Add a per setup unique machine-id (#257)

* add mount for machine-id
* services should check the availability of the machine id before starting
* add a note to the readme
* add new mounts to the multiserver example
* add dockerize to kweb
* fix meet demo

examples/kopano-multiserver/kopano-multiserver.yml

@@ -9,9 +9,9 @@ services:
 
   kopano_server:
     environment:
-      - KCCONF_SERVER_SERVER_NAME=kopano_server
-      - KCCONF_SERVER_ENABLE_DISTRIBUTED_KOPANO=true
       - KCCONF_ADMIN_SSLKEY_FILE=/kopano/ssl/admin.pem
+      - KCCONF_SERVER_ENABLE_DISTRIBUTED_KOPANO=true
+      - KCCONF_SERVER_SERVER_NAME=kopano_server
 
   kopano_server_2:
     image: ${docker_repo:-zokradonh}/kopano_core:${CORE_VERSION:-latest}
@@ -19,36 +19,36 @@ services:
     container_name: ${COMPOSE_PROJECT_NAME}_server_2
     depends_on:
       - db
-      - ldap
-      - kopano_ssl
       - kopano_konnect
+      - kopano_ssl
+      - ldap
     environment:
+      - ADDITIONAL_KOPANO_PACKAGES=${ADDITIONAL_KOPANO_PACKAGES}
+      - KCCOMMENT_LDAP_1=${KCCOMMENT_LDAP_1}
+      - KCCONF_ADMIN_SSLKEY_FILE=/kopano/ssl/admin.pem
+      - KCCONF_LDAP_LDAP_BIND_PASSWD=${LDAP_BIND_PW}
+      - KCCONF_LDAP_LDAP_BIND_USER=${LDAP_BIND_DN}
+      - KCCONF_LDAP_LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
+      - KCCONF_LDAP_LDAP_URI=${LDAP_SERVER}
+      - KCCONF_SERVER_COREDUMP_ENABLED=no
+      - KCCONF_SERVER_ENABLE_DISTRIBUTED_KOPANO=true
+      - KCCONF_SERVER_ENABLE_SSO=yes
+      - KCCONF_SERVER_KCOIDC_INSECURE_SKIP_VERIFY=${INSECURE}
+      - KCCONF_SERVER_KCOIDC_ISSUER_IDENTIFIER=https://${FQDN}
+      - KCCONF_SERVER_MYSQL_DATABASE=${MYSQL_DATABASE}2
+      - KCCONF_SERVER_MYSQL_HOST=${MYSQL_HOST}
+      - KCCONF_SERVER_MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - KCCONF_SERVER_MYSQL_PORT=3306
+      - KCCONF_SERVER_MYSQL_USER=${MYSQL_USER}
+      - KCCONF_SERVER_PROXY_HEADER=* # delete line if webapp is not behind reverse proxy
+      - KCCONF_SERVER_SERVER_NAME=kopano_server_2
+      - KCCONF_SERVER_SERVER_SSL_CA_FILE=/kopano/ssl/ca.pem
+      - KCCONF_SERVER_SERVER_SSL_KEY_FILE=/kopano/ssl/kopano_server_2.pem
+      - KCCONF_SERVER_SSLKEYS_PATH=/kopano/ssl/clients
+      - KCCONF_SERVER_SYSTEM_EMAIL_ADDRESS=${POSTMASTER_ADDRESS}
+      - KCUNCOMMENT_LDAP_1=${KCUNCOMMENT_LDAP_1}
       - SERVICE_TO_START=server
       - TZ=${TZ}
-      - KCCONF_SERVER_COREDUMP_ENABLED=no
-      - KCCONF_SERVER_MYSQL_HOST=${MYSQL_HOST}
-      - KCCONF_SERVER_MYSQL_PORT=3306
-      - KCCONF_SERVER_MYSQL_DATABASE=${MYSQL_DATABASE}2
-      - KCCONF_SERVER_MYSQL_USER=${MYSQL_USER}
-      - KCCONF_SERVER_MYSQL_PASSWORD=${MYSQL_PASSWORD}
-      - KCCONF_SERVER_SERVER_SSL_KEY_FILE=/kopano/ssl/kopano_server_2.pem
-      - KCCONF_SERVER_SERVER_SSL_CA_FILE=/kopano/ssl/ca.pem
-      - KCCONF_SERVER_SERVER_NAME=kopano_server_2
-      - KCCONF_SERVER_SSLKEYS_PATH=/kopano/ssl/clients
-      - KCCONF_SERVER_PROXY_HEADER=* # delete line if webapp is not behind reverse proxy
-      - KCCONF_SERVER_SYSTEM_EMAIL_ADDRESS=${POSTMASTER_ADDRESS}
-      - KCCONF_LDAP_LDAP_URI=${LDAP_SERVER}
-      - KCCONF_LDAP_LDAP_BIND_USER=${LDAP_BIND_DN}
-      - KCCONF_LDAP_LDAP_BIND_PASSWD=${LDAP_BIND_PW}
-      - KCCONF_LDAP_LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
-      - KCUNCOMMENT_LDAP_1=${KCUNCOMMENT_LDAP_1}
-      - KCCOMMENT_LDAP_1=${KCCOMMENT_LDAP_1}
-      - ADDITIONAL_KOPANO_PACKAGES=${ADDITIONAL_KOPANO_PACKAGES}
-      - KCCONF_SERVER_ENABLE_SSO=yes
-      - KCCONF_SERVER_KCOIDC_ISSUER_IDENTIFIER=https://${FQDN}
-      - KCCONF_SERVER_KCOIDC_INSECURE_SKIP_VERIFY=${INSECURE}
-      - KCCONF_SERVER_ENABLE_DISTRIBUTED_KOPANO=true
-      - KCCONF_ADMIN_SSLKEY_FILE=/kopano/ssl/admin.pem
     env_file:
       - kopano_server.env
     networks:
@@ -56,9 +56,11 @@ services:
       - ldap-net
       - web-net
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - kopanodata2/:/kopano/data
-      - kopanossl/:/kopano/ssl
       - kopanosocket2/:/run/kopano
+      - kopanossl/:/kopano/ssl
 
