appwrite-podman.sh

#!/bin/bash

# Create folder

if [[ ! -d appwrite ]]; then
mkdir appwrite
cd appwrite
fi

# Install AppWrite-Compose

cat > .env <<EOF
_APP_ENV=production
_APP_LOCALE=es
_APP_OPTIONS_ABUSE=enabled
_APP_OPTIONS_FORCE_HTTPS=disabled
_APP_OPENSSL_KEY_V1=o5Rxy7TCdkomrLuQOvX7mNULyQp6FctYk/9A9cTXBXzsxtdmT4+5bx5eAsgtWEMn
_APP_DOMAIN=localhost
_APP_DOMAIN_TARGET=localhost
_APP_CONSOLE_WHITELIST_ROOT=enabled
_APP_CONSOLE_WHITELIST_EMAILS=
_APP_CONSOLE_WHITELIST_IPS=
_APP_SYSTEM_EMAIL_NAME=Appwrite
_APP_SYSTEM_EMAIL_ADDRESS=appwriter@localhost
_APP_SYSTEM_RESPONSE_FORMAT=
_APP_SYSTEM_SECURITY_EMAIL_ADDRESS=appwriter@localhost
_APP_USAGE_STATS=enabled
_APP_REDIS_HOST=redis
_APP_REDIS_PORT=6379
_APP_REDIS_USER=appwriter
_APP_REDIS_PASS=xxRcY4TTXP5Fq+awI6Cy7aGNYBZ8fr4XK0cAaTJdj9J5dgW+odDEHiI3o9BFywj5
_APP_DB_HOST=mariadb
_APP_DB_PORT=3306
_APP_DB_SCHEMA=appwrite
_APP_DB_USER=appwriter
_APP_DB_PASS=qp6OVgcuncDXVHzpJuSRBMFmz5hBF3vhalrcIrRs0bDItexL25rssZE4tWv/aDY9
_APP_DB_ROOT_PASS=kpJfBVc8ILmrefjkDF5ATFH6R0I5KNELtg+dA67z/B8BJj1IdOg0HqhCeUQ9IdsO
_APP_INFLUXDB_HOST=influxdb
_APP_INFLUXDB_PORT=8086
_APP_STATSD_HOST=telegraf
_APP_STATSD_PORT=8125
_APP_SMTP_HOST=
_APP_SMTP_PORT=
_APP_SMTP_SECURE=
_APP_SMTP_USERNAME=
_APP_SMTP_PASSWORD=
_APP_STORAGE_LIMIT=10000000
_APP_STORAGE_ANTIVIRUS=disabled
_APP_STORAGE_ANTIVIRUS_HOST=clamav
_APP_STORAGE_ANTIVIRUS_PORT=3310
_APP_FUNCTIONS_TIMEOUT=900
_APP_FUNCTIONS_CONTAINERS=10
_APP_FUNCTIONS_CPUS=
_APP_FUNCTIONS_MEMORY=256
_APP_FUNCTIONS_MEMORY_SWAP=256
_APP_FUNCTIONS_RUNTIMES=node-16.0,php-8.0,python-3.9,ruby-3.0,java-16.0
_APP_FUNCTIONS_ENVS=node-16.0,php-7.4,python-3.9,ruby-3.0,java-16.0
EOF

cat >docker-compose.yml <<EOF
version: '3'

services:
  traefik:
    image: traefik:2.3
    container_name: appwrite-traefik
    command:
      - --providers.file.directory=/storage/config
      - --providers.file.watch=true
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --providers.docker.constraints=Label(\`traefik.constraint-label-stack\`,\`appwrite\`)
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
    restart: unless-stopped
    ports:
      - 127.0.0.1:9580:80
        #- 443:443
    volumes:
      - /var/run/user/${UID}/podman/podman.sock:/var/run/docker.sock
      - appwrite-config:/storage/config:ro
      - appwrite-certificates:/storage/certificates:ro
    depends_on:
      - appwrite
    networks:
      - gateway
      - appwrite

