293 lines
10 KiB
TypeScript
293 lines
10 KiB
TypeScript
/**
|
|
* MinIO (S3-compatible) Platform Service Provider
|
|
*/
|
|
|
|
import { BasePlatformServiceProvider } from './base.ts';
|
|
import type {
|
|
IService,
|
|
IPlatformResource,
|
|
IPlatformServiceConfig,
|
|
IProvisionedResource,
|
|
IEnvVarMapping,
|
|
TPlatformServiceType,
|
|
TPlatformResourceType,
|
|
} from '../../../types.ts';
|
|
import { logger } from '../../../logging.ts';
|
|
import { getErrorMessage } from '../../../utils/error.ts';
|
|
import { credentialEncryption } from '../../encryption.ts';
|
|
import type { Onebox } from '../../onebox.ts';
|
|
|
|
export class MinioProvider extends BasePlatformServiceProvider {
|
|
readonly type: TPlatformServiceType = 'minio';
|
|
readonly displayName = 'S3 Storage (MinIO)';
|
|
readonly resourceTypes: TPlatformResourceType[] = ['bucket'];
|
|
|
|
constructor(oneboxRef: Onebox) {
|
|
super(oneboxRef);
|
|
}
|
|
|
|
getDefaultConfig(): IPlatformServiceConfig {
|
|
return {
|
|
image: 'minio/minio:latest',
|
|
port: 9000,
|
|
volumes: ['/var/lib/onebox/minio:/data'],
|
|
command: 'server /data --console-address :9001',
|
|
environment: {
|
|
MINIO_ROOT_USER: 'admin',
|
|
// Password will be generated and stored encrypted
|
|
},
|
|
};
|
|
}
|
|
|
|
getEnvVarMappings(): IEnvVarMapping[] {
|
|
return [
|
|
{ envVar: 'S3_ENDPOINT', credentialPath: 'endpoint' },
|
|
{ envVar: 'S3_BUCKET', credentialPath: 'bucket' },
|
|
{ envVar: 'S3_ACCESS_KEY', credentialPath: 'accessKey' },
|
|
{ envVar: 'S3_SECRET_KEY', credentialPath: 'secretKey' },
|
|
{ envVar: 'S3_REGION', credentialPath: 'region' },
|
|
// AWS SDK compatible names
|
|
{ envVar: 'AWS_ACCESS_KEY_ID', credentialPath: 'accessKey' },
|
|
{ envVar: 'AWS_SECRET_ACCESS_KEY', credentialPath: 'secretKey' },
|
|
{ envVar: 'AWS_ENDPOINT_URL', credentialPath: 'endpoint' },
|
|
{ envVar: 'AWS_REGION', credentialPath: 'region' },
|
|
];
|
|
}
|
|
|
|
async deployContainer(): Promise<string> {
|
|
const config = this.getDefaultConfig();
|
|
const containerName = this.getContainerName();
|
|
const dataDir = '/var/lib/onebox/minio';
|
|
|
|
logger.info(`Deploying MinIO platform service as ${containerName}...`);
|
|
|
|
// Check if we have existing data and stored credentials
|
|
const platformService = this.oneboxRef.database.getPlatformServiceByType(this.type);
|
|
let adminCredentials: { username: string; password: string };
|
|
let dataExists = false;
|
|
|
|
// Check if data directory has existing MinIO data
|
|
// MinIO creates .minio.sys directory on first startup
|
|
try {
|
|
const stat = await Deno.stat(`${dataDir}/.minio.sys`);
|
|
dataExists = stat.isDirectory;
|
|
logger.info(`MinIO data directory exists with .minio.sys folder`);
|
|
} catch {
|
|
// .minio.sys doesn't exist, this is a fresh install
|
|
dataExists = false;
|
|
}
|
|
|
|
if (dataExists && platformService?.adminCredentialsEncrypted) {
|
|
// Reuse existing credentials from database
|
|
logger.info('Reusing existing MinIO credentials (data directory already initialized)');
|
|
adminCredentials = await credentialEncryption.decrypt(platformService.adminCredentialsEncrypted);
|
|
} else {
|
|
// Generate new credentials for fresh deployment
|
|
logger.info('Generating new MinIO admin credentials');
|
|
adminCredentials = {
|
|
username: 'admin',
|
|
password: credentialEncryption.generatePassword(32),
|
|
};
|
|
|
|
// If data exists but we don't have credentials, we need to wipe the data
|
|
if (dataExists) {
|
|
logger.warn('MinIO data exists but no credentials in database - wiping data directory');
