docker: multiple changes

- enable channelstream via traefik directly to bypass nginx
- simplified enabling https by setting explicit tls option for https endpoint
- set matching priority to catch nginx/channelstream BEFORE main instance 
- update templates with more info

config/traefik/dynamic/.htpasswd

@@ -0,0 +1,5 b''
+# basic auth for traefik middleware.
+# format here is <user>:<bcrypt_password>
+# to generate bcrypt password one can use
+# curl --verbose --request POST --data "password=XlokiAuth101&cost=10" https://www.toptal.com/developers/bcrypt/api/generate-hash.json
+loki-auth:$2b$10$U8Cui8cO9ZXehYV.7atv8uPuA6rBVrA.Mxzvt8EsdheztkyXZagv6

config/traefik/dynamic/traefik_dynamic.yaml

@@ -0,0 +1,30 b''
+
+## Setting up the middleware for redirect to https ##
+## This is mounted in /etc/traefik_dynamic dir
+
+http:
+
+  middlewares:
+
+    https-redirect:
+      redirectScheme:
+        scheme: https
+        # permanent: true
+
+    middlewares-rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+
+    basic-auth:
+      basicAuth:
+        usersfile: /etc/traefik_dynamic/.htpasswd
+
+# Dynamic configuration for standard file based SSL cert
+# create a custom copy of the traefik into .custom/ and remount this
+# to enable custom certificates
+#tls:
+#  certificates:
+#    # first certificate
+#    - certFile: /etc/traefik/certs/yourdomain-com.cert
+#      keyFile: /etc/traefik/certs/yourdomain-com.key

docs/ssl-enable.md

@@ -0,0 +1,18 b''
+TO Enable SSL, uncomment the traefik entrypoints labels in .custom folder docmpose overrides files.
+
+Those files are:
+ - docker-compose-apps.override.yaml
+ - docker-compose-metrics.override.yaml
+ - docker-compose-router.override.yaml
+ - docker-compose-services.override.yaml
+
+Search for `# Enable http+https endpoints` comment, and uncomment specific
+label. For example to enable ssl mode for RhodeCode:
+
+    service:
+        rhodecode:
+            labels: <-- this section was uncommented
+              # Enable http+https endpoints to serve SSL, select just 1 to disable the other
+              - "traefik.http.routers.rhodecode.entrypoints=http,https"
+
+Now the service will work on both http and https, to disable plain mode leave only https entrypoint
  No newline at end of file

README.md

@@ -100,7 +100,7 b' Those are step-by-step installation/run steps.'
 
     ---
     CONTAINER ID   IMAGE                                              STATUS                        NAMES                                 PORTS
-    ef54fc528e3a   traefik:v2.9.5                                     Up 19 hours                   rc_cluster_router-traefik-1           0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:3022->3022/tcp, :::3022->3022/tcp
+    ef54fc528e3a   traefik:v2.9.5                                     Up 19 hours                   rc_cluster_router-traefik-1           0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:9022->9022/tcp, :::9022->9022/tcp
     f3ea0539e8b0   rhodecode/rhodecode-ee:4.28.0                      Up About a minute (healthy)   rc_cluster_apps-rhodecode-1           0.0.0.0:10020->10020/tcp, :::10020->10020/tcp
     2be52ba58ffe   rhodecode/rhodecode-ee:4.28.0                      Up About a minute (healthy)   rc_cluster_apps-vcsserver-1
     7cd730ad3263   rhodecode/rhodecode-ee:4.28.0                      Up About a minute             rc_cluster_apps-celery-1

config/nginx/http.conf

@@ -1,37 +1,3 b''
-# read more here http://tautt.com/best-nginx-configuration-for-security/
-
-# config to don't allow the browser to render the page inside an frame or iframe
-# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
-# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
-# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
-#add_header X-Frame-Options SAMEORIGIN;
-
-# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
-# to disable content-type sniffing on some browsers.
-# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
-# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
-# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
-# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
-#add_header X-Content-Type-Options nosniff;
-
-# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
-# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
-# this particular website if it was disabled by the user.
-# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
-#add_header X-XSS-Protection "1; mode=block";
-
-# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
-# you can tell the browser that it can only download content from the domains you explicitly allow
-# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
-# https://www.owasp.org/index.php/Content_Security_Policy
-# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js(if you have inline css or js, you will need to keep it too).
-# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
-#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
-
-## rate limiter for certain pages to prevent brute force attacks
-limit_req_zone  $binary_remote_addr  zone=http_req_limit:10m   rate=1r/s;
-
 ## custom log format
 log_format http_log_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time $pipe';
 
