1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
23 "git.arvados.org/arvados.git/lib/cmd"
24 "git.arvados.org/arvados.git/lib/config"
25 "git.arvados.org/arvados.git/sdk/go/arvados"
26 "git.arvados.org/arvados.git/sdk/go/ctxlog"
30 var InitCommand cmd.Handler = &initCommand{}
32 type initCommand struct {
35 PostgreSQLPassword string
40 func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
41 logger := ctxlog.New(stderr, "text", "info")
42 ctx := ctxlog.Context(context.Background(), logger)
43 ctx, cancel := context.WithCancel(ctx)
49 logger.WithError(err).Info("exiting")
53 hostname, err := os.Hostname()
55 err = fmt.Errorf("Hostname(): %w", err)
59 flags := flag.NewFlagSet(prog, flag.ContinueOnError)
60 flags.SetOutput(stderr)
61 versionFlag := flags.Bool("version", false, "Write version information to stdout and exit 0")
62 flags.StringVar(&initcmd.ClusterID, "cluster-id", "", "cluster `id`, like x1234 for a dev cluster")
63 flags.StringVar(&initcmd.Domain, "domain", hostname, "cluster public DNS `name`, like x1234.arvadosapi.com")
64 flags.StringVar(&initcmd.Login, "login", "", "login `backend`: test, pam, or ''")
65 flags.BoolVar(&initcmd.Insecure, "insecure", false, "accept invalid TLS certificates and configure TrustAllContent (do not use in production!)")
66 if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok {
68 } else if *versionFlag {
69 return cmd.Version.RunCommand(prog, args, stdin, stdout, stderr)
70 } else if !regexp.MustCompile(`^[a-z][a-z0-9]{4}`).MatchString(initcmd.ClusterID) {
71 err = fmt.Errorf("cluster ID %q is invalid; must be an ASCII letter followed by 4 alphanumerics (try -help)", initcmd.ClusterID)
75 wwwuser, err := user.Lookup("www-data")
77 err = fmt.Errorf("user.Lookup(%q): %w", "www-data", err)
80 wwwgid, err := strconv.Atoi(wwwuser.Gid)
84 initcmd.PostgreSQLPassword = initcmd.RandomHex(32)
86 err = os.Mkdir("/var/lib/arvados/keep", 0600)
87 if err != nil && !os.IsExist(err) {
88 err = fmt.Errorf("mkdir /var/lib/arvados/keep: %w", err)
91 fmt.Fprintln(stderr, "created /var/lib/arvados/keep")
93 err = os.Mkdir("/etc/arvados", 0750)
94 if err != nil && !os.IsExist(err) {
95 err = fmt.Errorf("mkdir /etc/arvados: %w", err)
98 err = os.Chown("/etc/arvados", 0, wwwgid)
99 f, err := os.OpenFile("/etc/arvados/config.yml", os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0644)
101 err = fmt.Errorf("open /etc/arvados/config.yml: %w", err)
104 tmpl, err := template.New("config").Parse(`Clusters:
109 "http://0.0.0.0:8003/": {}
110 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4430/" ) }}
113 "http://0.0.0.0:8004/": {}
116 "http://0.0.0.0:8005/": {}
117 ExternalURL: {{printf "%q" ( print "wss://" .Domain ":4435/websocket" ) }}
120 "http://0.0.0.0:9005/": {}
123 "http://0.0.0.0:9001/": {}
124 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4436/" ) }}
127 "http://0.0.0.0:9006/": {}
130 "http://0.0.0.0:25108/": {}
131 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4437/" ) }}
134 "http://0.0.0.0:9002/": {}
135 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4438/" ) }}
138 "http://0.0.0.0:8004/": {}
139 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4439/" ) }}
142 "http://0.0.0.0:25107/": {}
144 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4440/composer" ) }}
147 "http://0.0.0.0:8001/": {}
148 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4441/" ) }}
150 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4442/" ) }}
153 "http://0.0.0.0:9007/": {}
155 BlobSigningKey: {{printf "%q" ( .RandomHex 50 )}}
157 TrustAllContent: true
160 DispatchPrivateKey: {{printf "%q" .GenerateSSHPrivateKey}}
161 ManagementToken: {{printf "%q" ( .RandomHex 50 )}}
164 dbname: arvados_production
167 password: {{printf "%q" .PostgreSQLPassword}}
168 SystemRootToken: {{printf "%q" ( .RandomHex 50 )}}
174 {{.ClusterID}}-nyw5e-000000000000000:
177 Root: /var/lib/arvados/keep
180 SecretKeyBase: {{printf "%q" ( .RandomHex 50 )}}
182 {{if eq .Login "pam"}}
185 {{else if eq .Login "test"}}
190 Email: admin@example.com
196 {{if eq .Login "test"}}
197 AutoAdminUserWithEmail: admin@example.com
205 err = tmpl.Execute(f, initcmd)
207 err = fmt.Errorf("/etc/arvados/config.yml: tmpl.Execute: %w", err)
212 err = fmt.Errorf("/etc/arvados/config.yml: close: %w", err)
215 fmt.Fprintln(stderr, "created /etc/arvados/config.yml")
217 ldr := config.NewLoader(nil, logger)
218 ldr.SkipLegacy = true
219 cfg, err := ldr.Load()
221 err = fmt.Errorf("/etc/arvados/config.yml: %w", err)
224 cluster, err := cfg.GetCluster("")
229 err = initcmd.createDB(ctx, cluster.PostgreSQL.Connection, stderr)
234 cmd := exec.CommandContext(ctx, "sudo", "-u", "www-data", "-E", "HOME=/var/www", "PATH=/var/lib/arvados/bin:"+os.Getenv("PATH"), "/var/lib/arvados/bin/bundle", "exec", "rake", "db:setup")
235 cmd.Dir = "/var/lib/arvados/railsapi"
240 err = fmt.Errorf("rake db:setup: %w", err)
243 fmt.Fprintln(stderr, "initialized database")
248 func (initcmd *initCommand) GenerateSSHPrivateKey() (string, error) {
249 privkey, err := rsa.GenerateKey(rand.Reader, 4096)
253 err = privkey.Validate()
257 return string(pem.EncodeToMemory(&pem.Block{
258 Type: "RSA PRIVATE KEY",
259 Bytes: x509.MarshalPKCS1PrivateKey(privkey),
263 func (initcmd *initCommand) RandomHex(chars int) string {
264 b := make([]byte, chars/2)
265 _, err := rand.Read(b)
269 return fmt.Sprintf("%x", b)
272 func (initcmd *initCommand) createDB(ctx context.Context, dbconn arvados.PostgreSQLConnection, stderr io.Writer) error {
273 for _, sql := range []string{
274 `CREATE USER ` + pq.QuoteIdentifier(dbconn["user"]) + ` WITH SUPERUSER ENCRYPTED PASSWORD ` + pq.QuoteLiteral(dbconn["password"]),
275 `CREATE DATABASE ` + pq.QuoteIdentifier(dbconn["dbname"]) + ` WITH TEMPLATE template0 ENCODING 'utf8'`,
276 `CREATE EXTENSION IF NOT EXISTS pg_trgm`,
278 cmd := exec.CommandContext(ctx, "sudo", "-u", "postgres", "psql", "-c", sql)
283 return fmt.Errorf("error setting up arvados user/database: %w", err)