moved to ab-openldap repo

Renamed backup script, added files to update script and regenerated
checksums

.gitattributes

@@ -74,3 +74,4 @@
 
 .gitattributes export-ignore
 .gitignore     export-ignore
+.vscode        export-ignore

.gitignore

@@ -3,4 +3,8 @@
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
+!.vscode/numbered-bookmarks.json
 *.code-workspace
+
+# ignore params files
+*.params

.vscode/numbered-bookmarks.json

@@ -0,0 +1,3 @@
+{
+	"bookmarks": []
+}

README.md

@@ -1,3 +1,7 @@
 # AB-Docker Convenience Scripts
 
-POSIX-shell scripts meant to make launching AB-Docker containers easier.  See relevant container repos for information on how to use each script.  The most updated version of each script will be in the container's git repo but are mirrored here for simplicity in distribution where only the script is needed as opposed to Dockerfiles, etc.
+POSIX-shell scripts meant to make launching AB-Docker containers easier.  See relevant container repos for information on how to use each script.
+
+## Organization
+
+Each container has it's own subdirectory within this repo for it's associated utility scripts. Each subdirectory has a *checksums.sha256* which allows the *update.sh* script to automate pulling the latest versions.

ab-openldap.params.template

@@ -1,73 +0,0 @@
-#
-## openldap environment variables
-#
-
-### Usage
-#
-# ***VERY IMPORTANT! DO NOT PUT QUOTES AROUND VALUES IN THIS FILE!!!***
-#      incorrect: ORG_NAME="MyOrganization"
-#      correct:   ORG_NAME=MyOrganization
-#
-# Instead of typing a myriad of "-e ...", you can fill them all out in this 
-# file and then use "--env-file ab-openldap.params" to tell docker to source
-# it's variables from here.  You can also combine both methods if you like.  
-# Most important, if you're using the convenience script, it draws all info from
-# this file!
-#
-# You should probably protect this file via file permissions since it likely 
-# will contain things like passwords!  Suggest restricting it to root only
-#    ex: chown root:root ab-openldap.parms && chmod 600 ab-openldap.parms
-###
-
-### Your timezone (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
-TZ=Area/Location
-
-### First user account (will be added to Organization DIT 'manager' role)
-USER=admin
-USER_PASS=admin
-USER_FIRSTNAME=admin
-USER_LASTNAME=admin
-
-### Your Organization domain and name
-# domain in standard (dotted) format -- not LDAP format
-DOMAIN=mydomain.net
-# Org name: suggest using [A-Z][a-z][0-9][-_] ONLY.  Avoid spaces.
-ORG_NAME=MyOrganization
-
-### Your 'directory browser' user
-BROWSER_USER=ldapbind
-BROWSER_PASS=ldapbind
-
-### Anonymous binding (enabled by default)
-ANONYMOUS_BINDING=yes
-
-### Location of your TLS files
-# Note: This section is only automated if using the script file to start the 
-# container.  If you are starting it manually and using '--env-file', you still 
-# have to manually bind-mount these files using '-v source:/certs/dest.file:ro'.
-#
-# If you're bind-mounting symlinks, remember that you have to fully expand them 
-# or Docker will try to bind the link instead of the target!  This is most 
-# common with Let's Encrypt.
-#
-# Example that does not work (binding directory instead of files):
-#   /etc/letsencrypt/live/mydomain.net:/certs:ro
-#   This will end up copying the symlinks themselves and, since the targets are 
-#   not available to the container, it doesn't work!
-# Example of the right way (bind actual files):
-#   /etc/letsencrypt/live/mydomain.net/privkey.pem:/certs/privkey.pem:ro
-###
-#TLS_CERT=/etc/letsencrypt/live/mydomain.net/fullchain.pem
-#TLS_KEY=/etc/letsencrypt/live/mydomain.net/privkey.pem
-#TLS_CHAIN=/etc/letsencrypt/live/mydomain.net/chain.pem
-
-# The container will generate Diffie-Hellman parameters automatically the first 
-# time it's launched with TLS certificates defined.
-
-### Custom LDIFs
-# Path to any custom LDIFs you want applied to the container. Leave this line/
-# variable commented-out if you don't have any LDIFs to apply.
-# MY_LDIF=/path/to/my/LDIFs
-
-
-#EOF