@@ -58,8 +24,8 b' log_format json_log_custom escape=json'
 server {
   listen 80 default;
   # ensure we get the proper Docker DNS resolver for load balancing.
-  resolver 127.0.0.11 ipv6=off valid=10s;
-  server_name localhost 127.0.0.1;
+  resolver        127.0.0.11 ipv6=off valid=10s;
+  server_name     localhost 127.0.0.1;
   access_log      /dev/stdout json_log_custom;
   error_log       /dev/stdout;
 
@@ -89,50 +55,6 b' server {'
       alias /var/opt/rhodecode_data/static;
   }
 
-  ## channelstream location handler, if channelstream live chat and notifications
-  ## are enable this will proxy the requests to channelstream websocket server
-  set $upstream_channelstream  channelstream:8000;
-  location /_channelstream {
-      rewrite /_channelstream/(.*) /$1 break;
-      gzip                         off;
-      tcp_nodelay                  off;
-
-      proxy_connect_timeout        10;
-      proxy_send_timeout           10m;
-      proxy_read_timeout           10m;
-
-      proxy_set_header             Host $host;
-      proxy_set_header             Referer $http_referer;
-      proxy_set_header             X-Url-Scheme $scheme;
-      proxy_set_header             X-Real-IP $remote_addr;
-      proxy_set_header             X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header             X-Forwarded-Proto $scheme;
-
-      proxy_http_version           1.1;
-      proxy_set_header Upgrade     $http_upgrade;
-      proxy_set_header Connection  "upgrade";
-
-      proxy_pass                  http://$upstream_channelstream;
-      proxy_redirect              http://$upstream_channelstream/ /_channelstream;
-  }
-
-#   ## rate limit this endpoint to prevent login page brute-force attacks
-#   location /_admin/login {
-#       limit_req  zone=http_req_limit  burst=10  nodelay;
-#       try_files $uri @rhodecode_http;
-#   }
-
-#   location / {
-#       include    /etc/nginx/proxy.conf;
-#       try_files  $uri @rhodecode_http;
-#   }
-#
-#   set $upstream  http://rhodecode:10020;
-#   location @rhodecode_http {
-#       include        /etc/nginx/proxy.conf;
-#       proxy_pass     $upstream;
-#   }
-
   ## Custom 502 error page.
   ## Will be displayed while RhodeCode server is turned off
   error_page 502 /502.html;

config/traefik/traefik.yaml

@@ -1,14 +1,24 b''
 ## Static configuration, needs traefik reload
 
+global:
+  checkNewVersion: false
+
+serversTransport:
+  #this disables SSL certificate verification for legacy own cert services like NextCloud etc
+  insecureSkipVerify: true
+
 entryPoints:
+
   http:
     address: ":80"
 
   https:
     address: ":443"
+    http:
+      tls: {}
 
   ssh:
-    address: ":${RC_SSH_PORT:?must-specify-ssh-port}"
+    address: ":9022"
 
   loki:
     address: ":3100"
@@ -29,19 +39,12 b' log:'
 metrics:
   prometheus: {}
 
-
 providers:
   docker:
     exposedByDefault: false
     swarmMode: false
     endpoint: "unix:///var/run/docker.sock"
     watch: true
-
   file:
-    filename: "/etc/traefik/traefik_dynamic.yaml"
+    directory: "/etc/traefik_dynamic"
     watch: true
-
-
-serversTransport:
-  #this disables SSL certificate verification for legacy own cert services like NextCloud etc
-  insecureSkipVerify: true

docker-compose-apps.yaml

@@ -96,15 +96,12 b' services:'
       - "autoheal=true"
       - "traefik.enable=true"
       - "traefik.http.routers.rhodecode.entrypoints=http"
+      - "traefik.http.routers.rhodecode.priority=10"
       - "traefik.http.routers.rhodecode.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`)"
       - "traefik.http.routers.rhodecode.service=rhodecode-web"
       - "traefik.http.services.rhodecode-web.loadbalancer.server.port=10020"
-      # SSL + proxy prefix example, should be put into .custom/docker-compose-apps.override.yaml
-      #- "traefik.http.routers.rhodecode-rt.entrypoints=https"
-      #- "traefik.http.routers.rhodecode-rt.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`)"
-      #- "traefik.http.routers.rhodecode-rt.tls=true"
-      #- "traefik.http.routers.rhodecode-rt.service=rhodecode-ssl"
-      #- "traefik.http.services.rhodecode-ssl.loadbalancer.server.port=10020"
+      # HTTP + SSL example, should be put into .custom/docker-compose-apps.override.yaml
+      #- "traefik.http.routers.rhodecode.entrypoints=http,https"
 
   vcsserver:
     networks:
@@ -205,8 +202,6 b' services:'
     logging:
       *custom-logging
 
-    labels:
-      - "traefik.enable=false"
 
   celery-beat:
     # This service is not scalable
@@ -252,8 +247,6 b' services:'
     logging:
       *custom-logging
 
