Update cs.py změna Organizační jednotky, Zařízení, Pobočky

- Split image to nginx and decidim
 - Make database migrations persistent, resolves #486

.gitlab/issue_templates/Issue.md

@@ -1,13 +0,0 @@
-### Steps to reproduce
-1. 
-2. 
-3. 
-
-### Expected behaviour
-
-
-### Observed behaviour
-
-
-### Additional data (ticket URL, log, timestamp, stack trace etc.)
-

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "app-vmmgr"]
+	path = apk/vmmgr
+	url = ssh://git@git.spotter.cz:2222/Spotter-Cluster/vmmgr.git
+[submodule "spoc"]
+	path = apk/spoc
+	url = ssh://git@git.spotter.cz:2222/Spotter-Cluster/spoc.git

00-install.sh

@@ -1,30 +0,0 @@
-#!/bin/bash
-
-# For production builds change to DEBUG=0 or comment the line entirely
-export DEBUG=1
-
-SOURCE_DIR=$(realpath $(dirname "${0}"))
-
-# Install shared packages and perform OS customization
-${SOURCE_DIR}/01-basic.sh
-
-# Install applications
-${SOURCE_DIR}/ckan.sh
-# ${SOURCE_DIR}/crisiscleanup.sh
-# ${SOURCE_DIR}/cts.sh
-${SOURCE_DIR}/gnuhealth.sh
-${SOURCE_DIR}/kanboard.sh
-${SOURCE_DIR}/mifosx.sh
-${SOURCE_DIR}/motech.sh
-${SOURCE_DIR}/openmapkit.sh
-${SOURCE_DIR}/pandora.sh
-${SOURCE_DIR}/sahana.sh
-${SOURCE_DIR}/sambro.sh
-${SOURCE_DIR}/seeddms.sh
-${SOURCE_DIR}/sigmah.sh
-${SOURCE_DIR}/ushahidi.sh
-
-# Perform cleanup only if DEBUG environment variable is not set
-if [ ${DEBUG:-0} -eq 0 ]; then
-    ${SOURCE_DIR}/zz-cleanup.sh
-fi

01-basic.sh

@@ -1,166 +0,0 @@
-#!/bin/bash
-
-SOURCE_DIR=$(realpath $(dirname "${0}"))/basic
-export DEBIAN_FRONTEND="noninteractive"
-
-# Uninstall unnecessary packages
-apt-get -y purge bsdmainutils dictionaries-common emacsen-common iamerican ibritish ienglish-common installation-report ispell laptop-detect nano os-prober task-english tasksel tasksel-data wamerican
-
-# Install useful packages
-apt-get -y update
-apt-get -y --no-install-recommends install apt-transport-https bash-completion ca-certificates curl file git htop ntp openssl sudo tree unzip vim
-
-
-######
-# OpenSSH and user settings
-#####
-
-# Install OpenSSH server
-apt-get -y --no-install-recommends install openssh-server
-mkdir ~/.ssh
-cp ${SOURCE_DIR}/root/.ssh/authorized_keys /root/.ssh/authorized_keys
-
-# Copy profile files and settings
-mkdir -p /root/.config/htop
-cp ${SOURCE_DIR}/root/.bashrc /root/.bashrc
-cp ${SOURCE_DIR}/root/.config/htop/htoprc /root/.config/htop/htoprc
-cp ${SOURCE_DIR}/root/.vimrc /root/.vimrc
-
-# Remove default user
-deluser --remove-all-files user 2>/dev/null
-
-
-#####
-# System boot
-#####
-
-# Rename encrypted partition
-sed -i 's/sda2_crypt/system/' /etc/crypttab
-dmsetup rename sda2_crypt system
-
-# Suppress warnings during boot
-cp ${SOURCE_DIR}/usr/share/initramfs-tools/scripts/local-top/lvm2 /usr/share/initramfs-tools/scripts/local-top/lvm2
-cp ${SOURCE_DIR}/usr/share/initramfs-tools/scripts/local-top/cryptroot /usr/share/initramfs-tools/scripts/local-top/cryptroot
-
-# Set GRUB options
-cp ${SOURCE_DIR}/etc/default/grub /etc/default/grub
-
-# Set legal banner with URL + latin2 character set
-cp ${SOURCE_DIR}/etc/default/console-setup /etc/default/console-setup
-cp ${SOURCE_DIR}/etc/issue /etc/issue
-dpkg-reconfigure console-setup
-
-# Forbid login on tty1, disable tty2-6
-cp ${SOURCE_DIR}/lib/systemd/system/getty@.service /lib/systemd/system/getty@.service
-systemctl mask getty-static
-
-# Update initramfs and GRUB
-update-initramfs -u
-update-grub
-
-
-#####
-# Postfix
-#####
-
-# Preconfigure
-echo postfix postfix/main_mailer_type string "Satellite system" | debconf-set-selections
-echo postfix postfix/mailname string "$(hostname -f)" | debconf-set-selections
-echo postfix postfix/relayhost string "" | debconf-set-selections
-
-# Install packages
-apt-get -y --no-install-recommends install postfix
-
-# Configure Postfix
-cp ${SOURCE_DIR}/etc/postfix/main.cf /etc/postfix/main.cf
-
-# Restart services
-systemctl restart postfix
-
-
-#####
-# Nginx + uWSGI
-#####
-
-# Install packages
-apt-get -y --no-install-recommends install nginx-light uwsgi uwsgi-plugin-python
-
-# Create a self-signed certificate
-openssl req -x509 -new -out /etc/ssl/certs/services.pem -keyout /etc/ssl/private/services.key -nodes -days 3654 -subj "/C=CZ/CN=$(hostname -f)"
-chgrp ssl-cert /etc/ssl/private/services.key
-chmod 640 /etc/ssl/private/services.key
-
-# Configure nginx
-mkdir /etc/nginx/apps-available /etc/nginx/apps-enabled
-cp ${SOURCE_DIR}/etc/nginx/nginx.conf /etc/nginx/nginx.conf
-cp ${SOURCE_DIR}/etc/nginx/sites-available/default /etc/nginx/sites-available/default
-
-# Workaround for web2py shutdown problem, see https://github.com/web2py/web2py/issues/1769
-sed -i 's|QUIT/30|QUIT/5|' /usr/share/uwsgi/init/specific_daemon
-
-# Copy Portal resources
-cp -r ${SOURCE_DIR}/usr/local/bin/portal-app-manager /usr/local/bin/portal-app-manager
-cp -r ${SOURCE_DIR}/srv/portal /srv/portal
-chown -R www-data:www-data /srv/portal
-
-# Restart
-systemctl restart nginx
-
-
-#####
-# PostgreSQL + PostGIS
-#####
-
-# Install packages
-apt-get -y --no-install-recommends install postgresql-9.6 postgresql-9.6-postgis postgresql-contrib-9.6
-
-# Install Czech search data
-wget http://postgres.cz/data/czech.tar.gz -O /tmp/czech.tar.gz
-tar xzf /tmp/czech.tar.gz -C /usr/share/postgresql/9.6/tsearch_data --strip-components 1
-chown root:root /usr/share/postgresql/9.6/tsearch_data/czech.*
-rm -f /tmp/czech.tar.gz
-
-# Configure
-cp ${SOURCE_DIR}/etc/postgresql/9.6/main/postgresql.conf /etc/postgresql/9.6/main/postgresql.conf
-cp ${SOURCE_DIR}/etc/postgresql/9.6/main/pg_hba.conf /etc/postgresql/9.6/main/pg_hba.conf
-
-# Enable query logging. Only if the DEBUG environment variable is set
-if [ ${DEBUG:-0} -eq 1 ]; then
-    sed -i 's/#log_destination/log_destination/' /etc/postgresql/9.6/main/postgresql.conf
-    sed -i 's/#logging_collector/logging_collector/' /etc/postgresql/9.6/main/postgresql.conf
-    sed -i 's/#log_directory/log_directory/' /etc/postgresql/9.6/main/postgresql.conf
-    sed -i 's/#log_statement/log_statement/' /etc/postgresql/9.6/main/postgresql.conf
-fi
-
-# Restart
-systemctl restart postgresql
-
-
-#####
-# MariaDB
-#####
-
-# Install packages
-apt-get -y --no-install-recommends install mariadb-server
-
-# Enable query logging. Only if the DEBUG environment variable is set
-if [ ${DEBUG:-0} -eq 1 ]; then
-    sed -i 's/#general_log/general_log/g' /etc/mysql/mariadb.conf.d/50-server.cnf
-fi
-
-# Restart
-systemctl restart mysqld
-
-
-#####
-# Tomcat
-#####
-
-# Install packages
-apt-get -y --no-install-recommends install libservlet3.1-java openjdk-8-jre-headless tomcat8
-
-# Configure
-cp ${SOURCE_DIR}/etc/tomcat8/server.xml /etc/tomcat8/server.xml
-
-# Restart
-systemctl restart tomcat8