ab-openldap.sh

@@ -1,300 +0,0 @@
-#!/bin/sh
-
-#
-### start openldap container using params file variables
-#
-
-
-# error code reference:
-# 0: exited normally, no errors
-# 1: unknown startup option passed to script
-# 2: current user is unauthorized to operate docker
-# 3: 'params' file not found in same directory as script
-# 5: specified TLS-related files (cert, key or chain) not found
-
-
-# text formatting presets
-cyan=$(tput setaf 6)
-err=$(tput bold)$(tput setaf 1)
-magenta=$(tput setaf 5)
-norm=$(tput sgr0)
-red=$(tput setaf 1)
-yellow=$(tput setaf 3)
-
-
-### parameter defaults
-clean=false
-container_name="ab-openldap"
-remove=0
-shell=false
-
-
-scriptHelp () {
-    printf "\n${magenta}%80s\n" | tr " " "-"
-    printf "${norm}This is a simple helper script so you can avoid lengthy typing when working\n"
-    printf "with the openLDAP container.  The script reads the contents of 'ab-openldap.params'\n"
-    printf "and constructs various 'docker run' commands based on that file.  The biggest\n"
-    printf "timesaver is working with certificates.  If they are specified in the '.params',\n"
-    printf "the script will automatically bind-mount them so openLDAP starts in 'TLS\n"
-    printf "required' mode.\n\n"
-    printf "If you run the script with no parameters, it will execute the container\n"
-    printf "'normally':  Run in detached mode with openLDAP automatically launched and\n"
-    printf "logging to stdout.  If you specified certificates, openLDAP will require a TLS\n"
-    printf "connection.  All modes of operation allow you to enter the container and\n"
-    printf "connect directly using UNIX sockets also.\n"
-    printf "Containers run in SHELL mode are ALWAYS removed upon exit as they are meant for\n"
-    printf "testing only.  By default, containers run without '--rm' will be restarted\n"
-    printf "automatically unless they are manually stopped via 'docker stop...'\n\n"
-    printf "${magenta}The script has the following parameters:\n"
-    printf "${cyan}(parameter in cyan) ${yellow}(default in yellow)${norm}\n\n"
-    printf "${cyan}-n|--name${norm}\n"
-    printf "Change the name of the container. This is cosmetic and does not affect\n"
-    printf "operation in any way.\n"
-    printf "${yellow}(ab-openldap)${norm}\n\n"
-    printf "${cyan}--rm|--remove${norm}\n"
-    printf "Automatically remove the container and volume (unless data is written) after it\n"
-    printf "is exited.\n"
-    printf "${yellow}(off: do not destroy container when stopped)${norm}\n\n"
-    printf "${cyan}-s|--shell${norm}\n"
-    printf "Enter the container using an interactive POSIX shell.  This happens after\n"
-    printf "startup operations but *before* openLDAP (slapd) is actually started.  This is\n"
-    printf "a great way to see configuration changes possibly stopping openLDAP from\n"
-    printf "starting.  You can combine this with '--rm' for easy configuration checks.\n"
-    printf "${yellow}(off: run in detached mode)${norm}\n\n"
-    printf "${cyan}--clean${norm}\n"
-    printf "This option will stop ALL running openLDAP containers *AND DESTROY ALL\n"
-    printf "VOLUMES*.  This is meant to give you a 'clean start' if you've made\n"
-    printf "configuration changes, etc.\n\n"
-    printf "${yellow}More information can be found at:\n"
-    printf "https://git.asifbacchus.app/ab-docker/openldap/wiki\n"
-    printf "${magenta}%80s\n\n" | tr " " "-"
-    exit 0
-}
-
-### pre-requisite checks
-
-# is user root or in the docker group?
-if [ ! "$( id -u )" -eq 0 ]; then
-    if ! id -Gn | grep docker > /dev/null; then
-        printf "${err}\nYou must either be root or in the 'docker' group to run this script since you must be able to actually start the container! Exiting.\n${norm}"
-        exit 2
-    fi
-fi
-
-# does the params file exist?
-if [ ! -f "./ab-openldap.params" ]; then
-    printf "${err}\nCannot find 'ab-openldap.params' file in the same directory as this script. Exiting.\n${norm}"
-    exit 3
-fi
-
-# read .params file
-. ./ab-openldap.params
-
