1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
24 "git.arvados.org/arvados.git/lib/cmd"
25 "git.arvados.org/arvados.git/lib/config"
26 "git.arvados.org/arvados.git/sdk/go/arvados"
27 "git.arvados.org/arvados.git/sdk/go/ctxlog"
31 var InitCommand cmd.Handler = &initCommand{}
33 type initCommand struct {
36 PostgreSQLPassword string
44 LoginGoogleClientID string
45 LoginGoogleClientSecret string
48 func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
49 logger := ctxlog.New(stderr, "text", "info")
50 ctx := ctxlog.Context(context.Background(), logger)
51 ctx, cancel := context.WithCancel(ctx)
57 logger.WithError(err).Info("exiting")
61 hostname, err := os.Hostname()
63 err = fmt.Errorf("Hostname(): %w", err)
67 flags := flag.NewFlagSet(prog, flag.ContinueOnError)
68 flags.SetOutput(stderr)
69 versionFlag := flags.Bool("version", false, "Write version information to stdout and exit 0")
70 flags.StringVar(&initcmd.ClusterID, "cluster-id", "", "cluster `id`, like x1234 for a dev cluster")
71 flags.StringVar(&initcmd.Domain, "domain", hostname, "cluster public DNS `name`, like x1234.arvadosapi.com")
72 flags.StringVar(&initcmd.Login, "login", "", "login `backend`: test, pam, 'google {client-id} {client-secret}', or ''")
73 flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, auto, insecure, or none")
74 flags.BoolVar(&initcmd.Start, "start", true, "start systemd service after creating config")
75 if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok {
77 } else if *versionFlag {
78 return cmd.Version.RunCommand(prog, args, stdin, stdout, stderr)
79 } else if !regexp.MustCompile(`^[a-z][a-z0-9]{4}`).MatchString(initcmd.ClusterID) {
80 err = fmt.Errorf("cluster ID %q is invalid; must be an ASCII letter followed by 4 alphanumerics (try -help)", initcmd.ClusterID)
84 if fields := strings.Fields(initcmd.Login); len(fields) == 3 && fields[0] == "google" {
85 initcmd.LoginGoogle = true
86 initcmd.LoginGoogleClientID = fields[1]
87 initcmd.LoginGoogleClientSecret = fields[2]
88 } else if initcmd.Login == "test" {
89 initcmd.LoginTest = true
90 } else if initcmd.Login == "pam" {
91 initcmd.LoginPAM = true
92 } else if initcmd.Login == "" {
93 // none; login will show an error page
95 err = fmt.Errorf("invalid argument to -login: %q: should be 'test', 'pam', 'google {client-id} {client-secret}', or empty")
99 confdir := "/etc/arvados"
100 conffile := confdir + "/config.yml"
101 if _, err = os.Stat(conffile); err == nil {
102 err = fmt.Errorf("config file %s already exists; delete it first if you really want to start over", conffile)
106 wwwuser, err := user.Lookup("www-data")
108 err = fmt.Errorf("user.Lookup(%q): %w", "www-data", err)
111 wwwgid, err := strconv.Atoi(wwwuser.Gid)
115 initcmd.PostgreSQLPassword = initcmd.RandomHex(32)
117 err = os.Mkdir("/var/lib/arvados/keep", 0600)
118 if err != nil && !os.IsExist(err) {
119 err = fmt.Errorf("mkdir /var/lib/arvados/keep: %w", err)
122 fmt.Fprintln(stderr, "created /var/lib/arvados/keep")
124 err = os.Mkdir(confdir, 0750)
125 if err != nil && !os.IsExist(err) {
126 err = fmt.Errorf("mkdir %s: %w", confdir, err)
129 err = os.Chown(confdir, 0, wwwgid)
131 err = fmt.Errorf("chown 0:%d %s: %w", wwwgid, confdir, err)
134 f, err := os.OpenFile(conffile, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0644)
136 err = fmt.Errorf("open %s: %w", conffile, err)
139 tmpl, err := template.New("config").Parse(`Clusters:
144 "http://0.0.0.0:9000/": {}
145 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4440/" ) }}
148 "http://0.0.0.0:9001/": {}
151 "http://0.0.0.0:8005/": {}
152 ExternalURL: {{printf "%q" ( print "wss://" .Domain ":4436/" ) }}
155 "http://0.0.0.0:9019/": {}
158 "http://0.0.0.0:9005/": {}
