Merge branch '16552-autocert'

[arvados.git] / lib / install / init.go

diff --git a/lib/install/init.go b/lib/install/init.go
index f65eae54c3f75366dc9b3b7f76899af174d5686b..d322e753ebd912152f67c7922bee0cb7998bfe9e 100644 (file)
--- a/lib/install/init.go
+++ b/lib/install/init.go
@@ -36,6 +36,7 @@ type initCommand struct {
        PostgreSQLPassword string
        Login              string
        TLS                string
+       AdminEmail         string
        Start              bool
 
        LoginPAM                bool
@@ -43,6 +44,7 @@ type initCommand struct {
        LoginGoogle             bool
        LoginGoogleClientID     string
        LoginGoogleClientSecret string
+       TLSDir                  string
 }
 
 func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
@@ -70,7 +72,8 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
        flags.StringVar(&initcmd.ClusterID, "cluster-id", "", "cluster `id`, like x1234 for a dev cluster")
        flags.StringVar(&initcmd.Domain, "domain", hostname, "cluster public DNS `name`, like x1234.arvadosapi.com")
        flags.StringVar(&initcmd.Login, "login", "", "login `backend`: test, pam, 'google {client-id} {client-secret}', or ''")
-       flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, auto, insecure, or none")
+       flags.StringVar(&initcmd.AdminEmail, "admin-email", "", "give admin privileges to user with given `email`")
+       flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, insecure, none, or /path/to/dir containing privkey and cert files")
        flags.BoolVar(&initcmd.Start, "start", true, "start systemd service after creating config")
        if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok {
                return code
@@ -87,15 +90,28 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
                initcmd.LoginGoogleClientSecret = fields[2]
        } else if initcmd.Login == "test" {
                initcmd.LoginTest = true
+               if initcmd.AdminEmail == "" {
+                       initcmd.AdminEmail = "admin@example.com"
+               }
        } else if initcmd.Login == "pam" {
                initcmd.LoginPAM = true
        } else if initcmd.Login == "" {
                // none; login will show an error page
        } else {
-               err = fmt.Errorf("invalid argument to -login: %q: should be 'test', 'pam', 'google {client-id} {client-secret}', or empty")
+               err = fmt.Errorf("invalid argument to -login: %q: should be 'test', 'pam', 'google {client-id} {client-secret}', or empty", initcmd.Login)
                return 1
        }
 
+       switch initcmd.TLS {
+       case "none", "acme", "insecure":
+       default:
+               if !strings.HasPrefix(initcmd.TLS, "/") {
+                       err = fmt.Errorf("invalid argument to -tls: %q; see %s -help", initcmd.TLS, prog)
+                       return 1
+               }
+               initcmd.TLSDir = initcmd.TLS
+       }
+
        confdir := "/etc/arvados"
        conffile := confdir + "/config.yml"
        if _, err = os.Stat(conffile); err == nil {
@@ -149,7 +165,7 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
       Websocket:
         InternalURLs:
           "http://0.0.0.0:8005/": {}
-        ExternalURL: {{printf "%q" ( print "wss://" .Domain ":4436/" ) }}
+        ExternalURL: {{printf "%q" ( print "wss://" .Domain ":4446/" ) }}
       Keepbalance:
         InternalURLs:
           "http://0.0.0.0:9019/": {}
@@ -201,7 +217,7 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
     ManagementToken: {{printf "%q" ( .RandomHex 50 )}}
     PostgreSQL:
       Connection:
-        dbname: arvados_production
+        dbname: arvados
         host: localhost
         user: arvados
         password: {{printf "%q" .PostgreSQLPassword}}
@@ -209,11 +225,12 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
     TLS:
       {{if eq .TLS "insecure"}}
       Insecure: true
-      {{else if eq .TLS "auto"}}
-      Automatic: true
       {{else if eq .TLS "acme"}}
-      Certificate: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/cert")}}
-      Key: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/privkey")}}
+      ACME:
+        Server: LE
+      {{else if ne .TLSDir ""}}
+      Certificate: {{printf "%q" (print .TLSDir "/cert")}}
+      Key: {{printf "%q" (print .TLSDir "/privkey")}}
       {{else}}
       {}
       {{end}}
@@ -235,7 +252,7 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
         Enable: true
         Users:
           admin:
-            Email: admin@example.com
+            Email: {{printf "%q" .AdminEmail}}
             Password: admin
     {{else if .LoginGoogle}}
     Login:
@@ -244,10 +261,8 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
         ClientID: {{printf "%q" .LoginGoogleClientID}}
         ClientSecret: {{printf "%q" .LoginGoogleClientSecret}}
     {{end}}
-    {{if .LoginTest}}
     Users:
-      AutoAdminUserWithEmail: admin@example.com
-    {{end}}
+      AutoAdminUserWithEmail: {{printf "%q" .AdminEmail}}
 `)
        if err != nil {
                return 1
@@ -339,6 +354,7 @@ func (initcmd *initCommand) createDB(ctx context.Context, dbconn arvados.Postgre
                `CREATE EXTENSION IF NOT EXISTS pg_trgm`,
        } {
                cmd := exec.CommandContext(ctx, "sudo", "-u", "postgres", "psql", "-c", sql)
+               cmd.Dir = "/"
                cmd.Stdout = stderr
                cmd.Stderr = stderr
                err := cmd.Run()