-# check for certs if using TLS
-if [ "$TLS_CERT" ]; then
-    if [ ! -f "$TLS_CERT" ]; then
-        printf "${err}\nCannot find specified TLS certificate file. Exiting.${norm}\n"
-        exit 5
-    fi
-    if [ ! -f "$TLS_KEY" ]; then
-        printf "${err}\nCannot find specified TLS private key file. Exiting.${norm}\n"
-        exit 5
-    fi
-    if [ ! -f "$TLS_CHAIN" ]; then
-        printf "${err}\nCannot find specified TLS certificate chain file. Exiting.${norm}\n"
-        exit 5
-    fi
-fi
-
-# process startup parameters
-while [ $# -gt 0 ]; do
-    case "$1" in
-        -h|-\?|--help)
-            # display help
-            scriptHelp
-            exit 0
-            ;;
-        --rm|--remove)
-            # remove container on exit
-            remove=1
-            ;;
-        -s|--shell)
-            # start shell instead of default CMD
-            shell=true
-            ;;
-        --clean)
-            # stop if necessary, delete volumes
-            clean=true
-            ;;
-        -n|--name)
-            # container name
-            if [ -z "$2" ]; then
-                printf "${err}\nNo container name specified. Exiting.\n${norm}"
-                exit 1
-            fi
-            container_name="$2"
-            shift
-            ;;
-        *)
-            printf "${err}\nUnknown option: %s\n" "$1"
-            printf "Use '--help' for valid options.\n\n${norm}"
-            exit 1
-            ;;
-    esac
-    shift
-done
-
-
-# cleanup any running containers and volumes
-if [ $clean = true ]; then
-    # get all ab-openldap containers
-    containers=$(docker ps -a --no-trunc --filter "label=org.label-schema.name=ab-openldap" --format "{{ .Names }}")
-    # check for null value -- no containers to remove
-    if [ -z "$containers" ]; then
-        printf "${err}No openldap containers to remove. Exiting.${norm}\n\n"
-        exit 0
-    fi
-
-    # iterate containers, stop them and remove straggling volumes
-    set -- dummy $containers
-    shift
-    for container; do
-        printf "\n${cyan}Found %s -- processing:${norm}\n" ${container}
-        volume=$(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination "/var/openldap/data" }}{{ .Name }}{{ end }}{{ end }}' ${container})
-        printf "\t${red}Stopping container...${norm}\n"
-        docker stop ${container} > /dev/null 2>&1
-        printf "\t${red}Removing container...${norm}\n"
-        docker rm ${container} > /dev/null 2>&1
-        printf "\t${red}Removing volume...${norm}\n"
-        docker volume rm ${volume} > /dev/null 2>&1
-        printf "${cyan}...done${norm}\n"
-    done
-# run without TLS
-elif [ -z "$TLS_CERT" ]; then    
-    if [ $shell = true ]; then
-        # exec shell
-        printf "${cyan}\nRunning SHELL on %s...${norm}\n" "$container_name"
-        if [ -d "$MY_LDIF" ]; then
-            # bind-mount custom LDIFs if specified
-            docker run --rm -it --name ${container_name} \
-                --env-file ab-openldap.params \
-                -v "$MY_LDIF":/etc/openldap/customLDIF \
-                -p 389:389 -p 636:636 \
-                docker.asifbacchus.app/ldap/ab-openldap:latest /bin/sh
-        else
-            docker run --rm -it --name ${container_name} \
-                --env-file ab-openldap.params \
-                -p 389:389 -p 636:636 \
-                docker.asifbacchus.app/ldap/ab-openldap:latest /bin/sh
-        fi
-    else
-        # exec normally
-        printf "${cyan}\nRunning OPENLDAP on %s...${norm}\n" "$container_name"
-        if [ "$remove" -eq 1 ]; then
-            if [ -d "$MY_LDIF" ]; then
-                # bind-mount custom LDIFs if specified
-                docker run --rm -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$MY_LDIF":/etc/openldap/customLDIF \
-                    -p 389:389 -p 636:636 \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            else
-                docker run --rm -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -p 389:389 -p 636:636 \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            fi
