Update latest to 10.29.1e (#107)

Co-authored-by: github-actions <[email protected]>

latest/Dockerfile

@@ -8,7 +8,7 @@
 # hadolint global ignore=DL3008
 FROM ubuntu:22.04 as setup
 
-ENV IB_GATEWAY_VERSION=10.29.1d
+ENV IB_GATEWAY_VERSION=10.29.1e
 ENV IB_GATEWAY_RELEASE_CHANNEL=latest
 ENV IBC_VERSION=3.18.0
 
@@ -49,7 +49,7 @@ COPY ./scripts /root/scripts
 
 FROM ubuntu:22.04
 
-ENV IB_GATEWAY_VERSION=10.29.1d
+ENV IB_GATEWAY_VERSION=10.29.1e
 # IB Gateway user constants
 ARG USER_ID="${USER_ID:-1000}"
 ARG USER_GID="${USER_GID:-1000}"

latest/Dockerfile.tws

@@ -7,7 +7,7 @@
 
 # hadolint global ignore=DL3008
 
-ARG IB_VERSION=10.29.1d
+ARG IB_VERSION=10.29.1e
 FROM ghcr.io/gnzsnz/ib-gateway:${IB_VERSION} as setup
 
 WORKDIR /
@@ -18,7 +18,7 @@ WORKDIR /
 
 FROM lscr.io/linuxserver/rdesktop:ubuntu-xfce
 
-ENV IB_GATEWAY_VERSION=10.29.1d
+ENV IB_GATEWAY_VERSION=10.29.1e
 ENV IB_GATEWAY_RELEASE_CHANNEL=latest
 ENV IBC_VERSION=3.18.0
 

latest/scripts/common.sh

@@ -5,8 +5,13 @@ apply_settings() {
 	# apply env variables into IBC and gateway/TWS config files
 	if [ "$CUSTOM_CONFIG" != "yes" ]; then
 		echo ".> Appling settings to IBC's config.ini"
+
+		file_env 'TWS_PASSWORD'
 		# replace env variables
 		envsubst <"${IBC_INI_TMPL}" >"${IBC_INI}"
+		unset_env 'TWS_PASSWORD'
+		# set config.ini readable by user only
+		chmod 600 "${IBC_INI}"
 
 		# where are settings stored
 		if [ -n "$TWS_SETTINGS_PATH" ]; then
@@ -33,6 +38,38 @@ apply_settings() {
 	fi
 }
 
+# usage: file_env VAR [DEFAULT]
+#    ie: file_env 'XYZ_DB_PASSWORD' 'example'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+#  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+file_env() {
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(<"${!fileVar}")"
+	fi
+	export "$var"="$val"
+	#unset "$fileVar"
+}
+
+# usage: unset_env VAR
+#	ie: unset_env 'XYZ_DB_PASSWORD'
+unset_env() {
+	local var="$1"
+	local fileVar="${var}_FILE"
+	if [ "${!fileVar:-}" ]; then
+		unset "$var"
+	fi
+}
+
 set_ports() {
 	# set ports for API and SOCAT
 
@@ -125,6 +162,7 @@ setup_ssh() {
 		export SSH_ALL_OPTIONS
 		echo ".> SSH options: $SSH_ALL_OPTIONS"
 
+		file_env 'SSH_PASSPHRASE'
 		if [ -n "$SSH_PASSPHRASE" ]; then
 			if ! pgrep ssh-agent >/dev/null; then
 				# start agent if it's not already running
@@ -142,10 +180,15 @@ setup_ssh() {
 				echo ".> ssh-agent sock: ${SSH_AUTH_SOCK}"
 			fi
 
-			echo ".> Adding keys to ssh-agent."
-			export SSH_ASKPASS_REQUIRE=never
-			SSHPASS="${SSH_PASSPHRASE}" sshpass -e -P "passphrase" ssh-add
-			echo ".> ssh-agent identities: $(ssh-add -l)"
+			if ls /config/.ssh/id_* >/dev/null; then
+				echo ".> Adding keys to ssh-agent."
+				export SSH_ASKPASS_REQUIRE=never
+				SSHPASS="${SSH_PASSPHRASE}" sshpass -e -P "passphrase" ssh-add
+				unset_env 'SSH_PASSPHRASE'
+				echo ".> ssh-agent identities: $(ssh-add -l)"
+			else
+				echo ".> SSH keys not found, ssh-agent not started"
+			fi
 		fi
 	else
 		echo ".> SSH tunnel disabled"
@@ -157,6 +200,10 @@ start_ssh() {
 		# if this script is already running don't start it
 		echo ".> SSH tunnel already active. Not starting a new one"
 		return 0
+	elif ! pgrep ssh-agent >/dev/null; then
+		# if ssh-agent is not running don't start tunnel
+		echo ".> ssh-agent is NOT running. Not starting a tunnel"
+		return 0
 	fi
 
 	if [ -z "$SSH_REMOTE_PORT" ]; then

latest/scripts/run.sh

@@ -2,6 +2,8 @@
 # shellcheck disable=SC2317
 # Don't warn about unreachable commands in this file
 
