Skip to content

feat(rocketchat): standalone Docker stack + split provisioner pattern (misp-style)#189

Open
t0kubetsu wants to merge 5 commits into
devfrom
feature/rocketchat-bootstrap
Open

feat(rocketchat): standalone Docker stack + split provisioner pattern (misp-style)#189
t0kubetsu wants to merge 5 commits into
devfrom
feature/rocketchat-bootstrap

Conversation

@t0kubetsu

@t0kubetsu t0kubetsu commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Adds the Rocket.Chat admin box and brings the stack/roles to a working end-to-end deploy, then refactors the provisioner to mirror the `misp-standalone` pattern.

What's in the PR

Ansible / topology (earlier commits)

  • admin-rocketchat box template (05_topology_layer) — removed; not present on dev, reverted to match.
  • software.install.rocketchat role — removed; not present on dev, reverted to match.
  • software.configure.docker-compose — `retry docker compose up` on transient registry/mirror timeouts; ubuntu task path aligned with dev.
  • basic_packages docker path — ubuntu tasks aligned with dev.

Rocket.Chat Docker stack (this branch)

  • Dockerfile — simplified to Alpine + bash/curl/jq/openssl one-shot provisioner; scripts volume-mounted at runtime (not baked in), matching the `misp-standalone` pattern.
  • compose.yml — provisioner service uses `env_file: .env` + three read-only volume mounts; MongoDB 8.0 replica set; Node healthcheck on `/health` (image ships no curl).
  • Provisioner split — monolithic `init.sh` + static `users.yml` replaced by:
    • `provision.sh` — 6-line orchestrator, ENTRYPOINT
    • `provision-users.sh` — creates instructor + team accounts with auto-generated passwords (`R42!` prefix + openssl rand, 20 chars); writes `/tokens/rc-credentials.json`; idempotent via `/tokens/.provisioned` stamp
    • `provision-tokens.sh` — generates a named PAT per user via REST; writes `/tokens/tokens.txt`
  • .env.example — enriched with team/org vars: `RC_TEAMS`, `RC_INSTRUCTOR_ORG`, `RC_INSTRUCTOR_COUNT`, `RC_USERS_PER_TEAM`, `RC_USER_DOMAIN`
  • Makefile — `make tokens` (username:PAT) + `make keys` (full credentials JSON)
  • README — documents provisioning architecture, env vars, both output files, API examples

Credentials output

File Contents
`/tokens/rc-credentials.json` `{"service","baseurl","users":[{username,role,team,password}]}`
`/tokens/tokens.txt` `username:PAT` per line

Both `chmod 600`. Retrieve via `make keys` / `make tokens`.

Dependency note

Stack deploys standalone; no dependency on other open dev PRs for the Docker layer. The Ansible role structure is intentionally absent from this branch (reverted to match dev).

Test plan

  • Deployed end-to-end; Rocket.Chat 8.4.3 healthy on MongoDB 8.0, web UI on :3000, provisioner created users/PATs.
  • Provisioner refactored to misp-standalone pattern; split scripts verified structurally.
  • Set real credentials in `.env` before non-throwaway use (defaults: `rc-admin` / `Admin1234!`).

@t0kubetsu
feat(topology): add admin-rocketchat box template + bootstrap role
13cff04 
Add an admin-rocketchat box template (Debian, template-vm-debian-trixie-medium)
that bootstraps the existing 03_container_layer/docker/admin/rocketchat compose
stack: firewall (22/3000) -> Docker baseline -> software.install.rocketchat.

- New role software.install.rocketchat: rsyncs the catalog Rocket.Chat stack
  onto the box and brings it up, delegating to software.configure.docker-compose
  (no stack duplication; env-lookup path lives in role defaults, not in the
  injection-guarded box-template params).
- software.configure.docker-compose: was Ubuntu-only (silent no-op on Debian);
  broadened the deploy gate to ['Ubuntu','Debian'] and renamed tasks/ubuntu ->
  tasks/debian-based to match the basic_packages convention. Tasks are apt/rsync
  based, so behaviour on Ubuntu is unchanged.
t0kubetsu added a commit that referenced this pull request Jun 10, 2026
@t0kubetsu
merge: PR #189 (feature/rocketchat-bootstrap) into dev_ada
aa9b953 
# Conflicts:
#	.gitignore
@t0kubetsu
fix(rocketchat): bring branch up to the working deploy state
752b5df 
Sync the rocketchat-deployable fixes proven on dev_ada so PR #189 reflects a
working end-to-end deploy on Debian:

