feat: Try initial release

* Feed initial codebase

.dockerignore

@@ -0,0 +1 @@
+.env

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  # Maintain dependencies for npm
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  # Maintain dependencies for docker
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/main.yml

@@ -0,0 +1,96 @@
+name: Build, release and publish
+on:
+  push:
+    branches:
+      - master
+      - next
+      - beta
+      - alpha
+      - '*.x'
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    types:
+      - closed
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  release:
+    name: Build, release and publish
+    # needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
+    # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
+    if: ${{ github.event_name == 'push' || github.event.pull_request.merged == true }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Setup Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: "lts/*"
+          cache: npm
+      - name: Setup semantic-release
+        run: yarn install
+      - name: Pre Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release -e ./pre-release.js
+      - name: Inject VERSION into workflow
+        run: |
+          echo VERSION=$(cat VERSION) >> $GITHUB_ENV
+        shell: bash
+      - name: Check for a bump
+        id: bump
+        continue-on-error: true
+        run: git diff --exit-code VERSION
+      # - name: Login to DockerHub
+      #   if: ${{ success() && steps.bump.outcome == 'failure' }}
+      #   uses: docker/login-action@v2
+      #   with:
+      #     username: ${{ secrets.DOCKERHUB_USERNAME }}
+      #     password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        if: ${{ success() && steps.bump.outcome == 'failure' }}
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Docker meta
+        if: ${{ success() && steps.bump.outcome == 'failure' }}
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            # ${{ github.repository }}
+            ghcr.io/${{ github.repository }}
+          tags: |
+            # use custom value instead of git tag
+            type=semver,pattern={{version}},value=v${{ env.VERSION }}
+      - name: Docker build and publish
+        if: ${{ success() && steps.bump.outcome == 'failure' }}
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+      - name: Publish GitHub Release on bump
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release -e ./release.js

.gitignore

@@ -0,0 +1,108 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+**/node_modules/
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Microbundle cache
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+**/.env
+**/.env/
+env
+**/env
+**/env/
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# Next.js build output
+.next
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+
+# Gatsby files
+.cache/
+# Comment in the public line in if your project uses Gatsby and *not* Next.js
+# https://nextjs.org/blog/next-9-1#public-directory-support
+# public
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# TernJS port file
+.tern-port