README.md

@@ -1,145 +0,0 @@
-This is the main repository containing all installation scripts, configuration and customization of operating system all application present in Spotter Cluster virtual machine.
-
-## Operating system preparation
-
-### Virtual machine specifications
-- **Memory:** 4 GB
-- **CPU:** 1 processor, 2 cores
-- **Hard Disk:** SCSI, 60 GB
-
-### Operating system media download
-Download **Debian 9.0.0 amd64 netinstall** from <https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/> and launch Text-mode installation
-
-## Operating system installation
-
-### Locale settings
-- **Language:** English
-- **Country, territory or area:** other
-- **Continent or region:** Europe
-- **Country, territory or area:** Czech Republic
-- **Country to base default locale settings on:** United States - en_US.UTF-8
-- **Keymap to use:** American English
-
-### Hostname
-- **Hostname:** debian
-- **Domain name:** [leave blank]
-
-### Users
-- **Root password:** [random password of your choice]
-- **Full name for the new user:** user
-- **Username for your account:** user
-- **Choose a password for the new user:** [random passowrd of your choice]
-
-Note: The *user* account will be deleted afterwards as part of installation steps.
-
-### Partitions
-- **Partitioning method:** Manual
-1. Create empty partition table on SCSI1 (0,0,0) (sda)
-2. Create new partition
-   - **New partition size:** 256 MB
-   - **Type for the new partition:** Primary
-   - **Location for the new partition:** Beginning
-   - Definition
-     - **Use as:** Ext2 file system  
-     - **Format the partition:** yes, format it  
-     - **Mount point:** /boot  
-     - **Mount options:** default  
-     - **Label:** none  
-     - **Reserved blocks:** 5%  
-     - **Typical usage:** standard  
-     - **Bootable flag:** on
-3. Create new partition
-   - **New partition size:** [maximum]
-   - **Type for the new partition:** Primary
-   - **Location for the new partition:** Beginning
-   - Definition
-     - **Use as:** physical volume for encryption  
-     - **Encryption method:** Device-mapper (dm-crypt)  
-     - **Encryption:** aes  
-     - **Key size:** 128  
-     - **IV algorithm:** xts-plain64  
-     - **Encryption key:** Passphrase  
-     - **Erase data:** no  
-     - **Bootable flag:** off
-4. Configure encrypted volumes
-   - Create encrypted volumes
-   - /dev/sda2
-   - Finish
-   - **Encryption passphrase:** [random]
-5. Select encrypted volume (sda2_crypt), partition #1
-   - **Use as:** physical volume for LVM
-6. Configure the Logical Volume Manager
-   - Create volume group
-     - **Volume group name:** vg0
-     - **Devices for the new volume group:** /dev/mapper/sda2_crypt
-   - Create logical volume
-     - **Volume group:** vg0
-     - **Logical volume name:** swap
-     - **Logical volume size:** 4 GB
-   - Create logical volume
-     - **Volume group:** vg0
-     - **Logical volume name:** root
-     - **Logical volume size:** [maximum]
-   - Finish
-7. Select LVM VG vg0, LV root, partition #1
-   - Definition
-     - **Use as:** Ext4 journaling file system  
-     - **Mount point:** /  
-     - **Mount options:** noatime  
-     - **Label:** none  
-     - **Reserved blocks:** 1%  
-     - **Typical usage:** standard
-8. Select LVM VG vg0, LV swap, partition #1
-   - **Use as:** swap area
-9. Finish partitioning and write changes to disk
-
-### Packages
-- **Scan another CD or DVD?:** No
-- **Debian archive mirror counrty:** Czechia
-- **Debian archive mirror:** ftp.cz.debian.org
-- **HTTP proxy information:** [leave blank]
-- **Participate in package survey:** No
-- **Choose software to install:** [unselect all]
-
-### Bootloader
-- **Install the GRUB boot loader to the master boot record?:** yes
-- **Device for boot loader installation:** /dev/sda
-
-## Application installation
-
-### First time setup
-```
-# Update package info
-apt update
-
-# Install git
-apt install git
-
-# Clone the repository
-git clone https://gitlab.dasm.cz:8443/Spotter-Cluster/Spotter-Cluster.git
-
-# Enter the repository directory
-cd Spotter-Cluster
-
-# Optional: Edit the install sequence script
-vi 00-install.sh
-
-# Launch the script
-./00-install.sh
-```
-
-### Resuming from a snapshot
-Assumes that the repository has already been cloned.
-```
-# Enter the repository directory
-cd Spotter-Cluster
-
-# Update repository
-git pull
-
-# Optional: Edit the install sequence script
-vi 00-install.sh
-
-# Launch the script
-./00-install.sh
-```

apk/py3-secure-cookie/APKBUILD

@@ -0,0 +1,28 @@
+# Maintainer: Disassembler <disassembler@dasm.cz>
+pkgname=py3-secure-cookie
+_pkgname=secure-cookie
+pkgver=0.1.0
+pkgrel=0
+pkgdesc="Secure cookie and session interface for WSGI applications"
+url="https://secure-cookie.readthedocs.io/"
+arch="noarch"
+license="MIT"
+depends="python3"
+makedepends="py3-setuptools"
+checkdepends="py3-pytest py3-werkzeug"
+source="https://files.pythonhosted.org/packages/source/${_pkgname:0:1}/$_pkgname/$_pkgname-$pkgver.tar.gz"
+builddir="$srcdir/$_pkgname-$pkgver"
+
+build() {
+	python3 setup.py build
+}
+
+package() {
+	python3 setup.py install --prefix=/usr --root="$pkgdir"
+}
+
+check() {
+	PYTHONPATH=$PWD/build/lib pytest
+}
+
+sha512sums="2e57dba6f73ceb03eda33c804dbe2277c9fe700dd1be219bb3d8d43a5c9105c2323fb6b28d74d3a1dfc8fbbd938b91ab54d3e1bac1dc74490335b1d27e43b55a  secure-cookie-0.1.0.tar.gz"

apk/spoc

@@ -0,0 +1 @@
+Subproject commit 8c22df2e71de329a286e75af9bff69e82876db35

apk/vmmgr

@@ -0,0 +1 @@
+Subproject commit 1c810db9472f50bd9dbe1e0f38df72590b120124

basic/etc/default/console-setup

@@ -1,16 +0,0 @@
-# CONFIGURATION FILE FOR SETUPCON
-
-# Consult the console-setup(5) manual page.
-
-ACTIVE_CONSOLES="/dev/tty[1-6]"
-
-CHARMAP="UTF-8"
-
-CODESET="Lat2"
-FONTFACE="Fixed"
-FONTSIZE="8x16"
-
-VIDEOMODE=
-
-# The following is an example how to use a braille font
-# FONT='lat9w-08.psf.gz brl-8x8.psf'

basic/etc/default/grub

@@ -1,34 +0,0 @@
-# If you change this file, run 'update-grub' afterwards to update
-# /boot/grub/grub.cfg.
-# For full documentation of the options in this file, see:
-#   info -f grub -n 'Simple configuration'
-
-GRUB_DEFAULT=0
-GRUB_TIMEOUT=0
-GRUB_RECORDFAIL_TIMEOUT=0
-GRUB_FORCE_HIDDEN_MENU="true"
-GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
-GRUB_CMDLINE_LINUX_DEFAULT="quiet loglevel=0"
-GRUB_CMDLINE_LINUX=""
-
-# Uncomment to enable BadRAM filtering, modify to suit your needs
-# This works with Linux (no patch required) and with any kernel that obtains
-# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
-#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
-
-# Uncomment to disable graphical terminal (grub-pc only)
-#GRUB_TERMINAL=console
-
-# The resolution used on graphical terminal
-# note that you can use only modes which your graphic card supports via VBE
-# you can see them in real GRUB with the command `vbeinfo'
-#GRUB_GFXMODE=640x480
-
-# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
-#GRUB_DISABLE_LINUX_UUID=true
-
-# Uncomment to disable generation of recovery mode menu entries
-GRUB_DISABLE_RECOVERY="true"
-
-# Uncomment to get a beep at grub start
-#GRUB_INIT_TUNE="480 440 1"

basic/etc/issue

@@ -1,36 +0,0 @@
-
-   _____             _   _               _____ _           _            
-  / ____|           | | | |             / ____| |         | |           
- | (___  _ __   ___ | |_| |_ ___ _ __  | |    | |_   _ ___| |_ ___ _ __ 
-  \\___ \\| '_ \\ / _ \\| __| __/ _ \\ '__| | |    | | | | / __| __/ _ \\ '__|
-  ____) | |_) | (_) | |_| ||  __/ |    | |____| | |_| \\__ \\ ||  __/ |   
- |_____/| .__/ \\___/ \\__|\\__\\___|_|     \\_____|_|\\__,_|___/\\__\\___|_|   
-        | |                                                             
-        |_|
-
-
-
-
- UPOZORNĚNÍ: Neoprávněný přístup k tomuto zařízení je zakázán.
- Musíte mít výslovné oprávnění k přístupu nebo konfiguraci tohoto zařízení.
- Neoprávněné pokusy a kroky k přístupu nebo používání tohoto systému mohou mít
- za následek občanské nebo trestní sankce.
-
-
- CAUTION: Unauthozired access to this device is prohibited.
- You must have explicit, authorized permission to access or configure this
- device. Unauthorized attempts and actions to access or use this system may
- result in civil or criminal penalties.
-
-
-
-
- Pro přístup k aplikacím otevřete URL https://\4/ ve Vašem
- internetovém prohlížeči.
-
-
-
-
-
-
-

basic/etc/nginx/nginx.conf

@@ -1,94 +0,0 @@
-user www-data;
-worker_processes auto;
-pid /run/nginx.pid;
-include /etc/nginx/modules-enabled/*.conf;
-
-events {
-	worker_connections 768;
-	# multi_accept on;
-}
-
-http {
-
-	##
-	# Basic Settings
-	##
-
-	sendfile on;
-	tcp_nopush on;
-	tcp_nodelay on;
-	keepalive_timeout 65;
-	types_hash_max_size 2048;
-	# server_tokens off;
-
-	# server_names_hash_bucket_size 64;
-	# server_name_in_redirect off;
-
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-
-	client_max_body_size 100m;
-
-	##
-	# SSL Settings
-	##
-
-	ssl_protocols TLSv1.2;
-	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
-	ssl_prefer_server_ciphers on;
-	ssl_session_cache shared:SSL:1m;
-	ssl_session_timeout 1d;
-	ssl_session_tickets off;
-	ssl_certificate /etc/ssl/certs/services.pem;
-	ssl_certificate_key /etc/ssl/private/services.key;
-
-	##
-	# Logging Settings
-	##
-
-	access_log /var/log/nginx/access.log;
-	error_log /var/log/nginx/error.log;
-
-	##
-	# Gzip Settings
-	##
-
-	gzip on;
-	gzip_disable "msie6";
-
-	# gzip_vary on;
-	# gzip_proxied any;
-	# gzip_comp_level 6;
-	# gzip_buffers 16 8k;
-	# gzip_http_version 1.1;
-	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-
-	##
-	# Virtual Host Configs
-	##
-
-	include /etc/nginx/conf.d/*.conf;
-	include /etc/nginx/sites-enabled/*;
-}
-
-
-#mail {
-#	# See sample authentication script at:
-#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
-# 
-#	# auth_http localhost/auth.php;
-#	# pop3_capabilities "TOP" "USER";
-#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
-# 
-#	server {
-#		listen     localhost:110;
-#		protocol   pop3;
-#		proxy      on;
-#	}
-# 
-#	server {
-#		listen     localhost:143;
-#		protocol   imap;
-#		proxy      on;
-#	}
-#}

