Cloudron community app transparency reports

13WORKDIR /build
14 
15RUN apt-get update && apt-get install -y --no-install-recommends \
16    gcc \
17    libpq-dev \

35WORKDIR /app
36 
37RUN apt-get update && apt-get install -y --no-install-recommends \
38    ca-certificates \
39    curl \

75wait_for_app() {
76  for _ in $(seq 1 60); do
77    curl -fsS "${BASE}/api/ready" >/dev/null 2>&1 && return 0
78    [ "$(docker inspect -f '{{.State.Running}}' "$APP" 2>/dev/null || true)" = true ] \
79      || fail "normal image exited under Cloudron constraints"

101 
102login() {
103  curl -fsS -X POST "${BASE}/api/auth/login" \
104    -H 'Content-Type: application/json' \
105    -d "{\"email\":\"${ADMIN_EMAIL}\",\"password\":\"${ADMIN_PASSWORD}\"}" \

110docker network create "$NET" >/dev/null
111docker run -d --name "$PG" --network "$NET" \
112  -v "${PGVOL}:/var/lib/postgresql/data" \
113  -e "POSTGRES_USER=${DB_USER}" \
114  -e "POSTGRES_PASSWORD=${DB_PASSWORD}" \

122 
123log "Checking first-run setup and runtime peer link"
124[ "$(curl -fsS "${BASE}/api/setup/status" | json_field setup_required)" = True ] \
125  || fail "fresh Cloudron instance did not require setup"
126curl -fsS "${BASE}/runtime-config.js" | grep -F "$PEER_URL" >/dev/null \

124[ "$(curl -fsS "${BASE}/api/setup/status" | json_field setup_required)" = True ] \
125  || fail "fresh Cloudron instance did not require setup"
126curl -fsS "${BASE}/runtime-config.js" | grep -F "$PEER_URL" >/dev/null \
127  || fail "runtime-config.js did not contain ${PEER_ENV}"
128 

127  || fail "runtime-config.js did not contain ${PEER_ENV}"
128 
129curl -fsS -X POST "${BASE}/api/setup" \
130  -H 'Content-Type: application/json' \
131  -d "{\"email\":\"${ADMIN_EMAIL}\",\"password\":\"${ADMIN_PASSWORD}\",\"full_name\":\"Cloudron Owner\"}" \

142start_app
143wait_for_app
144[ "$(curl -fsS "${BASE}/api/setup/status" | json_field setup_required)" = False ] \
145  || fail "setup reopened after container recreation"
146[ -n "$(login)" ] || fail "administrator login did not survive recreation"

87  local what="$1"
88  for _ in $(seq 1 60); do
89    if curl -fsS "${BASE}/api/ready" >/dev/null 2>&1; then return 0; fi
90    sleep 2
91  done

96  # Reuses the named PGVOL so data survives a container recreate.
97  docker run -d --name "$PG" --network "$NET" \
98    -v "${PGVOL}:/var/lib/postgresql/data" \
99    -e "POSTGRES_USER=${DB_USER}" \
100    -e "POSTGRES_PASSWORD=${DB_PASSWORD}" \

123 
124login_token() {
125  curl -fsS -X POST "${BASE}/api/auth/login" \
126    -H 'Content-Type: application/json' \
127    -d "{\"email\":\"${ADMIN_EMAIL}\",\"password\":\"${ADMIN_PASSWORD}\"}" | json_field access_token

152 
153log "/api/health must be liveness-only (never claim database \"connected\")"
154health="$(curl -fsS "${BASE}/api/health")"
155echo "    health = ${health}"
156printf '%s' "$health" | grep -q '"connected"' \

160 
161log "/api/ready must confirm the database"
162ready="$(curl -fsS "${BASE}/api/ready")"
163echo "    ready = ${ready}"
164printf '%s' "$ready" | grep -q '"database":"connected"' \

170 
171log "/api/version must report the released version (${expected_version})"
172version="$(curl -fsS "${BASE}/api/version" | json_field version)"
173echo "    /api/version = ${version}"
174[ "$version" = "$expected_version" ] \

180 
181log "Database-backed API call (list products)"
182curl -fsS "${BASE}/api/products" -H "Authorization: Bearer ${token}" >/dev/null \
183  || fail "authenticated products listing failed"
184 

187head -c 2097152 /dev/zero | tr '\0' 'A' > "$upload_file"   # 2 MiB, well over nginx's 1 MB default
188upload_sha="$(sha256sum "$upload_file" | awk '{print $1}')"
189artifact_id="$(curl -fsS -X POST "${BASE}/api/uploads" \
190  -H "Authorization: Bearer ${token}" \
191  -F "file=@${upload_file};type=text/plain;filename=e2e.txt" | json_field id)"

204token="$(login_token)"
205[ -n "$token" ] || fail "admin login failed after recreation (database did not persist)"
206curl -fsS "${BASE}/api/uploads/info/${artifact_id}" -H "Authorization: Bearer ${token}" >/dev/null \
207  || fail "artifact ${artifact_id} row did not persist across recreation"
208 

209log "Downloading the artifact and verifying its bytes + SHA-256"
210downloaded="$(mktemp)"
211curl -fsS "${BASE}/api/uploads/${artifact_id}" -H "Authorization: Bearer ${token}" -o "$downloaded" \
212  || fail "artifact ${artifact_id} bytes did not persist across recreation"
213download_sha="$(sha256sum "$downloaded" | awk '{print $1}')"

35  set +a
36 
37  DATABASE_URL="$(printf '%s' "$CLOUDRON_POSTGRESQL_URL" | sed 's#^postgres://#postgresql://#')"
38  export DATABASE_URL
39 

91chown "$APP_UID:$APP_GID" "$RUN_DIR/runtime-config.js"
92 
93exec /usr/local/bin/supervisord -c /etc/supervisord.conf
94