Initial commit.

2026-07-15 07:49:11 -04:00
commit a3f0f8a1be
37 changed files with 2825 additions and 0 deletions
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-configure() {
+  declare desc="configure the shared Google OAuth service"
+  local cmd="google-auth:configure"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local domains=() emails=() domains_given=false emails_given=false
+  local old_port
+  old_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --client-id)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--client-id requires a value"
+        fn-ga-global-set client-id "$2"
+        shift 2
+        ;;
+      --client-secret)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--client-secret requires a value"
+        fn-ga-global-set client-secret "$2"
+        shift 2
+        ;;
+      --auth-host)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--auth-host requires a value"
+        local host="${2#https://}"
+        host="${host#http://}"
+        host="${host%/}"
+        fn-ga-global-set auth-host "${host,,}"
+        shift 2
+        ;;
+      --allow-domain)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--allow-domain requires a value"
+        domains_given=true
+        domains+=("${2,,}")
+        shift 2
+        ;;
+      --allow-email)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--allow-email requires a value"
+        emails_given=true
+        emails+=("${2,,}")
+        shift 2
+        ;;
+      --session-ttl)
+        [[ "${2:-}" =~ ^[0-9]+(h|m|s)$ ]] || dokku_log_fail "--session-ttl must look like 24h, 30m, or 3600s"
+        fn-ga-global-set session-ttl "$2"
+        shift 2
+        ;;
+      --cookie-name)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--cookie-name requires a value"
+        fn-ga-global-set cookie-name "$2"
+        shift 2
+        ;;
+      --port)
+        [[ "${2:-}" =~ ^[0-9]+$ ]] || dokku_log_fail "--port must be a number"
+        fn-ga-global-set port "$2"
+        shift 2
+        ;;
+      --insecure-allow-http)
+        # For local/dev testing only; Google requires https redirect URIs.
+        fn-ga-global-set allow-insecure true
+        shift 1
+        ;;
+      --regenerate-cookie-secret)
+        fn-ga-global-set cookie-secret "$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+        dokku_log_info1 "cookie secret regenerated; all existing sessions are now invalid"
+        shift 1
+        ;;
+      *)
+        dokku_log_fail "unknown flag: $1 (see: dokku google-auth:help)"
+        ;;
+    esac
+  done
+
+  # Replace the allow lists only when new values were passed.
+  [[ "$domains_given" == "true" ]] && fn-ga-global-set-list allowed-domains "${domains[@]}"
+  [[ "$emails_given" == "true" ]] && fn-ga-global-set-list allowed-emails "${emails[@]}"
+
+  # First run: generate the cookie secret automatically.
+  if [[ -z "$(fn-ga-global-get cookie-secret)" ]]; then
+    fn-ga-global-set cookie-secret "$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+  fi
+
+  if ! fn-ga-configured; then
+    dokku_log_warn "configuration incomplete — required: --client-id, --client-secret, --auth-host, and at least one --allow-domain or --allow-email"
+    dokku_log_warn "settings so far are saved; run google-auth:configure again with the missing flags"
+    return 0
+  fi
+
+  fn-ga-service-start
+
+  local new_port
+  new_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
+  if [[ "$new_port" != "$old_port" ]]; then
+    dokku_log_info1 "service port changed; regenerating nginx config for enabled apps"
+    fn-ga-apply-all
+  fi
+
+  local auth_host
+  auth_host="$(fn-ga-global-get auth-host)"
+  dokku_log_info2 "google-auth configured"
+  dokku_log_verbose "Register this redirect URI in the Google Cloud Console for your OAuth client:"
+  dokku_log_verbose ""
+  dokku_log_verbose "    https://${auth_host}${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
+  dokku_log_verbose ""
+  dokku_log_verbose "Then protect apps with: dokku google-auth:enable <app>"
+  fn-ga-warn-if-auth-host-unrouted
+}
+
+cmd-google-auth-configure "$@"
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+# `dokku google-auth` with no subcommand shows the report.