   kopano_spooler_2:
     image: ${docker_repo:-zokradonh}/kopano_core:${CORE_VERSION:-latest}
@@ -70,14 +72,14 @@ services:
       - kopano_server_2
       - mail
     volumes:
-      - kopanossl/:/kopano/ssl
       - kopanosocket2/:/run/kopano
+      - kopanossl/:/kopano/ssl
     environment:
-      - SERVICE_TO_START=spooler
-      - TZ=${TZ}
       - KCCONF_SPOOLER_LOG_LEVEL=3
       - KCCONF_SPOOLER_SMTP_SERVER=mail
       - KCCONF_SPOOLER_SSLKEY_FILE=/kopano/ssl/kopano_spooler.pem
+      - SERVICE_TO_START=spooler
+      - TZ=${TZ}
     env_file:
       - kopano_spooler.env
     networks:
@@ -87,7 +89,6 @@ services:
     depends_on:
       - kopano_server_2
     environment:
-      - TZ=${TZ}
       - CRON_KOPANOUSERS2=10 * * * * docker exec kopano_server_2 kopano-admin --sync
 
 volumes:

examples/meet/docker-compose.yml

@@ -9,18 +9,20 @@ services:
       - "${HTTP:-80}:80"
       - "${HTTPS:-443}:443"
     environment:
+      - DEFAULTREDIRECT=/meet
       - EMAIL=${EMAIL:-off}
       - FQDN=${FQDNCLEANED?err}
-      - DEFAULTREDIRECT=/meet
     command: wrapper.sh
     cap_drop:
       - ALL
     cap_add:
-      - NET_BIND_SERVICE
       - CHOWN
+      - NET_BIND_SERVICE
       - SETGID
       - SETUID
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - web:/.kweb
     networks:
       web-net:
@@ -32,12 +34,12 @@ services:
     restart: unless-stopped
     container_name: ${COMPOSE_PROJECT_NAME}_ldap
     environment:
-      - LDAP_ORGANISATION=${LDAP_ORGANISATION}
-      - LDAP_DOMAIN=${LDAP_DOMAIN}
-      - LDAP_BASE_DN=${LDAP_BASE_DN}
       - LDAP_ADMIN_PASSWORD=${LDAP_ADMIN_PASSWORD}
-      - LDAP_READONLY_USER=true
+      - LDAP_BASE_DN=${LDAP_BASE_DN}
+      - LDAP_DOMAIN=${LDAP_DOMAIN}
+      - LDAP_ORGANISATION=${LDAP_ORGANISATION}
       - LDAP_READONLY_USER_PASSWORD=${LDAP_READONLY_USER_PASSWORD}
+      - LDAP_READONLY_USER=true
     command: "--loglevel info --copy-service"
     volumes:
       - ldap:/var/lib/ldap
@@ -58,16 +60,18 @@ services:
     restart: unless-stopped
     container_name: ${COMPOSE_PROJECT_NAME}_grapi
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - kopanosocket/:/run/kopano
     environment:
-      - SERVICE_TO_START=grapi
-      - TZ=${TZ}
       - ADDITIONAL_KOPANO_PACKAGES=python3-grapi.backend.ldap
       - GRAPI_BACKEND=ldap
-      - LDAP_URI=${LDAP_SERVER}
+      - LDAP_BASEDN=${LDAP_SEARCH_BASE}
       - LDAP_BINDDN=${LDAP_BIND_DN}
       - LDAP_BINDPW=${LDAP_BIND_PW}
-      - LDAP_BASEDN=${LDAP_SEARCH_BASE}
+      - LDAP_URI=${LDAP_SERVER}
+      - SERVICE_TO_START=grapi
+      - TZ=${TZ}
     networks:
       - kopano-net
       - ldap-net
@@ -79,15 +83,17 @@ services:
     depends_on:
       - kopano_grapi
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - kopanodata/:/kopano/data
-      - kopanossl/:/kopano/ssl
       - kopanosocket/:/run/kopano
+      - kopanossl/:/kopano/ssl
     environment:
-      - SERVICE_TO_START=kapi
-      - TZ=${TZ}
+      - KCCONF_KAPID_INSECURE=${INSECURE}
       - KCCONF_KAPID_LOG_LEVEL=DEBUG
       - KCCONF_KAPID_OIDC_ISSUER_IDENTIFIER=https://${FQDN}
-      - KCCONF_KAPID_INSECURE=${INSECURE}