  appwrite:
    image: appwrite/appwrite:0.9.1
    container_name: appwrite
    restart: unless-stopped
    networks:
      - appwrite
    labels:
      - traefik.enable=true
      - traefik.constraint-label-stack=appwrite
      - traefik.http.routers.appwrite.rule=PathPrefix(\`/\`)
      - traefik.http.routers.appwrite-secure.rule=PathPrefix(\`/\`)
      - traefik.http.routers.appwrite-secure.tls=true
    volumes:
      - appwrite-uploads:/storage/uploads:rw
      - appwrite-cache:/storage/cache:rw
      - appwrite-config:/storage/config:rw
      - appwrite-certificates:/storage/certificates:rw
      - appwrite-functions:/storage/functions:rw
    depends_on:
      - mariadb
      - redis
#      - clamav
      - influxdb
    environment:
      - _APP_ENV
      - _APP_LOCALE
      - _APP_CONSOLE_WHITELIST_ROOT
      - _APP_CONSOLE_WHITELIST_EMAILS
      - _APP_CONSOLE_WHITELIST_IPS
      - _APP_SYSTEM_EMAIL_NAME
      - _APP_SYSTEM_EMAIL_ADDRESS
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_SYSTEM_RESPONSE_FORMAT
      - _APP_OPTIONS_ABUSE
      - _APP_OPTIONS_FORCE_HTTPS
      - _APP_OPENSSL_KEY_V1
      - _APP_DOMAIN
      - _APP_DOMAIN_TARGET
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_SMTP_HOST
      - _APP_SMTP_PORT
      - _APP_SMTP_SECURE
      - _APP_SMTP_USERNAME
      - _APP_SMTP_PASSWORD
      - _APP_USAGE_STATS
      - _APP_INFLUXDB_HOST
      - _APP_INFLUXDB_PORT
      - _APP_STORAGE_LIMIT
      - _APP_STORAGE_ANTIVIRUS
      - _APP_STORAGE_ANTIVIRUS_HOST
      - _APP_STORAGE_ANTIVIRUS_PORT
      - _APP_FUNCTIONS_TIMEOUT
      - _APP_FUNCTIONS_CONTAINERS
      - _APP_FUNCTIONS_CPUS
      - _APP_FUNCTIONS_MEMORY
      - _APP_FUNCTIONS_MEMORY_SWAP
      - _APP_FUNCTIONS_RUNTIMES

  appwrite-worker-usage:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-usage
    container_name: appwrite-worker-usage
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - telegraf
    environment:
      - _APP_ENV
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_STATSD_HOST
      - _APP_STATSD_PORT

  appwrite-worker-audits:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-audits
    container_name: appwrite-worker-audits
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    environment:
      - _APP_ENV
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS

  appwrite-worker-webhooks:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-webhooks
    container_name: appwrite-worker-webhooks
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    environment:
      - _APP_ENV
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS

  appwrite-worker-tasks:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-tasks
    container_name: appwrite-worker-tasks
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    environment:
      - _APP_ENV
      - _APP_OPENSSL_KEY_V1
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS

  appwrite-worker-deletes:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-deletes
    container_name: appwrite-worker-deletes
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    volumes:
      - appwrite-uploads:/storage/uploads:rw
      - appwrite-cache:/storage/cache:rw
      - appwrite-certificates:/storage/certificates:rw
    environment:
      - _APP_ENV
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS

  appwrite-worker-certificates:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-certificates
    container_name: appwrite-worker-certificates
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    volumes:
      - appwrite-config:/storage/config:rw
      - appwrite-certificates:/storage/certificates:rw
    environment:
      - _APP_ENV
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DOMAIN_TARGET
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS

  appwrite-worker-functions:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-functions
    container_name: appwrite-worker-functions
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
      - mariadb
    volumes:
      - /var/run/user/${UID}/podman/podman.sock:/var/run/docker.sock
      - appwrite-functions:/storage/functions:rw
      - /tmp:/tmp:rw
    environment:
      - _APP_ENV
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_FUNCTIONS_TIMEOUT
      - _APP_FUNCTIONS_CONTAINERS
      - _APP_FUNCTIONS_CPUS
      - _APP_FUNCTIONS_MEMORY
      - _APP_FUNCTIONS_MEMORY_SWAP
      - _APP_FUNCTIONS_RUNTIMES
      - _APP_USAGE_STATS

  appwrite-worker-mails:
    image: appwrite/appwrite:0.9.1
    entrypoint: worker-mails
    container_name: appwrite-worker-mails
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
    environment:
      - _APP_ENV
      - _APP_SYSTEM_EMAIL_NAME
      - _APP_SYSTEM_EMAIL_ADDRESS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_SMTP_HOST
      - _APP_SMTP_PORT
      - _APP_SMTP_SECURE
      - _APP_SMTP_USERNAME
      - _APP_SMTP_PASSWORD

  appwrite-maintenance:
    image: appwrite/appwrite:0.9.1
    entrypoint: maintenance
    container_name: appwrite-maintenance
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
    environment:
      - _APP_ENV
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_MAINTENANCE_INTERVAL
      - _APP_MAINTENANCE_RETENTION_EXECUTION
      - _APP_MAINTENANCE_RETENTION_ABUSE
      - _APP_MAINTENANCE_RETENTION_AUDIT


  appwrite-schedule:
    image: appwrite/appwrite:0.9.1
    entrypoint: schedule
    container_name: appwrite-schedule
    restart: unless-stopped
    networks:
      - appwrite
    depends_on:
      - redis
    environment:
      - _APP_ENV
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS

  mariadb:
    image: appwrite/mariadb:1.2.0 # fix issues when upgrading using: mysql_upgrade -u root -p
    container_name: appwrite-mariadb
    restart: unless-stopped
    networks:
      - appwrite
    volumes:
      - appwrite-mariadb:/var/lib/mysql:rw
    environment:
      - MYSQL_ROOT_PASSWORD=\${_APP_DB_ROOT_PASS}
      - MYSQL_DATABASE=\${_APP_DB_SCHEMA}
      - MYSQL_USER=\${_APP_DB_USER}
      - MYSQL_PASSWORD=\${_APP_DB_PASS}
    command: 'mysqld --innodb-flush-method=fsync'

  redis:
    image: redis:6.0-alpine3.12
    container_name: appwrite-redis
    restart: unless-stopped
    networks:
      - appwrite
    volumes:
      - appwrite-redis:/data:rw

#  clamav:
#    image: appwrite/clamav:1.2.0
#    container_name: appwrite-clamav
#    restart: unless-stopped
#    networks:
#      - appwrite
#    volumes:
#      - appwrite-uploads:/storage/uploads

  influxdb:
    image: appwrite/influxdb:1.0.0
    container_name: appwrite-influxdb
    restart: unless-stopped
    networks:
      - appwrite
    volumes:
      - appwrite-influxdb:/var/lib/influxdb:rw

  telegraf:
    image: appwrite/telegraf:1.2.0
    container_name: appwrite-telegraf
    restart: unless-stopped
    networks:
      - appwrite
    environment:
      - _APP_INFLUXDB_HOST
      - _APP_INFLUXDB_PORT

networks:
  gateway:
  appwrite:

volumes:
  appwrite-mariadb:
  appwrite-redis:
  appwrite-cache:
  appwrite-uploads:
  appwrite-certificates:
  appwrite-functions:
  appwrite-influxdb:
  appwrite-config:
EOF

