diff --git a/Dockerfile b/Dockerfile index 974e990..db6e265 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,53 +1,61 @@ -FROM alpine:3.13 as builder -LABEL version="1.0" description="OwnTracks Recorder" -LABEL authors="Jan-Piet Mens , Giovanni Angoli , Amy Nagle , Malte Deiseroth " -MAINTAINER Malte Deiseroth +FROM alpine:3.15 AS builder -# build with `docker build --build-arg recorder_version=x.y.z ' -ARG recorder_version=0.8.8 +ARG RECORDER_VERSION=0.8.8 +# ARG RECORDER_VERSION=master -COPY entrypoint.sh /entrypoint.sh -COPY config.mk /config.mk -COPY recorder.conf /etc/default/recorder.conf -COPY recorder-health.sh /usr/local/sbin/recorder-health.sh - -ENV VERSION=$recorder_version -ENV EUID=9999 - -RUN apk add --no-cache --virtual .build-deps \ - curl-dev libconfig-dev make \ - gcc musl-dev mosquitto-dev shadow wget \ - && apk add --no-cache \ - libcurl libconfig-dev mosquitto-dev lmdb-dev libsodium-dev lua5.2-dev \ - && groupadd -g $EUID appuser \ - && useradd -r -u $EUID -s "/bin/sh" -g appuser appuser \ - && mkdir -p /usr/local/source \ - && cd /usr/local/source \ - && wget https://github.com/owntracks/recorder/archive/$VERSION.tar.gz \ - && tar xzf $VERSION.tar.gz \ - && cd recorder-$VERSION \ - && mv /config.mk ./ \ - && make \ - && make install \ - && cd / \ - && chmod 755 /entrypoint.sh \ - && rm -rf /usr/local/source \ - && chmod 755 /usr/local/sbin/recorder-health.sh \ - && apk del .build-deps RUN apk add --no-cache \ - curl jq + make \ + gcc \ + git \ + shadow \ + musl-dev \ + curl-dev \ + libconfig-dev \ + mosquitto-dev \ + lmdb-dev \ + libsodium-dev \ + lua5.2-dev + +RUN git clone --branch=${RECORDER_VERSION} https://github.com/owntracks/recorder /src/recorder +WORKDIR /src/recorder + +COPY config.mk . +RUN make -j $(nprocs) +RUN make install DESTDIR=/app + +FROM alpine:3.15 VOLUME ["/store", "/config"] +RUN apk add --no-cache \ + curl \ + jq \ + libcurl \ + libconfig \ + mosquitto \ + lmdb \ + libsodium \ + lua5.2 + COPY recorder.conf /config/recorder.conf COPY JSON.lua /config/JSON.lua +COPY --from=builder /app / + +COPY recorder-health.sh /usr/sbin/recorder-health.sh +COPY entrypoint.sh /usr/sbin/entrypoint.sh + +RUN chmod +x /usr/sbin/*.sh # If you absolutely need health-checking, enable the option below. Keep in # mind that until https://github.com/systemd/systemd/issues/6432 is resolved, # using the HEALTHCHECK feature will cause systemd to generate a significant # amount of spam in the system logs. -# HEALTHCHECK CMD /usr/local/sbin/recorder-health.sh +# HEALTHCHECK CMD /usr/sbin/recorder-health.sh EXPOSE 8083 -ENTRYPOINT ["/entrypoint.sh"] +ENV OTR_CAFILE=/etc/ssl/cert.pem +ENV OTR_STORAGEDIR=/store +ENV OTR_TOPIC="owntracks/#" + +ENTRYPOINT ["/usr/sbin/entrypoint.sh"] diff --git a/README.md b/README.md index 87b549e..fc3380f 100644 --- a/README.md +++ b/README.md @@ -6,12 +6,13 @@ Dockerfile for the [Recorder](https://github.com/owntracks/recorder) of the OwnTracks project. The image is [owntracks/recorder](https://hub.docker.com/r/owntracks/recorder). ## Quickstart + ```bash -$ docker volume create recorder_store -$ docker run -d -p 8083:8083 -v recorder_store:/store -e OTR_HOST=mqtt_broker owntracks/recorder +docker volume create recorder_store +docker run -d -p 8083:8083 -v recorder_store:/store -e OTR_HOST=mqtt_broker owntracks/recorder ``` -Recorder is now accessible at `http://localhost:8083`. +Recorder is now accessible at `http://localhost:8083`. `-p 8083:8083` makes the container reachable at port 8083. `-d` detaches the container into the background. The volume `recorder_store` is mounted at @@ -21,6 +22,7 @@ environment variables. Multiple `-e` parameters can be used for multiple environment variables. ## Configuration + The Recorder can be configured using two methods, environment variables and via the a `recorder.conf` file in the `/config` volume of the container. @@ -29,31 +31,33 @@ via the a `recorder.conf` file in the `/config` volume of the container. Can be passed to the container with the `-e` parameter. Example: ```bash -$ docker run -d -p 8083:8083 \ +docker run -d -p 8083:8083 \ -e OTR_HOST=mqtt_broker \ - -e OTR_PORT=1883 \ - -e OTR_USER=user \ - -e OTR_PASS=pass \ - owntracks/recorder + -e OTR_PORT=1883 \ + -e OTR_USER=user \ + -e OTR_PASS=pass \ + owntracks/recorder ``` The complete list of parameters can be found in the [recorder documentation](https://github.com/owntracks/recorder/blob/master/README.md#configuration-file). ### Configuration file + One can also use a configuration file. The container reads a `recorder.conf` file from the `/config` folder. To use this, create a folder e.g. `./config` and mount it into you docker container at `/config`. ```bash -$ mkdir config -$ docker run -d -p 8083:8083 -v recorder_store:/store -v ./config:/config owntracks/recorder +mkdir config +docker run -d -p 8083:8083 -v recorder_store:/store -v ./config:/config owntracks/recorder ``` Up on starting the recorder, a default `recorder.conf` file will be created if none exists. Possible options are documented [here](https://github.com/owntracks/recorder/blob/master/README.md#configuration-file). **Notes:** + - The value of `OTR_HOST` is as seen from the container. Thus `localhost` refers to the container not the host and should likely not be used. - Environment variables, overwrite the `recorder.conf` file options. @@ -66,14 +70,15 @@ The `/store` volume of the container is used for persistent storage of location data. The volume needs to be created explicitly. ```bash -$ docker volume create recorder_storage -$ docker run -d -p 8083:8083 -v recorder_store:/store owntracks/recorder +docker volume create recorder_storage +docker run -d -p 8083:8083 -v recorder_store:/store owntracks/recorder ``` + It is also possible to use a local folder instead of an static docker volume. ```bash -$ mkdir store -$ docker run -d -p 8083:8083 -v ./store:/store owntracks/recorder +mkdir store +docker run -d -p 8083:8083 -v ./store:/store owntracks/recorder ``` If nothing is mounted at `/store`, docker will create a unique volume @@ -81,7 +86,8 @@ automatically. However up on recreation of the docker container, this process will be repeated and another unique volume will be created. As a result, the container will have forgotten about previous tracks. -## TLS between MQTT broker and Recorder +## TLS between MQTT broker and recorder + The `OTR_CAPATH` of the container defaults to the `/config` volume. Thus certificates and key files belong into the `/config` volume. `OTR_CAFILE` must be configured for TLS. @@ -97,17 +103,17 @@ details. ## Healthcheck -The Recorder container performs a Docker-style HEALTHCHECK on itself by periodically +The Recorder container performs a Docker-style `HEALTHCHECK` on itself by periodically running `recorder-health.sh` on itself. This program POSTS a `_type: location` JSON message to itself over HTTP to the ping-ping endpoint and verifies via the HTTP API whether the message was received. - ## Docker compose files -Save a file with the name [docker-compose.yml](docker-compose.yml) and following content. Run with -`docker-compose up` from the same folder. -``` yaml +Save a file with the name [docker-compose.yml](docker-compose.yml) and following content. +Run with `docker-compose up` from the same folder. + +```yaml version: '3' services: @@ -124,7 +130,6 @@ services: volumes: store: config: - ``` This [docker-compose.yml](docker-compose.yml) file creates `store` and `config` volumes. It is @@ -137,7 +142,7 @@ variables see An example might look like: -``` yaml +```yaml version: '3' services: @@ -156,7 +161,6 @@ services: volumes: store: - ``` ### With MQTT broker @@ -164,7 +168,7 @@ volumes: If you need to set up an MQTT broker, you can easily use, say, Mosquitto. There are ready to use containers available on docker hub. To use `eclipse-mosquitto` add something like [the following](docker-compose-mqtt.yml) to your `docker-compose.yml` file. -``` yaml +```yaml version: '3' services: @@ -196,6 +200,7 @@ volumes: mosquitto-logs: mosquitto-conf: ``` + See [here](https://hub.docker.com/_/eclipse-mosquitto) for info on the eclipse-mosquitto image and how to configure it. ### All in one solution with reverse proxy and Let's Encrypt @@ -222,7 +227,7 @@ There are some caveats people seem to step into: the virtual host, e.g. `owntrack.domain.com` in the **folder** `/etc/nginx/htpasswd` -``` yaml +```yaml version: '2' @@ -313,9 +318,10 @@ networks: external: name: nginx-proxy ``` + a minimal mosquitto.conf which can act as a start: -``` +``` allow_anonymous false password_file /etc/mosquitto/passwd #use mosquitto_passwd inside container to populate the passwd file @@ -338,8 +344,7 @@ cafile /etc/letsencrypt/live/mqtt.domain.com/chain.pem keyfile /etc/letsencrypt/live/mqtt.domain.com/key.pem ``` - -# Possible enhancements +## Possible enhancements - Maybe put the most common Mosquitto options in the section which uses an MQTT broker in the docker-compose file diff --git a/config.mk b/config.mk index 34f4125..e7946f8 100644 --- a/config.mk +++ b/config.mk @@ -1,4 +1,4 @@ -CFLAGS += -g +CFLAGS += -g -DNS_ENABLE_IPV6 INSTALLDIR = /usr diff --git a/entrypoint.sh b/entrypoint.sh index e3b3f78..294aaae 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,16 +1,7 @@ #!/bin/sh -# If running as root (first invocation), fix mountpoint permissions -# and re-run this script as appuser. -if [[ $(id -u) -eq 0 ]]; then - chown -R appuser:appuser /store /config - exec su appuser -- "$0" "$@" +if ! [ -f ${OTR_STORAGEDIR}/ghash/data.mdb ]; then + ot-recorder --initialize fi -# Load Default recorder.conf if not available -if [ ! -f /config/recorder.conf ]; then - cp /etc/default/recorder.conf /config/recorder.conf -fi - -ot-recorder --initialize -ot-recorder "$@" +ot-recorder ${OTR_TOPIC} diff --git a/recorder-health.sh b/recorder-health.sh index 02e65ef..9015488 100644 --- a/recorder-health.sh +++ b/recorder-health.sh @@ -1,30 +1,29 @@ #!/bin/sh -addr=`hostname` -port=8083 +ADDR=`hostname` +PORT=8083 -epoch=$(date +%s) +EPOCH=$(date +%s) -location=$(cat < /dev/null +curl -sSL --data "${LOCATION}" "http://${ADDR}:${PORT}/pub?u=ping&d=ping" > /dev/null # obtain tst of ping/ping's last location -ret_epoch=$(curl -sSL http://${addr}:${port}/api/0/last --data "user=ping&device=ping" | - env jq -r '.[0].tst' ) +RET_EPOCH=$(curl -sSL http://${ADDR}:${PORT}/api/0/last --data "user=ping&device=ping" | env jq -r '.[0].tst' ) -if [ $epoch -ne $ret_epoch ]; then - echo PANIC $epoch $ret_epoch +if [ ${EPOCH} -ne ${RET_EPOCH} ]; then + echo PANIC ${EPOCH} ${RET_EPOCH} exit 1 else echo OK diff --git a/recorder.conf b/recorder.conf index 9671e63..d8c448a 100644 --- a/recorder.conf +++ b/recorder.conf @@ -4,9 +4,16 @@ # and its associated utilities to override compiled-in defaults. OTR_TOPICS = "owntracks/#" -OTR_HTTPHOST = "0.0.0.0" + +# Binding on 0.0.0.0 will listen on IPv4 only +# Binding on [::] will listen on IPv4 and IPv6 +# OTR_HTTPHOST = "0.0.0.0" +OTR_HTTPHOST = "[::]" + +# CA data for MQTT client # OTR_CAPATH = "/config" # OTR_CAFILE = "ca.pem" +# Server Certificate for builtin HTTPS server # OTR_CERTFILE = "cert.pem" # OTR_KEYFILE = "key.pem"