How do I configure OIDC using env variables for automatic deployment?

[MalteMagnussen]

https://gokapi.readthedocs.io/en/latest/advanced.html#available-environment-variables

I can't find how to set the env variables to connect to Entra ID.

[MalteMagnussen]

How can this run in Kubernetes? Do I really need to do the UI setup every time a pod starts?

    spec:  
      containers:
      - image: REDACTED/mirror/docker.io/f0rc3/gokapi:v1.8.2
        imagePullPolicy: "IfNotPresent"
        name: gokapi
        
        # https://gokapi.readthedocs.io/en/latest/advanced.html#available-environment-variables
        env:
        # If not using OIDC ENTRA ID
        - name: GOKAPI_USERNAME
          value: "admin"
        - name: GOKAPI_PASSWORD
          valueFrom:
            secretKeyRef:
              name: gokapi-secret
              key: GOKAPI_PASSWORD

        # S3 Bucket info
        - name: GOKAPI_AWS_BUCKET
          value: "REDACTED-gokapi"
        - name: GOKAPI_AWS_REGION
          value: "us-east-1"
        - name: GOKAPI_AWS_KEY
          value: "REDACTED"
        - name: GOKAPI_AWS_KEY_SECRET
          valueFrom:
            secretKeyRef:
              name: gokapi-secret
              key: GOKAPI_AWS_KEY_SECRET
        - name: GOKAPI_AWS_ENDPOINT
          value: "REDACTED"

        # Sets the webserver port
        - name: GOKAPI_PORT
          value: "53842"
        
        # Sets the maximum allowed file size in MB
        - name: GOKAPI_MAX_FILESIZE
          value: "102400"  # 100GB

        # Sets the amount of RAM in MB that can be allocated for an upload.
        # Any upload with a size greater than that will be written to a temporary file
        - name: GOKAPI_MAX_MEMORY_UPLOAD
          value: "20"

        volumeMounts:
        - name: data-volume
          mountPath: /app/data
        - name: config-volume
          mountPath: /app/config

How can I configure it to just start, without having to use the UI to configure it?

The Docs say I can set it up without any interacting, by setting env variables, but I can't seem to make it work: https://gokapi.readthedocs.io/en/latest/advanced.html#environment-variables

[MalteMagnussen]

Aha, I found this from the creator:

#17 (comment)

I'll try again, with those set.

    GOKAPI_USERNAME (eg. admin)
    GOKAPI_PASSWORD (eg. 123456)
    GOKAPI_PORT (eg. 53842)
    GOKAPI_EXTERNAL_URL (eg. http://localhost:53842)
    GOKAPI_REDIRECT_URL (eg. https://github.com/Forceu/Gokapi/)

My original question about how to configure OIDC ENTRA ID using ENV variables still stands though.

[Forceu]

I had some time to spare today and added a function to set a password with a flag and also have the salts generated if they are empty, so that should make automatic deployment a little bit easier. Changes are in 5a31cd5. Also I added a small section in the documentation and updated the old part. https://gokapi.readthedocs.io/en/latest/advanced.html#automatic-deployment

[MalteMagnussen]

@Forceu - Got OIDC and S3 working now. Thank you very much.

Went with the approach of booting it up in docker and mounting the /app dir to my local machine, and doing the setup via the UI.

Then turning those two files into secrets, and mounting those in kubernetes.

However I am now running into some issues with logging. I'd like the /app/data/log.txt to simply be output to stdout/stderr as is best practice in kubernetes. Then our logging system will pick them up automatically.

I could make a sidecar that will take the contents of log.txt and output to stdout, but that is a bit hacky.

Is there a config or setting (I can't find it in docs if there is) that can allow me to send log.txt to stdout/stderr?

Btw, I highly recommend following https://12factor.net/ when developing apps nowadays, in the cloud era :) Thanks again for creating Gokapi and all the assistance here.

EDIT:

Also investigating an issue where any filer larger than 1-2 mb will just "hang" on upload.

Click me - Screenshot

[Forceu]

Sure, that was quite easy to implement. In 5fcd264 I added an environment variable GOKAPI_LOG_STDOUT to also log all log file entries to stdout.

Regarding the upload issue, are there any errors in the Javascript console?

[MalteMagnussen]

@Forceu - wow! Thank you very much! That is really appreciated.

Aha! The JavaScript console is showing some stuff.

Click me - Screenshots

Maybe I have to configure something in the nginx ingress in kubernetes? 🤔

EDIT: I probably have to set some annotations like this: https://nginx.org/en/docs/http/ngx_http_core_module.html?&_ga=2.21155131.1419103165.1621519836-1658138782.1615479940#client_max_body_size

EDIT2: Yep, I set nginx.ingress.kubernetes.io/proxy-body-size: "0" # https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-body-size and now it works. Have a great day!

I'm off work very soon though. Will continue on this tomorrow.

Thanks again man. Asked if we have a policy for donating to open-source, but that was shut down pretty quickly I'm afraid.

Hope there's nothing too sensitive in those screenshots. From a quick skim it doesn't look like it.

[Forceu]

Yes, the body size needs to be increased for that. But good that you mention it, there should be an error message in the user interface in such a case. I will have a look at it later on. Edit: Fixed in 1729200.

And don't worry about donations! This project does not have a lot of expenses fortunately, so code contribution / finding problems is much more important at the moment. So with your feedback you already helped me, thanks :)

[MalteMagnussen]

Thanks for all the help @Forceu ! Will open a new discussion if I hit any problems I can't figure out via docs and a bit of tinkering myself.

EDIT: Oops, how do I close as resolved? Feel free to mark your response as answer, and close this discussion :)

[Forceu]

Please note: The documentation is only for the current preview version and not included in the latest release yet!

For other readers interested in the solution: An overview for automatic deployment has been added to the documentation:

https://gokapi.readthedocs.io/en/latest/advanced.html#automatic-deployment

In summary, the setup has to be ran once and afterwards the configuration file can be added to new instances, in order to skip the setup.