Add docker compose

[neo773]

This PR adds one click docker-compose setup

a.mp4

/claim #727
/closes #727

[ezekg]

Had a suggestion on overall direction. Also, can you add better instructions to the PR description? I assume this is meant to be run via ./scripts/docker-compose.sh and not docker-compose -f docker-compose.yml up -d? Is this typical? I'd like to follow what other projects do for consistency. I don't use Compose enough to have any real opinion, but this seems atypical to what I've seen with other Compose implementations for self-hosting.

[ezekg]

I would prefer to do away with the docker-compose.sh script, and do something more along the lines of what Chatwoot is doing: https://www.chatwoot.com/docs/self-hosted/deployment/docker/, e.g. as part of initial setup, have them run:

docker compose run -i --rm web bundle exec rails keygen:setup

I also want to do away with all hard-coded passwords in .env.sample. This is just asking for somebody to setup a production database using defaults. I'm fine with requiring somebody manually setup their .env file i.e. not doing it for them.

And if we're going to go the route of a .env.sample, we need to actually cover all required environment vars. Let's mirror what Chatwoot does here? Seems pretty straight forward and reduces "magic" unlike the current shell script.

We should also not have a default for KEYGEN_HOST, since that must be set to the actual domain name being used — a default is just going to cause more trouble than it helps.

The message after setup can be adjusted to mention adding vars to the current shell environment, or to .env.

Then we can also instruct migrations and seeds to be run before each deployment, similarly to the setup:

docker compose run --rm web bundle exec rails db:migrate db:seed

Overall, I want to avoid footguns here — people using Compose want simple/safe.

wdyt?

[neo773]

Sounds good, I initially went with 1 click setup as I wanted it to be as frictionless as possible.

Also good idea to cover all ENV vars will do that.

[neo773]

To set it up you'd run it like this.

docker-compose --profile setup run --rm setup

docker-compose up

[neo773]

Pushed and squashed

[ezekg]

Could we update this message to something along the lines of this?

To complete setup, add the following env vars in your shell or to .env:

  SECRET_KEY_BASE=xxx
  ENCRYPTION_DETERMINISTIC_KEY=xxx
  ENCRYPTION_PRIMARY_KEY=xxx
  ENCRYPTION_KEY_DERIVATION_SALT=xxx
  KEYGEN_EDITION=CE
  KEYGEN_MODE=singleplayer
  KEYGEN_HOST=licensing.example.com
  KEYGEN_ACCOUNT_ID=xxx

In addition, you may want to keep track of the following information:

  Account ID: xxx
  Account slug: me
  Admin email: [email protected]

Then start the web and worker processes.

*keygen music intensifies*

[neo773]

@ezekg
Shouldn't we display it if user hasn't set them?

[ezekg]

@ezekg Shouldn't we display it if user hasn't set them?

It's fine to display all vars. If the user has already set them, the values won't be overridden so it will just print current vals.

[ezekg]

Also —one final ask: is there a way to add Caddy into this to automatically handle TLS and reverse-proxy side of things? 🙂

Ideally, it'd reverse-proxy all domains in KEYGEN_HOST and KEYGEN_HOSTS.

[neo773]

Also —one final ask: is there a way to add Caddy into this to automatically handle TLS and reverse-proxy side of things? 🙂

Ideally, it'd serve all domains in KEYGEN_HOST and KEYGEN_HOSTS.

I'd figured since we're keeping it less opinionated it might be better off to leave that to user?
They could use reverse proxy of their choice which could Nginx or Caddy etc.

Let me know what you think.

[neo773]

To complete setup, add the following env vars in your shell or to .env:

Looks like current file is already printing all the variables however we could change this part

Then run the following to start the server:

rails s

to if we're inside docker container set by IS_DOCKER_SETUP env var in the config

Then run the following to start the server:

docker-compose up

[ezekg]

I'd figured since we're keeping it less opinionated it might be better off to leave that to user? They could use reverse proxy of their choice which could Nginx or Caddy etc.

Let me know what you think.

I think it's fine to have Caddy be the default here. People can always modify the compose file to use Nginx or Apache. But Caddy gives the 99% an easy way to get a reverse-proxy and TLS set up with minimal effort. This is a big pain point for people not super knowledgeable in networking when it comes to self-hosting Keygen CE.

I'm all for doing things the Rails way — sensible defaults, config when needed.

To complete setup, add the following env vars in your shell or to .env:

Looks like current file is already printing all the variables however we could change this part

Then run the following to start the server:

rails s

to if we're inside docker container set by IS_DOCKER_SETUP env var in the config

Then run the following to start the server:

docker-compose up

I want to change it to a more general: "Then start the web and worker processes." as I mentioned above. I also want to adjust wording and format to match what I showed above so that it's more generalized:

-To complete setup, run the following in a shell, or add it to a shell profile:
+To complete setup, add the following env vars in your shell or to .env:
 
-  export SECRET_KEY_BASE=xxx
-  export ENCRYPTION_DETERMINISTIC_KEY=xxx
-  export ENCRYPTION_PRIMARY_KEY=xxx
-  export ENCRYPTION_KEY_DERIVATION_SALT=xxx
-  export KEYGEN_EDITION=CE
-  export KEYGEN_MODE=singleplayer
-  export KEYGEN_HOST=licensing.example.com
-  export KEYGEN_ACCOUNT_ID=xxx
+  SECRET_KEY_BASE=xxx
+  ENCRYPTION_DETERMINISTIC_KEY=xxx
+  ENCRYPTION_PRIMARY_KEY=xxx
+  ENCRYPTION_KEY_DERIVATION_SALT=xxx
+  KEYGEN_EDITION=CE
+  KEYGEN_MODE=singleplayer
+  KEYGEN_HOST=licensing.example.com
+  KEYGEN_ACCOUNT_ID=xxx
 
 In addition, you may want to keep track of the following information:
 
   Account ID: xxx
   Account slug: me
   Admin email: [email protected]
 
-Then run the following to start the server:
-
-  rails s
+Then start the web and worker processes.
 
 *keygen music intensifies*

[ezekg]

@neo773 I updated the Caddy setup. I wanted to make it more production-capable out-of-the-box.

wdyt?

[ezekg]

/approve