From 4e92edac82b83bc0148018c5b4ac26e4af0ebe0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=98eho=C5=99?= <rx@rx.cz>
Date: Fri, 21 Jun 2024 23:03:01 +0200
Subject: [PATCH] feat: add emqx-init

---
 apps/emqx-init/Dockerfile    | 29 ++++++++++++++++++
 apps/emqx-init/README.md     |  8 +++++
 apps/emqx-init/ci/goss.yaml  |  9 ++++++
 apps/emqx-init/ci/latest.sh  |  3 ++
 apps/emqx-init/entrypoint.sh | 59 ++++++++++++++++++++++++++++++++++++
 apps/emqx-init/metadata.yaml | 10 ++++++
 6 files changed, 118 insertions(+)
 create mode 100644 apps/emqx-init/Dockerfile
 create mode 100644 apps/emqx-init/README.md
 create mode 100644 apps/emqx-init/ci/goss.yaml
 create mode 100755 apps/emqx-init/ci/latest.sh
 create mode 100755 apps/emqx-init/entrypoint.sh
 create mode 100644 apps/emqx-init/metadata.yaml

diff --git a/apps/emqx-init/Dockerfile b/apps/emqx-init/Dockerfile
new file mode 100644
index 0000000..095f8f2
--- /dev/null
+++ b/apps/emqx-init/Dockerfile
@@ -0,0 +1,29 @@
+ARG VERSION
+FROM docker.io/library/alpine:3.20
+
+ARG TARGETPLATFORM
+ARG VERSION
+ARG CHANNEL
+
+ENV CHARSET="UTF-8" \
+    LANG="en_US.UTF-8" \
+    UMASK="0002" \
+    TZ="Etc/UTC"
+
+USER root
+
+RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl
+
+COPY ./apps/usbip/entrypoint.sh /entrypoint.sh
+
+WORKDIR /config
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
+CMD ["/entrypoint.sh"]
+
+LABEL org.opencontainers.image.source="https://github.com/torvalds/linux/blob/master/tools/usb/usbip/README"
diff --git a/apps/emqx-init/README.md b/apps/emqx-init/README.md
new file mode 100644
index 0000000..051e969
--- /dev/null
+++ b/apps/emqx-init/README.md
@@ -0,0 +1,8 @@
+# EMQX Init
+
+EMQX Authentication:
+* https://docs.emqx.com/en/emqx/latest/access-control/authn/authn.html
+* https://github.com/emqx/emqx/discussions/9142#discussioncomment-3862923
+
+EMQX Authorization:
+* https://docs.emqx.com/en/emqx/latest/access-control/authz/authz.html
diff --git a/apps/emqx-init/ci/goss.yaml b/apps/emqx-init/ci/goss.yaml
new file mode 100644
index 0000000..373197f
--- /dev/null
+++ b/apps/emqx-init/ci/goss.yaml
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/goss-org/goss/master/docs/schema.yaml
+file:
+  /entrypoint.sh:
+    exists: true
+    mode: "0755"
+  /usr/bbin/curl:
+    exists: true
+    mode: "0755"
diff --git a/apps/emqx-init/ci/latest.sh b/apps/emqx-init/ci/latest.sh
new file mode 100755
index 0000000..840f2dc
--- /dev/null
+++ b/apps/emqx-init/ci/latest.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+version="1.0.0"
+printf "%s" "${version}"
diff --git a/apps/emqx-init/entrypoint.sh b/apps/emqx-init/entrypoint.sh
new file mode 100755
index 0000000..8746516
--- /dev/null
+++ b/apps/emqx-init/entrypoint.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+: "${INIT_EMQX_HOST:=localhost}"
+: "${INIT_EMQX_PORT:=18083}"
+: "${INIT_EMQX_SUPER_USER}"
+: "${INIT_EMQX_SUPER_PASS}"
+: "${INIT_EMQX_ACCESS_KEY}"
+: "${INIT_EMQX_SECRET_KEY}"
+: "${INIT_EMQX_IS_SUPERUSER:=false}"
+: "${INIT_EMQX_TOPIC:=${INIT_EMQX_ACCESS_KEY}/*}"
+
+INIT_EMQX_BASE_API_URL="http://${INIT_EMQX_SUPER_USER}:${INIT_EMQX_SUPER_PASS}@${INIT_EMQX_HOST}:${INIT_EMQX_PORT}/api/v5"
+INIT_EMQX_AUTHN_API_URL="${INIT_EMQX_BASE_API_URL}/authentication/password_based:built_in_database/users"
+INIT_EMQX_AUTHZ_API_URL="${INIT_EMQX_BASE_API_URL}/authorization/sources/built_in_database/username"
+
+while ! curl -s "${INIT_EMQX_AUTHN_API_URL}"; do
+    echo 'Waiting for EMQX to start...'
+    sleep 5
+done
+
+echo 'EMQX started, ready to initialize...';
+
+# Authentication
+curl -s "${INIT_EMQX_AUTHN_API_URL}" \
+     -H 'Content-Type: application/json' \
+     -d "$(cat <<EOF
+    {
+        "user_id": "${INIT_EMQX_ACCESS_KEY}",
+        "password": "${INIT_EMQX_SECRET_KEY}",
+        "is_superuser": "${INIT_EMQX_IS_SUPERUSER}"
+    }
+EOF
+)"
+echo 'EMQX access key created!'
+
+# Superuser does not need authorization
+if [ "${INIT_EMQX_IS_SUPERUSER}" -eq "true" ]; then
+    return
+fi
+
+# Authorization
+curl -s "${INIT_EMQX_AUTHZ_API_URL}" \
+     -H 'Content-Type: application/json' \
+     -d "$(cat <<EOF
+    [
+        {
+            "username": "${INIT_EMQX_ACCESS_KEY}",
+            "rules": [
+                {
+                    "action": "all",
+                    "permission": "allow",
+                    "topic": "${INIT_EMQX_TOPIC}"
+                }
+            ]
+        }
+    ]
+EOF
+)"
+echo 'EMQX authorization created!'
diff --git a/apps/emqx-init/metadata.yaml b/apps/emqx-init/metadata.yaml
new file mode 100644
index 0000000..b82f7a9
--- /dev/null
+++ b/apps/emqx-init/metadata.yaml
@@ -0,0 +1,10 @@
+---
+app: emqx-init
+semver: true
+channels:
+  - name: stable
+    platforms: ["linux/amd64"]
+    stable: true
+    tests:
+      enabled: true
+      type: cli