From e13aac496361f2df4cd2261db65a5f3e9868683d Mon Sep 17 00:00:00 2001 From: "m.nabokikh" Date: Thu, 28 Jan 2021 15:25:55 +0400 Subject: [PATCH] Switch to gomplate Signed-off-by: m.nabokikh --- Dockerfile | 16 +++++++++-- entrypoint.sh | 13 +++++++++ examples/config-example.tmpl | 54 ++++++++++++++++++++++++++++++++++++ examples/config.tmpl | 44 ----------------------------- 4 files changed, 81 insertions(+), 46 deletions(-) create mode 100755 entrypoint.sh create mode 100644 examples/config-example.tmpl delete mode 100644 examples/config.tmpl diff --git a/Dockerfile b/Dockerfile index cb410dab..41c0d6f8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,11 +27,22 @@ FROM alpine:3.13.1 # experience when this doesn't work out of the box. # # OpenSSL is required so wget can query HTTPS endpoints for health checking. +ARG TARGETARCH +ARG TARGETVARIANT="" +ARG GOMPLATE_VERSION=v3.9.0 + RUN apk add --no-cache --update ca-certificates openssl +RUN wget -O /usr/local/bin/gomplate \ + "https://github.com/hairyhenderson/gomplate/releases/download/${GOMPLATE_VERSION}/gomplate_linux-${TARGETARCH:-amd64}${TARGETVARIANT}" \ + && chmod +x /usr/local/bin/gomplate RUN mkdir -p /var/dex RUN chown -R 1001:1001 /var/dex +RUN mkdir -p /etc/dex +COPY examples/config-example.tmpl /etc/dex/config.tmpl +RUN chown -R 1001:1001 /etc/dex + # Copy module files for CVE scanning / dependency analysis. COPY --from=builder /usr/local/src/dex/go.mod /usr/local/src/dex/go.sum /usr/local/src/dex/ COPY --from=builder /usr/local/src/dex/api/v2/go.mod /usr/local/src/dex/api/v2/go.sum /usr/local/src/dex/api/v2/ @@ -46,6 +57,7 @@ COPY --from=builder /usr/local/src/dex/web /web USER 1001:1001 -ENTRYPOINT ["dex"] +COPY entrypoint.sh / -CMD ["version"] +ENTRYPOINT ["/entrypoint.sh"] +CMD ["serve", "/etc/dex/config.tmpl"] diff --git a/entrypoint.sh b/entrypoint.sh new file mode 100755 index 00000000..3e6a8e27 --- /dev/null +++ b/entrypoint.sh @@ -0,0 +1,13 @@ +#!/bin/sh -e + +### Usage: /entrypoint.sh +set -e +command=$1 + +if [ "$command" == "serve" ]; then + file="$2" + gomplate -f "$file" -o "/etc/dex/config.yaml"; + exec dex serve "/etc/dex/config.yaml" +else + exec dex $@ +fi diff --git a/examples/config-example.tmpl b/examples/config-example.tmpl new file mode 100644 index 00000000..acbe90e2 --- /dev/null +++ b/examples/config-example.tmpl @@ -0,0 +1,54 @@ +issuer: {{ getenv "DEX_ISSUER" "http://127.0.0.1:5556/dex" }} + +storage: + type: sqlite3 + config: + file: {{ getenv "DEX_STORAGE_SQLITE3_CONFIG_FILE" "/etc/dex/dex.db" }} + +web: +{{- if getenv "DEX_WEB_HTTPS" "" }} + https: {{ .Env.DEX_WEB_HTTPS }} + {{- if getenv "DEX_WEB_TLS_KEY" }} + tlsKey: {{ .Env.DEX_WEB_TLS_KEY }} + {{- else }} +{{- fail "$DEX_WEB_TLS_KEY is required" }} + {{- end }} + {{- if getenv "DEX_WEB_TLS_CERT" "" }} + tlsCert: {{ .Env.DEX_WEB_TLS_CERT }} + {{- else }} +{{- fail "$DEX_WEB_TLS_CERT is required" }} + {{- end }} +{{- end }} + http: {{ getenv "DEX_WEB_HTTP" "0.0.0.0:5556" }} + +{{- if getenv "DEX_TELEMETRY_HTTP" "" }} +telemetry: + http: {{ .Env.DEX_TELEMETRY_HTTP }} +{{- end }} + +expiry: + deviceRequests: {{ getenv "DEX_EXPIRY_DEVICE_REQUESTS" "5m" }} + signingKeys: {{ getenv "DEX_EXPIRY_SIGNING_KEYS" "6h" }} + idTokens: {{ getenv "DEX_EXPIRY_ID_TOKENS" "24h" }} + authRequests: {{ getenv "DEX_EXPIRY_AUTH_REQUESTS" "24h" }} + +logger: + level: {{ getenv "DEX_LOGGER_LEVEL" "info" }} + format: {{ getenv "DEX_LOGGER_FORMAT" "text" }} + +oauth2: + responseTypes: {{ getenv "DEX_OAUTH2_RESPONSE_TYPES" "[code]" }} + skipApprovalScreen: {{ getenv "DEX_OAUTH2_SKIP_APPROVAL_SCREEN" "false" }} + alwaysShowLoginScreen: {{ getenv "DEX_OAUTH2_ALWAYS_SHOW_LOGIN_SCREEN" "false" }} +{{- if getenv "DEX_OAUTH2_PASSWORD_CONNECTOR" "" }} + passwordConnector: {{ .Env.DEX_OAUTH2_PASSWORD_CONNECTOR }} +{{- end }} + +enablePasswordDB: {{ getenv "DEX_ENABLE_PASSWORD_DB" "true" }} + +connectors: +{{- if getenv "DEX_CONNECTORS_ENABLE_MOCK" "" }} +- type: mockCallback + id: mock + name: Example +{{- end }} diff --git a/examples/config.tmpl b/examples/config.tmpl deleted file mode 100644 index 43d12dbc..00000000 --- a/examples/config.tmpl +++ /dev/null @@ -1,44 +0,0 @@ -issuer: {{ default .Env.DEX_ISSUER "http://127.0.0.1:5556/dex" }} - -storage: - type: sqlite3 - config: - file: {{ default .Env.DEX_STORAGE_SQLITE3_CONFIG_FILE "/etc/dex/dex.db" }} - -web: -{{- if .Env.DEX_WEB_HTTPS }} - https: {{ .Env.DEX_WEB_HTTPS }} -{{- else }} - http: {{ default .Env.DEX_WEB_HTTP "0.0.0.0:5556" }} -{{- end }} -{{- if .Env.DEX_WEB_TLS_KEY }} - tlsKey: {{ .Env.DEX_WEB_TLS_KEY }} -{{- end }} -{{- if .Env.DEX_WEB_TLS_CERT }} - tlsCert: {{ .Env.DEX_WEB_TLS_CERT }} -{{- end }} - -{{- if .Env.DEX_TELEMETRY_HTTP }} -telemetry: - http: {{ .Env.DEX_TELEMETRY_HTTP }} -{{- end }} - -expiry: - deviceRequests: {{ default .Env.DEX_EXPIRY_DEVICE_REQUESTS "5m" }} - signingKeys: {{ default .Env.DEX_EXPIRY_SIGNING_KEYS "6h" }} - idTokens: {{ default .Env.DEX_EXPIRY_ID_TOKENS "24h" }} - authRequests: {{ default .Env.DEX_EXPIRY_AUTH_REQUESTS "24h" }} - -logger: - level: {{ default .Env.DEX_LOGGER_LEVEL "info" }} - format: {{ default .Env.DEX_LOGGER_FORMAT "text" }} - -oauth2: - responseTypes: {{ default .Env.DEX_OAUTH2_RESPONSE_TYPES "[code]" }} - skipApprovalScreen: {{ default .Env.DEX_OAUTH2_SKIP_APPROVAL_SCREEN "false" }} - alwaysShowLoginScreen: {{ default .Env.DEX_OAUTH2_ALWAYS_SHOW_LOGIN_SCREEN "false" }} -{{- if .Env.DEX_OAUTH2_PASSWORD_CONNECTOR }} - passwordConnector: {{ .Env.DEX_OAUTH2_PASSWORD_CONNECTOR }} -{{- end }} - -enablePasswordDB: {{ default .Env.DEX_ENABLE_PASSWORD_DB "true" }}