|
|
try {
|
|
await Deno.remove(dataDir, { recursive: true });
|
|
} catch (e) {
|
|
logger.error(`Failed to wipe MinIO data directory: ${getErrorMessage(e)}`);
|
|
throw new Error('Cannot deploy MinIO: data directory exists without credentials');
|
|
}
|
|
}
|
|
}
|
|
|
|
// Ensure data directory exists
|
|
try {
|
|
await Deno.mkdir(dataDir, { recursive: true });
|
|
} catch (e) {
|
|
// Directory might already exist
|
|
if (!(e instanceof Deno.errors.AlreadyExists)) {
|
|
logger.warn(`Could not create MinIO data directory: ${getErrorMessage(e)}`);
|
|
}
|
|
}
|
|
|
|
// Create container using Docker API
|
|
const envVars = [
|
|
`MINIO_ROOT_USER=${adminCredentials.username}`,
|
|
`MINIO_ROOT_PASSWORD=${adminCredentials.password}`,
|
|
];
|
|
|
|
const containerId = await this.oneboxRef.docker.createPlatformContainer({
|
|
name: containerName,
|
|
image: config.image,
|
|
port: config.port,
|
|
env: envVars,
|
|
volumes: config.volumes,
|
|
network: this.getNetworkName(),
|
|
command: config.command?.split(' '),
|
|
exposePorts: [9000, 9001], // API and Console ports
|
|
});
|
|
|
|
// Store encrypted admin credentials (only update if new or changed)
|
|
const encryptedCreds = await credentialEncryption.encrypt(adminCredentials);
|
|
if (platformService) {
|
|
this.oneboxRef.database.updatePlatformService(platformService.id!, {
|
|
containerId,
|
|
adminCredentialsEncrypted: encryptedCreds,
|
|
status: 'starting',
|
|
});
|
|
}
|
|
|
|
logger.success(`MinIO container created: ${containerId}`);
|
|
return containerId;
|
|
}
|
|
|
|
async stopContainer(containerId: string): Promise<void> {
|
|
logger.info(`Stopping MinIO container ${containerId}...`);
|
|
await this.oneboxRef.docker.stopContainer(containerId);
|
|
logger.success('MinIO container stopped');
|
|
}
|
|
|
|
async healthCheck(): Promise<boolean> {
|
|
try {
|
|
logger.info('MinIO health check: starting...');
|
|
const platformService = this.oneboxRef.database.getPlatformServiceByType(this.type);
|
|
if (!platformService) {
|
|
logger.info('MinIO health check: platform service not found in database');
|
|
return false;
|
|
}
|
|
if (!platformService.adminCredentialsEncrypted) {
|
|
logger.info('MinIO health check: no admin credentials stored');
|
|
return false;
|
|
}
|
|
if (!platformService.containerId) {
|
|
logger.info('MinIO health check: no container ID in database record');
|
|
return false;
|
|
}
|
|
|
|
logger.info(`MinIO health check: using container ID ${platformService.containerId.substring(0, 12)}...`);
|
|
|
|
// Use docker exec to run health check inside the container
|
|
// This avoids network issues with overlay networks
|
|
const result = await this.oneboxRef.docker.execInContainer(
|
|
platformService.containerId,
|
|
['curl', '-sf', 'http://localhost:9000/minio/health/live']
|
|
);
|
|
|
|
if (result.exitCode === 0) {
|
|
logger.info('MinIO health check: success');
|
|
return true;
|
|
} else {
|
|
logger.info(`MinIO health check failed: exit code ${result.exitCode}, stderr: ${result.stderr.substring(0, 200)}`);
|
|
return false;
|
|
}
|
|
} catch (error) {
|
|
logger.info(`MinIO health check exception: ${getErrorMessage(error)}`);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
async provisionResource(userService: IService): Promise<IProvisionedResource> {
|
|
const platformService = this.oneboxRef.database.getPlatformServiceByType(this.type);
|
|
if (!platformService || !platformService.adminCredentialsEncrypted || !platformService.containerId) {
|
|
