rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add cfg generation on docker run using ENV vars

Browse Source 
Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>
This commit is contained in:
Thomas Stocker
2025-10-27 15:31:21 +01:00
committed by Bryan Frimin
parent 4518fca72f
commit 4bf5343143
3 changed files with 319 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Dockerfile
View File

@@ -11,9 +11,14 @@ RUN useradd -m probo && \
rm -rf /var/lib/apt/lists/*
COPY probod /usr/local/bin/probod
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/probod && \
setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/probod
chmod +x /usr/local/bin/entrypoint.sh && \
setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/probod && \
mkdir -p /etc/probod && \
chown probo:probo /etc/probod
USER probo
ENTRYPOINT ["probod"]
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

185
docker-compose.yaml Normal file
View File

@@ -0,0 +1,185 @@
services:
probo:
image: "ghcr.io/getprobo/probo:latest"
environment:
# Required secrets (use secure values in production)
PROBOD_ENCRYPTION_KEY: "thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA="
AUTH_COOKIE_SECRET: "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes"
AUTH_PASSWORD_PEPPER: "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes"
TRUST_AUTH_TOKEN_SECRET: "this-is-a-secure-secret-for-trust-token-signing-at-least-32-bytes"
# Application settings
PROBOD_HOSTNAME: "localhost:8080"
API_ADDR: "localhost:8080"
API_CORS_ALLOWED_ORIGINS: "http://localhost:8080,http://localhost:5173"
# PostgreSQL database
PG_ADDR: "postgres:5432"
PG_USERNAME: "postgres"
PG_PASSWORD: "postgres"
PG_DATABASE: "probod"
PG_POOL_SIZE: "100"
# AWS/MinIO S3 storage
AWS_REGION: "us-east-1"
AWS_BUCKET: "probod"
AWS_ACCESS_KEY_ID: "probod"
AWS_SECRET_ACCESS_KEY: "thisisnotasecret"
AWS_ENDPOINT: "http://minio:9000"
# Observability - Metrics & Tracing
METRICS_ADDR: "probo:8081"
TRACING_ADDR: "tempo:4317"
# Email notifications
SMTP_ADDR: "mailpit:1025"
SMTP_TLS_REQUIRED: "false"
MAILER_SENDER_NAME: "Probo"
MAILER_SENDER_EMAIL: "no-reply@notification.getprobo.com"
# Chrome for PDF generation
CHROME_DP_ADDR: "chrome:9222"
ports:
- "8080:8080"
- "8081:8081"
- "8443:8443"
volumes:
- "probo-data:/data"
depends_on:
- postgres
- minio
- chrome
postgres:
image: "postgres:17.4"
shm_size: "1g"
command: >
postgres -c "shared_buffers=4GB"
-c "max_connections=200"
-c "log_statement=all"
ports:
- "5432:5432"
volumes:
- "./compose/postgres:/docker-entrypoint-initdb.d:ro"
- "postgres-data:/var/lib/postgresql/data:rw"
environment:
POSTGRES_USER: "postgres"
POSTGRES_PASSWORD: "postgres"
minio:
image: "quay.io/minio/minio"
entrypoint: "sh"
command: |