-    labels:
-      - "traefik.enable=false"
 
   svn:
     networks:
@@ -332,7 +325,7 b' services:'
 
 #    ports:
 #      # set from .env file
-#      - "${RC_SSH_PORT:?must-specify-ssh-port}:22"
+#      - "9022:22"
 
     volumes:
       - confvolume:/etc/rhodecode/conf
@@ -349,4 +342,4 b' services:'
       - "traefik.http.routers.sshd.entrypoints=ssh"
       - "traefik.http.routers.sshd.rule=Host(`*`)"
       - "traefik.http.routers.sshd.service=rhodecode-ssh"
-      - "traefik.http.services.rhodecode-ssh.loadbalancer.server.port=${RC_SSH_PORT:?must-specify-ssh-port}"
+      - "traefik.http.services.rhodecode-ssh.loadbalancer.server.port=22"

docker-compose-metrics.yaml

@@ -94,15 +94,12 b' services:'
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.grafana.entrypoints=http"
-      - "traefik.http.routers.grafana.rule=PathPrefix(`/_grafana`)"
-      - "traefik.http.routers.grafana.service=grafana-http"
-      - "traefik.http.services.grafana-http.loadbalancer.server.port=3000"
+      - "traefik.http.routers.grafana.priority=20"
+      - "traefik.http.routers.grafana.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`) && PathPrefix(`/_grafana`)"
+      - "traefik.http.routers.grafana.service=grafana-web"
+      - "traefik.http.services.grafana-web.loadbalancer.server.port=3000"
       # SSL + proxy prefix example, should be put into .custom/docker-compose-metrics.override.yaml
-      #- "traefik.http.routers.grafana-rt.entrypoints=https"
-      #- "traefik.http.routers.grafana-rt.rule=Host(`metrics.example.com`) && PathPrefix(`/_grafana`)"
-      #- "traefik.http.routers.grafana-rt.tls=true"
-      #- "traefik.http.routers.grafana-rt.service=grafana-ssl"
-      #- "traefik.http.services.grafana-ssl.loadbalancer.server.port=3000"
+      #- "traefik.http.routers.grafana.entrypoints=http,https"
 
   loki:
     image: grafana/loki:2.7.1
@@ -128,8 +125,8 b' services:'
       - "traefik.http.routers.loki.entrypoints=loki"
       - "traefik.http.routers.loki.rule=PathPrefix(`/`)"
       - "traefik.http.routers.loki.middlewares=basic-auth@file"
-      - "traefik.http.routers.loki.service=loki-http"
-      - "traefik.http.services.loki-http.loadbalancer.server.port=3100"
+      - "traefik.http.routers.loki.service=loki-web"
+      - "traefik.http.services.loki-web.loadbalancer.server.port=3100"
 
   promtail:
     image: grafana/promtail:2.7.1

docker-compose-router.yaml

@@ -23,14 +23,15 b' services:'
       - "80:80"
       # The HTTPS port, exposed as https entrypoint
       - "443:443"
-      # The loki port, exposed as http entrypoint behind auth
+      # The loki port, exposed as loki entrypoint behind auth
       - "3100:3100"
-      # The SSH port
-      - "${RC_SSH_PORT}:${RC_SSH_PORT}"
+      # The SSH port exposed as sshd entrypoint, default 9022
+      - "${RC_SSH_PORT:-9022}:${RC_SSH_PORT:-9022}"
     volumes:
       # So that Traefik can listen to the Docker events
       - /var/run/docker.sock:/var/run/docker.sock
       - ./config/traefik:/etc/traefik
+      - ./config/traefik/dynamic:/etc/traefik_dynamic
     deploy:
       placement:
         constraints:

docker-compose-services.yaml

@@ -41,7 +41,7 b' services:'
     restart: always
 
 #    ports:
-#      - "127.0.0.1:9800:9800"
+#      - "127.0.0.1:8000:8000"
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: ["channelstream"]
@@ -60,9 +60,16 b' services:'
       *custom-logging
 
     labels:
-      - "traefik.enable=false"
-      #- "traefik.http.routers.channelstream.entrypoints=http"
-      #- "traefik.http.services.channelstream.loadbalancer.server.port=9800"
+      - "traefik.enable=true"
+      - "traefik.http.routers.channelstream.entrypoints=http"
+      - "traefik.http.routers.channelstream.priority=20"
+      - "traefik.http.routers.channelstream.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`) && PathPrefix(`/_channelstream`)"
+      - "traefik.http.routers.channelstream.service=channelstream-web"
+      - "traefik.http.routers.channelstream.middlewares=strip-cs"
+      - "traefik.http.middlewares.strip-cs.stripprefix.prefixes=/_channelstream"
+      - "traefik.http.services.channelstream-web.loadbalancer.server.port=8000"
+      # HTTP + SSL example, should be put into .custom/docker-compose-services.override.yaml
+      #- "traefik.http.routers.channelstream.entrypoints=http,https"
 