basic/etc/nginx/sites-available/default

@@ -1,21 +0,0 @@
-server {
-    listen 80;
-    listen [::]:80;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
-    add_header Strict-Transport-Security "max-age=31536000;";
-
-    root /srv/portal;
-    index index.html;
-
-    location / {
-        try_files $uri $uri/ =404;
-    }
-
-    include /etc/nginx/apps-enabled/*;
-}

basic/etc/postfix/main.cf

@@ -1,13 +0,0 @@
-append_dot_mydomain = no
-biff = no
-compatibility_level = 2
-inet_interfaces = loopback-only
-inet_protocols = ipv4
-mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
-recipient_delimiter = +
-smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
-smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
-smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
-smtpd_use_tls=yes
-smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_use_tls=yes

basic/etc/postgresql/9.6/main/pg_hba.conf

@@ -1,4 +0,0 @@
-local all postgres         peer
-local all all              md5
-host  all all 127.0.0.1/32 md5
-host  all all ::1/128      md5

basic/lib/systemd/system/getty@.service

@@ -1,53 +0,0 @@
-#  This file is part of systemd.
-#
-#  systemd is free software; you can redistribute it and/or modify it
-#  under the terms of the GNU Lesser General Public License as published by
-#  the Free Software Foundation; either version 2.1 of the License, or
-#  (at your option) any later version.
-
-[Unit]
-Description=Getty on %I
-Documentation=man:agetty(8) man:systemd-getty-generator(8)
-Documentation=http://0pointer.de/blog/projects/serial-console.html
-After=systemd-user-sessions.service plymouth-quit-wait.service
-After=rc-local.service
-
-# If additional gettys are spawned during boot then we should make
-# sure that this is synchronized before getty.target, even though
-# getty.target didn't actually pull it in.
-Before=getty.target
-IgnoreOnIsolate=yes
-
-# IgnoreOnIsolate causes issues with sulogin, if someone isolates
-# rescue.target or starts rescue.service from multi-user.target or
-# graphical.target.
-Conflicts=rescue.service
-Before=rescue.service
-
-# On systems without virtual consoles, don't start any getty. Note
-# that serial gettys are covered by serial-getty@.service, not this
-# unit.
-ConditionPathExists=/dev/tty0
-
-[Service]
-# the VT is cleared by TTYVTDisallocate
-ExecStart=-/sbin/agetty -l /usr/sbin/nologin %I $TERM
-Type=idle
-Restart=always
-RestartSec=0
-UtmpIdentifier=%I
-TTYPath=/dev/%I
-TTYReset=yes
-TTYVHangup=yes
-TTYVTDisallocate=yes
-KillMode=process
-IgnoreSIGPIPE=no
-SendSIGHUP=yes
-
-# Unset locale for the console getty since the console has problems
-# displaying some internationalized messages.
-Environment=LANG= LANGUAGE= LC_CTYPE= LC_NUMERIC= LC_TIME= LC_COLLATE= LC_MONETARY= LC_MESSAGES= LC_PAPER= LC_NAME= LC_ADDRESS= LC_TELEPHONE= LC_MEASUREMENT= LC_IDENTIFICATION=
-
-[Install]
-WantedBy=getty.target
-DefaultInstance=tty1

basic/root/.bashrc

@@ -1,25 +0,0 @@
-shopt -s histappend
-HISTSIZE=10000
-HISTFILESIZE=20000
-HISTTIMEFORMAT="(%F %T)  "
-PROMPT_COMMAND="history -a"
-
-case "$TERM" in
-xterm*|rxvt*)
-    PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\H:\w\a\]$PS1"
-    ;;
-*)
-    ;;
-esac
-
-eval "`dircolors`"
-COLOR="--color=auto"
-
-if [ -f /etc/bash_completion ]; then
-   . /etc/bash_completion
-fi
-
-alias ls='ls --color=auto'
-alias ll='ls -la --color=auto'
-alias l='ls -a --color=auto'
-alias grep='grep --color=auto'

basic/root/.ssh/authorized_keys

@@ -1,2 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILc3Mu7OlKrV7VqDQZ31vT3I3JJxtNNBiemUTRQVOZ3I Disassembler
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMLx88cP67gOmmwDj2vjnPZnZp4KT/aqAkIEVBasss073wtU+tHAia5qKB+PJau3WnUSid/ZVcwHNXgrXE69DS2ZlBQFFBCJdWKP1Pd528Ot66mw9FaZvxRLaeA60yxC9dTFD0WCyVJw3HSdkJf17NYTtKcPQcn5DGfrdPHX16C3KUxOJXveTBOiieWbkQ1uUCTYyfeR9Qj+RR0gPogK217dNxGd4F3PJ3hXPKWDVpSH9JBnpG64mab3krhb6/eMUnLPUUAtgF6b0vXWNahFlA3NsriQiJy5mroLQCL2feqfkGVKlbxpRwgkGOPph4UK6RgNehF7oPwni/zMQ2rjxbpIWredlOPNvU7F8BebiuU8K4/16tz6xRiSgYzpm9nTHvJaz3W12b8Co145zPcmIdRg5KCQDEf+xB7gfpK/uo3qmc7ddMtA4oqUztbAlpfW6qR+i4X5ed9LnWdMKoWeB5Xn52cbKuTvD1qmVWGm0IPF/r+hw7Gn97nyq1Oatn9LKTJaLZeaJ9b1nBGL56U5i+4hdZPema7tVgWEYfYKTq4hrKWdWwJjlpJjqZ2qLltJmkJMNji9Ve+xBe+nRjW9wNk7c7fDxPvJe45EbrqDQNFxXjw4CKOIIt/k6e/imrVf9S7Or4Vxi+OJCQLZYT8EPb/VUuPn0JhtpIlBvD3xCDjw== vampola.karel@gmail.com

basic/root/.vimrc

@@ -1,2 +0,0 @@
-runtime! defaults.vim
-set mouse-=a

basic/srv/portal/css/style.css

@@ -1,85 +0,0 @@
-* {
-    margin: 0;
-    padding: 0;
-    border: 0;
-}
-
-body {
-    font-family: 'Calibri', 'Verdana', 'Tahoma', sans-serif;
-    background-color: silver;
-    color: black;
-    line-height: 150%;
-    margin: 25px 30px;
-}
-
-a {
-    text-decoration: none;
-}
-
-h1, h2 {
-    font-size: 150%;
-    font-weight: normal;
-}
-
-h2 a {
-    color: inherit;
-}
-
-h2 img {
-    float: right;
-    margin-left: 10px;
-    margin-bottom:10px;
-    width: 100px;
-    height: 100px;
-}
-
-ul {
-    margin-left: 30px;
-}
-
-header {
-    color: white;
-}
-
-header h1 {
-    font-weight: bold;
-}
-
-header p {
-    padding: 0px;
-    margin: 0px;
-}
-
-.c, .c2 {
-    background-color: white;
-    position: relative;
-    min-width: 365px;
-    max-width: 365px;
-    width: 90%;
-    float: left;
-    min-height: 175px;
-    margin-top: 13px;
-    margin-right: 13px;
-    border: solid 1px black;
-    padding: 10px;
-}
-
-.c {
-    display: none;
-}
-
-.c2 {
-    max-width: 765px;
-    width: 95%;
-}
-
-.ico {
-    margin-right: 5px;
-    width: 20px;
-    height: 20px;
-    vertical-align: top;
-}
-
-.cleaner {
-    clear: both;
-}