- admin-rocketchat box template: drop NTP-and-update-time (no reachable NTP in
  egress-filtered ranges; host kvm-clock is correct).
- software.install.warmup.basic_packages docker path: Debian-clean — drop
  Ubuntu-only software-properties-common, use keyring instead of removed
  apt-key, install the docker compose v2 plugin + python Docker SDK (ubuntu/
  tasks -> debian-based/).
- software.configure.docker-compose: retry `docker compose up` on transient
  registry/mirror timeouts.
- rocketchat stack: MongoDB 6.0 -> 8.0 (rocket.chat:latest is 8.4.3, needs >=8);
  Node-based healthcheck on /health + provisioner curl + /api/info readiness
  (rocket.chat image ships no curl; /api/v1/info is 404 on 8.x).

Deployed clean: Rocket.Chat 8.4.3 healthy on :3000 with provisioning.
@t0kubetsu

t0kubetsu commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

🔗 test_rocketchat deploy chain (verified end-to-end on dev_ada)

This PR is one of three that together make the test_rocketchat lab deploy:

  • This PR — range42/range42-catalog#189: admin-rocketchat box template + software.install.rocketchat role + Rocket.Chat stack + Debian role fixes (basic_packages docker path, docker-compose retry).
  • Generator — range42/range42-playbooks#77: template build-IP allocation (unique per template) + default_vm_ci_dns_ips emission that the scenario relies on.
  • Scenario — range42/range42-playbooks#87: the test_rocketchat scenario that deploys this box.

Builds on the catalog topology/role PRs #180 (topology-layer-templates), #188 (admin-docker-elements), #181 (local-apt-mirror). Merge those + #77 before/with the scenario #87 (or promote dev_ada → dev as one batch).

@t0kubetsu t0kubetsu mentioned this pull request Jun 11, 2026
Closed
5 tasks
t0kubetsu added 2 commits June 12, 2026 09:41
@t0kubetsu
refactor(rocketchat): replace monolithic init.sh with split provision…
5191f83 
…er scripts

Mirrors the misp-standalone provisioner pattern: dedicated one-shot Alpine
provisioner service with scripts volume-mounted at runtime (not baked in),
team/org-aware env config, auto-generated passwords, and structured
credentials output.

- Remove provisioning/init.sh + provisioning/users.yml
- Add provision.sh (orchestrator, ENTRYPOINT), provision-users.sh (creates
  instructor + team accounts, writes /tokens/rc-credentials.json + .provisioned
  stamp), provision-tokens.sh (generates PATs, writes /tokens/tokens.txt)
- Dockerfile: simplify to Alpine + bash/curl/jq/openssl, no COPY
- compose.yml: provisioner uses env_file + 3 read-only volume mounts
- .env.example: add RC_TEAMS, RC_INSTRUCTOR_ORG, RC_INSTRUCTOR_COUNT,
  RC_USERS_PER_TEAM, RC_USER_DOMAIN
- Makefile: add keys target (rc-credentials.json), update help text
- README.md: document new architecture, env vars, both output files
@t0kubetsu
chore: revert 02_ansible_layer and 05_topology_layer to match dev
d301aa5 
Brings the branch back in sync with dev for these two layers:
- Replace debian-based docker tasks with ubuntu equivalents
- Remove software.install.rocketchat Ansible role (not present on dev)
- Remove admin-rocketchat box template (not present on dev)
@t0kubetsu t0kubetsu changed the title feat(topology): add admin-rocketchat box template + bootstrap role feat(rocketchat): split provisioner scripts, team-aware env config, misp-standalone pattern Jun 12, 2026
@t0kubetsu t0kubetsu changed the title feat(rocketchat): split provisioner scripts, team-aware env config, misp-standalone pattern feat(rocketchat): standalone Docker stack + split provisioner pattern (misp-style) Jun 12, 2026
@t0kubetsu

t0kubetsu commented Jun 12, 2026

Copy link
Copy Markdown
Contributor Author

Deployment prerequisite — cp .env.example .env on the deployer

Before running the scenario, the stack directory on the deployer's catalog copy must have a .env file. The compose.yml declares env_file: .env for the provisioner service; Docker Compose treats this as required by default and returns empty stdout if the file is missing, causing community.docker.docker_compose_v2 to fail with:

Error while parsing JSON output … Expecting value: line 1 column 1 (char 0)

Workaround (until resolved at the catalog level):

cd /path/to/range42-catalog/03_container_layer/docker/admin/rocketchat-bootstrap
cp .env.example .env

All defaults in .env.example are suitable for lab use. Test plan is otherwise ✅ all green.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@t0kubetsu