159 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4445/" ) }}
162 "http://0.0.0.0:9006/": {}
165 "http://0.0.0.0:9007/": {}
166 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4447/" ) }}
169 "http://0.0.0.0:9008/": {}
170 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4448/" ) }}
173 "http://0.0.0.0:9009/": {}
174 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4449/" ) }}
177 "http://0.0.0.0:9010/": {}
179 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4459/composer" ) }}
182 "http://0.0.0.0:9002/": {}
183 ExternalURL: {{printf "%q" ( print "https://" .Domain ":4442/" ) }}
186 "http://0.0.0.0:9003/": {}
187 ExternalURL: {{printf "%q" ( print "https://" .Domain "/" ) }}
190 "http://0.0.0.0:9011/": {}
192 BlobSigningKey: {{printf "%q" ( .RandomHex 50 )}}
193 {{if eq .TLS "insecure"}}
194 TrustAllContent: true
197 DispatchPrivateKey: {{printf "%q" .GenerateSSHPrivateKey}}
201 ManagementToken: {{printf "%q" ( .RandomHex 50 )}}
204 dbname: arvados_production
207 password: {{printf "%q" .PostgreSQLPassword}}
208 SystemRootToken: {{printf "%q" ( .RandomHex 50 )}}
210 {{if eq .TLS "insecure"}}
212 {{else if eq .TLS "auto"}}
214 {{else if eq .TLS "acme"}}
215 Certificate: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/cert")}}
216 Key: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/privkey")}}
221 {{.ClusterID}}-nyw5e-000000000000000:
224 Root: /var/lib/arvados/keep
227 SecretKeyBase: {{printf "%q" ( .RandomHex 50 )}}
232 {{else if .LoginTest}}
238 Email: admin@example.com
240 {{else if .LoginGoogle}}
244 ClientID: {{printf "%q" .LoginGoogleClientID}}
245 ClientSecret: {{printf "%q" .LoginGoogleClientSecret}}
249 AutoAdminUserWithEmail: admin@example.com
255 err = tmpl.Execute(f, initcmd)
257 err = fmt.Errorf("%s: tmpl.Execute: %w", conffile, err)
262 err = fmt.Errorf("%s: close: %w", conffile, err)
265 fmt.Fprintln(stderr, "created", conffile)
267 ldr := config.NewLoader(nil, logger)
268 ldr.SkipLegacy = true
269 cfg, err := ldr.Load()
271 err = fmt.Errorf("%s: %w", conffile, err)
274 cluster, err := cfg.GetCluster("")
279 err = initcmd.createDB(ctx, cluster.PostgreSQL.Connection, stderr)
284 cmd := exec.CommandContext(ctx, "sudo", "-u", "www-data", "-E", "HOME=/var/www", "PATH=/var/lib/arvados/bin:"+os.Getenv("PATH"), "/var/lib/arvados/bin/bundle", "exec", "rake", "db:setup")
285 cmd.Dir = "/var/lib/arvados/railsapi"
290 err = fmt.Errorf("rake db:setup failed: %w", err)
293 fmt.Fprintln(stderr, "initialized database")
296 fmt.Fprintln(stderr, "starting systemd service")
297 cmd := exec.CommandContext(ctx, "systemctl", "start", "--no-block", "arvados")
303 err = fmt.Errorf("%v: %w", cmd.Args, err)
311 func (initcmd *initCommand) GenerateSSHPrivateKey() (string, error) {
312 privkey, err := rsa.GenerateKey(rand.Reader, 4096)
316 err = privkey.Validate()
320 return string(pem.EncodeToMemory(&pem.Block{
321 Type: "RSA PRIVATE KEY",
322 Bytes: x509.MarshalPKCS1PrivateKey(privkey),
326 func (initcmd *initCommand) RandomHex(chars int) string {
327 b := make([]byte, chars/2)
328 _, err := rand.Read(b)
332 return fmt.Sprintf("%x", b)
335 func (initcmd *initCommand) createDB(ctx context.Context, dbconn arvados.PostgreSQLConnection, stderr io.Writer) error {
336 for _, sql := range []string{
337 `CREATE USER ` + pq.QuoteIdentifier(dbconn["user"]) + ` WITH SUPERUSER ENCRYPTED PASSWORD ` + pq.QuoteLiteral(dbconn["password"]),
338 `CREATE DATABASE ` + pq.QuoteIdentifier(dbconn["dbname"]) + ` WITH TEMPLATE template0 ENCODING 'utf8'`,
339 `CREATE EXTENSION IF NOT EXISTS pg_trgm`,
341 cmd := exec.CommandContext(ctx, "sudo", "-u", "postgres", "psql", "-c", sql)
346 return fmt.Errorf("error setting up arvados user/database: %w", err)