basic/srv/portal/index.html

@@ -1,276 +0,0 @@
-<!DOCTYPE html>
-<html lang="cs">
-    <head>
-        <meta charset="utf-8">
-        <meta name="author" content="TS">
-        <meta name="copyright" content="page is under CC BY-NC-ND 3.0 CZ">
-        <meta name="generator" content="Spotter.ngo">
-        <meta name="viewport" content="width=device-width, initial-scale=1">
-        <title>Cluster NGO</title>
-        <link rel="icon" href="img/cluster_spotter.png" type="image/png">
-        <link rel="stylesheet" href="css/style.css" type="text/css" media="screen">
-        <script src="js/jquery-3.2.1.min.js" type="text/javascript"></script>
-        <script src="js/script.js" type="text/javascript"></script>
-    </head>
-    <body>
-        <header>
-            <h1>CLUSTER NGO</h1>
-            <p>Sada softwarových nástrojů určená pro krizový management.</p>
-        </header>
-
-        <div class="c c2" id="sahana-eden">
-            <h2><a href="#"><img src="img/EDEN.png" alt="Sahana EDEN" title="Sahana EDEN">Sahana EDEN</a></h2>
-            <p><strong>Registr kontaktů</strong> asociací, organizací, jednotek zaměstnanců, dobrovolníků, <strong>Registr prostředků</strong>, materiálních zdrojů určených pro činnost v krizových situacích, <strong>logistika</strong> krizového zboží ve skladištích, úkrytech, <strong>organizace lidských zdrojů</strong>, diobrovolníků, <strong>mapová vizualizace</strong> pro lokalizaci a popis krizové události a <strong>mnoho dalších funkcí</strong>.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="sahana-eden-demo">
-            <h2><a href="#"><img src="img/EDEN.png" alt="Sahana EDEN DEMO" title="Sahana EDEN DEMO">Sahana EDEN DEMO</a></h2>
-            <p>Přístup určený k bezpečnému vyzkoušení aplikace. Zde můžete přidávat i mazat testovací data.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="sambro">
-            <h2><a href="#"><img src="img/EDEN.png" alt="Sahana EDEN SAMBRO" title="Sahana EDEN SAMBRO">Sahana EDEN SAMBRO</a></h2>
-            <p>Samostatná instance Sahana EDEN s šablonou SAMBRO.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="sambro-mobile">
-            <h2><a href="#"><img src="img/EDEN.png" alt="SAMBRO Mobile" title="SAMBRO Mobile">SAMBRO Mobile</a></h2>
-            <p>Mobilní klient k aplikaci Sahana EDEN. Po stažení se zaregistrujte a pro přístup k serveru zadejte IP vaší instalace Sahana EDEN.<br>
-                <a href="https://itunes.apple.com/us/app/sambro-mobile/id1127251669"><img src="img/ios.png" class="ico" alt="IOS">IOS 6.0 a vyšší</a><br>
-                <a href="https://play.google.com/store/apps/details?id=io.sahana.sambro.mobile"><img src="img/android.png" class="ico" alt="Android">Android 4.0 a vyšší</a>
-            </p>
-        </div>
-
-        <div class="c" id="crisis-cleanup">
-            <h2><a href="#"><img src="img/Crisis_Cleanup.png" alt="Crisis Cleanup" title="Crisis Cleanup">Crisis Cleanup</a></h2>
-            <p><strong>Mapování krizové pomoci</strong> při odstraňování následků katastrof a koordinaci práce. Jde o majetek, ne o lidi.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="ckan">
-            <h2><a href="#"><img src="img/CKAN.png" alt="CKAN" title="CKAN">CKAN</a></h2>
-            <p><strong>Repository</strong> management a datová analýza pro vytváření otevřených dat.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="opendatakit">
-            <h2><a href="#"><img src="img/ODK.png" alt="Open Data Kit" title="Open Data Kit">Open Data Kit</a></h2>
-            <p><strong>Sběr dat s pomocí smartphone</strong>.<br>
-                <a href="http://geoodk.com/xlsform_converter.html">XLSForm</a> - online konverter XLS.<br>
-                <a href="httbap://geoodk.com">GeoODK Collect</a> - náhrada papírových dotazníků smartphonem.
-            </p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="openmapkit">
-            <h2><a href="#"><img src="img/OMK.png" alt="Open Map Kit" title="Open Map Kit">Open Data Kit</a></h2>
-            <p><strong>Sběr dat s pomocí smartphone</strong>.<br>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="openmapkit-clients">
-            <h2><a href="#"><img src="img/OMK.png" alt="Open Map Kit" title="Open Map Kit">Open Map Kit</a></h2>
-            <p>Mobilní aplikace<br>
-                <a href="https://play.google.com/store/apps/details?id=org.odk.collect.android"><img src="img/android.png" class="ico" alt="ODK Collect">ODK Collect pro Android</a><br>
-                <a href="https://play.google.com/store/apps/details?id=org.redcross.openmapkit"><img src="img/android.png" class="ico" alt="Android">OpenMapKit pro Android 4.1 a vyšší</a>
-            </p>
-            <ul>
-                <li><strong>URL:</strong> <span class="clienturl"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="frontlinesms">
-            <h2><a href="#"><img src="img/FrontlineSMS.png" alt="FrontlineSMS" title="FrontlineSMS">FrontlineSMS</a></h2>
-            <p><strong>SMS messaging</strong> přes veřejné datové brány</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="seeddms">
-            <h2><a href="#"><img src="img/SeedDMS.png" alt="SeedDMS" title="SeedDMS">SeedDMS</a></h2>
-            <p><strong>Dokument management</strong> na dokumentaci a projektovou dokumentaci</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="pandora">
-            <h2><a href="#"><img src="img/Pandora.png" alt="Pan.do/ra" title="Pan.do/ra">Pan.do/ra</a></h2>
-            <p><strong>Media management</strong> na foto a video z krizové události. Tvorba metadat, komentářů, lokalizace v čase a na mapě.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="pandora-client">
-            <h2><a href="#"><img src="img/Pandora.png" alt="Pan.do/ra" title="Pan.do/ra">Pan.do/ra Client</a></h2>
-            <p><strong>Dávkový upload videa</strong> do aplikace Pan.do/ra. Podpora rozlišení HD. Videa nahrávejte pouze pod licencí Creative Commons nebo Public Domain.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="ushahidi">
-            <h2><a href="#"><img src="img/Ushahidi.png" alt="Ushahidi" title="Ushahidi">Ushahidi</a></h2>
-            <p>Reakce na krizovou událost. Shromažďujte zprávy od obětí a pracovníků v terénu prostřednictvím SMS, e-mailu, webu, Twitteru.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="ushahidi-mobile">
-            <h2><a href="#"><img src="img/Ushahidi_mobile.png" alt="Ushahidi" title="Ushahidi">Ushahidi Mobile</a></h2>
-            <p>Mobilní aplikace Ushahidi pro<br>
-                <a href="https://itunes.apple.com/us/app/ushahidi-mobile/id1205994516?mt=8"><img src="img/ios.png" class="ico" alt="IOS">IOS 9.0 a vyšší</a><br>
-                <a href="https://play.google.com/store/apps/details?id=com.ushahidi.mobile"><img src="img/android.png" class="ico" alt="Android">Android 4.4 a vyšší</a>
-            </p>
-        </div>
-
-        <div class="c" id="sms-sync-gateway">
-            <h2><a href="#"><img src="img/SMS_Sync.png" alt="SMS Sync Gateway" title="SMS Sync Gateway">SMS Sync Gateway</a></h2>
-            <p>Mobilní aplikace pro<br>
-                <a href="https://play.google.com/store/apps/details?id=org.addhen.smssync"><img src="img/android.png" class="ico" alt="Android">Android 2.3 a vyšší</a>
-            </p>
-        </div>
-
-        <div class="c" id="kanboard">
-            <h2><a href="#"><img src="img/Kanboard.png" alt="Kanboard" title="Kanboard">Kanboard</a></h2>
-            <p>Usnadňuje tvorbu a řízení projektů s pomocí Kanban metodiky.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="kanboard-mobile">
-            <h2><a href="#"><img src="img/Kanboard.png" alt="Kanboard" title="Kanboard">Kanboard Mobile</a></h2>
-            <p>Mobilní aplikace<br>
-                <a href="https://play.google.com/store/apps/details?id=eu.it_quality.kanboard"><img src="img/android.png" class="ico" alt="KanBoard">KanBoard client pro Android 4.1 a vyšší</a><br>
-                <a href="https://f-droid.org/packages/in.andres.kandroid/"><img src="img/android.png" class="ico" alt="Android">Kandroid pro Android 4.2 a vyšší</a>
-            </p>
-        </div>
-
-        <div class="c" id="cts">
-            <h2><a href="#"><img src="img/CTS.png" alt="CTS" title="CTS">CTS</a></h2>
-            <p>Logistika hmotné pomoci pro humanitární potřeby.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="gnuhealth">
-            <h2><a href="#"><img src="img/GNU_Health.png" alt="GNU Health" title="GNU Health">GNU Health</a></h2>
-            <p>Zdravotní a nemocniční informační systém.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-                <li><strong>Heslo k demu:</strong> <span class="demopassword">gnusolidario</span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="gnuhealth-clients">
-            <h2><a href="#"><img src="img/GNU_Health.png" alt="GNU Health" title="GNU Health">GNU Health klienti</a></h2>
-            <p>Klientské aplikace platformy Tryton GNU Health pro<br>
-                <a href="https://downloads.tryton.org/4.2/tryton-last.exe"><img src="img/Windows.png" class="ico" alt="Windows">Windows</a><br>
-                <a href="https://downloads.tryton.org/4.2/tryton-last.dmg"><img src="img/MacOS.png" class="ico" alt="MacOS">MacOS</a><br>
-                <a href="https://downloads.tryton.org/4.2/tryton-last.tar.gz"><img src="img/Linux.png" class="ico" alt="Linux">Linux</a>
-            </p>
-            <ul>
-                <li><strong>URL:</strong> <span class="clienturl"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="sigmah">
-            <h2><a href="#"><img src="img/Sigmah.png" alt="Sigmah" title="Sigmah">Sigmah</a></h2>
-            <p>Rozpočtování získávání finančních prostředků.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="motech">
-            <h2><a href="#"><img src="img/Motech.png" alt="Motech" title="Motech">Motech</a></h2>
-            <p>Integrace zdravotnických a komunikačních služeb.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="mifosx">
-            <h2><a href="#"><img src="img/MifosX.png" alt="Mifos X" title="Mifos X">Mifos X</a></h2>
-            <p>Nástroj na rozvojovou, humanitární pomoc a mikrofinancování.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="mifosx-mobile">
-            <h2><a href="#"><img src="img/MifosX_Mobile.png" alt="Mifos X" title="Mifos X">Mifos X</a></h2>
-            <p>Mobilní aplikace<br>
-                <a href="https://play.google.com/store/apps/details?id=com.mifos.mifosxdroid"><img src="img/android.png" class="ico" alt="KanBoard">Mifos X client pro Android 3.0 a vyšší</a><br>
-            </p>
-        </div>
-
-        <div class="c" id="diaspora">
-            <h2><a href="#"><img src="img/Diaspora.png" alt="diaspora*" title="diaspora*">diaspora*</a></h2>
-            <p>Autonomní sociání síť s možností propojení do cizích sociálních sítí.</p>
-            <ul>
-                <li><strong>Login:</strong> <span class="login"></span></li>
-                <li><strong>Heslo:</strong> <span class="password"></span></li>
-            </ul>
-        </div>
-
-        <div class="c" id="openid">
-            <h2><a href="http://openid.net"><img src="img/OpenID.png" alt="OpenID" title="OpenID">OpenID</a></h2>
-            <p>Pro ověření identity budete potřebovat účet OpenID. Zaregistrujte se. Registraci využijete v software Sahana EDEN.</p>
-        </div>
-
-        <div class="c" id="posm">
-            <h2><a href="#"><img src="img/POSM.png" alt="POSM" title="POSM">POSM</a></h2>
-            <p><strong>Portable Open Street Map</strong> - softwarový balík na offline používání OpenStreet Map v samostatné virtuální image.</p>
-        </div>
-
-        <div class="c" id="cluster-spotter">
-            <h2><a href="http://spotter.ngo"><img src="img/cluster_spotter.png" alt="Cluster Spotter" title="Cluster Spotter">Cluster Spotter</a></h2>
-            <p>Info o Misi a Vizi projektu, včetně kontaktu. Zachovejte data bezpečná a neposkytujte je nepovolaným osobám.<br>
-                <small>CC 4.0 CZ by <a href="http://trendspotter.cz">TS</a>. Content is based on PD, CC, GNU/GPL. Brand names, trademarks belong to their respective holders.</small>
-            </p>
-        </div>
-
-        <div class="cleaner"></div>
-    </body>
-</html>