-        else
-            if [ -d "$MY_LDIF" ]; then
-                # bind-mount custom LDIFs if specified
-                docker run -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$MY_LDIF":/etc/openldap/customLDIF \
-                    -p 389:389 -p 636:636 \
-                    --restart unless-stopped \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            else
-                docker run -d --name ${container_name} \
-                --env-file ab-openldap.params \
-                -p 389:389 -p 636:636 \
-                --restart unless-stopped \
-                docker.asifbacchus.app/ldap/ab-openldap:latest
-            fi
-        fi
-    fi
-# run with TLS
-elif [ "$TLS_CERT" ] && [ "$TLS_KEY" ] && [ "$TLS_CHAIN" ]; then
-    if [ $shell = true ]; then
-        # exec shell
-        printf "${cyan}\nRunning SHELL on %s (TLS)...${norm}\n" "$container_name"
-        if [ -d "$MY_LDIF" ]; then
-            # bind-mount custom LDIFs if specified
-            docker run --rm -it --name ${container_name} \
-                --env-file ab-openldap.params \
-                -v "$MY_LDIF":/etc/openldap/customLDIF \
-                -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                -v "$TLS_KEY":/certs/privkey.pem:ro \
-                -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                -p 389:389 -p 636:636 \
-                docker.asifbacchus.app/ldap/ab-openldap:latest /bin/sh
-        else
-            docker run --rm -it --name ${container_name} \
-                --env-file ab-openldap.params \
-                -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                -v "$TLS_KEY":/certs/privkey.pem:ro \
-                -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                -p 389:389 -p 636:636 \
-                docker.asifbacchus.app/ldap/ab-openldap:latest /bin/sh
-        fi
-    else
-        # exec normally
-        printf "${cyan}\nRunning OPENLDAP on %s (TLS)...${norm}\n" "$container_name"
-        if [ "$remove" -eq 1 ]; then
-            if [ -d "$MY_LDIF" ]; then
-                # bind-mount custom LDIFs if specified
-                docker run --rm -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$MY_LDIF":/etc/openldap/customLDIF \
-                    -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                    -v "$TLS_KEY":/certs/privkey.pem:ro \
-                    -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                    -p 389:389 -p 636:636 \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            else
-                docker run --rm -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                    -v "$TLS_KEY":/certs/privkey.pem:ro \
-                    -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                    -p 389:389 -p 636:636 \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            fi
-        else
-            if [ -d "$MY_LDIF" ]; then
-                # bind-mount custom LDIFs if specified
-                docker run -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$MY_LDIF":/etc/openldap/customLDIF \
-                    -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                    -v "$TLS_KEY":/certs/privkey.pem:ro \
-                    -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                    -p 389:389 -p 636:636 \
-                    --restart unless-stopped \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            else
-                docker run -d --name ${container_name} \
-                    --env-file ab-openldap.params \
-                    -v "$TLS_CERT":/certs/fullchain.pem:ro \
-                    -v "$TLS_KEY":/certs/privkey.pem:ro \
-                    -v "$TLS_CHAIN":/certs/chain.pem:ro \
-                    -p 389:389 -p 636:636 \
-                    --restart unless-stopped \
-                    docker.asifbacchus.app/ldap/ab-openldap:latest
-            fi
-        fi
-    fi
-fi
-
-
-### exit gracefully
-exit 0

