on.consent.screen": "false",
40+
"saml.onetimeuse.condition": "false"
41+
},
42+
"authenticationFlowBindingOverrides": {},
43+
"fullScopeAllowed": true,
44+
"nodeReRegistrationTimeout": -1,
45+
"defaultClientScopes": [
46+
"web-origins",
47+
"role_list",
48+
"profile",
49+
"roles",
50+
"owncloud",
51+
"email"
52+
],
53+
"optionalClientScopes": [
54+
"address",
55+
"phone",
56+
"offline_access",
57+
"microprofile-jwt"
58+
],
59+
"access": {
60+
"view": true,
61+
"configure": true,
62+
"manage": true
63+
}
64+
}

‎deployments/examples/oc10_ocis_parallel/config/keycloak/clients/ios_app.json

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"clientId": "mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1",
3+
"name": "ownCloud iOS app",
4+
"surrogateAuthRequired": false,
5+
"enabled": true,
6+
"alwaysDisplayInConsole": false,
7+
"clientAuthenticatorType": "client-secret",
8+
"secret" : "KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx",
9+
"redirectUris": [
10+
"oc://ios.owncloud.com",
11+
"oc.ios://ios.owncloud.com"
12+
],
13+
"webOrigins": [],
14+
"notBefore": 0,
15+
"bearerOnly": false,
16+
"consentRequired": false,
17+
"standardFlowEnabled": true,
18+
"implicitFlowEnabled": false,
19+
"directAccessGrantsEnabled": true,
20+
"serviceAccountsEnabled": false,
21+
"publicClient": false,
22+
"frontchannelLogout": false,
23+
"protocol": "openid-connect",
24+
"attributes": {
25+
"saml.assertion.signature": "false",
26+
"saml.force.post.binding": "false",
27+
"saml.multivalued.roles": "false",
28+
"saml.encrypt": "false",
29+
"backchannel.logout.revoke.offline.tokens": "false",
30+
"saml.server.signature": "false",
31+
"saml.server.signature.keyinfo.ext": "false",
32+
"exclude.session.state.from.auth.response": "false",
33+
"backchannel.logout.session.required": "true",
34+
"client_credentials.use_refresh_token": "false",
35+
"saml_force_name_id_format": "false",
36+
"saml.client.signature": "false",
37+
"tls.client.certificate.bound.access.tokens": "false",
38+
"saml.authnstatement": "false",
39+
"display.on.consent.screen": "false",
40+
"saml.onetimeuse.condition": "false"
41+
},
42+
"authenticationFlowBindingOverrides": {},
43+
"fullScopeAllowed": true,
44+
"nodeReRegistrationTimeout": -1,
45+
"defaultClientScopes": [
46+
"web-origins",
47+
"role_list",
48+
"profile",
49+
"roles",
50+
"owncloud",
51+
"email"
52+
],
53+
"optionalClientScopes": [
54+
"address",
55+
"phone",
56+
"offline_access",
57+
"microprofile-jwt"
58+
],
59+
"access": {
60+
"view": true,
61+
"configure": true,
62+
"manage": true
63+
}
64+
}

‎deployments/examples/oc10_ocis_parallel/config/keycloak/clients/oc10-web.json

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"clientId": "oc10-web",
3+
"rootUrl": "https://cloud.owncloud.test",
4+
"adminUrl": "https://cloud.owncloud.test",
5+
"surrogateAuthRequired": false,
6+
"enabled": true,
7+
"alwaysDisplayInConsole": false,
8+
"clientAuthenticatorType": "client-secret",
9+
"redirectUris": [
10+
"https://cloud.owncloud.test/*"
11+
],
12+
"webOrigins": [
13+
"https://cloud.owncloud.test"
14+
],
15+
"notBefore": 0,
16+
"bearerOnly": false,
17+
"consentRequired": false,
18+
"standardFlowEnabled": true,
19+
"implicitFlowEnabled": false,
20+
"directAccessGrantsEnabled": true,
21+
"serviceAccountsEnabled": false,
22+
"publicClient": true,
23+
"frontchannelLogout": false,
24+
"protocol": "openid-connect",
25+
"attributes": {
26+
"saml.assertion.signature": "false",
27+
"id.token.as.detached.signature": "false",
28+
"saml.force.post.binding": "false",
29+
"saml.multivalued.roles": "false",
30+
"saml.encrypt": "false",
31+
"oauth2.device.authorization.grant.enabled": "false",
32+
"backchannel.logout.revoke.offline.tokens": "false",
33+
"saml.server.signature": "false",
34+
"saml.server.signature.keyinfo.ext": "false",
35+
"use.refresh.tokens": "true",
36+
"exclude.session.state.from.auth.response": "false",
37+
"oidc.ciba.grant.enabled": "false",
38+
"saml.artifact.binding": "false",
39+
"backchannel.logout.session.required": "true",
40+
"client_credentials.use_refresh_token": "false",
41+
"saml_force_name_id_format": "false",
42+
"saml.client.signature": "false",
43+
"tls.client.certificate.bound.access.tokens": "false",
44+
"saml.authnstatement": "false",
45+
"display.on.consent.screen": "false",
46+
"saml.onetimeuse.condition": "false"
47+
},
48+
"authenticationFlowBindingOverrides": {},
49+
"fullScopeAllowed": true,
50+
"nodeReRegistrationTimeout": -1,
51+
"defaultClientScopes": [
52+
"web-origins",
53+
"profile",
54+
"roles",
55+
"owncloud",
56+
"email"
57+
],
58+
"optionalClientScopes": [
59+
"address",
60+
"phone",
61+
"offline_access",
62+
"microprofile-jwt"
63+
],
64+
"access": {
65+
"view": true,
66+
"configure": true,
67+
"manage": true
68+
}
69+
}

0 commit comments

Comments
 (0)