basic/srv/portal/js/apps.json

@@ -1 +0,0 @@
-{"cluster-spotter": {}}

basic/srv/portal/js/script.js

@@ -1,12 +0,0 @@
-$(function() {
-    $.getJSON('js/apps.json', function(data) {
-        $.each(data, function(id, props) {
-            var div = $('#'+id).show();
-            if (props.hasOwnProperty('url'))
-                div.find('h2 a').attr('href', props.url.replace('{host}', window.location.hostname));
-            $.each(props, function(key, value) {
-                div.find('.'+key).text(value.replace('{host}', window.location.hostname));
-            });
-        });
-    });
-});

basic/usr/local/bin/portal-app-manager

@@ -1,33 +0,0 @@
-#!/usr/bin/env python
-
-import argparse
-import json
-
-def main(args):
-    jsonfile = '/srv/portal/js/apps.json'
-
-    data = {}
-    with open(jsonfile, 'r') as f:
-        data = json.load(f)
-    if not args.app in data:
-        data[args.app] = {}
-    if args.url:
-        data[args.app]['url'] = args.url
-    if args.login:
-        data[args.app]['login'] = args.login
-    if args.password:
-        data[args.app]['password'] = args.password
-    if args.property:
-        for key, value in args.property:
-            data[args.app][key] = value
-    with open(jsonfile, 'w') as f:
-        json.dump(data, f)
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description='Spotter Cluster portal application manager')
-    parser.add_argument('app', help='Application ID.')
-    parser.add_argument('url', nargs='?', help='URL to the application. Use "{host}" as a host placeholder.')
-    parser.add_argument('login', nargs='?', help='Administrative login.')
-    parser.add_argument('password', nargs='?', help='Administrative password.')
-    parser.add_argument('-p', '--property', nargs=2, action='append', help='Add arbitrary key-value to the application properties')
-    main(parser.parse_args())

basic/usr/share/initramfs-tools/scripts/local-top/cryptroot

@@ -1,425 +0,0 @@
-#!/bin/sh
-
-PREREQ="cryptroot-prepare"
-
-#
-# Standard initramfs preamble
-#
-prereqs()
-{
-	# Make sure that cryptroot is run last in local-top
-	for req in $(dirname $0)/*; do
-		script=${req##*/}
-		if [ $script != cryptroot ]; then
-			echo $script
-		fi
-	done
-}
-
-case $1 in
-prereqs)
-	prereqs
-	exit 0
-	;;
-esac
-
-# source for log_*_msg() functions, see LP: #272301
-. /scripts/functions
-
-#
-# Helper functions
-#
-message()
-{
-	if [ -x /bin/plymouth ] && plymouth --ping; then
-		plymouth message --text="$@"
-	else
-		echo "$@" >&2
-	fi
-	return 0
-}
-
-udev_settle()
-{
-	# Wait for udev to be ready, see https://launchpad.net/bugs/85640
-	if command -v udevadm >/dev/null 2>&1; then
-		udevadm settle --timeout=30
-	elif command -v udevsettle >/dev/null 2>&1; then
-		udevsettle --timeout=30
-	fi
-	return 0
-}
-
-parse_options()
-{
-	local cryptopts
-	cryptopts="$1"
-
-	if [ -z "$cryptopts" ]; then
-		return 1
-	fi
-
-	# Defaults
-	cryptcipher=aes-cbc-essiv:sha256
-	cryptsize=256
-	crypthash=ripemd160
-	crypttarget=cryptroot
-	cryptsource=""
-	cryptheader=""
-	cryptlvm=""
-	cryptkeyscript=""
-	cryptkey="" # This is only used as an argument to an eventual keyscript
-	cryptkeyslot=""
-	crypttries=3
-	crypttcrypt=""
-	cryptveracrypt=""
-	cryptrootdev=""
-	cryptdiscard=""
-	CRYPTTAB_OPTIONS=""
-
-	local IFS=" ,"
-	for x in $cryptopts; do
-		case $x in
-		hash=*)
-			crypthash=${x#hash=}
-			;;
-		size=*)
-			cryptsize=${x#size=}
-			;;
-		cipher=*)
-			cryptcipher=${x#cipher=}
-			;;
-		target=*)
-			crypttarget=${x#target=}
-			export CRYPTTAB_NAME="$crypttarget"
-			;;
-		source=*)
-			cryptsource=${x#source=}
-			if [ ${cryptsource#UUID=} != $cryptsource ]; then
-				cryptsource="/dev/disk/by-uuid/${cryptsource#UUID=}"
-			elif [ ${cryptsource#LABEL=} != $cryptsource ]; then
-				cryptsource="/dev/disk/by-label/$(printf '%s' "${cryptsource#LABEL=}" | sed 's,/,\\x2f,g')"
-			fi
-			export CRYPTTAB_SOURCE="$cryptsource"
-			;;
-		header=*)
-			cryptheader=${x#header=}
-			if [ ! -e "$cryptheader" ] && [ -e "/conf/conf.d/cryptheader/$cryptheader" ]; then
-				cryptheader="/conf/conf.d/cryptheader/$cryptheader"
-			fi
-			export CRYPTTAB_HEADER="$cryptheader"
-			;;
-		lvm=*)
-			cryptlvm=${x#lvm=}
-			;;
-		keyscript=*)
-			cryptkeyscript=${x#keyscript=}
-			;;
-		key=*)
-			if [ "${x#key=}" != "none" ]; then
-				cryptkey=${x#key=}
-			fi
-			export CRYPTTAB_KEY="$cryptkey"
-			;;
-		keyslot=*)
-			cryptkeyslot=${x#keyslot=}
-			;;
-		tries=*)
-			crypttries="${x#tries=}"
-			case "$crypttries" in
-			  *[![:digit:].]*)
-				crypttries=3
-				;;
-			esac
-			;;
-		tcrypt)
-			crypttcrypt="yes"
-			;;
-		veracrypt)
-			cryptveracrypt="--veracrypt"
-			;;
-		rootdev)
-			cryptrootdev="yes"
-			;;
-		discard)
-			cryptdiscard="yes"
-			;;
-		esac
-		PARAM="${x%=*}"
-		if [ "$PARAM" = "$x" ]; then
-			VALUE="yes"
-		else
-			VALUE="${x#*=}"
-		fi
-		CRYPTTAB_OPTIONS="$CRYPTTAB_OPTIONS $PARAM"
-		eval export CRYPTTAB_OPTION_$PARAM="\"$VALUE\""
-	done
-	export CRYPTTAB_OPTIONS
-
-	if [ -z "$cryptsource" ]; then
-		message "cryptsetup ($crypttarget): source parameter missing"
-		return 1
-	fi
-	return 0
-}
-
-activate_vg()
-{
-	# Sanity checks
-	if [ ! -x /sbin/lvm ]; then
-		message "cryptsetup ($crypttarget): lvm is not available"
-		return 1
-	fi
-
-	# Detect and activate available volume groups
-	/sbin/lvm vgscan >/dev/null 2>&1
-	/sbin/lvm vgchange -a y --sysinit >/dev/null 2>&1
-	return $?
-}
-
-setup_mapping()
-{
-	local opts count cryptopen cryptremove NEWROOT
-	opts="$1"
-
-	if [ -z "$opts" ]; then
-		return 0
-	fi
-
-	parse_options "$opts" || return 1
-
-	if [ -z "$cryptkeyscript" ]; then
-		if [ ${cryptsource#/dev/disk/by-uuid/} != $cryptsource ]; then
-			# UUIDs are not very helpful
-			diskname="$crypttarget"
-		else
-			diskname="$cryptsource ($crypttarget)"
-		fi
-		cryptkeyscript="/lib/cryptsetup/askpass"
-		cryptkey="Please unlock disk $diskname: "
-	elif ! type "$cryptkeyscript" >/dev/null; then
-		message "cryptsetup ($crypttarget): error - script \"$cryptkeyscript\" missing"
-		return 1
-	fi
-
-	if [ "$cryptkeyscript" = "cat" ] && [ "${cryptkey#/root/}" != "$cryptkey" ]; then
-		# skip the mapping if the root FS is not mounted yet
-		sed -rn 's/^\s*[^#]\S*\s+(\S+)\s.*/\1/p' /proc/mounts | grep -Fxq "$rootmnt" || return 1
-		# substitute the "/root" prefix by the real root FS mountpoint otherwise
-		cryptkey="${rootmnt}/${cryptkey#/root/}"
-	fi
-
-	if [ -n "$cryptheader" ] && ! type "$cryptheader" >/dev/null; then
-		message "cryptsetup ($crypttarget): error - LUKS header \"$cryptheader\" missing"
-		return 1
-	fi
-
-	# The same target can be specified multiple times
-	# e.g. root and resume lvs-on-lvm-on-crypto
-	if [ -e "/dev/mapper/$crypttarget" ]; then
-		return 0
-	fi
-
-	modprobe -q dm_crypt
-
-	# Make sure the cryptsource device is available
-	if [ ! -e $cryptsource ]; then
-		activate_vg
-	fi
-
-	# If the encrypted source device hasn't shown up yet, give it a
-	# little while to deal with removable devices
-
-	# the following lines below have been taken from
-	# /usr/share/initramfs-tools/scripts/local, as suggested per
-	# https://launchpad.net/bugs/164044
-	if [ ! -e "$cryptsource" ]; then
-		log_begin_msg "Waiting for encrypted source device..."
-
-		# Default delay is 180s
-		if [ -z "${ROOTDELAY}" ]; then
-			slumber=180
-		else
-			slumber=${ROOTDELAY}
-		fi
-
-		slumber=$(( ${slumber} * 10 ))
-		while [ ! -e "$cryptsource" ]; do
-			# retry for LVM devices every 10 seconds
-			if [ ${slumber} -eq $(( ${slumber}/100*100 )) ]; then
-				activate_vg
-			fi
-
-			/bin/sleep 0.1
-			slumber=$(( ${slumber} - 1 ))
-			[ ${slumber} -gt 0 ] || break
-		done
-
-		if [ ${slumber} -gt 0 ]; then
-			log_end_msg 0
-		else
-			log_end_msg 1 || true
-		fi
- 	fi
-	udev_settle
-
-	# We've given up, but we'll let the user fix matters if they can
-	if [ ! -e "${cryptsource}" ]; then
-		
-		echo "  ALERT! ${cryptsource} does not exist."
-		echo "	Check cryptopts=source= bootarg: cat /proc/cmdline"
-		echo "	or missing modules, devices: cat /proc/modules; ls /dev"
-		panic -r "Dropping to a shell. Will skip ${cryptsource} if you can't fix."
-	fi
-
-	if [ ! -e "${cryptsource}" ]; then
-		return 1
-	fi
-
-
-	# Prepare commands
-	cryptopen="/sbin/cryptsetup -T 1"
-	if [ "$cryptdiscard" = "yes" ]; then
-		cryptopen="$cryptopen --allow-discards"
-	fi
-	if [ -n "$cryptheader" ]; then
-		cryptopen="$cryptopen --header=$cryptheader"
-	fi
-	if [ -n "$cryptkeyslot" ]; then
-		cryptopen="$cryptopen --key-slot=$cryptkeyslot"
-	fi
-	if /sbin/cryptsetup isLuks ${cryptheader:-$cryptsource} >/dev/null 2>&1; then
-		cryptopen="$cryptopen open --type luks $cryptsource $crypttarget --key-file=-"
-	elif [ "$crypttcrypt" = "yes" ]; then
-		cryptopen="$cryptopen open --type tcrypt $cryptveracrypt $cryptsource $crypttarget"
-	else
-		cryptopen="$cryptopen -c $cryptcipher -s $cryptsize -h $crypthash open --type plain $cryptsource $crypttarget --key-file=-"
-	fi
-	cryptremove="/sbin/cryptsetup remove $crypttarget"
-	NEWROOT="/dev/mapper/$crypttarget"
-
-	# Try to get a satisfactory password $crypttries times
-	count=0
-	while [ $crypttries -le 0 ] || [ $count -lt $crypttries ]; do
-		export CRYPTTAB_TRIED="$count"
-		count=$(( $count + 1 ))
-
-		if [ ! -e "$NEWROOT" ]; then
-			if ! crypttarget="$crypttarget" cryptsource="$cryptsource" \
-			     $cryptkeyscript "$cryptkey" | $cryptopen; then
-				message "cryptsetup ($crypttarget): cryptsetup failed, bad password or options?"
-				continue
-			fi
-		fi
-
-		if [ ! -e "$NEWROOT" ]; then
-			message "cryptsetup ($crypttarget): unknown error setting up device mapping"
-			return 1
-		fi
-
-		#FSTYPE=''
-		#eval $(fstype < "$NEWROOT")
-		FSTYPE="$(/sbin/blkid -s TYPE -o value "$NEWROOT")"
-
-		# See if we need to setup lvm on the crypto device
-		#if [ "$FSTYPE" = "lvm" ] || [ "$FSTYPE" = "lvm2" ]; then
-		if [ "$FSTYPE" = "LVM_member" ] || [ "$FSTYPE" = "LVM2_member" ]; then
-			if [ -z "$cryptlvm" ]; then
-				message "cryptsetup ($crypttarget): lvm fs found but no lvm configured"
-				return 1
-			elif ! activate_vg; then
-				# disable error message, LP: #151532
-				#message "cryptsetup ($crypttarget): failed to setup lvm device"
-				return 1
-			fi
-
-			# Apparently ROOT is already set in /conf/param.conf for
-			# flashed kernels at least. See bugreport #759720.
-			if [ -f /conf/param.conf ] && grep -q "^ROOT=" /conf/param.conf; then
-				NEWROOT=$(sed -n 's/^ROOT=//p' /conf/param.conf)
-			else
-				NEWROOT=${cmdline_root:-/dev/mapper/$cryptlvm}
-				if [ "$cryptrootdev" = "yes" ]; then
-					# required for lilo to find the root device
-					echo "ROOT=$NEWROOT" >>/conf/param.conf
-				fi
-			fi
-			#eval $(fstype < "$NEWROOT")
-			FSTYPE="$(/sbin/blkid -s TYPE -o value "$NEWROOT")"
-		fi
-
-		#if [ -z "$FSTYPE" ] || [ "$FSTYPE" = "unknown" ]; then
-		if [ -z "$FSTYPE" ]; then
-			message "cryptsetup ($crypttarget): unknown fstype, bad password or options?"
-			udev_settle
-			$cryptremove
-			continue
-		fi
-
-		# decrease $count by 1, apparently last try was successful.
-		count=$(( $count - 1 ))
-
-		message "cryptsetup ($crypttarget): set up successfully"
-		break
-	done
-
-	failsleep=60 # make configurable later?
-
-	if [ "$cryptrootdev" = "yes" ] && [ $crypttries -gt 0 ] && [ $count -ge $crypttries ]; then
-		message "cryptsetup ($crypttarget): maximum number of tries exceeded"
-		message "cryptsetup: going to sleep for $failsleep seconds..."
-		sleep $failsleep
-		exit 1
-	fi
-
-	udev_settle
-	return 0
-}
-
-#
-# Begin real processing
-#
-
-# Do we have any kernel boot arguments?
-cmdline_cryptopts=''
-unset cmdline_root
-for opt in $(cat /proc/cmdline); do
-	case $opt in
-	cryptopts=*)
-		opt="${opt#cryptopts=}"
-		if [ -n "$opt" ]; then
-			if [ -n "$cmdline_cryptopts" ]; then
-				cmdline_cryptopts="$cmdline_cryptopts $opt"
-			else
-				cmdline_cryptopts="$opt"
-			fi
-		fi
-		;;
-	root=*)
-		opt="${opt#root=}"
-		case $opt in
-		/*) # Absolute path given. Not lilo major/minor number.
-			cmdline_root=$opt
-			;;
-		*) # lilo major/minor number (See #398957). Ignore
-		esac
-		;;
-	esac
-done
-
-if [ -n "$cmdline_cryptopts" ]; then
-	# Call setup_mapping separately for each possible cryptopts= setting
-	for cryptopt in $cmdline_cryptopts; do
-		setup_mapping "$cryptopt"
-	done
-	exit 0
-fi
-
-# Do we have any settings from the /conf/conf.d/cryptroot file?
-if [ -r /conf/conf.d/cryptroot ]; then
-	while read mapping <&3; do
-		setup_mapping "$mapping" 3<&-
-	done 3< /conf/conf.d/cryptroot
-fi
-
-exit 0

