Allow setting auth_token at 1st container startup

[thopre]

Summary

Removing or renaming machines or runs require to have an auth_token.
This commit adds a mechanism to set that token on first startup of the
LNT container by setting the LNT_AUTH_TOKEN environment variable.

[PrzemekWirkus]

LGTM, but Thomas please wait 24h for this patch to cool down. Maybe others have comments.
But change itself is straightforward IMO.

[tnfchris]

Yes this works fine and doesn't interfere with our approach.

We took a different route here in that we COPY the lnt.cfg from outside the container into it to /etc/lnt-new.cfg and then restore it after the create command
but before the exec.

We do this since there are other settings we want to preserve, such as mail server settings etc.

[thopre]

In D113470#3117975, @tnfchris wrote:

Yes this works fine and doesn't interfere with our approach.

We took a different route here in that we COPY the lnt.cfg from outside the container into it to /etc/lnt-new.cfg and then restore it after the create command
but before the exec.

We do this since there are other settings we want to preserve, such as mail server settings etc.

Sounds like create-config should be modified to honor an existing config file so that you could just use a ADD in your Dockerfile

[tnfchris]

In D113470#3118004, @thopre wrote:

In D113470#3117975, @tnfchris wrote:

Yes this works fine and doesn't interfere with our approach.

We took a different route here in that we COPY the lnt.cfg from outside the container into it to /etc/lnt-new.cfg and then restore it after the create command
but before the exec.

We do this since there are other settings we want to preserve, such as mail server settings etc.

Sounds like create-config should be modified to honor an existing config file so that you could just use a ADD in your Dockerfile

Yeah, I think that's the best long term approach, but doesn't need to block your change here though.

[thopre]

In D113470#3118020, @tnfchris wrote:

In D113470#3118004, @thopre wrote:

In D113470#3117975, @tnfchris wrote:

Yes this works fine and doesn't interfere with our approach.

We took a different route here in that we COPY the lnt.cfg from outside the container into it to /etc/lnt-new.cfg and then restore it after the create command
but before the exec.

We do this since there are other settings we want to preserve, such as mail server settings etc.

Sounds like create-config should be modified to honor an existing config file so that you could just use a ADD in your Dockerfile

Yeah, I think that's the best long term approach, but doesn't need to block your change here though.

Sure. Thanks. I'll wait 24h as recommended by @PrzemekWirkus and land it if noone objects.

[cmatthews]

LGTM

docker/docker-compose.yml

 version: '3'
 
 services:
   lnt:
     build:
       context: .
     container_name: lnt
     image: lnt
     environment:
       - DB_ENGINE=postgres
       - DB_HOST=lnt-postgres
       - DB_PWD
+      - LNT_AUTH_TOKEN
     depends_on:
       - db
     deploy:
       restart_policy:
         condition: on-failure
     ports:
       - "8000:8000"
 
   db:
     container_name: lnt-postgres
     image: postgres:11-alpine
     environment:
       - POSTGRES_PASSWORD=${DB_PWD}
       - POSTGRES_USER=${DB_USER}
       - POSTGRES_DB=${DB_BASE}

docker/docker-entrypoint.sh

 #!/bin/sh
 
 DB_PATH=${DB_ENGINE:-postgresql}://${DB_USER:-lntuser}:${DB_PWD:?}@${DB_HOST:?}
 DB_BASE=${DB_BASE:-lnt}
 
 if [ ! -r /etc/lnt.cfg ]; then
   DB_BASE_PATH="${DB_PATH}/${DB_BASE}" wait_db
   lnt create /var/lib/lnt \
     --config /etc/lnt.cfg \
     --wsgi lnt_wsgi.py \
     --tmp-dir /tmp/lnt \
     --db-dir "${DB_PATH}" \
     --default-db "${DB_BASE}"
+  if [ -n "${LNT_AUTH_TOKEN:-}" ]; then
+    sed -i "s/# \(api_auth_token =\).*/\1 '${LNT_AUTH_TOKEN}'/" /etc/lnt.cfg
+  fi
 fi
 
 cd /var/lib/lnt
 exec gunicorn lnt_wsgi:application \
   --bind 0.0.0.0:8000 \
   --workers 8 \
   --timeout 300 \
   --name lnt_server \
   --log-file /var/log/lnt/lnt.log \
   --access-logfile /var/log/lnt/gunicorn_access.log \
   --max-requests 250000 "$@"