diff --git a/Site/ASAB Maestro/Descriptors/influxdb.yaml b/Site/ASAB Maestro/Descriptors/influxdb.yaml index e9db945..69575f2 100644 --- a/Site/ASAB Maestro/Descriptors/influxdb.yaml +++ b/Site/ASAB Maestro/Descriptors/influxdb.yaml @@ -40,6 +40,26 @@ nginx: - rewrite ^/influxdb/(.*) /$1 break - proxy_pass http://upstream-influxdb +sherpas: + # Sherpas containers: akin to their namesake mountain guides, these containers provide essential support and guidance throughout the application's lifecycle. + # provide a name to your sherpa and a descriptor for its very own container. + init: + image: infuxdb:{{ VERSIONS["influxdb"] }} + entrypoint: ["bash", "/script/influx-init.sh"] + command: ["echo", "DONE"] + volumes: + - "{{SITE}}/{{INSTANCE_ID}}/script:/script:ro" + depends_on: ["{{INSTANCE_ID}}"] + environment: + INFLUXDB_HOSTNAME: "{{INFLUXDB_HOSTNAME}}" + DOCKER_INFLUXDB_INIT_BUCKET: "{{DOCKER_INFLUXDB_INIT_BUCKET}}" + DOCKER_INFLUXDB_INIT_ORG: "{{DOCKER_INFLUXDB_INIT_ORG}}" + DOCKER_INFLUXDB_INIT_USERNAME: "{{DOCKER_INFLUXDB_INIT_USERNAME}}" + +files: + - "script/influx-init.sh" + # - "script/replica-set.json" will be added by ASAB Remote Control / Mongo Tech + # Exposure of InfluxDB on the public HTTPS is disabled b/c there is no authorization introspection available # https: # location /influxdb: diff --git a/Site/ASAB Maestro/Files/influxdb/influx-init.sh b/Site/ASAB Maestro/Files/influxdb/influx-init.sh new file mode 100755 index 0000000..a6c9263 --- /dev/null +++ b/Site/ASAB Maestro/Files/influxdb/influx-init.sh @@ -0,0 +1,36 @@ +#!/bin/sh + +# Wait for InfluxDB to start +until curl -s http://{{INFLUXDB_HOSTNAME}}:8086/health | grep -q '"status": "pass"'; do + echo "Waiting for InfluxDB to start..." + sleep 1 +done + +# Get the bucket ID +BUCKET_ID=$(curl -s -X GET http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/buckets -H 'Authorization: Token "{{INFLUXDB_TOKEN}}"' -H "Accept: application/json" | jq -r '.buckets[] | select(.name=="{{DOCKER_INFLUXDB_INIT_BUCKET}}") | .id') +# Get the org ID +ORG_ID=$(curl -s -X GET http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/orgs -H 'Authorization: Token "{{INFLUXDB_TOKEN}}"' -H "Accept: application/json" | jq -r '.orgs[] | select(.name=="{{DOCKER_INFLUXDB_INIT_ORG}}") | .id') + +# Get the user ID +USER_ID=$(curl -s -X GET http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/users -H 'Authorization: Token "{{INFLUXDB_TOKEN}}"' -H "Accept: application/json" | jq -r '.users[] | select(.name=="{{DOCKER_INFLUXDB_INIT_USERNAME}}") | .id') + +# Create the non-admin token using the InfluxDB API v2 +curl -X POST http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/authorizations \ + -H "Authorization: Token {{INFLUXDB_TOKEN}}" \ + -H "Accept: application/json" \ + -H "Content-Type: application/json" \ + -d '{ + "description": "Non-admin user with write access", + "orgID": "'"$ORG_ID"'", + "permissions": [ + { + "action": "write", + "resource": { + "type": "buckets", + "id": "'"$BUCKET_ID"'" + } + } + ], + "status": "active", + "userID": "'"$USER_ID"'" + }' \ No newline at end of file