basic/usr/share/initramfs-tools/scripts/local-top/lvm2

@@ -1,65 +0,0 @@
-#!/bin/sh
-
-PREREQ="mdadm mdrun multipath"
-
-prereqs()
-{
-	echo "$PREREQ"
-}
-
-case $1 in
-# get pre-requisites
-prereqs)
-	prereqs
-	exit 0
-	;;
-esac
-
-if [ ! -e /sbin/lvm ]; then
-	exit 0
-fi
-
-lvchange_activate() {
-	lvm lvchange -aay -y --sysinit --ignoreskippedcluster "$@" >/dev/null 2>&1
-}
-
-activate() {
-	local dev="$1"
-
-	# Make sure that we have a non-empty argument
-	if [ -z "$dev" ]; then
-		return 1
-	fi
-
-	case "$dev" in
-	# Take care of lilo boot arg, risky activating of all vg
-	fe[0-9]*)
-		lvchange_activate
-		exit 0
-		;;
-	# FIXME: check major
-	/dev/root)
-		lvchange_activate
-		exit 0
-		;;
-
-	/dev/mapper/*)
-		eval $(dmsetup splitname --nameprefixes --noheadings --rows "${dev#/dev/mapper/}")
-		if [ "$DM_VG_NAME" ] && [ "$DM_LV_NAME" ]; then
-			lvchange_activate "$DM_VG_NAME/$DM_LV_NAME"
-		fi
-		;;
-
-	/dev/*/*)
-		# Could be /dev/VG/LV; use lvs to check
-		if lvm lvs -- "$dev" >/dev/null 2>&1; then
-			lvchange_activate "$dev"
-		fi
-		;;
-	esac
-}
-
-activate "$ROOT"
-activate "$resume"
-
-exit 0

