Skip to content

docker.md

Latest commit

 

History

History
177 lines (137 loc) · 5.3 KB

docker.md

File metadata and controls

177 lines (137 loc) · 5.3 KB
Raw

Docker Deployment

Quick Start

Before starting a fresh container, configure JWT_SECRET and an independent PABAWI_BOOTSTRAP_TOKEN in its environment file. Keep access private and follow Initial setup to claim the administrator account.

# Using published image
docker run -d \
  --name pabawi \
  --user "$(id -u):1001" \
  -p 127.0.0.1:3000:3000 \
  -v "$(pwd)/bolt-project:/opt/pabawi/bolt-project:ro" \
  -v "$(pwd)/data:/opt/pabawi/data" \
  --env-file .env \
  example42/pabawi:latest

--user "$(id -u):1001": your user must be able to read all mounted files.

Run build and repository Compose examples from the repository root. Standalone docker run examples assume .env, data/ and bolt-project/ in the current working directory. Set HOST=0.0.0.0 and PORT=3000 inside the container.

The repository Compose file publishes application and PostgreSQL ports on all host interfaces by default. For private first start, edit its mappings to 127.0.0.1:3000:3000 and 127.0.0.1:5432:5432 before starting services. The standalone example and the Compose example below already bind to loopback. See Docker port binding.

Building the Image

docker build -t pabawi:latest .
docker build -f Dockerfile.alpine -t pabawi:alpine .  # smaller

Multi-arch:

docker buildx build --platform linux/amd64,linux/arm64 -t pabawi:latest .

Volume Mounts

All paths in .env must be container paths (under /opt/pabawi/), not host paths.

Data Host → Container Env setting
SQLite DB ./data → /opt/pabawi/data DATABASE_PATH=/opt/pabawi/data/pabawi.db
Bolt project ./bolt-project → /opt/pabawi/bolt-project BOLT_PROJECT_PATH=/opt/pabawi/bolt-project
Control repo ./control-repo → /opt/pabawi/control-repo HIERA_CONTROL_REPO_PATH=/opt/pabawi/control-repo
Ansible ./ansible → /opt/pabawi/ansible ANSIBLE_PROJECT_PATH=/opt/pabawi/ansible
SSL certs ./certs → /opt/pabawi/certs PUPPETDB_SSL_CA=/opt/pabawi/certs/ca.pem
SSH keys ~/.ssh → /opt/pabawi/ssh SSH_DEFAULT_KEY=/opt/pabawi/ssh/id_rsa

Permissions: The container runs as UID 1001.

chown -R 1001:1001 ./data
chmod 755 ./bolt-project ./control-repo
chmod 600 ./certs/*.pem ./certs/*.key

Docker Compose

services:
  pabawi:
    image: example42/pabawi:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:3000:3000"
    user: "${UID:-1000}:1001"
    env_file: .env
    volumes:
      - ./bolt-project:/opt/pabawi/bolt-project:ro
      - ./control-repo:/opt/pabawi/control-repo:ro
      - ./ansible:/opt/pabawi/ansible:ro
      - ./certs:/opt/pabawi/certs:ro
      - ~/.ssh:/opt/pabawi/ssh:ro
      - ./data:/opt/pabawi/data

PostgreSQL backend

The repository's docker-compose.yml includes a profile-gated postgres service. It stays off by default; enable it with the postgres profile:

docker compose --profile postgres up

Before starting the profile, point the app at it in .env:

DB_TYPE=postgres
DATABASE_URL=postgres://pabawi:pabawi@postgres:5432/pabawi

Service credentials default to pabawi and are overridable via POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB, and POSTGRES_PORT. See configuration.md for details.

Example .env for Docker

# Server
PORT=3000
HOST=0.0.0.0
LOG_LEVEL=info
DATABASE_PATH=/opt/pabawi/data/pabawi.db

# Bolt
BOLT_PROJECT_PATH=/opt/pabawi/bolt-project
BOLT_EXECUTION_TIMEOUT=300000
COMMAND_WHITELIST_ALLOW_ALL=false
COMMAND_WHITELIST='["uptime","df -h","free -m"]'
COMMAND_WHITELIST_MATCH_MODE=exact

# PuppetDB (example)
PUPPETDB_ENABLED=true
PUPPETDB_SERVER_URL=https://puppetdb.example.com
PUPPETDB_PORT=8081
PUPPETDB_SSL_CA=/opt/pabawi/certs/ca.pem
PUPPETDB_SSL_CERT=/opt/pabawi/certs/client.crt
PUPPETDB_SSL_KEY=/opt/pabawi/certs/client.key

# Hiera (example)
HIERA_ENABLED=true
HIERA_CONTROL_REPO_PATH=/opt/pabawi/control-repo

# Safety
ALLOW_DESTRUCTIVE_PROVISIONING=false

See configuration.md for all available variables.

SSL Certificate Setup

Copy Puppet SSL certs from the Puppetserver host:

mkdir -p ./certs
scp puppet.example.com:/etc/puppetlabs/puppet/ssl/certs/ca.pem ./certs/
scp puppet.example.com:/etc/puppetlabs/puppet/ssl/certs/pabawi.pem ./certs/client.crt
scp puppet.example.com:/etc/puppetlabs/puppet/ssl/private_keys/pabawi.pem ./certs/client.key
chmod 644 ./certs/ca.pem ./certs/client.crt
chmod 600 ./certs/client.key

Troubleshooting

# View logs
docker logs pabawi -f

# Enter the container
docker exec -it pabawi /bin/sh

# Check health
curl http://localhost:3000/api/health
Problem Fix
Permission denied on volume Check ownership (chown -R 1001:1001 ./data) and mode
"Bolt project not found" Check BOLT_PROJECT_PATH is /opt/pabawi/bolt-project (container path)
SSL errors Verify cert permissions (600) and that CA matches the server cert
Container exits immediately Check docker logs pabawi for config validation errors

Build verification

See Build inputs and release verification for Node versions, locked workspace installation, script policy, image smoke tests and scan gates.