     profiles:
       ["channelstream"]
@@ -102,8 +109,11 b' services:'
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nginx.entrypoints=http"
-      - "traefik.http.routers.nginx.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`) && ( PathPrefix(`/_health`) || PathPrefix(`/_channelstream`) || PathPrefix(`/_static/rhodecode`) )"
+      - "traefik.http.routers.nginx.priority=40"
+      - "traefik.http.routers.nginx.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`) && PathPrefix(`/_static/rhodecode`)"
       - "traefik.http.services.nginx.loadbalancer.server.port=80"
+      # HTTP + SSL example, should be put into .custom/docker-compose-services.override.yaml
+      #- "traefik.http.routers.nginx.entrypoints=http,https"
 
   elasticsearch:
     networks:
@@ -142,7 +152,7 b' services:'
   redis:
     networks:
       - rhodecode_network
-    image: library/redis:7.0.6
+    image: library/redis:7.0.7
 
     restart: always
     env_file:
@@ -246,3 +256,4 b' services:'
 
       logging:
         *custom-logging
+

scripts/rccontrol/rccontrol

@@ -36,8 +36,9 b' rccontrol_usage() {'
   echo
   # :command.usage_commands
   printf "Commands:\n"
+  echo "  get-started           Print instructions to get started with rhodecode docker stack"
   echo "  self-update           update rccontrol and it's docker definitions"
-  echo "  bootstrap             Bootstrap this machine, check docker version and install rhodecode-network"
+  echo "  init                  Bootstrap this machine, check docker version and install rhodecode-network"
   echo
   printf "Build Commands:\n"
   echo "  get-build-artifacts   Fetch Artifacts to run installer based build"
@@ -128,6 +129,35 b' rccontrol_usage() {'
 }
 
 # :command.usage
+rccontrol_get_started_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol get-started - Print instructions to get started with rhodecode docker stack\n"
+    echo
+
+  else
+    printf "rccontrol get-started - Print instructions to get started with rhodecode docker stack\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol get-started\n"
+  printf "  rccontrol get-started --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
 rccontrol_self_update_usage() {
   if [[ -n $long_usage ]]; then
     printf "rccontrol self-update - update rccontrol and it's docker definitions\n"
@@ -175,23 +205,20 b' rccontrol_self_update_usage() {'
 }
 
 # :command.usage
-rccontrol_bootstrap_usage() {
+rccontrol_init_usage() {
   if [[ -n $long_usage ]]; then
-    printf "rccontrol bootstrap - Bootstrap this machine, check docker version and install rhodecode-network\n"
+    printf "rccontrol init - Bootstrap this machine, check docker version and install rhodecode-network\n"
     echo
 
   else
-    printf "rccontrol bootstrap - Bootstrap this machine, check docker version and install rhodecode-network\n"
+    printf "rccontrol init - Bootstrap this machine, check docker version and install rhodecode-network\n"
     echo
 
   fi
 
-  printf "Alias: init\n"
-  echo
-
   printf "Usage:\n"
-  printf "  rccontrol bootstrap [OPTIONS]\n"
-  printf "  rccontrol bootstrap --help | -h\n"
+  printf "  rccontrol init [OPTIONS]\n"
+  printf "  rccontrol init --help | -h\n"
   echo
 
   # :command.long_usage
@@ -457,7 +484,7 b' rccontrol_stack_usage() {'
 
     # :command.usage_examples
     printf "Examples:\n"
-    printf "  - ./rccontrol stack router up          # run router stack with output to\n  stdout\n  - ./rccontrol stack router up --detach # run router stack detached\n  - ./rccontrol stack router down        # stop whole router stack\n  - ./rccontrol stack router ps          # check status of router stack\n  \n  # scale a single stack service[s] to more replicas (horizontally)\n  - ./rccontrol stack rhodecode up --detach --no-recreate --scale rhodecode=2\n  --scale vcsserver=2\n  \n  # run router stack with your overrides compose file\n  - ./rccontrol stack router -f docker-overrides.yaml up -d\n  \n  # Upgrade whole metrics stack\n  - ./rccontrol stack metrics up --force-recreate --build --detach\n"
+    printf "  # running stack\n  - ./rccontrol stack router up          # run router stack with output to\n  stdout\n  - ./rccontrol stack router up --detach # run router stack detached\n  - ./rccontrol stack router down        # stop whole router stack\n  - ./rccontrol stack router ps          # check status of router stack\n  \n  # logs, use logs -f to follow/tail --until 1h to limit for last time\n  - ./rccontrol stack services logs -f database\n  \n  # scale a single stack service[s] to more replicas (horizontally), use\n  overrides files to permanently set scale\n  - ./rccontrol stack rhodecode up --detach --no-recreate --scale rhodecode=2\n  --scale vcsserver=2\n  \n  # run router stack with your overrides compose file\n  - ./rccontrol stack router -f docker-overrides.yaml up -d\n"
     echo
 
   fi
@@ -714,6 +741,11 b' rccontrol_stack_upgrade_usage() {'
     printf "    Show this help\n"
     echo
 