build/build-all.sh

@@ -0,0 +1,117 @@
+#!/bin/sh
+set -ev
+
+ROOT=$(dirname $(dirname $(realpath "${0}")))
+
+# Build documentation
+cd ${ROOT}/doc
+make html
+
+# Build basic tar
+cd ${ROOT}/vm
+tar czpf /srv/build/vm.tar.gz *
+
+# Build native apps
+cd ${ROOT}/apk/py3-secure-cookie
+apk add -U py3-setuptools py3-pytest py3-werkzeug
+abuild -F
+
+cd ${ROOT}/apk/spoc
+abuild -F
+
+cd ${ROOT}/apk/vmmgr
+abuild -F
+
+# Build runtimes
+cd ${ROOT}/lxc-shared
+spoc-image build -p alpine3.8/image
+spoc-image build -p alpine3.8-java8/image
+spoc-image build -p alpine3.8-ruby2.4/image
+spoc-image build -p alpine3.10/image
+spoc-image build -p alpine3.10-nodejs10/image
+spoc-image build -p alpine3.11/image
+spoc-image build -p alpine3.11-python2.7/image
+spoc-image build -p alpine3.12/image
+spoc-image build -p alpine3.12-java8/image
+spoc-image build -p alpine3.12-php7.3/image
+spoc-image build -p alpine3.12-python3.8/image
+spoc-image build -p alpine3.12-ruby2.4/image
+spoc-image build -p alpine3.12-ruby2.7/image
+spoc-image build -p alpine3.12-tomcat7/image
+spoc-image build -p alpine3.12-tomcat8.5/image
+spoc-image build -p debian10/image
+
+# Build services
+cd ${ROOT}/lxc-services
+spoc-image build -p activemq/image
+spoc-image build -p mariadb/image
+spoc-image build -p mongodb/image
+spoc-image build -p postgres/image
+spoc-image build -p postgis/image
+spoc-image build -p rabbitmq/image
+spoc-image build -p redis/image
+spoc-image build -p solr6/image
+
+# Build applications
+cd ${ROOT}/lxc-apps
+
+spoc-image build -p ckan/ckan.image
+spoc-image build -p ckan/ckan-datapusher.image
+spoc-app publish ckan/app
+
+spoc-image build -p crisiscleanup/image
+spoc-app publish crisiscleanup/app
+
+spoc-image build -p cts/image
+spoc-app publish cts/app
+
+spoc-image build -p decidim/decidim-nginx.image
+spoc-image build -p decidim/decidim.image
+spoc-app publish decidim/app
+
+spoc-image build -p dhis2/image
+spoc-app publish dhis2/app
+
+spoc-image build -p frontlinesms/image
+spoc-app publish frontlinesms/app
+
+spoc-image build -p gnuhealth/image
+spoc-app publish gnuhealth/app
+
+spoc-image build -p kanboard/image
+spoc-app publish kanboard/app
+
+spoc-image build -p mifosx/image
+spoc-app publish mifosx/app
+
+spoc-image build -p motech/image
+spoc-app publish motech/app
+
+spoc-image build -p odoo/image
+spoc-app publish odoo/app
+
+spoc-image build -p opendatakit/opendatakit.image
+spoc-image build -p opendatakit/opendatakit-build.image
+spoc-app publish opendatakit/app
+
+spoc-image build -p openmapkit/image
+spoc-app publish openmapkit/app
+
+spoc-image build -p pandora/image
+spoc-app publish pandora/app
+
+spoc-image build -p sahana/image
+spoc-app publish sahana/app
+spoc-app publish sahana-demo/app
+spoc-app publish sambro/app
+spoc-app publish safire/app
+spoc-app publish share/app
+
+spoc-image build -p seeddms/image
+spoc-app publish seeddms/app
+
+spoc-image build -p taarifa/image
+spoc-app publish taarifa/app
+
+spoc-image build -p ushahidi/image
+spoc-app publish ushahidi/app

build/clean-all.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+set -ev
+
+# Clean documentation
+rm -rf /srv/build/doc/*
+
+# Clean basic tar
+rm -f /srv/build/vm.tar.gz
+
+# Clean native apps
+rm -rf /srv/build/alpine/*
+
+# Clean built LXC packages
+rm -rf /srv/build/spoc
+
+# Remove nginx configs
+for CONF in $(find /etc/nginx/conf.d -name '*.conf' -a ! -name repo.conf -a ! -name default.conf); do
+    rm -f ${CONF}
+done
+service nginx reload
+
+# Stop running containers
+for APP in $(spoc-container list); do
+    spoc-container stop ${APP}
+done
+
+# Remove data
+rm -rf /var/lib/spoc
+rm -rf /var/log/spoc

build/etc/abuild.conf

@@ -0,0 +1,32 @@
+export CFLAGS="-Os -fomit-frame-pointer"
+export CXXFLAGS="$CFLAGS"
+export CPPFLAGS="$CFLAGS"
+export LDFLAGS="-Wl,--as-needed"
+
+export JOBS=2
+export MAKEFLAGS=-j$JOBS
+
+# remove line below to disable colors
+USE_COLORS=1
+
+# uncomment line below to enable ccache support.
+#USE_CCACHE=1
+
+SRCDEST=/var/cache/distfiles
+
+# uncomment line below to store built packages in other location
+# The package will be stored as $REPODEST/$repo/$pkgname-$pkgver-r$pkgrel.apk
+# where $repo is the name of the parent directory of $startdir.
+REPODEST=/srv/build/alpine/v3.12
+
+# PACKAGER and MAINTAINER are used by newapkbuild when creating new aports for
+# the APKBUILD's "Contributor:" and "Maintainer:" comments, respectively.
+#PACKAGER="Your Name <your@email.address>"
+#MAINTAINER="$PACKAGER"
+PACKAGER_PRIVKEY="/root/repo.spotter.cz.rsa"
+
+# what to clean up after a successful build
+CLEANUP="srcdir bldroot pkgdir deps"
+
+# what to cleanup after a failed build
+ERROR_CLEANUP="bldroot deps"

build/etc/nginx/conf.d/repo.conf

@@ -0,0 +1,8 @@
+server {
+    listen [::]:80;
+    server_name repo.build.vm;
+
+    location / {
+        root /srv/build;
+    }
+}

build/install-toolchain.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -ev
+
+cd $(realpath $(dirname "${0}"))
+
+# Install basic build tools
+apk update
+apk add git file htop less openssh-client tree
+# Install Alpine SDK (for APK builds)
+apk add alpine-sdk
+# Install Sphinx support (for documentation builds)
+apk add py3-sphinx py3-sphinx_rtd_theme
+
+# Copy root profile files and settings
+mkdir -p /root/.config/htop
+cp root/.profile /root/.profile
+cp root/.config/htop/htoprc /root/.config/htop/htoprc
+
+# Prepare abuild toolchain
+adduser root abuild
+cp etc/abuild.conf /etc/abuild.conf
+
+# Prepare local APK repository
+cp etc/nginx/conf.d/repo.conf /etc/nginx/conf.d/repo.conf
+echo "172.17.0.1 repo.build.vm" >>/etc/hosts
+service nginx reload
+
+# Change SPOC repository
+sed -i 's/https:\/\/repo\.spotter\.cz/http:\/\/repo.build.vm/' /etc/spoc/spoc.conf
+
+# Supply abuild key
+# echo '/root/repo.spotter.cz.rsa' | abuild-keygen
+
+# Supply SPOC key
+# openssl ecparam -genkey -name secp384r1 -out /etc/spoc/publish.key
+# openssl ec -in /etc/spoc/publish.key -pubout -out /tmp/repository.pub

build/root/.profile

@@ -0,0 +1,2 @@
+alias ll="ls -la"
+alias view="vi -R"

ckan.sh

@@ -1,120 +0,0 @@
-#!/bin/bash
-
-SOURCE_DIR=$(realpath $(dirname "${0}"))/ckan
-
-# Install dependencies for CKAN
-apt-get -y --no-install-recommends install gcc libpq-dev python-dev python-virtualenv redis-server virtualenv
-
-# Install dependencies for Solr
-apt-get -y --no-install-recommends install openjdk-8-jre-headless lsof
-
-# Install CKAN python virtual environment
-mkdir -p /srv/ckan
-virtualenv --no-site-packages --python=/usr/bin/python2.7 /srv/ckan
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckan.git#egg=ckan'
-/srv/ckan/bin/pip install -r /srv/ckan/src/ckan/requirements.txt
-
-# Install Datapusher python virtual environment
-mkdir -p /srv/ckan-datapusher
-virtualenv --no-site-packages --python=/usr/bin/python2.7 /srv/ckan-datapusher
-/srv/ckan-datapusher/bin/pip install -e 'git+https://github.com/ckan/datapusher.git#egg=datapusher'
-/srv/ckan-datapusher/bin/pip install -r /srv/ckan-datapusher/src/datapusher/requirements.txt
-
-# Patch service provider TLS verification for Datapusher
-# https://github.com/ckan/ckan-service-provider/issues/36
-patch -d /srv/ckan-datapusher -p0 <${SOURCE_DIR}/ckan-serviceprovider-sslverify.patch
-
-# Install CKAN extensions
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckanext-basiccharts#egg=ckanext_basiccharts'
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckanext-spatial#egg=ckanext_spatial'
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckanext-geoview#egg=ckanext_geoview'
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckanext-mapviews#egg=ckanext_mapviews'
-/srv/ckan/bin/pip install -e 'git+https://github.com/ckan/ckanext-pages#egg=ckanext_pages'
-/srv/ckan/bin/pip install -e 'git+https://github.com/XVTSolutions/ckanext-spatialUI#egg=ckanext_spatialui'
-/srv/ckan/bin/pip install -e 'git+https://github.com/aptivate/ckanext-datasetthumbnail#egg=ckanext_datasetthumbnail'
-/srv/ckan/bin/pip install -e 'git+https://github.com/datagvat/ckanext-dgvat_xls#egg=ckanext_dgvat_xls'
-/srv/ckan/bin/pip install -r /srv/ckan/src/ckanext-spatial/pip-requirements.txt
-/srv/ckan/bin/pip install -r /srv/ckan/src/ckanext-datasetthumbnail/requirements.txt
-/srv/ckan/bin/pip install -r /srv/ckan/src/ckanext-dgvat-xls/requirements.txt
-
-# Download Solr
-wget http://archive.apache.org/dist/lucene/solr/6.5.1/solr-6.5.1.tgz -O /tmp/solr-6.5.1.tgz
-tar xzf /tmp/solr-6.5.1.tgz -C /opt/
-mv /opt/solr-6.5.1 /opt/solr
-rm -f /tmp/solr-6.5.1.tgz
-
-# Create Solr OS user
-adduser --system --group --home /var/lib/solr --shell /bin/false solr
-chown -R solr:solr /opt/solr/
-
-# Configure Solr
-cp ${SOURCE_DIR}/lib/systemd/system/solr.service /lib/systemd/system/solr.service
-cp -p /opt/solr/server/solr/solr.xml /var/lib/solr/
-systemctl daemon-reload
-systemctl enable solr
-systemctl start solr
-sleep 5
-
-# Configure CKAN Solr core
-sudo -u solr /opt/solr/bin/solr create -c ckan
-cp ${SOURCE_DIR}/var/lib/solr/ckan/conf/solrconfig.xml /var/lib/solr/ckan/conf/solrconfig.xml
-ln -s /srv/ckan/src/ckan/ckan/config/solr/schema.xml /var/lib/solr/ckan/conf/schema.xml
-systemctl restart solr
-
-# Create database
-export CKAN_PWD=$(head -c 18 /dev/urandom | base64)
-export CKAN_DS_PWD=$(head -c 18 /dev/urandom | base64)
-envsubst <${SOURCE_DIR}/tmp/ckan-createdb.sql >/tmp/ckan-createdb.sql
-sudo -u postgres psql -f /tmp/ckan-createdb.sql
-rm -f /tmp/ckan-createdb.sql
-
-# Configure CKAN
-export CKAN_SECRET=$(head -c 18 /dev/urandom | base64)
-export CKAN_UUID=$(python -c "import uuid; print uuid.uuid4()")
-mkdir /etc/ckan
-envsubst <${SOURCE_DIR}/etc/ckan/ckan.ini >/etc/ckan/ckan.ini
-cp ${SOURCE_DIR}/etc/ckan/datapusher.wsgi /etc/ckan/datapusher.wsgi
-cp ${SOURCE_DIR}/etc/ckan/datapusher_settings.py /etc/ckan/datapusher_settings.py
-ln -s /srv/ckan/src/ckan/ckan/config/who.ini /etc/ckan/who.ini
-cp ${SOURCE_DIR}/srv/ckan/update-ip.sh /srv/ckan/update-ip.sh
-/srv/ckan/update-ip.sh
-
-# Populate database
-/srv/ckan/bin/paster --plugin=ckan db init -c /etc/ckan/ckan.ini
-/srv/ckan/bin/paster --plugin=ckanext-spatial spatial initdb -c /etc/ckan/ckan.ini
-/srv/ckan/bin/paster --plugin=ckan datastore set-permissions -c /etc/ckan/ckan.ini | sudo -u postgres psql
-
-# Create CKAN OS user
-adduser --system --group --home /srv/ckan --shell /bin/false ckan
-chown -R ckan:ckan /srv/ckan/
-chown -R ckan:ckan /srv/ckan-datapusher/
-
-# Create admin account
-export CKAN_ADMIN_USER="admin"
-export CKAN_ADMIN_UUID=$(python -c "import uuid; print uuid.uuid4()")
-export CKAN_ADMIN_APIKEY=$(python -c "import uuid; print uuid.uuid4()")
-export CKAN_ADMIN_PWD=$(head -c 12 /dev/urandom | base64)
-export CKAN_ADMIN_HASH=$(/srv/ckan/bin/python ${SOURCE_DIR}/ckan-adminpwd.py ${CKAN_ADMIN_PWD})
-export CKAN_ADMIN_EMAIL="admin@example.com"
-envsubst <${SOURCE_DIR}/tmp/ckan-adminpwd.sql >/tmp/ckan-adminpwd.sql
-sudo -u postgres psql -f /tmp/ckan-adminpwd.sql ckan
-rm /tmp/ckan-adminpwd.sql
-
-# Create uwsgi and nginx app definition
-cp ${SOURCE_DIR}/etc/uwsgi/apps-available/ckan.ini /etc/uwsgi/apps-available/ckan.ini
-cp ${SOURCE_DIR}/etc/uwsgi/apps-available/ckan-datapusher.ini /etc/uwsgi/apps-available/ckan-datapusher.ini
-ln -s /etc/uwsgi/apps-available/ckan.ini /etc/uwsgi/apps-enabled/ckan.ini
-ln -s /etc/uwsgi/apps-available/ckan-datapusher.ini /etc/uwsgi/apps-enabled/ckan-datapusher.ini
-cp ${SOURCE_DIR}/etc/nginx/sites-available/ckan /etc/nginx/sites-available/ckan
-ln -s /etc/nginx/sites-available/ckan /etc/nginx/sites-enabled/ckan
-
-# Restart services
-systemctl restart uwsgi
-systemctl restart nginx
-
-# Install cron job
-cp ${SOURCE_DIR}/srv/ckan/cron-pageviews.sh /srv/ckan/cron-pageviews.sh
-cp ${SOURCE_DIR}/etc/cron.d/ckan /etc/cron.d/ckan
-
-# Add portal application definition
-portal-app-manager ckan "https://{host}:8003/" "${CKAN_ADMIN_USER}" "${CKAN_ADMIN_PWD}"

