diff --git a/nixos/modules/services/web-apps/kasmweb/default.nix b/nixos/modules/services/web-apps/kasmweb/default.nix index 9f1da78f3c76..f626e369334e 100644 --- a/nixos/modules/services/web-apps/kasmweb/default.nix +++ b/nixos/modules/services/web-apps/kasmweb/default.nix @@ -124,38 +124,31 @@ in }; config = lib.mkIf cfg.enable { - systemd.services = { "init-kasmweb" = { wantedBy = [ "docker-kasm_db.service" + "podman-kasm_db.service" ]; - before = [ - "docker-kasm_db.service" - "docker-kasm_redis.service" - "docker-kasm_db_init.service" - "docker-kasm_api.service" - "docker-kasm_agent.service" - "docker-kasm_manager.service" - "docker-kasm_share.service" - "docker-kasm_guac.service" - "docker-kasm_proxy.service" - ]; + wants = ["network-online.target"]; + after = ["network-online.target"]; serviceConfig = { Type = "oneshot"; + TimeoutStartSec = 300; ExecStart = pkgs.substituteAll { src = ./initialize_kasmweb.sh; isExecutable = true; - binPath = lib.makeBinPath [ pkgs.docker pkgs.openssl pkgs.gnused ]; + binPath = lib.makeBinPath [ pkgs.docker pkgs.openssl pkgs.gnused pkgs.yq-go ]; runtimeShell = pkgs.runtimeShell; kasmweb = pkgs.kasmweb; - postgresUser = cfg.postgres.user; - postgresPassword = cfg.postgres.password; + postgresUser = "postgres"; + postgresPassword = "postgres"; inherit (cfg) datastorePath sslCertificate sslCertificateKey redisPassword + networkSubnet defaultUserPassword defaultAdminPassword defaultManagerToken @@ -167,12 +160,14 @@ in }; virtualisation = { + oci-containers.backend = "docker"; oci-containers.containers = { kasm_db = { - image = "postgres:12-alpine"; + image = "postgres:16-alpine"; + autoStart = true; environment = { - POSTGRES_PASSWORD = cfg.postgres.password; - POSTGRES_USER = cfg.postgres.user; + POSTGRES_PASSWORD = "postgres"; + POSTGRES_USER = "postgres"; POSTGRES_DB = "kasm"; }; volumes = [ @@ -185,6 +180,7 @@ in kasm_db_init = { image = "kasmweb/api:${pkgs.kasmweb.version}"; user = "root:root"; + autoStart = true; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" "kasmweb_api_data:/tmp" @@ -197,6 +193,7 @@ in kasm_redis = { image = "redis:5-alpine"; entrypoint = "/bin/sh"; + autoStart = true; cmd = [ "-c" "redis-server --requirepass ${cfg.redisPassword}" @@ -205,6 +202,7 @@ in }; kasm_api = { image = "kasmweb/api:${pkgs.kasmweb.version}"; + autoStart = false; user = "root:root"; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" @@ -215,15 +213,17 @@ in }; kasm_manager = { image = "kasmweb/manager:${pkgs.kasmweb.version}"; + autoStart = false; user = "root:root"; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" ]; - dependsOn = [ "kasm_db" "kasm_api" ]; + dependsOn = [ "kasm_db_init" "kasm_db" "kasm_api" ]; extraOptions = [ "--network=kasm_default_network" "--userns=host" "--read-only"]; }; kasm_agent = { image = "kasmweb/agent:${pkgs.kasmweb.version}"; + autoStart = false; user = "root:root"; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" @@ -236,15 +236,17 @@ in }; kasm_share = { image = "kasmweb/share:${pkgs.kasmweb.version}"; + autoStart = false; user = "root:root"; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" ]; - dependsOn = [ "kasm_db" "kasm_redis" ]; + dependsOn = [ "kasm_db_init" "kasm_db" "kasm_redis" ]; extraOptions = [ "--network=kasm_default_network" "--userns=host" "--read-only" ]; }; kasm_guac = { image = "kasmweb/kasm-guac:${pkgs.kasmweb.version}"; + autoStart = false; user = "root:root"; volumes = [ "${cfg.datastorePath}/:/opt/kasm/current/" @@ -254,6 +256,7 @@ in }; kasm_proxy = { image = "kasmweb/nginx:latest"; + autoStart = false; ports = [ "${cfg.listenAddress}:${toString cfg.listenPort}:443" ]; user = "root:root"; volumes = [ diff --git a/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh b/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh index dbf043b98693..232fbf34028b 100644 --- a/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh +++ b/nixos/modules/services/web-apps/kasmweb/initialize_kasmweb.sh @@ -11,12 +11,39 @@ mkdir -p @datastorePath@/conf/nginx/containers.d chmod -R a+rw @datastorePath@/conf ln -sf @kasmweb@/www @datastorePath@ +cat >@datastorePath@/init_seeds.sh </dev/null || docker network create kasm_default_network --subnet @networkSubnet@ -if docker volume inspect kasmweb_db >/dev/null; then +if [ -e @datastorePath@/ids.env ]; then source @datastorePath@/ids.env - echo 'echo "skipping database init"' > @datastorePath@/init_seeds.sh - echo 'while true; do sleep 10 ; done' >> @datastorePath@/init_seeds.sh else API_SERVER_ID=$(cat /proc/sys/kernel/random/uuid) MANAGER_ID=$(cat /proc/sys/kernel/random/uuid) @@ -30,43 +57,10 @@ else mkdir -p @datastorePath@/certs openssl req -x509 -nodes -days 1825 -newkey rsa:2048 -keyout @datastorePath@/certs/kasm_nginx.key -out @datastorePath@/certs/kasm_nginx.crt -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=$(hostname)/emailAddress=none@none.none" 2> /dev/null - docker volume create kasmweb_db + mkdir -p @datastorePath@/file_mappings + + docker volume create kasmweb_db || true rm @datastorePath@/.done_initing_data - cat >@datastorePath@/init_seeds.sh <&1 | grep -v UserWarning - /usr/bin/kasm_server.so --cfg \ - /opt/kasm/current/conf/app/api.app.config.yaml \ - --populate-production \ - --seed-file \ - /opt/kasm/current/conf/database/seed_data/default_agents.yaml \ - 2>&1 | grep -v UserWarning - /usr/bin/kasm_server.so --cfg \ - /opt/kasm/current/conf/app/api.app.config.yaml \ - --populate-production \ - --seed-file \ - /opt/kasm/current/conf/database/seed_data/default_connection_proxies.yaml \ - 2>&1 | grep -v UserWarning - /usr/bin/kasm_server.so --cfg \ - /opt/kasm/current/conf/app/api.app.config.yaml \ - --populate-production \ - --seed-file \ - /opt/kasm/current/conf/database/seed_data/default_images_amd64.yaml \ - 2>&1 | grep -v UserWarning - touch /opt/kasm/current/.done_initing_data - while true; do sleep 10 ; done -else - echo "skipping database init" - while true; do sleep 10 ; done -fi -EOF fi chmod +x @datastorePath@/init_seeds.sh @@ -77,11 +71,14 @@ if [ -e @sslCertificate@ ]; then cp @sslCertificateKey@ @datastorePath@/certs/kasm_nginx.key fi +yq -i '.server.zone_name = "'default'"' @datastorePath@/conf/app/api.app.config.yaml +yq -i '(.zones.[0]) .zone_name = "'default'"' @datastorePath@/conf/database/seed_data/default_properties.yaml + sed -i -e "s/username.*/username: @postgresUser@/g" \ -e "s/password.*/password: @postgresPassword@/g" \ -e "s/host.*db/host: kasm_db/g" \ -e "s/ssl: true/ssl: false/g" \ - -e "s/redisPassword.*/redisPassword: @redisPassword@/g" \ + -e "s/redis_password.*/redis_password: @redisPassword@/g" \ -e "s/server_hostname.