-c 'mkdir -p /var/lib/minio/probod && minio server --json --console-address :9001 /var/lib/minio'
ports:
- "9000:9000"
- "9001:9001"
volumes:
- "minio-data:/var/lib/minio:rw"
environment:
MINIO_ROOT_USER: "probod"
MINIO_ROOT_PASSWORD: "thisisnotasecret"
grafana:
image: "grafana/grafana:latest"
ports:
- "3001:3000"
volumes:
- "./compose/grafana/provisioning:/etc/grafana/provisioning:ro"
- "grafana-data:/var/lib/grafana:rw"
environment:
GF_AUTH_ANONYMOUS_ENABLED: "true"
GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin"
GF_AUTH_DISABLE_LOGIN_FORM: "true"
GF_USERS_DEFAULT_THEME: "light"
prometheus:
image: "prom/prometheus:latest"
volumes:
- "./compose/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yml"
- "prometheus-data:/prometheus"
command:
- "--config.file=/etc/prometheus/prometheus.yml"
- "--storage.tsdb.path=/prometheus"
- "--web.console.libraries=/etc/prometheus/console_libraries"
- "--web.console.templates=/etc/prometheus/consoles"
- "--web.enable-lifecycle"
- "--web.enable-remote-write-receiver"
- "--web.listen-address=:9191"
ports:
- "9191:9191"
loki:
image: "grafana/loki:latest"
ports:
- "3100:3100"
command:
- "-config.file=/etc/loki/local-config.yaml"
tempo:
image: "grafana/tempo:latest"
command:
- "-config.file=/etc/tempo.yaml"
ports:
- "4317:4317"
volumes:
- "./compose/tempo/tempo.yaml:/etc/tempo.yaml:ro"
- "tempo-data:/var/tempo:rw"
mailpit:
image: "axllent/mailpit:latest"
ports:
- "1025:1025" # SMTP server
- "8025:8025" # Web UI
environment:
- "MP_DISABLE_VERSION_CHECK=true"
- "MP_VERBOSE=false"
- "MP_SMTP_AUTH_ACCEPT_ANY=true"
- "MP_ENABLE_PROMETHEUS=true"
- "MP_SMTP_AUTH_ALLOW_INSECURE=true"
chrome:
image: "chromedp/headless-shell:140.0.7259.2"
ports:
- "9222:9222"
command:
- "--headless"
- "--disable-gpu"
- "--disable-dev-shm-usage"
- "--hide-scrollbars"
- "--mute-audio"
- "--no-default-browser-check"
- "--no-first-run"
- "--disable-background-networking"
- "--disable-background-timer-throttling"
- "--disable-extensions"
pebble:
image: "letsencrypt/pebble:latest"
ports:
- "14000:14000" # ACME server
- "15000:15000" # Management interface
environment:
PEBBLE_VA_NOSLEEP: "1" # Don't sleep during validation for faster testing
PEBBLE_WFE_NONCEREJECT: "0" # Don't reject reused nonces
PEBBLE_VA_ALWAYS_VALID: "1" # Skip actual HTTP/DNS validation for local dev
command: pebble -config /test/config/pebble-config.json -dnsserver 127.0.0.1:8053
volumes:
- "./compose/pebble:/test/config:ro"
pebble-challtestsrv:
image: "letsencrypt/pebble-challtestsrv:latest"
ports:
- "8055:8055" # HTTP-01 challenge test server
- "8053:8053" # DNS server
- "8056:8056" # Management API
command: pebble-challtestsrv -dns01 ":8053" -http01 ":8055" -management ":8056"
volumes:
probo-data:
postgres-data:
minio-data:
grafana-data:
prometheus-data:
tempo-data:

127
entrypoint.sh Normal file
View File

@@ -0,0 +1,127 @@
#!/bin/bash
set -e
# Configuration file path
CONFIG_FILE="${CONFIG_FILE:-/etc/probod/config.yml}"
# Check if config file already exists (e.g., mounted from ConfigMap)
if [ -f "$CONFIG_FILE" ]; then
echo "Using existing configuration file at: $CONFIG_FILE"
else
echo "Generating configuration file from environment variables at: $CONFIG_FILE"
# Create directory if it doesn't exist
mkdir -p "$(dirname "$CONFIG_FILE")"
cat > "$CONFIG_FILE" <<EOF
unit:
metrics:
addr: "${METRICS_ADDR:-localhost:8081}"
tracing:
addr: "${TRACING_ADDR:-localhost:4317}"
max-batch-size: ${TRACING_MAX_BATCH_SIZE:-512}
batch-timeout: ${TRACING_BATCH_TIMEOUT:-5}
export-timeout: ${TRACING_EXPORT_TIMEOUT:-30}
max-queue-size: ${TRACING_MAX_QUEUE_SIZE:-2048}
probod:
hostname: "${PROBOD_HOSTNAME:-localhost:8080}"
encryption-key: "${PROBOD_ENCRYPTION_KEY:?PROBOD_ENCRYPTION_KEY is required}"
chrome-dp-addr: "${CHROME_DP_ADDR:-localhost:9222}"
api:
addr: "${API_ADDR:-:8080}"
cors:
allowed-origins: [${API_CORS_ALLOWED_ORIGINS:-"http://localhost:8080"}]
extra-header-fields: {}
pg:
addr: "${PG_ADDR:-localhost:5432}"
username: "${PG_USERNAME:-postgres}"
password: "${PG_PASSWORD:-postgres}"
database: "${PG_DATABASE:-probod}"
pool-size: ${PG_POOL_SIZE:-100}
auth:
disable-signup: ${AUTH_DISABLE_SIGNUP:-false}
invitation-confirmation-token-validity: ${AUTH_INVITATION_TOKEN_VALIDITY:-3600}
cookie:
name: "${AUTH_COOKIE_NAME:-SSID}"
domain: "${AUTH_COOKIE_DOMAIN:-localhost}"
secret: "${AUTH_COOKIE_SECRET:?AUTH_COOKIE_SECRET is required}"
duration: ${AUTH_COOKIE_DURATION:-24}
password:
pepper: "${AUTH_PASSWORD_PEPPER:?AUTH_PASSWORD_PEPPER is required}"
iterations: ${AUTH_PASSWORD_ITERATIONS:-1000000}
trust-auth:
cookie-name: "${TRUST_AUTH_COOKIE_NAME:-TCT}"
cookie-domain: "${TRUST_AUTH_COOKIE_DOMAIN:-localhost}"
cookie-duration: ${TRUST_AUTH_COOKIE_DURATION:-24}
token-duration: ${TRUST_AUTH_TOKEN_DURATION:-168}
report-url-duration: ${TRUST_AUTH_REPORT_URL_DURATION:-15}
token-secret: "${TRUST_AUTH_TOKEN_SECRET:?TRUST_AUTH_TOKEN_SECRET is required}"
scope: "${TRUST_AUTH_SCOPE:-trust_center_readonly}"
token-type: "${TRUST_AUTH_TOKEN_TYPE:-trust_center_access}"
aws:
region: "${AWS_REGION:-us-east-1}"
bucket: "${AWS_BUCKET:-probod}"
access-key-id: "${AWS_ACCESS_KEY_ID:-}"
secret-access-key: "${AWS_SECRET_ACCESS_KEY:-}"
endpoint: "${AWS_ENDPOINT:-}"
notifications:
mailer:
sender-name: "${MAILER_SENDER_NAME:-Probo}"
sender-email: "${MAILER_SENDER_EMAIL:-no-reply@notification.getprobo.com}"
smtp:
addr: "${SMTP_ADDR:-localhost:1025}"
tls-required: ${SMTP_TLS_REQUIRED:-false}
mailer-interval: ${MAILER_INTERVAL:-60}
slack:
sender-interval: ${SLACK_SENDER_INTERVAL:-60}
openai:
api-key: "${OPENAI_API_KEY:-}"
temperature: ${OPENAI_TEMPERATURE:-0.1}
model-name: "${OPENAI_MODEL_NAME:-gpt-4o}"
custom-domains:
renewal-interval: ${CUSTOM_DOMAINS_RENEWAL_INTERVAL:-3600}
provision-interval: ${CUSTOM_DOMAINS_PROVISION_INTERVAL:-30}
cname-target: "${CUSTOM_DOMAINS_CNAME_TARGET:-custom.getprobo.com}"
acme:
directory: "${ACME_DIRECTORY:-https://acme-v02.api.letsencrypt.org/directory}"
email: "${ACME_EMAIL:-admin@getprobo.com}"
key-type: "${ACME_KEY_TYPE:-EC256}"
root-ca: "${ACME_ROOT_CA:-}"
EOF
# Add connectors if configured
if [ -n "$CONNECTOR_SLACK_CLIENT_ID" ]; then
cat >> "$CONFIG_FILE" <<EOF
connectors:
- provider: "slack"
protocol: "oauth2"
config:
client-id: "${CONNECTOR_SLACK_CLIENT_ID}"
client-secret: "${CONNECTOR_SLACK_CLIENT_SECRET:?CONNECTOR_SLACK_CLIENT_SECRET is required when CONNECTOR_SLACK_CLIENT_ID is set}"
redirect-uri: "${CONNECTOR_SLACK_REDIRECT_URI:-https://localhost:8080/api/console/v1/connectors/complete}"
auth-url: "${CONNECTOR_SLACK_AUTH_URL:-https://slack.com/oauth/v2/authorize}"
token-url: "${CONNECTOR_SLACK_TOKEN_URL:-https://slack.com/api/oauth.v2.access}"
scopes:
- "chat:write"
- "channels:join"
- "incoming-webhook"
settings:
signing-secret: "${CONNECTOR_SLACK_SIGNING_SECRET:?CONNECTOR_SLACK_SIGNING_SECRET is required when CONNECTOR_SLACK_CLIENT_ID is set}"
EOF
fi
echo "Configuration file generated at: $CONFIG_FILE"
fi
# Execute probod with the generated config
exec probod -cfg-file "$CONFIG_FILE" "$@"