+exec "$(dirname "${BASH_SOURCE[0]}")/report" "$@"
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-disable() {
+  declare desc="remove Google sign-in from an app"
+  local cmd="google-auth:disable"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1"
+
+  [[ -n "$APP" ]] || dokku_log_fail "usage: dokku google-auth:disable <app>"
+  verify_app_name "$APP"
+
+  fn-ga-app-set-enabled "$APP" false
+  fn-ga-apply "$APP"
+  dokku_log_info2 "Google auth disabled for $APP"
+
+  local auth_host
+  auth_host="$(fn-ga-global-get auth-host)"
+  if [[ -n "$auth_host" && -f "$DOKKU_ROOT/$APP/VHOST" ]] && grep -qxF "$auth_host" "$DOKKU_ROOT/$APP/VHOST"; then
+    dokku_log_warn "$APP served the auth host '$auth_host'; sign-in for other apps will break until another enabled app serves it"
+  fi
+}
+
+cmd-google-auth-disable "$@"
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-enable() {
+  declare desc="require Google sign-in for all requests to an app"
+  local cmd="google-auth:enable"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1"
+
+  [[ -n "$APP" ]] || dokku_log_fail "usage: dokku google-auth:enable <app>"
+  verify_app_name "$APP"
+  fn-ga-configured || dokku_log_fail "google-auth is not configured yet; run: dokku google-auth:configure"
+
+  if ! fn-ga-service-running; then
+    dokku_log_info1 "auth service is not running; starting it"
+    fn-ga-service-start
+  fi
+
+  fn-ga-app-set-enabled "$APP" true
+  fn-ga-apply "$APP"
+
+  dokku_log_info2 "Google auth enabled for $APP"
+  dokku_log_verbose "Authenticated requests reach the app with these headers:"
+  dokku_log_verbose "    X-Forwarded-Email / X-Auth-Request-Email  — signed-in Google email"
+  dokku_log_verbose "    X-Forwarded-User  / X-Auth-Request-User   — stable Google account id"
+  dokku_log_verbose "    X-Auth-Request-Name                       — display name"
+  fn-ga-warn-if-auth-host-unrouted
+}
+
+cmd-google-auth-enable "$@"
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-exclude() {
+  declare desc="exempt paths from Google sign-in (prefix: /path, regex: re:^/pattern)"
+  local cmd="google-auth:exclude"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1"
+  shift 1 || true
+
+  [[ -n "$APP" ]] || dokku_log_fail "usage: dokku google-auth:exclude <app> <pattern...>"
+  verify_app_name "$APP"
+
+  if [[ $# -eq 0 ]]; then
+    dokku_log_info2 "excluded paths for $APP"
+    local pattern
+    while IFS= read -r pattern; do
+      [[ -n "$pattern" ]] && dokku_log_verbose "$pattern"
+    done < <(fn-ga-excludes "$APP")
+    return 0
+  fi
+
+  local pattern
+  for pattern in "$@"; do
+    fn-ga-validate-pattern "$pattern" ||
+      dokku_log_fail "invalid pattern '$pattern' — use a path prefix like /api/webhooks or a regex like re:^/v[0-9]+/public/ (no spaces, quotes, or ;{})"
+    fn-ga-exclude-add "$APP" "$pattern"
+    dokku_log_info1 "excluded: $pattern"
+  done
+
+  if fn-google-auth-app-enabled "$APP"; then
+    fn-ga-apply "$APP"
+  else
+    dokku_log_verbose "patterns saved; they take effect when google-auth is enabled for $APP"
+  fi
+}
+
+cmd-google-auth-exclude "$@"
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-logs() {
+  declare desc="show logs from the shared auth service container"
+  local cmd="google-auth:logs"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local args=(--tail 100)
+  if [[ "${1:-}" == "--tail" || "${1:-}" == "-t" ]]; then
+    args=(--tail 100 --follow)
+  fi
+  docker container logs "${args[@]}" "$GOOGLE_AUTH_SERVICE_NAME"
+}
+
+cmd-google-auth-logs "$@"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+fn-ga-report-app() {
+  declare APP="$1"
+  dokku_log_info2 "$APP google-auth information"
+  if fn-google-auth-app-enabled "$APP"; then
+    dokku_log_verbose "Enabled:  true"
