// Copyright (C) The Arvados Authors. All rights reserved. // // SPDX-License-Identifier: AGPL-3.0 package install import ( "context" "crypto/rand" "crypto/rsa" "crypto/x509" "encoding/pem" "flag" "fmt" "io" "net" "net/http" "net/url" "os" "os/exec" "os/user" "regexp" "strconv" "strings" "sync/atomic" "text/template" "time" "git.arvados.org/arvados.git/lib/cmd" "git.arvados.org/arvados.git/lib/config" "git.arvados.org/arvados.git/lib/controller/rpc" "git.arvados.org/arvados.git/sdk/go/arvados" "git.arvados.org/arvados.git/sdk/go/auth" "git.arvados.org/arvados.git/sdk/go/ctxlog" "github.com/lib/pq" ) var InitCommand cmd.Handler = &initCommand{} type initCommand struct { ClusterID string Domain string CreateDB bool Login string TLS string AdminEmail string Start bool PostgreSQL struct { Host string User string Password string DB string } LoginPAM bool LoginTest bool LoginGoogle bool LoginGoogleClientID string LoginGoogleClientSecret string TLSDir string } func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int { logger := ctxlog.New(stderr, "text", "info") ctx := ctxlog.Context(context.Background(), logger) ctx, cancel := context.WithCancel(ctx) defer cancel() var err error defer func() { if err != nil { logger.WithError(err).Info("exiting") } }() hostname, err := os.Hostname() if err != nil { err = fmt.Errorf("Hostname(): %w", err) return 1 } flags := flag.NewFlagSet(prog, flag.ContinueOnError) flags.SetOutput(stderr) versionFlag := flags.Bool("version", false, "Write version information to stdout and exit 0") flags.StringVar(&initcmd.ClusterID, "cluster-id", "", "cluster `id`, like x1234 for a dev cluster") flags.BoolVar(&initcmd.CreateDB, "create-db", true, "create an 'arvados' postgresql role and database using 'sudo -u postgres psql ...' (if false, use existing database specified by POSTGRES_HOST, POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB env vars, and assume 'CREATE EXTENSION IF NOT EXISTS pg_trgm' has already been done)") flags.StringVar(&initcmd.Domain, "domain", hostname, "cluster public DNS `name`, like x1234.arvadosapi.com") flags.StringVar(&initcmd.Login, "login", "", "login `backend`: test, pam, 'google {client-id} {client-secret}', or ''") flags.StringVar(&initcmd.AdminEmail, "admin-email", "", "give admin privileges to user with given `email`") flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, insecure, none, or /path/to/dir containing privkey and cert files") flags.BoolVar(&initcmd.Start, "start", true, "start systemd service after creating config") if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok { return code } else if *versionFlag { return cmd.Version.RunCommand(prog, args, stdin, stdout, stderr) } else if !regexp.MustCompile(`^[a-z][a-z0-9]{4}`).MatchString(initcmd.ClusterID) { err = fmt.Errorf("cluster ID %q is invalid; must be an ASCII letter followed by 4 alphanumerics (try -help)", initcmd.ClusterID) return 1 } if fields := strings.Fields(initcmd.Login); len(fields) == 3 && fields[0] == "google" { initcmd.LoginGoogle = true initcmd.LoginGoogleClientID = fields[1] initcmd.LoginGoogleClientSecret = fields[2] } else if initcmd.Login == "test" { initcmd.LoginTest = true if initcmd.AdminEmail == "" { initcmd.AdminEmail = "admin@example.com" } } else if initcmd.Login == "pam" { initcmd.LoginPAM = true } else if initcmd.Login == "" { // none; login will show an error page } else { err = fmt.Errorf("invalid argument to -login: %q: should be 'test', 'pam', 'google {client-id} {client-secret}', or empty", initcmd.Login) return 1 } switch initcmd.TLS { case "none", "acme", "insecure": default: if !strings.HasPrefix(initcmd.TLS, "/") { err = fmt.Errorf("invalid argument to -tls: %q; see %s -help", initcmd.TLS, prog) return 1 } initcmd.TLSDir = initcmd.TLS } confdir := "/etc/arvados" conffile := confdir + "/config.yml" if _, err = os.Stat(conffile); err == nil { err = fmt.Errorf("config file %s already exists; delete it first if you really want to start over", conffile) return 1 } ports := []int{443} for i := 4440; i < 4460; i++ { ports = append(ports, i) } if initcmd.TLS == "acme" { ports = append(ports, 80) } for _, port := range ports { err = initcmd.checkPort(ctx, fmt.Sprintf("%d", port)) if err != nil { return 1 } } if initcmd.CreateDB { // Do the "create extension" thing early. This way, if // there's no local postgresql server (a likely // failure mode), we can bail out without any side // effects, and the user can start over easily. fmt.Fprintln(stderr, "installing pg_trgm postgresql extension...") cmd := exec.CommandContext(ctx, "sudo", "-u", "postgres", "psql", "--quiet", "-c", `CREATE EXTENSION IF NOT EXISTS pg_trgm`) cmd.Dir = "/" cmd.Stdout = stdout cmd.Stderr = stderr err = cmd.Run() if err != nil { err = fmt.Errorf("error preparing postgresql server: %w", err) return 1 } fmt.Fprintln(stderr, "...done") initcmd.PostgreSQL.Host = "localhost" initcmd.PostgreSQL.User = "arvados" initcmd.PostgreSQL.Password = initcmd.RandomHex(32) initcmd.PostgreSQL.DB = "arvados" } else { initcmd.PostgreSQL.Host = os.Getenv("POSTGRES_HOST") initcmd.PostgreSQL.User = os.Getenv("POSTGRES_USER") initcmd.PostgreSQL.Password = os.Getenv("POSTGRES_PASSWORD") initcmd.PostgreSQL.DB = os.Getenv("POSTGRES_DB") if initcmd.PostgreSQL.Host == "" || initcmd.PostgreSQL.User == "" || initcmd.PostgreSQL.Password == "" || initcmd.PostgreSQL.DB == "" { err = fmt.Errorf("missing $POSTGRES_* env var(s) for -create-db=false; see %s -help", prog) return 1 } } wwwuser, err := user.Lookup("www-data") if err != nil { err = fmt.Errorf("user.Lookup(%q): %w", "www-data", err) return 1 } wwwgid, err := strconv.Atoi(wwwuser.Gid) if err != nil { return 1 } fmt.Fprintln(stderr, "creating data storage directory /var/lib/arvados/keep ...") err = os.Mkdir("/var/lib/arvados/keep", 0600) if err != nil && !os.IsExist(err) { err = fmt.Errorf("mkdir /var/lib/arvados/keep: %w", err) return 1 } fmt.Fprintln(stderr, "...done") fmt.Fprintln(stderr, "creating config file", conffile, "...") err = os.Mkdir(confdir, 0750) if err != nil && !os.IsExist(err) { err = fmt.Errorf("mkdir %s: %w", confdir, err) return 1 } err = os.Chown(confdir, 0, wwwgid) if err != nil { err = fmt.Errorf("chown 0:%d %s: %w", wwwgid, confdir, err) return 1 } f, err := os.OpenFile(conffile+".tmp", os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0644) if err != nil { err = fmt.Errorf("open %s: %w", conffile+".tmp", err) return 1 } tmpl, err := template.New("config").Parse(`Clusters: {{.ClusterID}}: Services: Controller: InternalURLs: "http://0.0.0.0:9000/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4440/" ) }} RailsAPI: InternalURLs: "http://0.0.0.0:9001/": {} Websocket: InternalURLs: "http://0.0.0.0:8005/": {} ExternalURL: {{printf "%q" ( print "wss://" .Domain ":4446/" ) }} Keepbalance: InternalURLs: "http://0.0.0.0:9019/": {} GitHTTP: InternalURLs: "http://0.0.0.0:9005/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4445/" ) }} DispatchCloud: InternalURLs: "http://0.0.0.0:9006/": {} Keepproxy: InternalURLs: "http://0.0.0.0:9007/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4447/" ) }} WebDAV: InternalURLs: "http://0.0.0.0:9008/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4448/" ) }} WebDAVDownload: InternalURLs: "http://0.0.0.0:9009/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4449/" ) }} Keepstore: InternalURLs: "http://0.0.0.0:9010/": {} Composer: ExternalURL: {{printf "%q" ( print "https://" .Domain ":4459/composer" ) }} Workbench1: InternalURLs: "http://0.0.0.0:9002/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain ":4442/" ) }} Workbench2: InternalURLs: "http://0.0.0.0:9003/": {} ExternalURL: {{printf "%q" ( print "https://" .Domain "/" ) }} Health: InternalURLs: "http://0.0.0.0:9011/": {} Collections: BlobSigningKey: {{printf "%q" ( .RandomHex 50 )}} {{if eq .TLS "insecure"}} TrustAllContent: true {{end}} Containers: DispatchPrivateKey: {{printf "%q" .GenerateSSHPrivateKey}} CloudVMs: Enable: true Driver: loopback ManagementToken: {{printf "%q" ( .RandomHex 50 )}} PostgreSQL: Connection: dbname: {{printf "%q" .PostgreSQL.DB}} host: {{printf "%q" .PostgreSQL.Host}} user: {{printf "%q" .PostgreSQL.User}} password: {{printf "%q" .PostgreSQL.Password}} SystemRootToken: {{printf "%q" ( .RandomHex 50 )}} TLS: {{if eq .TLS "insecure"}} Insecure: true {{else if eq .TLS "acme"}} ACME: Server: LE {{else if ne .TLSDir ""}} Certificate: {{printf "%q" (print .TLSDir "/cert")}} Key: {{printf "%q" (print .TLSDir "/privkey")}} {{else}} {} {{end}} Volumes: {{.ClusterID}}-nyw5e-000000000000000: Driver: Directory DriverParameters: Root: /var/lib/arvados/keep Replication: 2 Workbench: SecretKeyBase: {{printf "%q" ( .RandomHex 50 )}} {{if .LoginPAM}} Login: PAM: Enable: true {{else if .LoginTest}} Login: Test: Enable: true Users: admin: Email: {{printf "%q" .AdminEmail}} Password: admin {{else if .LoginGoogle}} Login: Google: Enable: true ClientID: {{printf "%q" .LoginGoogleClientID}} ClientSecret: {{printf "%q" .LoginGoogleClientSecret}} {{end}} Users: AutoAdminUserWithEmail: {{printf "%q" .AdminEmail}} `) if err != nil { return 1 } err = tmpl.Execute(f, initcmd) if err != nil { err = fmt.Errorf("%s: tmpl.Execute: %w", conffile+".tmp", err) return 1 } err = f.Close() if err != nil { err = fmt.Errorf("%s: close: %w", conffile+".tmp", err) return 1 } err = os.Rename(conffile+".tmp", conffile) if err != nil { err = fmt.Errorf("rename %s -> %s: %w", conffile+".tmp", conffile, err) return 1 } fmt.Fprintln(stderr, "...done") ldr := config.NewLoader(nil, logger) ldr.SkipLegacy = true ldr.Path = conffile // load the file we just wrote, even if $ARVADOS_CONFIG is set cfg, err := ldr.Load() if err != nil { err = fmt.Errorf("%s: %w", conffile, err) return 1 } cluster, err := cfg.GetCluster("") if err != nil { return 1 } fmt.Fprintln(stderr, "creating postresql user and database...") err = initcmd.createDB(ctx, cluster.PostgreSQL.Connection, stderr) if err != nil { return 1 } fmt.Fprintln(stderr, "...done") fmt.Fprintln(stderr, "initializing database...") cmd := exec.CommandContext(ctx, "sudo", "-u", "www-data", "-E", "HOME=/var/www", "PATH=/var/lib/arvados/bin:"+os.Getenv("PATH"), "/var/lib/arvados/bin/bundle", "exec", "rake", "db:setup") cmd.Dir = "/var/lib/arvados/railsapi" cmd.Stdout = stderr cmd.Stderr = stderr err = cmd.Run() if err != nil { err = fmt.Errorf("rake db:setup failed: %w", err) return 1 } fmt.Fprintln(stderr, "...done") if initcmd.Start { fmt.Fprintln(stderr, "starting systemd service...") cmd := exec.CommandContext(ctx, "systemctl", "start", "arvados") cmd.Dir = "/" cmd.Stdout = stderr cmd.Stderr = stderr err = cmd.Run() if err != nil { err = fmt.Errorf("%v: %w", cmd.Args, err) return 1 } fmt.Fprintln(stderr, "...done") fmt.Fprintln(stderr, "checking controller API endpoint...") u := url.URL(cluster.Services.Controller.ExternalURL) conn := rpc.NewConn(cluster.ClusterID, &u, cluster.TLS.Insecure, rpc.PassthroughTokenProvider) ctx := auth.NewContext(context.Background(), auth.NewCredentials(cluster.SystemRootToken)) _, err = conn.UserGetCurrent(ctx, arvados.GetOptions{}) if err != nil { err = fmt.Errorf("API request failed: %w", err) return 1 } fmt.Fprintln(stderr, "...looks good") } fmt.Fprintf(stderr, ` Setup complete. Next