throw new Error('MinIO platform service not found or not configured');
|
|
}
|
|
|
|
const adminCreds = await credentialEncryption.decrypt(platformService.adminCredentialsEncrypted);
|
|
const containerName = this.getContainerName();
|
|
|
|
// Generate bucket name
|
|
const bucketName = this.generateBucketName(userService.name);
|
|
|
|
logger.info(`Provisioning MinIO bucket '${bucketName}' for service '${userService.name}'...`);
|
|
|
|
// Use docker exec with mc (MinIO Client) inside the container
|
|
// First configure mc alias for local server
|
|
await this.execMc(platformService.containerId, [
|
|
'alias', 'set', 'local', 'http://localhost:9000',
|
|
adminCreds.username, adminCreds.password,
|
|
]);
|
|
|
|
// Create the bucket
|
|
const mbResult = await this.execMc(platformService.containerId, [
|
|
'mb', '--ignore-existing', `local/${bucketName}`,
|
|
]);
|
|
logger.info(`Created MinIO bucket '${bucketName}'`);
|
|
|
|
// Set bucket policy to allow public read/write (services on the same network use root creds)
|
|
await this.execMc(platformService.containerId, [
|
|
'anonymous', 'set', 'none', `local/${bucketName}`,
|
|
]);
|
|
|
|
// Use container name for the endpoint in credentials (user services run in same network)
|
|
const serviceEndpoint = `http://${containerName}:9000`;
|
|
|
|
const credentials: Record<string, string> = {
|
|
endpoint: serviceEndpoint,
|
|
bucket: bucketName,
|
|
accessKey: adminCreds.username,
|
|
secretKey: adminCreds.password,
|
|
region: 'us-east-1',
|
|
};
|
|
|
|
// Map credentials to env vars
|
|
const envVars: Record<string, string> = {};
|
|
for (const mapping of this.getEnvVarMappings()) {
|
|
if (credentials[mapping.credentialPath]) {
|
|
envVars[mapping.envVar] = credentials[mapping.credentialPath];
|
|
}
|
|
}
|
|
|
|
logger.success(`MinIO bucket '${bucketName}' provisioned`);
|
|
|
|
return {
|
|
type: 'bucket',
|
|
name: bucketName,
|
|
credentials,
|
|
envVars,
|
|
};
|
|
}
|
|
|
|
async deprovisionResource(resource: IPlatformResource, credentials: Record<string, string>): Promise<void> {
|
|
const platformService = this.oneboxRef.database.getPlatformServiceByType(this.type);
|
|
if (!platformService || !platformService.adminCredentialsEncrypted || !platformService.containerId) {
|
|
throw new Error('MinIO platform service not found or not configured');
|
|
}
|
|
|
|
const adminCreds = await credentialEncryption.decrypt(platformService.adminCredentialsEncrypted);
|
|
|
|
logger.info(`Deprovisioning MinIO bucket '${resource.resourceName}'...`);
|
|
|
|
// Configure mc alias
|
|
await this.execMc(platformService.containerId, [
|
|
'alias', 'set', 'local', 'http://localhost:9000',
|
|
adminCreds.username, adminCreds.password,
|
|
]);
|
|
|
|
try {
|
|
// Remove all objects and the bucket
|
|
await this.execMc(platformService.containerId, [
|
|
'rb', '--force', `local/${resource.resourceName}`,
|
|
]);
|
|
logger.success(`MinIO bucket '${resource.resourceName}' deleted`);
|
|
} catch (e) {
|
|
logger.error(`Failed to delete MinIO bucket: ${getErrorMessage(e)}`);
|
|
throw e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Execute mc (MinIO Client) command inside the container
|
|
*/
|
|
private async execMc(
|
|
containerId: string,
|
|
args: string[],
|
|
): Promise<{ stdout: string; stderr: string }> {
|
|
const result = await this.oneboxRef.docker.execInContainer(containerId, ['mc', ...args]);
|
|
if (result.exitCode !== 0) {
|
|
throw new Error(`mc command failed (exit ${result.exitCode}): ${result.stderr.substring(0, 200)}`);
|
|
}
|
|
return result;
|
|
}
|
|
}
|