+      - SERVICE_TO_START=kapi
+      - TZ=${TZ}
     networks:
       - kopano-net
       - web-net
@@ -99,29 +105,31 @@ services:
       - kopano_ssl
       - web
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - kopanossl/:/kopano/ssl
     environment:
-      - FQDN=${FQDN}
-      - ecparam=/kopano/ssl/ecparam.pem
-      - eckey=/kopano/ssl/meet-kwmserver.pem
-      - signing_private_key=/kopano/ssl/konnectd-tokens-signing-key.pem
-      - encryption_secret_key=/kopano/ssl/konnectd-encryption.key
-      - identifier_registration_conf=/kopano/ssl/konnectd-identifier-registration.yaml
-      - identifier_scopes_conf=/etc/kopano/konnectd-identifier-scopes.yaml
       - allow_client_guests=yes
       - allow_dynamic_client_registration=yes
+      - eckey=/kopano/ssl/meet-kwmserver.pem
+      - ecparam=/kopano/ssl/ecparam.pem
+      - encryption_secret_key=/kopano/ssl/konnectd-encryption.key
+      - FQDN=${FQDN}
+      - identifier_registration_conf=/kopano/ssl/konnectd-identifier-registration.yaml
+      - identifier_scopes_conf=/etc/kopano/konnectd-identifier-scopes.yaml
       - KONNECT_BACKEND=ldap
-      - LDAP_URI=${LDAP_SERVER}
+      - LDAP_BASEDN=${LDAP_SEARCH_BASE}
       - LDAP_BINDDN=${LDAP_BIND_DN}
       - LDAP_BINDPW=${LDAP_BIND_PW}
-      - LDAP_BASEDN=${LDAP_SEARCH_BASE}
-      - LDAP_SCOPE=sub
-      - LDAP_LOGIN_ATTRIBUTE=uid
       - LDAP_EMAIL_ATTRIBUTE=mail
-      - LDAP_NAME_ATTRIBUTE=cn
-      - LDAP_UUID_ATTRIBUTE=uidNumber
-      - LDAP_UUID_ATTRIBUTE_TYPE=text
       - LDAP_FILTER=(objectClass=organizationalPerson)
+      - LDAP_LOGIN_ATTRIBUTE=uid
+      - LDAP_NAME_ATTRIBUTE=cn
+      - LDAP_SCOPE=sub
+      - LDAP_URI=${LDAP_SERVER}
+      - LDAP_UUID_ATTRIBUTE_TYPE=text
+      - LDAP_UUID_ATTRIBUTE=uidNumber
+      - signing_private_key=/kopano/ssl/konnectd-tokens-signing-key.pem
     networks:
       - kopano-net
       - ldap-net
@@ -135,13 +143,15 @@ services:
       - kopano_kapi
       - kopano_konnect
     environment:
+      - enable_guest_api=yes
       - INSECURE=${INSECURE}
       - oidc_issuer_identifier=https://${FQDN}
-      - enable_guest_api=yes
       - public_guest_access_regexp=^group/public/.*
-      - turn_service_credentials_user=${TURN_USER}
       - turn_service_credentials_password=${TURN_PASSWORD}
+      - turn_service_credentials_user=${TURN_USER}
     volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
       - kopanossl/:/kopano/ssl
     networks:
       - web-net
@@ -150,30 +160,33 @@ services:
     image: ${docker_repo:-kopano}/kopano_meet:${MEET_VERSION:-latest}
     restart: unless-stopped
     environment:
-      - SERVICE_TO_START=meet
       - KCCONF_MEET_disableFullGAB=false
+      - KCCONF_MEET_GRID_WEBAPP=no
       - KCCONF_MEET_guests_enabled=true
       - KCCONF_MEET_useIdentifiedUser=true
-      - KCCONF_MEET_GRID_WEBAPP=no
+      - SERVICE_TO_START=meet
     depends_on:
       - kopano_kapi
       - kopano_konnect
       - kopano_kwmserver
       - web
+    volumes:
+      - /etc/machine-id:/etc/machine-id
+      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id
     networks:
       - web-net
 
