From f0d48a83ccca6b524f305df583060e1c126bdc1b Mon Sep 17 00:00:00 2001 From: Daniel Borkan Date: Thu, 29 Mar 2018 15:38:27 -0400 Subject: [PATCH 1/3] Fix Watchtower interval (should be 1 hour) --- .../install_scripts/do_install_server.sh | 2 ++ src/server_manager/install_scripts/install_server.sh | 10 ++++++---- src/server_manager/web_app/digitalocean_server.ts | 3 ++- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/server_manager/install_scripts/do_install_server.sh b/src/server_manager/install_scripts/do_install_server.sh index ab2897a2..9e9c932d 100755 --- a/src/server_manager/install_scripts/do_install_server.sh +++ b/src/server_manager/install_scripts/do_install_server.sh @@ -21,6 +21,8 @@ # SB_IMAGE: Shadowbox Docker image to install, e.g. quay.io/outline/shadowbox:nightly # SB_API_PORT: The port number of the management API. # SENTRY_API_URL: Url to post Sentry report to on error. +# WATCHTOWER_REFRESH_SECONDS: refresh interval in seconds to check for updates, +# defaults to 3600. set -euxo pipefail diff --git a/src/server_manager/install_scripts/install_server.sh b/src/server_manager/install_scripts/install_server.sh index 977032e6..6e3c4cd9 100755 --- a/src/server_manager/install_scripts/install_server.sh +++ b/src/server_manager/install_scripts/install_server.sh @@ -27,6 +27,8 @@ # SENTRY_LOG_FILE: File for writing logs which may be reported to Sentry, in case # of an install error. No PII should be written to this file. Intended to be set # only by do_install_server.sh. +# WATCHTOWER_REFRESH_SECONDS: refresh interval in seconds to check for updates, +# defaults to 3600. # Requires curl and docker to be installed @@ -81,7 +83,7 @@ function verify_docker_installed() { if ! command_exists docker; then log_error "Docker CE must be installed, please run \"curl -sS https://get.docker.com/ | sh\" or visit https://docs.docker.com/install/" exit 1 - fi + fi } function verify_docker_running() { @@ -111,7 +113,7 @@ function get_random_port { function create_persisted_state_dir() { readonly STATE_DIR="$SHADOWBOX_DIR/persisted-state" - mkdir -p "${STATE_DIR}" + mkdir -p "${STATE_DIR}" } # Generate a secret key for access to the shadowbox API and store it in a tag. @@ -173,7 +175,7 @@ function start_watchtower() { # Start watchtower to automatically fetch docker image updates. # Set watchtower to refresh every 30 seconds if a custom SB_IMAGE is used (for # testing). Otherwise refresh every hour. - readonly WATCHTOWER_REFRESH_SECONDS=$([ $SB_IMAGE ] && echo 30 || echo 3600) + readonly WATCHTOWER_REFRESH_SECONDS="${WATCHTOWER_REFRESH_SECONDS:-3600}" declare -a docker_watchtower_flags=(--name watchtower --restart=always) docker_watchtower_flags+=(-v /var/run/docker.sock:/var/run/docker.sock) docker run -d "${docker_watchtower_flags[@]}" v2tec/watchtower --cleanup --tlsverify --interval $WATCHTOWER_REFRESH_SECONDS >/dev/null @@ -208,7 +210,7 @@ set up, because there's a firewall (in this machine, your router or cloud provider) that is preventing incoming connections to ports ${SB_API_PORT} and ${ACCESS_KEY_PORT}. -- If you plan to have a single access key to access your server, opening those +- If you plan to have a single access key to access your server, opening those ports for TCP and UDP should suffice. - If you plan on adding additional access keys, you’ll have to open ports 1024 through 65535 on your firewall since the Outline server may allocate any of diff --git a/src/server_manager/web_app/digitalocean_server.ts b/src/server_manager/web_app/digitalocean_server.ts index 0d74d0da..096b8842 100644 --- a/src/server_manager/web_app/digitalocean_server.ts +++ b/src/server_manager/web_app/digitalocean_server.ts @@ -424,7 +424,8 @@ function getInstallScript( const sanitizezedAccessToken = sanitizeDigitaloceanToken(accessToken); return '#!