+set -Eeo pipefail
+
 echo "*************************************************************************"
 echo ".> Starting IBC/IB gateway"
 echo "*************************************************************************"
@@ -53,9 +55,11 @@ start_xvfb() {
 
 start_vnc() {
 	# start VNC server
+	file_env 'VNC_SERVER_PASSWORD'
 	if [ -n "$VNC_SERVER_PASSWORD" ]; then
 		echo ".> Starting VNC server"
 		x11vnc -ncache_cr -display :1 -forever -shared -bg -noipv6 -passwd "$VNC_SERVER_PASSWORD" &
+		unset_env 'VNC_SERVER_PASSWORD'
 	else
 		echo ".> VNC server disabled"
 	fi
@@ -141,8 +145,15 @@ if [ "$DUAL_MODE" == "yes" ]; then
 	TRADING_MODE=paper
 	TWS_USERID="${TWS_USERID_PAPER}"
 	export TWS_USERID
-	TWS_PASSWORD="${TWS_PASSWORD_PAPER}"
-	export TWS_PASSWORD
+
+	# handle password for dual mode
+	if [ -n "${TWS_PASSWORD_PAPER_FILE}" ]; then
+		TWS_PASSWORD_FILE="${TWS_PASSWORD_PAPER_FILE}"
+		export TWS_PASSWORD_FILE
+	else
+		TWS_PASSWORD="${TWS_PASSWORD_PAPER}"
+		export TWS_PASSWORD
+	fi
 	# disable duplicate ssh for vnc/rdp
 	SSH_VNC_PORT=
 	export SSH_VNC_PORT

latest/scripts/run_socat.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -Eeo pipefail
 
 LOCAL_PORT="$API_PORT"
 # shellcheck disable=SC2153

latest/scripts/run_ssh.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -Eeo pipefail
 
 _OPTIONS="$SSH_ALL_OPTIONS"
 _LOCAL_PORT="$API_PORT"

latest/tws-scripts/run_tws.sh

@@ -2,6 +2,8 @@
 # shellcheck shell=bash
 # shellcheck disable=SC1091,SC2317,SC2034
 
+set -Eeo pipefail
+
 echo "*************************************************************************"
 echo ".> Starting IBC/TWS"
 echo "*************************************************************************"
@@ -11,6 +13,7 @@ source "${SCRIPT_PATH}/common.sh"
 disable_agents() {
 	## disable ssh and gpg agent
 	# https://docs.xfce.org/xfce/xfce4-session/advanced
+
 	if [ ! -f /config/.config/disable_agents ]; then
 		echo ".> Disabling ssh-agent and gpg-agent"
 		# disable xfce
@@ -29,7 +32,8 @@ disable_compositing() {
 	# disable compositing
 	# https://github.com/gnzsnz/ib-gateway-docker/issues/55
 	echo ".> Disabling xfce compositing"
-	xfconf-query --channel=xfwm4 --property=/general/use_compositing --type=bool --set=false --create
+	xfconf-query --channel=xfwm4 --property=/general/use_compositing \
+		--type=bool --set=false --create
 }
 
 start_IBC() {
@@ -60,15 +64,12 @@ start_process() {
 	apply_settings
 	# forward ports, socat/ssh
 	port_forwarding
-
 	start_IBC
 }
 
 ###############################################################################
 #####		Common Start
 ###############################################################################
-# set display
-export DISPLAY=:10
 
 # user id
 echo ".> Running as user"
@@ -109,13 +110,23 @@ fi
 
 start_process
 
+# do it outside if dual mode, so the clean up is done anyway
+file_env 'TWS_PASSWORD_PAPER'
+
 if [ "$DUAL_MODE" == "yes" ]; then
 	# running dual mode, start paper
 	TRADING_MODE=paper
 	TWS_USERID="${TWS_USERID_PAPER}"
 	export TWS_USERID
-	TWS_PASSWORD="${TWS_PASSWORD_PAPER}"
-	export TWS_PASSWORD
+
+	# handle password for dual mode
+	if [ -n "${TWS_PASSWORD_PAPER_FILE}" ]; then
+		TWS_PASSWORD_FILE="${TWS_PASSWORD_PAPER_FILE}"
+		export TWS_PASSWORD_FILE
+	else
+		TWS_PASSWORD="${TWS_PASSWORD_PAPER}"
+		export TWS_PASSWORD
+	fi
 	# disable duplicate ssh for vnc/rdp
 	SSH_VNC_PORT=
 	export SSH_VNC_PORT
@@ -131,6 +142,8 @@ if [ "$DUAL_MODE" == "yes" ]; then
 	sleep 15
 	start_process
 fi
+# outside if dual mode, to ensure cleanup/unset
+unset_env 'TWS_PASSWORD_PAPER'
 
 wait "${pid[@]}"
 _wait="$?"

latest/tws-scripts/start_session.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
+set -Eeo pipefail
 
 echo "*************************************************************************"
 echo ".> Launching IBC/TWS service"
@@ -8,13 +9,12 @@ echo "*************************************************************************"
 # source common functions
 source "${SCRIPT_PATH}/common.sh"
 
-# set display
-export DISPLAY=:10
-
 # set user pass
+file_env 'PASSWD'
 _PASS=${PASSWD:-abc}
 echo ".> Setting user password"
 echo "abc:$_PASS" | chpasswd
+unset_env 'PASSWD'
 id
 
 if [ -n "${TZ}" ]; then
@@ -24,7 +24,14 @@ fi
 
 # open xfce session
 echo ".> Openning Xrdp session"
-echo "${_PASS}" | xrdp-sesrun -s 127.0.0.1 -F 0 abc
+_out=$(echo "${_PASS}" | xrdp-sesrun -s 127.0.0.1 -F 0 abc)
+unset _PASS #unset
+_display=$(echo "$_out" | grep -e '^ok' | cut -d ' ' -f 3 | cut -d '=' -f 2)
+if [ -n "$_display" ]; then
+	DISPLAY=$_display
+	export DISPLAY
+	echo ".> Xrdp started on DISPLAY=${DISPLAY}"
+fi
 
 # setting permissions
 echo ".> Setting permissions for ${TWS_PATH} and ${IBC_PATH}"