# Setup CNI rootless

cat > rootless-cni-infra << \EOF
#!/bin/sh
set -eu

ARG0="$0"
BASE="/run/rootless-cni-infra"

wait_unshare_net() {
    pid="$1"
    # NOTE: busybox shell doesn't support the `for ((i=0; i < $MAX; i++)); do foo; done` statement
    i=0
    while :; do
        if [ "$(readlink /proc/self/ns/net)" != "$(readlink /proc/${pid}/ns/net)" ]; then
            break
        fi
        sleep 0.1
        if [ $i -ge 10 ]; then
            echo >&2 "/proc/${pid}/ns/net cannot be unshared"
            exit 1
        fi
        i=$((i + 1))
    done
}

# CLI subcommand: "alloc $CONTAINER_ID $NETWORK_NAME $POD_NAME $IP $MAC $CAP_ARGS"
cmd_entrypoint_alloc() {
    if [ "$#" -ne 6 ]; then
        echo >&2 "Usage: $ARG0 alloc CONTAINER_ID NETWORK_NAME POD_NAME IP MAC CAP_ARGS"
        exit 1
    fi

    ID="$1"
    NET="$2"
    K8S_POD_NAME="$3"
    IP="$4"
    MAC="$5"
    CAP_ARGS="$6"

    dir="${BASE}/${ID}"
    mkdir -p "${dir}/attached" "${dir}/attached-args"

    pid=""
    if [ -f "${dir}/pid" ]; then
        pid=$(cat "${dir}/pid")
    else
        unshare -n sleep infinity &
        pid="$!"
        wait_unshare_net "${pid}"
        echo "${pid}" >"${dir}/pid"
        nsenter -t "${pid}" -n ip link set lo up
    fi
    CNI_ARGS="IgnoreUnknown=1;K8S_POD_NAME=${K8S_POD_NAME}"
    if [ "$IP" ]; then
        CNI_ARGS="$CNI_ARGS;IP=${IP}"
    fi
    if [ "$MAC" ]; then
        CNI_ARGS="$CNI_ARGS;MAC=${MAC}"
    fi
    if [ "$CAP_ARGS" ]; then
        CAP_ARGS="$CAP_ARGS"
    fi
    nwcount=$(find "${dir}/attached" -type f | wc -l)
    CNI_IFNAME="eth${nwcount}"
    export CNI_ARGS CNI_IFNAME CAP_ARGS
    cnitool add "${NET}" "/proc/${pid}/ns/net" >"${dir}/attached/${NET}"
    echo "${CNI_ARGS}" >"${dir}/attached-args/${NET}"

    # return the result
    ns="/proc/${pid}/ns/net"
    echo "{\"ns\":\"${ns}\"}"
}

# CLI subcommand: "dealloc $CONTAINER_ID $NETWORK_NAME"
cmd_entrypoint_dealloc() {
    if [ "$#" -ne 2 ]; then
        echo >&2 "Usage: $ARG0 dealloc CONTAINER_ID NETWORK_NAME"
        exit 1
    fi

    ID=$1
    NET=$2

    dir="${BASE}/${ID}"
    if [ ! -f "${dir}/pid" ]; then
        exit 0
    fi
    pid=$(cat "${dir}/pid")
    if [ -f "${dir}/attached-args/${NET}" ]; then
        CNI_ARGS=$(cat "${dir}/attached-args/${NET}")
        export CNI_ARGS
    fi
    cnitool del "${NET}" "/proc/${pid}/ns/net"
    rm -f "${dir}/attached/${NET}" "${dir}/attached-args/${NET}"

    nwcount=$(find "${dir}/attached" -type f | wc -l)
    if [ "${nwcount}" = 0 ]; then
        kill -9 "${pid}"
        rm -rf "${dir}"
    fi

    # return empty json
    echo "{}"
}

# CLI subcommand: "is-idle"
cmd_entrypoint_is_idle() {
    if [ ! -d ${BASE} ]; then
        echo '{"idle": true}'
    elif [ -z "$(ls -1 ${BASE})" ]; then
        echo '{"idle": true}'
    else
        echo '{"idle": false}'
    fi
}