 volumes:
-  web:
+  kopanodata:
+  kopanosocket:
+  kopanossl:
   ldap:
   slapd:
-  kopanodata:
-  kopanossl:
-  kopanosocket:
+  web:
 
 networks:
-  web-net:
   kopano-net:
     driver: bridge
   ldap-net:
     driver: bridge
+  web-net:

examples/meet/tests/startup-test/test.sh

@@ -5,7 +5,7 @@ set -ex
 # waits for key events in various containers
 # e.g. kopano_server:236 signals succesful start of kopano-server process
 dockerize \
-	-wait file://var/run/kopano/grapi/notify.sock \
+	-wait file:///var/run/kopano/grapi/notify.sock \
 	-wait http://kopano_konnect:8777/.well-known/openid-configuration \
 	-wait tcp://kopano_kwmserver:8778 \
 	-wait tcp://kopano_meet:9080 \

examples/meet/tests/test-container.yml

@@ -11,9 +11,13 @@ services:
       - ldap-net
       - web-net
     volumes:
-      - kopanodata/:/kopano/data
-      - kopanossl/:/kopano/ssl
-      - kopanosocket/:/run/kopano
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      - kopanodata/:/kopano/data
+      - kopanosocket/:/run/kopano
+      - kopanossl/:/kopano/ssl
     environment:
       - KCCONF_SERVER_MYSQL_HOST=${MYSQL_HOST}
+  ldap:
+    tmpfs:
+      - /var/lib/ldap
+      - /etc/ldap/slapd.d