/bin/bash -eu\n' + `export DO_ACCESS_TOKEN=${sanitizezedAccessToken}\n` + - (image ? `export SB_IMAGE=${image}\n` : '') + + // Set watchtower to 30 second refresh rate when overriding image. + (image ? `export SB_IMAGE=${image}\nexport WATCHTOWER_REFRESH_SECONDS=30\n` : '') + (sentryApiUrl ? `export SENTRY_API_URL="${sentryApiUrl}"\n` : '') + (metricsUrl ? `export SB_METRICS_URL=${metricsUrl}\n` : '') + `export SB_DEFAULT_SERVER_NAME="${name}"\n` + do_install_script.SCRIPT; From 8775cd3377428747fc3d2beda44c4c94df0c404e Mon Sep 17 00:00:00 2001 From: Daniel Borkan Date: Thu, 29 Mar 2018 15:56:32 -0400 Subject: [PATCH 2/3] Update version number --- src/server_manager/electron_app/config.json | 2 +- src/server_manager/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/server_manager/electron_app/config.json b/src/server_manager/electron_app/config.json index bb62ce61..514568a1 100644 --- a/src/server_manager/electron_app/config.json +++ b/src/server_manager/electron_app/config.json @@ -1,4 +1,4 @@ { - "version": "1.0.2", + "version": "1.0.3", "releaseDataUrl": "https://raw.githubusercontent.com/Jigsaw-Code/outline-server/master/release/release_data.json" } diff --git a/src/server_manager/package.json b/src/server_manager/package.json index 5b5d1cdd..bf108a63 100644 --- a/src/server_manager/package.json +++ b/src/server_manager/package.json @@ -1,7 +1,7 @@ { "name": "outline-manager", "productName": "Outline Manager", - "version": "1.0.2", + "version": "1.0.3", "description": "Create and manage access to Outline servers", "homepage": "https://getoutline.org/", "author": { From 68e88ad7a7b899fc04f1149c1ce0b589d37a082a Mon Sep 17 00:00:00 2001 From: Daniel Borkan Date: Thu, 29 Mar 2018 17:48:22 -0400 Subject: [PATCH 3/3] Make watchtowerRefreshSeconds an arg to getInstallScript --- src/server_manager/web_app/digitalocean_server.ts | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/server_manager/web_app/digitalocean_server.ts b/src/server_manager/web_app/digitalocean_server.ts index 096b8842..60a5626d 100644 --- a/src/server_manager/web_app/digitalocean_server.ts +++ b/src/server_manager/web_app/digitalocean_server.ts @@ -375,8 +375,9 @@ export class DigitaloceanServerRepository implements server.ManagedServerReposit console.time('activeServer'); console.time('servingServer'); const keyPair = crypto.generateKeyPair(); + const watchtowerRefreshSeconds = this.image ? 30 : undefined; const installCommand = getInstallScript( - this.digitalOcean.accessToken, name, this.image, this.metricsUrl, this.sentryApiUrl); + this.digitalOcean.accessToken, name, this.image, watchtowerRefreshSeconds, this.metricsUrl, this.sentryApiUrl); const dropletSpec = { installCommand, @@ -419,13 +420,14 @@ function sanitizeDigitaloceanToken(input: string): string { // cloudFunctions needs to define cloud::public_ip and cloud::add_tag. function getInstallScript( - accessToken: string, name: string, image?: string, metricsUrl?: string, - sentryApiUrl?: string): string { + accessToken: string, name: string, image?: string, watchtowerRefreshSeconds?: number, + metricsUrl?: string, sentryApiUrl?: string): string { const sanitizezedAccessToken = sanitizeDigitaloceanToken(accessToken); + // TODO: consider shell escaping these variables. return '#!/bin/bash -eu\n' + `export DO_ACCESS_TOKEN=${sanitizezedAccessToken}\n` + - // Set watchtower to 30 second refresh rate when overriding image. - (image ? `export SB_IMAGE=${image}\nexport WATCHTOWER_REFRESH_SECONDS=30\n` : '') + + (image ? `export SB_IMAGE=${image}\n` : '') + + (watchtowerRefreshSeconds ? `export WATCHTOWER_REFRESH_SECONDS=${watchtowerRefreshSeconds}\n` : '') + (sentryApiUrl ? `export SENTRY_API_URL="${sentryApiUrl}"\n` : '') + (metricsUrl ? `export SB_METRICS_URL=${metricsUrl}\n` : '') + `export SB_DEFAULT_SERVER_NAME="${name}"\n` + do_install_script.SCRIPT;