diff --git a/changelog b/changelog index cf4b471..a577f9d 100644 --- a/changelog +++ b/changelog @@ -3,13 +3,19 @@ turnkey-canvas-18.1 (1) turnkey; urgency=low * Install latest Canvas LTS stable (prod branch), Canvas RCE API and required dependencies. Canvas installed from upstream git repo. + * Pre-install QTI import tool - as requested/suggested on TKL forums. + * Update Ruby (3.1.6). * Update bundler to 2.5.10 - as per "Production Start" doc. * Disable Apache mod_evasie for Canvas - part of #1965. - * Run switchman_inst_jobs:install:migrations - closes #1965. + * Bump delayed worker RAM allowance. Real fix for - closes #1978 & #1979. + Also properly resolves #1965. + + * Add LTI JWK keys to default conf (regenerated at firstboot) - should close + #1977 - although has not been confirmed, needs user feedback. * Update GEM_PATH in Apache conf - didn't seem to be causing issues, but better for it to be correct path. @@ -26,7 +32,7 @@ turnkey-canvas-18.1 (1) turnkey; urgency=low * Reduce log noise by creating ntpsec log dir - closes #1952. - -- Jeremy Davis Sat, 06 Jul 2024 11:31:36 +0000 + -- Jeremy Davis Wed, 28 Aug 2024 00:36:52 +0000 turnkey-canvas-18.0 (1) turnkey; urgency=low diff --git a/conf.d/52canvas-configs b/conf.d/52canvas-configs index 47f7cfb..44aff0f 100755 --- a/conf.d/52canvas-configs +++ b/conf.d/52canvas-configs @@ -1,9 +1,32 @@ #!/bin/bash -ex +# load common env vars source /usr/local/src/canvas.conf +CONF_DIR="$WEBROOT/config" +USER=www-data + +add_comment() { + cat <$WEBROOT/config/database.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/outgoing_mail.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/domain.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/cache_store.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/redis.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/delayed_jobs.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/vault_contents.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/security.yml< "$CONF_DIR/$conf_file" <$WEBROOT/config/dynamic_settings.yml< "$CONF_DIR/$conf_file" <> $PASSGR_CONF +# part of fix for https://github.com/phusion/passenger/issues/2397 +# other part in /etc/tmpfiles.d/passenger.conf (overlay) +echo "PassengerInstanceRegistryDir /run/passenger-instreg" >> $PASSGR_CONF + # create convenience symlink for logs rm -rf /var/log/canvas ln -s $WEBROOT/log /var/log/canvas -chown -R www-data:www-data /var/www/canvas/{config,log} - -# fix for github.com/phusion/passenger/wiki/Debugging-application-startup-problems -echo "PassengerStartTimeout 300" >> /etc/apache2/mods-available/passenger.conf - -# part of fix for https://github.com/phusion/passenger/issues/2397 -echo "PassengerInstanceRegistryDir /run/passenger-instreg" >> /etc/apache2/mods-available/passenger.conf -# see also /etc/tmpfiles.d/passenger.conf in overlay - +chown -R www-data:www-data $WEBROOT/{config,log} chmod 400 $WEBROOT/config/cache_store.yml +py3clean / +yarn cache clean + rm -f /usr/local/src/canvas.conf diff --git a/overlay/usr/lib/inithooks/bin/canvas.py b/overlay/usr/lib/inithooks/bin/canvas.py index 6d08347..fe3fbd1 100755 --- a/overlay/usr/lib/inithooks/bin/canvas.py +++ b/overlay/usr/lib/inithooks/bin/canvas.py @@ -19,18 +19,17 @@ from libinithooks import inithooks_cache from libinithooks.dialog_wrapper import Dialog +DEFAULT_DOMAIN = "www.example.com" + def usage(s=None): if s: print("Error:", s, file=sys.stderr, **kwargs) - print("Syntax: %s [options]" % sys.argv[0], file=sys.stderr) + print(f"Syntax: {sys.argv[0]} [options]", file=sys.stderr) print(__doc__, file=sys.stderr) sys.exit(1) -DEFAULT_DOMAIN = "www.example.com" - - def main(): try: opts, args = getopt.gnu_getopt(sys.argv[1:], "h", @@ -104,25 +103,25 @@ def main(): config = "/var/www/canvas/config/outgoing_mail.yml" subprocess.run(["sed", "-ri", - 's|domain:.*|domain: "%s"|' % domain, + f's|domain:.*|domain: "{domain}"|', config]) subprocess.run(["sed", "-ri", - 's|outgoing_address:.*|outgoing_address: "%s"|' % email, + f's|outgoing_address:.*|outgoing_address: "{email}"|', config]) config = "/var/www/canvas/config/dynamic_settings.yml" subprocess.run(["sed", "-ri", - 's|app-host:.*|app-host: "%s:3000"|' % domain, + f's|app-host:.*|app-host: "{domain}:3000"|', config]) config = "/var/www/canvas/config/domain.yml" subprocess.run(["sed", "-ri", - 's|domain:.*|domain: "%s"|' % domain, + f's|domain:.