# CLI subcommand: "print-cni-result $CONTAINER_ID $NETWORK_NAME"
cmd_entrypoint_print_cni_result() {
    if [ "$#" -ne 2 ]; then
        echo >&2 "Usage: $ARG0 print-cni-result CONTAINER_ID NETWORK_NAME"
        exit 1
    fi

    ID=$1
    NET=$2

    # the result shall be CNI JSON
    cat "${BASE}/${ID}/attached/${NET}"
}

# CLI subcommand: "print-netns-path $CONTAINER_ID"
cmd_entrypoint_print_netns_path() {
    if [ "$#" -ne 1 ]; then
        echo >&2 "Usage: $ARG0 print-netns-path CONTAINER_ID"
        exit 1
    fi

    ID=$1

    pid=$(cat "${BASE}/${ID}/pid")
    path="/proc/${pid}/ns/net"

    # return the result
    echo "{\"path\":\"${path}\"}"
}

# CLI subcommand: "help"
cmd_entrypoint_help() {
    echo "Usage: ${ARG0} COMMAND"
    echo
    echo "Rootless CNI Infra container"
    echo
    echo "Commands:"
    echo "  alloc             Allocate a netns"
    echo "  dealloc           Deallocate a netns"
    echo "  is-idle           Print whether the infra container is idle"
    echo "  print-cni-result  Print CNI result"
    echo "  print-netns-path  Print netns path"
    echo "  help              Print help"
    echo "  version           Print version"
}

# CLI subcommand: "version"
cmd_entrypoint_version() {
    echo "{\"version\": \"${ROOTLESS_CNI_INFRA_VERSION}\"}"
}

# parse args
command="${1:-}"
if [ -z "$command" ]; then
    echo >&2 "No command was specified. Run \`${ARG0} help\` to see the usage."
    exit 1
fi

command_func=$(echo "cmd_entrypoint_${command}" | sed -e "s/-/_/g")
if ! command -v "${command_func}" >/dev/null 2>&1; then
    echo >&2 "Unknown command: ${command}. Run \`${ARG0} help\` to see the usage."
    exit 1
fi

# start the command func
shift
"${command_func}" "$@"
EOF

cat >Containerfile<<\EOF
ARG GOLANG_VERSION=1.15
ARG ALPINE_VERSION=3.12
ARG CNI_VERSION=v0.8.0
ARG CNI_PLUGINS_VERSION=v0.8.7
ARG DNSNAME_VERSION=v1.1.1

FROM golang:${GOLANG_VERSION}-alpine${ALPINE_VERSION} AS golang-base
RUN apk add --no-cache git

FROM golang-base AS cnitool
RUN git clone https://github.com/containernetworking/cni /go/src/github.com/containernetworking/cni
WORKDIR /go/src/github.com/containernetworking/cni
ARG CNI_VERSION
RUN git checkout ${CNI_VERSION}
RUN go build -o /cnitool ./cnitool

FROM golang-base AS dnsname
RUN git clone https://github.com/containers/dnsname /go/src/github.com/containers/dnsname
WORKDIR /go/src/github.com/containers/dnsname
ARG DNSNAME_VERSION
RUN git checkout ${DNSNAME_VERSION}
RUN go build -o /dnsname ./plugins/meta/dnsname

FROM alpine:${ALPINE_VERSION}
RUN apk add --no-cache curl dnsmasq iptables ip6tables iproute2
ARG TARGETARCH
ARG CNI_PLUGINS_VERSION
RUN mkdir -p /opt/cni/bin && \
    curl -fsSL https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/cni-plugins-linux-${TARGETARCH}-${CNI_PLUGINS_VERSION}.tgz | tar xz -C /opt/cni/bin
COPY --from=cnitool /cnitool /usr/local/bin
COPY --from=dnsname /dnsname /opt/cni/bin
COPY rootless-cni-infra /usr/local/bin
ENV CNI_PATH=/opt/cni/bin
CMD ["sleep", "infinity"]

ENV ROOTLESS_CNI_INFRA_VERSION=5
EOF