*/server_hostname: kasm_api/g" \ -e "s/server_id.*/server_id: $API_SERVER_ID/g" \ -e "s/manager_id.*/manager_id: $MANAGER_ID/g" \ @@ -93,22 +90,36 @@ sed -i -e "s/ token:.*/ token: \"@defaultManagerToken@\"/g" \ -e "s/server_id.*/server_id: $SERVER_ID/g" \ @datastorePath@/conf/app/agent.app.config.yaml +# Generate a salt and hash for the desired passwords. Update the yaml +ADMIN_SALT=$(cat /proc/sys/kernel/random/uuid) +ADMIN_HASH=$(printf @defaultAdminPassword@${ADMIN_SALT} | sha256sum | cut -c-64) +USER_SALT=$(cat /proc/sys/kernel/random/uuid) +USER_HASH=$(printf @defaultUserPassword@${USER_SALT} | sha256sum | cut -c-64) -sed -i -e "s/password: admin.*/password: \"@defaultAdminPassword@\"/g" \ - -e "s/password: user.*/password: \"@defaultUserPassword@\"/g" \ - -e "s/default-manager-token/@defaultManagerToken@/g" \ - -e "s/default-registration-token/@defaultRegistrationToken@/g" \ - -e "s/upstream_auth_address:.*/upstream_auth_address: 'proxy'/g" \ +yq -i '(.users.[] | select(.username=="admin@kasm.local") | .salt) = "'${ADMIN_SALT}'"' @datastorePath@/conf/database/seed_data/default_properties.yaml +yq -i '(.users.[] | select(.username=="admin@kasm.local") | .pw_hash) = "'${ADMIN_HASH}'"' @datastorePath@/conf/database/seed_data/default_properties.yaml + +yq -i '(.users.[] | select(.username=="user@kasm.local") | .salt) = "'${USER_SALT}'"' @datastorePath@/conf/database/seed_data/default_properties.yaml +yq -i '(.users.[] | select(.username=="user@kasm.local") | .pw_hash) = "'${USER_HASH}'"' @datastorePath@/conf/database/seed_data/default_properties.yaml + +yq -i '(.settings.[] | select(.name=="token") | select(.category == "manager")) .value = "'@defaultManagerToken@'"' @datastorePath@/conf/database/seed_data/default_properties.yaml + +yq -i '(.settings.[] | select(.name=="registration_token") | select(.category == "auth")) .value = "'@defaultRegistrationToken@'"' @datastorePath@/conf/database/seed_data/default_properties.yaml + +sed -i -e "s/upstream_auth_address:.*/upstream_auth_address: 'proxy'/g" \ @datastorePath@/conf/database/seed_data/default_properties.yaml sed -i -e "s/GUACTOKEN/@defaultGuacToken@/g" \ -e "s/APIHOSTNAME/proxy/g" \ @datastorePath@/conf/app/kasmguac.app.config.yaml -sed -i -e "s/GUACTOKEN/@defaultGuacToken@/g" \ - -e "s/APIHOSTNAME/proxy/g" \ - @datastorePath@/conf/database/seed_data/default_connection_proxies.yaml - sed -i "s/00000000-0000-0000-0000-000000000000/$SERVER_ID/g" \ @datastorePath@/conf/database/seed_data/default_agents.yaml + +while [ ! -e @datastorePath@/.done_initing_data ]; do + sleep 10; +done + +systemctl restart docker-kasm_proxy.service + diff --git a/pkgs/servers/web-apps/kasmweb/default.nix b/pkgs/servers/web-apps/kasmweb/default.nix index f83db6baddc5..9c40fab2b95d 100644 --- a/pkgs/servers/web-apps/kasmweb/default.nix +++ b/pkgs/servers/web-apps/kasmweb/default.nix @@ -5,12 +5,12 @@ stdenv.mkDerivation rec { pname = "kasmweb"; - version = "1.12.0"; - build = "d4fd8a"; + version = "1.15.0"; + build = "06fdc8"; src = fetchzip { url = "https://kasm-static-content.s3.amazonaws.com/kasm_release_${version}.${build}.tar.gz"; - sha256 = "sha256-dCjWmI8gYtoMiMHVNgTg2ZROHXvT4ulynNvnKfMxURo="; + sha256 = "sha256-7z5lc4QEpQQdVGMEMc04wXlJTK5VXJ4rufZmDEflJLw="; }; dontConfigure = true;