*|domain: "{domain}"|', config]) - config = "/var/www/canvas/config/initializers/outgoing_mail.rb" + config = "/var/www/canvas/config/security.yml" subprocess.run(["sed", "-ri", - 's|:domain => .*|:domain => "%s",|' % domain, + f's|lti_iss:.*|lti_iss: "https://{domain}"|', config]) print("Restarting services; please wait...") diff --git a/overlay/usr/lib/inithooks/bin/regen_jwks b/overlay/usr/lib/inithooks/bin/regen_jwks new file mode 100755 index 0000000..403ee89 --- /dev/null +++ b/overlay/usr/lib/inithooks/bin/regen_jwks @@ -0,0 +1,30 @@ +#!/bin/bash -e + +# bash script that wraps rails script (regen_jwks.rb) to generate unique Canvas +# LTI JWK tokens and update the corresponding keys in dynamic_settings.yml + +INIT_BIN="/usr/lib/inithooks/bin" +WEBROOT="/var/www/canvas" +CONF="$WEBROOT/config/dynamic_settings.yml" + +export RAILS_ENV=production + +echo "Regenerating LTI JWKs - please wait" +cd $WEBROOT +readarray -t lines <<<"$(bin/rails runner $INIT_BIN/regen_jwks.rb 2>/dev/null)" + +for line in "${lines[@]}"; do + read -ra key_val <<<"$line" + key="${key_val[0]}" + val="${key_val[1]}" + + # (double) escape double quotes - using UTF8 hex ASCII codes + # '\x22' = '"' + # '\x5C' = '\' + # disable "use bash var search/replace" check as this only works with sed + # shellcheck disable=SC2001 + jwk=$(sed "s|\x22|\x5C\x5C\x22|g" <<<"$val") + # the double escape above is reqd because this sed strips one + sed -Ei "/ +$key:/ s|^( +$key:).*|\1 \"$jwk\"|g" "$CONF" +done +echo "JWTs updated" diff --git a/overlay/usr/lib/inithooks/bin/regen_jwks.rb b/overlay/usr/lib/inithooks/bin/regen_jwks.rb new file mode 100644 index 0000000..3e47753 --- /dev/null +++ b/overlay/usr/lib/inithooks/bin/regen_jwks.rb @@ -0,0 +1,13 @@ +# Rails script to regenerate LTI JWK tokens +# +# This script is run by regen_jwks via rails runner + +keys = ["jwk-past.json", "jwk-present.json", "jwk-future.json"] + +rsa_key = OpenSSL::PKey::RSA.generate(2048) + +# generate JWKs as per comment in dynamic_settings.yml.example +for key in keys do + jwk = rsa_key.public_key.to_jwk(kid: Time.now.utc.iso8601).to_json + puts "#{key} #{jwk}" +end diff --git a/overlay/usr/lib/inithooks/firstboot.d/20regen-canvas-secrets b/overlay/usr/lib/inithooks/firstboot.d/20regen-canvas-secrets index 2af0036..e874b8e 100755 --- a/overlay/usr/lib/inithooks/firstboot.d/20regen-canvas-secrets +++ b/overlay/usr/lib/inithooks/firstboot.d/20regen-canvas-secrets @@ -7,7 +7,7 @@ # Canvas Rich Content Editor API keys ENV_FILE=/var/www/canvas-rce-api/.env -VAULT_CONTENTS=/var/www/canvas/config/vault_contents.yml +VAULT=/var/www/canvas/config/vault_contents.yml SECURITY=/var/www/canvas/config/security.yml SECRET=$(mcookie) @@ -17,11 +17,16 @@ EKEY=$(mcookie) sed -i "s|ECOSYSTEM_KEY=.*|ECOSYSTEM_KEY=\"$SECRET\"|" $ENV_FILE sed -i "s|ECOSYSTEM_SECRET=.*|ECOSYSTEM_SECRET=\"$KEY\"|" $ENV_FILE sed -i "s|CIPHER_PASSWORD=.*|CIPHER_PASSWORD=\"NOT_USED\"|" $ENV_FILE -sed -i "s|signing_secret: .*|signing_secret: \"$KEY\"|" $VAULT_CONTENTS -sed -i "s|encryption_secret: .*|encryption_secret: \"$SECRET\"|" $VAULT_CONTENTS +sed -i "s|signing_secret: .*|signing_secret: \"$KEY\"|" $VAULT +sed -i "s|encryption_secret: .*|encryption_secret: \"$SECRET\"|" $VAULT sed -i "s|encryption_key: .*|encryption_key: \"$EKEY\"|" $SECURITY -su -s /bin/bash -l www-data -c "cd /var/www/canvas && RAILS_ENV=production BUNDLE_PATH='vendor/bundle' bundle exec rake db:reset_encryption_key_hash" +su - www-data -s /bin/bash \ + -c "cd /var/www/canvas \ + && RAILS_ENV=production BUNDLE_PATH='vendor/bundle' \ + bundle exec rake db:reset_encryption_key_hash" + +$INITHOOKS_PATH/bin/regen_jwks # Perhaps should restart apache (mod_passenger) here? Canvas is so slow to # start though, will just do it in interactive hook (rather than twice). diff --git a/overlay/usr/local/src/canvas.conf b/overlay/usr/local/src/canvas.conf index 0cadb28..d6b5550 100644 --- a/overlay/usr/local/src/canvas.conf +++ b/overlay/usr/local/src/canvas.conf @@ -1,7 +1,5 @@ # central configuration and functions used by conf.d scripts -export VERSION_CANVAS=prod - export SRC=/usr/local/src export WEBROOT=/var/www/canvas diff --git a/plan/main b/plan/main index cd178dc..1484162 100644 --- a/plan/main +++ b/plan/main @@ -13,3 +13,6 @@ libsqlite3-dev libmariadb-dev python3-psycopg2 libidn11-dev /* for ruby-idn */ + +/* QTI Migration Tool */ +python3-lxml