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  # Upgrading stack\n  - ./rccontrol stack-upgrade router\n  \n  # RhodeCode stack upgrades with 0 downtime using container rotation\n  - ./rccontrol stack-upgrade rhodecode\n"
+    echo
+
   fi
 }
 
@@ -1174,7 +1206,7 b' for stage in $BOOTSTRAP_STAGES; do'
     stage_func=$(echo $stage | cut -d ":" -f 2)
     if ! config_has_key $stage_name ; then
       echo "$(yellow WARNING:) bootstrap key $stage_name not found in config file $CONFIG_FILE!"
-      echo "$(yellow NOTICE:) Please run ./rccontrol bootstrap first"
+      echo "$(yellow NOTICE:) Please run ./rccontrol init first"
       exit
     fi
 done
@@ -1606,6 +1638,12 b' validate_stack_exists() {'
 
 # :command.command_functions
 # :command.function
+rccontrol_get_started_command() {
+  # src/get_started_command.sh
+  get_started_full
+}
+
+# :command.function
 rccontrol_self_update_command() {
   # src/self_update_command.sh
   check_bootstrap
@@ -1676,8 +1714,8 b' rccontrol_self_update_command() {'
 }
 
 # :command.function
-rccontrol_bootstrap_command() {
-  # src/bootstrap_command.sh
+rccontrol_init_command() {
+  # src/init_command.sh
   DEBUG=${args[--debug]}
   force=${args[--force]}
 
@@ -1744,7 +1782,6 b' rccontrol_bootstrap_command() {'
     # TODO: change formatter to json for loki usage
     log_formatter=generic
     base_domain=docker-dev
-    base_url=http://$base_domain
     DB_USER='rhodecode'
     DB_NAME='rhodecode'
 
@@ -1771,27 +1808,28 b' rccontrol_bootstrap_command() {'
 
       .env set DB_PASSWORD=$db_key
 
-      .env set +RC_ENCRYPTED_SECRET=$shared_key
-      .env set +RC_DB_URL="postgresql://$DB_USER:$db_key@database/$DB_NAME"
-      .env set +RC_SQLALCHEMY_DB1_URL="postgresql://$DB_USER:$db_key@database/$DB_NAME"
+      .env set RC_ENCRYPTED_SECRET=$shared_key
+      .env set RC_DB_URL="postgresql://$DB_USER:$db_key@database/$DB_NAME"
+      .env set RC_SQLALCHEMY_DB1_URL="postgresql://$DB_USER:$db_key@database/$DB_NAME"
 
-      .env set +RC_LICENSE_TOKEN=$license_token
-      .env set +RC_APP_BASE_URL=$base_url
+      .env set RC_LICENSE_TOKEN=$license_token
+      .env set RC_HOSTNAME=$base_domain
+      .env set RC_APP_BASE_URL=http://$base_domain
 
       .env puts '# Log formatter option'
-      .env set +RC_LOGGING_FORMATTER=$log_formatter
-      .env set +RC_USE_CELERY=true
+      .env set RC_LOGGING_FORMATTER=$log_formatter
+      .env set RC_USE_CELERY=true
 
       .env puts '# Channelstream config'
-      .env set +RC_CHANNELSTREAM_SERVER=channelstream:8000
-      .env set +RC_CHANNELSTREAM_WS_URL=ws:/$base_domain/_channelstream
-      .env set +CHANNELSTREAM_ALLOW_POSTING_FROM=0.0.0.0
+      .env set RC_CHANNELSTREAM_SERVER=channelstream:8000
+      .env set RC_CHANNELSTREAM_WS_URL=ws:/$base_domain/_channelstream
+      .env set CHANNELSTREAM_ALLOW_POSTING_FROM=0.0.0.0
 
-      .env set +CHANNELSTREAM_SECRET=$shared_key
-      .env set +RC_CHANNELSTREAM_SECRET=$shared_key
+      .env set CHANNELSTREAM_SECRET=$shared_key
+      .env set RC_CHANNELSTREAM_SECRET=$shared_key
 