steps: * run 'arv sudo diagnostics' * log in to workbench2 at %s * see documentation at https://doc.arvados.org/install/automatic.html `, cluster.Services.Workbench2.ExternalURL.String()) return 0 } func (initcmd *initCommand) GenerateSSHPrivateKey() (string, error) { privkey, err := rsa.GenerateKey(rand.Reader, 4096) if err != nil { return "", err } err = privkey.Validate() if err != nil { return "", err } return string(pem.EncodeToMemory(&pem.Block{ Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privkey), })), nil } func (initcmd *initCommand) RandomHex(chars int) string { b := make([]byte, chars/2) _, err := rand.Read(b) if err != nil { panic(err) } return fmt.Sprintf("%x", b) } func (initcmd *initCommand) createDB(ctx context.Context, dbconn arvados.PostgreSQLConnection, stderr io.Writer) error { cmd := exec.CommandContext(ctx, "sudo", "-u", "postgres", "psql", "--quiet", "-c", `CREATE USER `+pq.QuoteIdentifier(dbconn["user"])+` WITH SUPERUSER ENCRYPTED PASSWORD `+pq.QuoteLiteral(dbconn["password"]), "-c", `CREATE DATABASE `+pq.QuoteIdentifier(dbconn["dbname"])+` WITH TEMPLATE template0 ENCODING 'utf8'`, ) cmd.Dir = "/" cmd.Stdout = stderr cmd.Stderr = stderr err := cmd.Run() if err != nil { return fmt.Errorf("error setting up arvados user/database: %w", err) } return nil } // Confirm that http://{initcmd.Domain}:{port} reaches a server that // we run on {port}. // // If port is "80", listening fails, and Nginx appears to be using the // debian-packaged default configuration that listens on port 80, // disable that Nginx config and try again. // // (Typically, the reason Nginx is installed is so that Arvados can // run an Nginx child process; the default Nginx service using config // from /etc/nginx is just an unfortunate side effect of installing // Nginx by way of the Debian package.) func (initcmd *initCommand) checkPort(ctx context.Context, port string) error { err := initcmd.checkPortOnce(ctx, port) if err == nil || port != "80" { // success, or poking Nginx in the eye won't help return err } d, err2 := os.Open("/etc/nginx/sites-enabled/.") if err2 != nil { return err } fis, err2 := d.Readdir(-1) if err2 != nil || len(fis) != 1 { return err } if target, err2 := os.Readlink("/etc/nginx/sites-enabled/default"); err2 != nil || target != "/etc/nginx/sites-available/default" { return err } err2 = os.Remove("/etc/nginx/sites-enabled/default") if err2 != nil { return err } exec.CommandContext(ctx, "nginx", "-s", "reload").Run() time.Sleep(time.Second) return initcmd.checkPortOnce(ctx, port) } // Start an http server on 0.0.0.0:{port} and confirm that // http://{initcmd.Domain}:{port} reaches that server. func (initcmd *initCommand) checkPortOnce(ctx context.Context, port string) error { b := make([]byte, 128) _, err := rand.Read(b) if err != nil { return err } token := fmt.Sprintf("%x", b) srv := http.Server{ Addr: net.JoinHostPort("", port), Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, token) })} var errServe atomic.Value go func() { errServe.Store(srv.ListenAndServe()) }() defer srv.Close() url := "http://" + net.JoinHostPort(initcmd.Domain, port) + "/probe" req, err := http.NewRequestWithContext(ctx, "GET", url, nil) if err != nil { return err } resp, err := http.DefaultClient.Do(req) if err == nil { defer resp.Body.Close() } if errServe, _ := errServe.Load().(error); errServe != nil { // If server already exited, return that error // (probably "can't listen"), not the request error. return errServe } if err != nil { return err } buf := make([]byte, len(token)) n, err := io.ReadFull(resp.Body, buf) if string(buf[:n]) != token { return fmt.Errorf("listened on port %s but %s connected to something else, returned %q, err %v", port, url, buf[:n], err) } return nil }