Dockerfile

@@ -0,0 +1,63 @@
+FROM dexidp/dex:v2.33.0
+
+LABEL org.opencontainers.image.title="dns3l auth"
+LABEL org.opencontainers.image.description="An OIDC provider for DNS3L"
+LABEL org.opencontainers.image.version=0.0.0
+
+ENV VERSION=0.0.0
+
+ENV PAGER=less
+
+ARG http_proxy
+ARG https_proxy
+ARG no_proxy
+
+# provided via BuildKit
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+
+# defaults for none BuildKit
+ENV _platform=${TARGETPLATFORM:-linux/amd64}
+ENV _os=${TARGETOS:-linux}
+ENV _arch=${TARGETARCH:-amd64}
+ENV _variant=${TARGETVARIANT:-}
+
+ENV DEXPATH="/home/dex"
+ENV DEX_FRONTEND_DIR="/srv/dex/web"
+ENV DEX="/srv/dex"
+
+ARG DEXUID=10042
+ARG DEXGID=10042
+
+USER root
+RUN apk --update upgrade && \
+    apk add --no-cache \
+        ca-certificates curl less bash busybox-extras \
+        joe tzdata coreutils openssl \
+        apache2-utils uuidgen && \
+    addgroup -g ${DEXGID} dex && \
+    adduser -D -u ${DEXUID} -G dex dex && \
+    chmod g-s ${DEXPATH} && \
+    chown dex:dex ${DEXPATH} && \
+    rm -rf /var/cache/apk/*
+
+# Install Mo Mustache
+#
+ENV MO_VERSION="2.2.0"
+RUN curl -fsSL https://github.com/tests-always-included/mo/archive/$MO_VERSION.tar.gz | \
+      tar -xO -zf- mo-$MO_VERSION/mo > /mo && \
+    chmod a+x /mo
+
+COPY --chown=dex:dex web/ ${DEXPATH}
+COPY --chown=root:root config.docker.yaml /etc/dex/config.yaml.mustache
+COPY --chown=root:root docker-entrypoint.sh /entrypoint.sh
+
+USER dex
+WORKDIR $DEXPATH
+
+EXPOSE 5556
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["dex", "serve", "/home/dex/config.yaml"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 dns3l
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,46 @@
+[![CI workflow](https://img.shields.io/github/workflow/status/dns3l/auth/main?label=ci&logo=github)](https://github.com/dns3l/auth/actions/workflows/main.yml)
+[![GitHub release](https://img.shields.io/github/release/dns3l/auth.svg&logo=github)](https://github.com/dns3l/auth/releases/latest)
+[![Semantic Release](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/semantic-release/semantic-release)
+![License](https://img.shields.io/github/license/dns3l/auth)
+
+## [Dex][1] OIDC provider backend for DNS3L
+
+`docker pull ghcr.io/dns3l/auth`
+
+[1]: https://dexidp.io/
+
+### Configuration
+
+| variable | note | default |
+| --- | --- | --- |
+| ENVIRONMENT | `production` or other deployments | |
+| DEX_URL | published Dex endpoint | `http://localhost:5556/auth` |
+| DNS3L_URL | published DNS3L endpoint | `http://localhost:3000` |
+| HELP_URL | provide help regarding auth | `https://github.com/dns3l/dns3l` |
+| DNS3L_USER | local account(s) UID | `certbot` |
+| DNS3L_USERNAME | local account username | `CertBOT` |
+| DNS3L_USERMAIL | local account e-mail | `[email protected]` |
+| DNS3L_PASS | local account(s) password | random |
+| DNS3L_CLI_SECRET | CLI shared secret | random |
+| LDAP_CONNECTOR_NAME | UI display name | `LDAP` |
+| LDAP_CONNECTOR_HOST | AD/LDAP server | `localhost:636` |
+| LDAP_CONNECTOR_PROMPT | UI prompt | `LDAP Username` |
+| LDAP_TLS_VERIFY | enforce TLS validation | `no` |
+| LDAP_STARTTLS | use `STARTTLS` | `no` |
+| LDAP_BindDN | DN to bind | |
+| LDAP_BindPW | password for bind DN | |
+| LDAP_USER_BASE | [ldap connector][2] | `ou=users,dc=localhost` |
+| LDAP_USER_FILTER | [ldap connector][2] | `(objectClass=*)` |
+| LDAP_GROUP_BASE | [ldap connector][2] | `ou=groups,dc=localhost` |
+| LDAP_GROUP_FILTER | [ldap connector][2] | `(objectClass=*)` |
+| LDAP_USER_ID_ATTR | [ldap connector][2] | `DN` |
+| LDAP_USER_UID_ATTR | [ldap connector][2] | `sAMAccountName` |
+| LDAP_USER_MAIL_ATTR | [ldap connector][2] | `mail` |
+| LDAP_USER_NAME_ATTR | [ldap connector][2] | `displayName` |
+| LDAP_GROUP_NAME_ATTR | [ldap connector][2] | `cn` |
+| LDAP_GROUP_USER_ATTR | [ldap connector][2] | `DN` |
+| LDAP_GROUP_MEMBER_ATTR | [ldap connector][2] | `member` |
+
+[2]: https://dexidp.io/docs/connectors/ldap/
+
+If `ENVIRONMENT` is `production` and `LDAP_BindDN`, `LDAP_BindPW` are set the LDAP connector is configured only.

VERSION

@@ -0,0 +1 @@
+0.0.0

bump.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+echo "${1}" > VERSION
+sed -i -e "/^ENV VERSION=.*/s/.*/ENV VERSION=${1}/" Dockerfile
+sed -i -e "/org.opencontainers.image.version=.*/s/.*/LABEL org.opencontainers.image.version=${1}/" Dockerfile