-      .env set +CHANNELSTREAM_ADMIN_SECRET=$shared_key
-      .env set +RC_CHANNELSTREAM_ADMIN_SECRET=$shared_key
+      .env set CHANNELSTREAM_ADMIN_SECRET=$shared_key
+      .env set RC_CHANNELSTREAM_ADMIN_SECRET=$shared_key
 
     else
       echo "bootstrap_config: $BOOTSTRAP_RUNTIME_ENV file exists, not adding any configuration..."
@@ -2191,6 +2229,10 b' rccontrol_stack_status_command() {'
   DEBUG=${args[--debug]}
   DETAILED=${args[--detailed]}
 
+  .env --file $RUNTIME_ENV
+  .env get RC_APP_BASE_URL
+  RC_APP_BASE_URL=$REPLY
+
   if [[ $DEBUG ]]; then
     echo "---"
       ps_cmd=$(docker ps --filter=name=rc_cluster --format="{{.ID}}")
@@ -2207,6 +2249,7 b' rccontrol_stack_status_command() {'
     echo "---"
     fi
 
+  echo "Running hostname: $RC_APP_BASE_URL"
   if [[ $DETAILED ]]; then
       ps_cmd=$(docker ps --filter=name=rc_cluster --format="{{.ID}}")
 
@@ -2291,7 +2334,7 b' rccontrol_stack_upgrade_rhodecode_command() {'
   fi
 
   echo "Pulling new image: rhodecode/rhodecode-ee:${RC_VERSION}"
-  #eval "docker pull rhodecode/rhodecode-ee:${RC_VERSION}"
+  echo "./rccontrol stack rhodecode pull"
 
   stop_containers() {
     target_container=$1
@@ -2639,6 +2682,13 b' parse_requirements() {'
   case $action in
     -*) ;;
 
+    get-started)
+      action="get-started"
+      shift
+      rccontrol_get_started_parse_requirements "$@"
+      shift $#
+      ;;
+
     self-update)
       action="self-update"
       shift
@@ -2646,10 +2696,10 b' parse_requirements() {'
       shift $#
       ;;
 
-    bootstrap | init)
-      action="bootstrap"
+    init)
+      action="init"
       shift
-      rccontrol_bootstrap_parse_requirements "$@"
+      rccontrol_init_parse_requirements "$@"
       shift $#
       ;;
 
@@ -2767,6 +2817,50 b' parse_requirements() {'
 }
 
 # :command.parse_requirements
+rccontrol_get_started_parse_requirements() {
+  # :command.fixed_flags_filter
+  while [[ $# -gt 0 ]]; do
+    case "${1:-}" in
+      --help | -h)
+        long_usage=yes
+        rccontrol_get_started_usage
+        exit
+        ;;
+
+      *)
+        break
+        ;;
+
+    esac
+  done
+
+  # :command.command_filter
+  action="get-started"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+      -?*)
+        printf "invalid option: %s\n" "$key" >&2
+        exit 1
+        ;;
+
+      *)
+        # :command.parse_requirements_case
+        # :command.parse_requirements_case_simple
+        printf "invalid argument: %s\n" "$key" >&2
+        exit 1
+
+        ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
 rccontrol_self_update_parse_requirements() {
   # :command.fixed_flags_filter
   while [[ $# -gt 0 ]]; do
@@ -2870,13 +2964,13 b' rccontrol_self_update_parse_requirements() {'
 }
 
 # :command.parse_requirements
-rccontrol_bootstrap_parse_requirements() {
+rccontrol_init_parse_requirements() {
   # :command.fixed_flags_filter
   while [[ $# -gt 0 ]]; do
     case "${1:-}" in
       --help | -h)
         long_usage=yes
-        rccontrol_bootstrap_usage
+        rccontrol_init_usage
         exit
         ;;
 