+    local pattern found=false
+    while IFS= read -r pattern; do
+      [[ -z "$pattern" ]] && continue
+      if [[ "$found" == "false" ]]; then
+        dokku_log_verbose "Excluded: $pattern"
+        found=true
+      else
+        dokku_log_verbose "          $pattern"
+      fi
+    done < <(fn-ga-excludes "$APP")
+    [[ "$found" == "false" ]] && dokku_log_verbose "Excluded: (none)"
+    if [[ -f "$(fn-ga-conf-path "$APP")" ]]; then
+      dokku_log_verbose "Nginx:    $(fn-ga-conf-path "$APP")"
+    else
+      dokku_log_verbose "Nginx:    (config pending; will be written on next deploy)"
+    fi
+  else
+    dokku_log_verbose "Enabled:  false"
+  fi
+}
+
+cmd-google-auth-report() {
+  declare desc="show global and per-app google-auth status"
+  local cmd="google-auth:report"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="${1:-}"
+
+  if [[ -n "$APP" ]]; then
+    verify_app_name "$APP"
+    fn-ga-report-app "$APP"
+    return 0
+  fi
+
+  dokku_log_info2 "google-auth global information"
+  if fn-ga-configured; then
+    dokku_log_verbose "Configured:      true"
+  else
+    dokku_log_verbose "Configured:      false (run dokku google-auth:configure)"
+  fi
+  local client_id
+  client_id="$(fn-ga-global-get client-id)"
+  dokku_log_verbose "Client id:       ${client_id:-(unset)}"
+  dokku_log_verbose "Client secret:   $([[ -n "$(fn-ga-global-get client-secret)" ]] && echo '(set)' || echo '(unset)')"
+  dokku_log_verbose "Auth host:       $(fn-ga-global-get auth-host '(unset)')"
+  dokku_log_verbose "Callback URL:    https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
+  dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -)"
+  dokku_log_verbose "Allowed emails:  $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
+  dokku_log_verbose "Session TTL:     $(fn-ga-global-get session-ttl 24h)"
+  dokku_log_verbose "Service port:    127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
+  if fn-ga-service-running; then
+    dokku_log_verbose "Service:         running"
+  else
+    dokku_log_verbose "Service:         not running"
+  fi
+
+  local app
+  while IFS= read -r app; do
+    [[ -z "$app" ]] && continue
+    fn-ga-report-app "$app"
+  done < <(fn-ga-enabled-apps)
+}
+
+cmd-google-auth-report "$@"
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-restart() {
+  declare desc="restart the shared auth service container"
+  local cmd="google-auth:restart"
+  [[ "$1" == "$cmd" ]] && shift 1
+  fn-ga-service-start
+}
+
+cmd-google-auth-restart "$@"
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-start() {
+  declare desc="start the shared auth service container"
+  local cmd="google-auth:start"
+  [[ "$1" == "$cmd" ]] && shift 1
+  fn-ga-service-start
+}
+
+cmd-google-auth-start "$@"
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-stop() {
+  declare desc="stop the shared auth service container"
+  local cmd="google-auth:stop"
+  [[ "$1" == "$cmd" ]] && shift 1
+  fn-ga-service-stop
+  dokku_log_info1 "google-auth service stopped"
+  dokku_log_warn "apps with google-auth enabled will return 502/redirect errors until it is started again"
+}
+
+cmd-google-auth-stop "$@"
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-unexclude() {
+  declare desc="remove previously excluded patterns"
+  local cmd="google-auth:unexclude"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1"
+  shift 1 || true
+
+  [[ -n "$APP" && $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:unexclude <app> <pattern...>"
+  verify_app_name "$APP"
+
+  local pattern
+  for pattern in "$@"; do
+    fn-ga-exclude-remove "$APP" "$pattern"
+    dokku_log_info1 "removed exclusion: $pattern"
+  done
+
+  if fn-google-auth-app-enabled "$APP"; then
+    fn-ga-apply "$APP"
+  fi
+}
+
+cmd-google-auth-unexclude "$@"