44 lines
2.0 KiB
Bash
Executable File
44 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Runs (as root) on `dokku plugin:install` and `dokku plugin:update`.
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
|
|
PLUGIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
DOKKU_LIB_ROOT=${DOKKU_LIB_ROOT:-/var/lib/dokku}
|
|
DATA_ROOT="$DOKKU_LIB_ROOT/data/google-auth"
|
|
|
|
mkdir -p "$DATA_ROOT/global" "$DATA_ROOT/apps"
|
|
|
|
if command -v docker >/dev/null 2>&1; then
|
|
echo "-----> Building dokku-google-auth service image (first build can take a few minutes)"
|
|
docker image build -t dokku-google-auth:latest "$PLUGIN_DIR"
|
|
# Pick up the new image if the service is already running. This goes through
|
|
# fn-ga-service-start rather than its own `docker run` so an upgrade always
|
|
# rewrites service.env first: recreating the container from the file an older
|
|
# version left behind gives it stale settings — most damagingly a missing
|
|
# GOOGLE_AUTH_APP_CONFIG_DIR, which makes the service ignore every per-app
|
|
# access list and fall back to the global one.
|
|
if [[ "$(docker container inspect -f '{{.State.Running}}' dokku-google-auth 2>/dev/null)" == "true" ]]; then
|
|
echo "-----> Restarting google-auth service with the new image"
|
|
# shellcheck disable=SC1091
|
|
source "$PLUGIN_DIR/functions"
|
|
if fn-ga-configured; then
|
|
fn-ga-service-start
|
|
else
|
|
echo " ! google-auth is not fully configured; the running service keeps the old image" 1>&2
|
|
echo " ! run 'dokku google-auth:configure' then 'dokku google-auth:restart'" 1>&2
|
|
fi
|
|
fi
|
|
else
|
|
echo " ! docker not found; the google-auth service image was not built" 1>&2
|
|
fi
|
|
|
|
# Ownership and modes last: the steps above can rewrite service.env as root,
|
|
# and the dokku user has to be able to rewrite it from then on.
|
|
chown -R dokku:dokku "$DATA_ROOT" 2>/dev/null || true
|
|
chmod 700 "$DATA_ROOT"
|
|
# apps/ is bind-mounted into the service container, which runs as an
|
|
# unprivileged uid and must be able to traverse it to read per-app access
|
|
# lists. The 0700 on DATA_ROOT still keeps other host users out.
|
|
chmod 711 "$DATA_ROOT/apps"
|