@@ -2909,7 +3003,7 b' rccontrol_bootstrap_parse_requirements() {'
   fi
 
   # :command.command_filter
-  action="bootstrap"
+  action="init"
 
   # :command.parse_requirements_while
   while [[ $# -gt 0 ]]; do
@@ -4542,9 +4636,9 b' initialize() {'
 
   get_started() {
     echo ""
-    echo "To start using RhodeCode run the following stacks using ./rccontrol stack [STACK_NAME]"
+    echo "To start using RhodeCode run the following stacks using './rccontrol stack [STACK_NAME]'"
     echo ""
-    echo "$(yellow_bold [Optional]): run the edge router to control domain and SSL"
+    echo "$(yellow_bold [Optional]): run the edge router to control traffic / domain and optionally SSL termination"
     echo "./rccontrol stack router up --detach"
     echo ""
     echo "$(green_bold [Mandatory]): run the services, like database, redis, channelstream etc..."
@@ -4553,15 +4647,27 b' initialize() {'
     echo "$(green_bold [Mandatory]): run the rhodecode app stack"
     echo "./rccontrol stack rhodecode up --detach"
     echo ""
-    echo "$(yellow_bold [Optional]): run the monitoring stack, this includes grafana/promethues logging/metrics system"
+    echo "$(yellow_bold [Optional]): run the monitoring stack, this includes grafana/prometheus logging/metrics system"
     echo "./rccontrol stack metrics up --detach"
     echo ""
     echo "$(bold [Status]): check services run status, ports etc.."
     echo "./rccontrol status"
     echo ""
     echo "$(bold [Logs]): check service logs"
-    echo "./rccontrol logs SERVICE_NAME"
+    echo "./rccontrol stack [STACK_NAME] logs"
   }
+
+  get_started_full() {
+    echo "$(blue_bold [~~~~ GET STARTED ~~~~~])"
+    echo "./rccontrol is a CLI based installer/manager for RhodeCode Cluster Stack"
+    echo "./rccontrol -h is your friend, in case of doubt, check examples and usage options with -h / --help flag"
+    echo ""
+    echo "$(yellow_bold [First time run])"
+    echo "run './rccontrol init' to setup docker and download required installer files"
+
+    get_started
+  }
+
 }
 
 # :command.run
@@ -4573,6 +4679,15 b' run() {'
   parse_requirements "${input[@]}"
 
   case "$action" in
+    "get-started")
+      if [[ ${args[--help]:-} ]]; then
+        long_usage=yes
+        rccontrol_get_started_usage
+      else
+        rccontrol_get_started_command
+      fi
+      ;;
+
     "self-update")
       if [[ ${args[--help]:-} ]]; then
         long_usage=yes
@@ -4582,12 +4697,12 b' run() {'
       fi
       ;;
 
-    "bootstrap")
+    "init")
       if [[ ${args[--help]:-} ]]; then
         long_usage=yes
-        rccontrol_bootstrap_usage
+        rccontrol_init_usage
       else
-        rccontrol_bootstrap_command
+        rccontrol_init_command
       fi
       ;;
 

templates/docker-compose-apps.override.yaml

@@ -7,16 +7,24 b' services:'
     #  # expose port for optional direct port connection
     #  - "10020:10020"
     environment:
-      DB_UPGRADE: 0  # run the DB upgrade
-      SETUP_APP: 0   # run the application default settings setup, can be turned off after initial run
+      RC_EXAMPLE_KEY: 'ok'
+      #DB_UPGRADE: 0  # 1 run the DB upgrade, 0 disable db upgrade at startup
+      #SETUP_APP: 0   # run the application default settings setup, can be turned off after initial run
 
     #healthcheck:
-    #  # disable the healthcheck
+    #  # disable the healthcheck for faster signal handling
+    #  # generally not recommended
     #  test: ['CMD','true']
 
+    #labels:
+    #  # Enable http+https endpoints to serve SSL, select just 1 to disable the other
+    #  - "traefik.http.routers.rhodecode.entrypoints=http,https"
+
+
     deploy:
       replicas: 1
 
+
   vcsserver:
 
     environment:
@@ -26,7 +34,8 b' services:'
       replicas: 1
 
     #healthcheck:
-    #  # disable the healthcheck
+    #  # disable the healthcheck for faster signal handling
+    #  # generally not recommended
     #  test: ['CMD','true']
 
   sshd:
@@ -34,7 +43,8 b' services:'
       replicas: 1
 
   svn:
-    {}
+    deploy:
+      replicas: 1
 
   celery-beat:
     deploy:

templates/docker-compose-metrics.override.yaml

@@ -2,15 +2,17 b" version: '3.9'"
 
 services:
 
+  grafana:
+    {}
+    #labels:
+    #  # Enable http+https endpoints to serve SSL, select just 1 to disable the other
+    #  - "traefik.http.routers.grafana.entrypoints=http,https"
+
   promtail:
     {}
 
   loki:
     {}
-#    labels:
-#      - "traefik.enable=true"
-#      - "traefik.http.services.loki.loadbalancer.server.port=3100"
-#      - "traefik.http.services.loki.loadbalancer.server.port=9095"
 
   prometheus:
     {}
@@ -21,12 +23,3 b' services:'
   statsd-exporter:
     {}
 
-  grafana:
-
-    labels:
-      # SSL + proxy prefix
-      - "traefik.http.routers.grafana-rt.service=grafana-ssl"
-      - "traefik.http.routers.grafana-rt.entrypoints=https"
-      - "traefik.http.routers.grafana-rt.rule=Host(`your-domain.com`) && PathPrefix(`/_grafana`)"
-      - "traefik.http.routers.grafana-rt.tls=true"
-      - "traefik.http.services.grafana-ssl.loadbalancer.server.port=3000"
  No newline at end of file