checksums.sha256

@@ -1 +0,0 @@
-# checksums for scripts and parameter files

template-update.sh

@@ -0,0 +1,144 @@
+#!/bin/sh
+
+### update script for <ab-container> container and utility scripts
+# version x.y.z
+# script by Asif Bacchus
+# usage of this script is subject to the license terms found at:
+# https://git.asifbacchus.app/ab-docker/scripts/LICENSE
+
+
+### pre-requisites
+
+# check if wget is installed
+if ! command -v wget > /dev/null 2>&1; then
+    printf "\nSorry, this script requires that 'wget' is installed in order to automatically update files.\nExiting.\n\n"
+    exit 1
+fi
+
+# is user root or in the docker group?
+if [ ! "$( id -u )" -eq 0 ]; then
+    if ! id -Gn | grep docker > /dev/null; then
+        consoleError '1' "You must either be root or in the 'docker' group to pull container updates."
+    fi
+fi
+
+# zero counters
+updatesAvailable=0
+downloadFailed=0
+downloadSuccess=0
+updateFailed=0
+updateSuccess=0
+
+# reference constants
+containerName=''
+containerUpdatePath='docker.asifbacchus.app/...:latest'
+server="https://git.asifbacchus.app/ab-docker/scripts/raw/branch/master/$containerName/"
+checksumFilename='checksums.sha256'
+
+# files to update
+localScriptName='update.sh'
+repoScriptName='update.sh'
+updateFiles=""
+
+
+### update container
+printf "\n*** Updating %s container and service scripts ***\n\n" "$containerName"
+
+printf "Updating container:\n"
+if ! docker pull "$containerUpdatePath"; then
+    printf "There was an error updating the container. Try again later.\n\n"
+    exit 1
+else
+    printf "Container updated!\n"
+fi
+
+
+### update scripts
+printf "Updating %s service scripts\n" "$containerName"
+
+## download latest checksums
+printf "Getting latest checksums from ab-git server... "
+if ! wget --quiet --tries=3 --timeout=10 -N "${server}${checksumFilename}"; then
+    printf "[ERROR]\n"
+    printf "Unable to download checksums from ab-git server. Try again later.\n\n"
+    exit 1
+else
+    printf "[OK]\n"
+fi
+
+## check for updates to this script
+printf "Checking for updates to this script... "
+repoScriptChecksum=$( grep "$repoScriptName" "$checksumFilename" | grep -o '^\S*' )
+localScriptChecksum=$( sha256sum "$localScriptName" | grep -o '^\S*' )
+if [ "$localScriptChecksum" = "$repoScriptChecksum" ]; then
+    printf "[NONE]\n"
+else
+    # download updated script
+    if ! wget --quiet --tries=3 --timeout=10 -O $localScriptName "${server}${repoScriptName}"; then
+        printf "[ERROR]\n"
+        printf "Unable to download script update. Try again later.\n\n"
+        exit 1
+    else
+        # verify download
+        localScriptChecksum=$( sha256sum "$localScriptName" | grep -o '^\S*' )
+        if ! [ "$localScriptChecksum" = "$repoScriptChecksum" ]; then
+            printf "[ERROR]\n"
+            printf "Unable to verify checksum of updated script. Try again later.\n\n"
+        else
+        printf "[UPDATED]\n\n"
+        printf "*** This script has been updated. Please re-run it to load the updated version of this file. ***\n\n"
+        exit 0
+        fi
+    fi
+fi
+
+## update files
+set -- dummy $updateFiles
+shift
+for file; do
+    updateTarget="$file"
+    printf "\nChecking '%s' for updates... " "$updateTarget"
+    repoFile=$( grep "$updateTarget" "$checksumFilename" | grep -o '^\S*' )
+    if [ -f "$file" ]; then
+        localFile=$( sha256sum "$updateTarget" | grep -o '^\S*' )
+    else
+        localFile=0
+    fi
+
+    if ! [ "$localFile" = "$repoFile" ]; then
+        printf "[AVAILABLE]\n"
+        updatesAvailable=$((updatesAvailable+1))
+        # download update
+        printf "Downloading updated '%s'... " "$updateTarget"
+        # specify a name here instead of using the server name so that wget
+        # overwrites the file
+        if ! wget --quiet --tries=3 --timeout=10 -O "$updateTarget" "${server}${updateTarget}"; then
+            printf "[ERROR]\n"
+            downloadFailed=$((downloadFailed+1))
+        else
+            printf "[OK]\n"
+            downloadSuccess=$((downloadSuccess+1))
+            # verify download
+            printf "Verifying '%s'... " "$updateTarget"
+            localFile=$( sha256sum "$updateTarget" | grep -o '^\S*' )
+            if ! [ "$localFile" = "$repoFile" ]; then
+                printf "[INVALID]\n"
+                updateFailed=$((updateFailed+1))
+            else
+                printf "[OK]\n"
+                updateSuccess=$((updateSuccess+1))
+            fi
+        fi
+    else
+        printf "[NONE]\n"
+    fi
+done
+
+
+### display results
+printf "\nResults:\n"
+printf "\tUpdates: %s available\n" "$updatesAvailable"
+printf "\tDownloads: %s successful, %s failed\n" "$downloadSuccess" "$downloadFailed"
+printf "\tUpdates: %s applied, %s failed\n" "$updateSuccess" "$updateFailed"
+
+exit 0