templates/docker-compose-router.override.yaml

@@ -13,36 +13,7 b' services:'
       # So that Traefik can listen to the Docker events
       - /var/run/docker.sock:/var/run/docker.sock
       # custom traefik config, enable SSL etc..
-      # put your traefik setup in this directory
-      - $PWD/.custom/traefik_custom:/etc/traefik
-
-  portainer:
-    # Run with COMPOSE_PROFILES=portainer
-    # to access portainer set HEADER `X-Docker-Host=portainer`
-    image: portainer/portainer-ce:latest
-    restart: always
-    volumes:
-      - portainer_data:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints:
-          # limit swarm deploy to MANAGER only
-          - node.role == manager
-
-    networks:
-      - rhodecode_network
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.portainer.entrypoints=https"
-      - "traefik.http.routers.portainer.rule=Headers(`X-Docker-Host`, `portainer`)"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
-
-    profiles:
-      ["portainer"]
-
-volumes:
-  portainer_data:
-    external: true
  No newline at end of file
+      # put your traefik setup in this directory structure, and uncomment to override
+      # default traefik static/dynamic configs
+      #- $PWD/.custom/traefik_custom:/etc/traefik:ro
+      #- $PWD/.custom/traefik_custom/dynamic:/etc/traefik_dynamic:ro

templates/docker-compose-services.override.yaml

@@ -7,19 +7,19 b' services:'
 
   database:
     {}
-    # to disable usage of this service
+    # to disable usage of this service using your own postgres instance
     #deploy:
     #  replicas: 0
 
   database-mysql:
     {}
-    # to disable usage of this service
+    # to disable usage of this service, running your own mysql instance
     #deploy:
     #  replicas: 0
 
   redis:
     {}
-    # to disable usage of this service
+    # to disable usage of this service using external redis
     #deploy:
     #  replicas: 0
 
@@ -30,4 +30,41 b' services:'
     {}
 
   channelstream:
-    {}
  No newline at end of file
+    {}
+    # Enable http+https endpoints to serve SSL, select just 1 to disable the other
+    #labels:
+    #  - "traefik.http.routers.channelstream.entrypoints=http,https
+
+
+  portainer:
+    # Run with COMPOSE_PROFILES=portainer
+    # to access portainer set separate domain for portainer
+    # also needs a external new volume
+    # docker volume create --label keep=1 --name=portainer_data
+    image: portainer/portainer-ce:latest
+    restart: always
+    volumes:
+      - portainer_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          # limit swarm deploy to MANAGER only
+          - node.role == manager
+
+    networks:
+      - rhodecode_network
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.portainer.entrypoints=https"
+      - "traefik.http.routers.portainer.rule=Host(`portainer.yourdomain.com`)"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
+
+    profiles:
+      ["portainer"]
+
+volumes:
+  portainer_data:
+    external: true

templates/runtime.env.tmpl

@@ -1,17 +1,28 b''
-## BUILD ARGS
+## BUILD/RUN ARGS ##
+####################
+
 TZ="UTC"
 
 # Version to deploy and run
+# rccontrol will automatically update and adjust this if needed
 RC_VERSION="4.28.0"
 
-# ce, or ee
+# Select RhodeCode edition ce (free community), or ee (paid/enterprise)
 RC_EDITION=ee
 
-# GENERATED ARGS, Please don't change those
+# GENERATED ARGS #
+##################
+
+# set limit of redis in-memory cache before keys get evicted using LRU cache
+RC_REDIS_MAXMEMORY=1024mb
+
+# set the size of ramdisk used for locking files
+RC_DATA_RAMDISK_SIZE=512M
 
 # Database bootstrap/access credentials
 # Bootstrap container with specific password
 # This password will be used to generate new account and password for the database
+# Please don't change those unless you use your own database
 DB_NAME=rhodecode
 DB_USER=rhodecode
 DB_PASSWORD=GENERATED_AT_BOOTSTRAP
@@ -22,6 +33,16 b' RHODECODE_USER_EMAIL=admin@server-com'
 RHODECODE_USER_NAME=admin
 RHODECODE_USER_PASS=secret4
 
+# prependend to loki url prefix, this will be generated
+RC_LOKI_AUTH=loki-auth:password@
+
 RC_USE_CELERY=true
 
-RC_APP_BASE_URL=base-url
  No newline at end of file
+# base url for running app, this is used for traefik hasname matching, so accessing this host will redirect
+# traffic to the running instance. This needs to be the same as RC_APP_BASE_URL
+# replace this with your name of host. e.g yourdomain.com or rc.company.local
+RC_HOSTNAME=base-url
+
+# application base url, at which location including a scheme (http/https) this app will be
+# running, this needs to be a valid resolvable domain for rhodecode links to work properly
+RC_APP_BASE_URL=http://base-url
  No newline at end of file