ckan/ckan-adminpwd.py

@@ -1,6 +0,0 @@
-#!/usr/bin/python
-
-import sys
-from passlib.hash import pbkdf2_sha512
-
-print pbkdf2_sha512.encrypt(sys.argv[1])

ckan/ckan-serviceprovider-sslverify.patch

@@ -1,11 +0,0 @@
-diff -ruN orig/python2.7/site-packages/ckanserviceprovider/web.py lib/python2.7/site-packages/ckanserviceprovider/web.py
---- orig/python2.7/site-packages/ckanserviceprovider/web.py	2017-12-01 08:55:57.595353323 +0100
-+++ lib/python2.7/site-packages/ckanserviceprovider/web.py	2017-12-01 08:56:37.819592364 +0100
-@@ -733,6 +733,7 @@
-     try:
-         result = requests.post(
-             result_url,
-+            verify=False,
-             data=json.dumps(job_dict, cls=DatetimeJsonEncoder),
-             headers=headers)
- 

ckan/etc/cron.d/ckan

@@ -1 +0,0 @@
-10 * * * * ckan /srv/ckan/bin/paster --plugin=ckan tracking update -c /etc/ckan/ckan.ini >/dev/null && /srv/ckan/bin/paster --plugin=ckan search-index rebuild -r -c /etc/ckan/ckan.ini >/dev/null

ckan/etc/nginx/sites-available/ckan

@@ -1,29 +0,0 @@
-server {
-    listen 8003 ssl http2;
-    listen [::]:8003 ssl http2;
-
-    access_log /var/log/nginx/ckan.access.log;
-    error_log /var/log/nginx/ckan.error.log;
-
-    location / {
-        uwsgi_pass unix:///run/uwsgi/app/ckan/socket;
-        include uwsgi_params;
-        uwsgi_param SCRIPT_NAME '';
-        uwsgi_param UWSGI_SCHEME $scheme;
-    }
-}
-
-server {
-    listen 127.0.0.1:8098;
-    listen [::1]:8098;
-
-    access_log /var/log/nginx/ckan-datapusher.access.log;
-    error_log /var/log/nginx/ckan-datapusher.error.log;
-
-    location / {
-        uwsgi_pass unix:///run/uwsgi/app/ckan-datapusher/socket;
-        include uwsgi_params;
-        uwsgi_param SCRIPT_NAME '';
-        uwsgi_param UWSGI_SCHEME $scheme;
-    }
-}

ckan/etc/uwsgi/apps-available/ckan-datapusher.ini

@@ -1,11 +0,0 @@
-[uwsgi]
-uid = ckan
-gid = ckan
-chown-socket = www-data:www-data
-chdir = /srv/ckan-datapusher
-home = /srv/ckan-datapusher
-master = false
-workers = 1
-disable-logging = true
-file = /etc/ckan/datapusher.wsgi
-enable-threads = true

ckan/etc/uwsgi/apps-available/ckan.ini

@@ -1,12 +0,0 @@
-[uwsgi]
-uid = ckan
-gid = ckan
-chown-socket = www-data:www-data
-chdir = /srv/ckan
-home = /srv/ckan
-master = false
-workers = 1
-exec-asap = /srv/ckan/update-ip.sh
-disable-logging = true
-ini-paste = /etc/ckan/ckan.ini
-enable-threads = true

ckan/lib/systemd/system/solr.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Apache Solr
-After=network.target
-
-[Service]
-ExecStart=/opt/solr/bin/solr start -f -p 8983 -s /var/lib/solr
-ExecStop=/opt/solr/bin/solr stop -p 8983
-User=solr
-
-[Install]
-WantedBy=multi-user.target

ckan/srv/ckan/update-ip.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-
-URL=$(ip route get 1 | awk '{print $NF;exit}')
-sed -i "s|^ckan\.site_url.*|ckan.site_url = https://${URL}:8003|" /etc/ckan/ckan.ini

crisiscleanup.sh

@@ -1,69 +0,0 @@
-#!/bin/bash
-
-SOURCE_DIR=$(realpath $(dirname "${0}"))/crisiscleanup
-
-# Add NodeJS + Yarn repositories
-wget https://deb.nodesource.com/gpgkey/nodesource.gpg.key -O - | apt-key add -
-wget https://dl.yarnpkg.com/debian/pubkey.gpg -O - | apt-key add -
-echo 'deb https://deb.nodesource.com/node_8.x stretch main' > /etc/apt/sources.list.d/nodejs.list
-echo 'deb https://dl.yarnpkg.com/debian/ stable main' > /etc/apt/sources.list.d/yarn.list
-apt-get -y update
-
-# Install CrisisCleanup dependecies
-apt-get -y --no-install-recommends install build-essential curl libpq-dev nodejs ruby ruby-dev yarn zlib1g-dev
-gem install bundler
-
-# Clone CrisisCleanup git repository
-git clone --depth 1 https://github.com/CrisisCleanup/crisiscleanup /srv/crisiscleanup
-
-# Fix Ruby version dependencies
-sed -i 's/2\.2\.5/2.3.3/' /srv/crisiscleanup/Gemfile
-sed -i 's/rdoc (4\.2\.0)/rdoc (4.3.0)/' /srv/crisiscleanup/Gemfile.lock
-
-# Create CrisisCleanup OS user
-adduser --system --group --home /srv/crisiscleanup --shell /bin/bash crisis
-chown -R crisis:crisis /srv/crisiscleanup/
-
-# Install CrisisCleanup dependencies
-sudo -u crisis -i bundle install --path /srv/crisiscleanup/vendor/bundle
-sudo -u crisis -i npm install
-sudo -u crisis -i yarn
-
-# Create database
-export CRISISCLEANUP_PWD=$(head -c 18 /dev/urandom | base64)
-envsubst <${SOURCE_DIR}/tmp/crisiscleanup-createdb.sql >/tmp/crisiscleanup-createdb.sql
-sudo -u postgres psql -f /tmp/crisiscleanup-createdb.sql
-rm /tmp/crisiscleanup-createdb.sql
-
-# Configure CrisisCleanup
-export CRISISCLEANUP_SECRET=$(sudo -u crisis -i /srv/crisiscleanup/bin/rake secret)
-export CRISISCLEANUP_ADMIN_USER="Admin"
-export CRISISCLEANUP_ADMIN_EMAIL="admin@example.com"
-export CRISISCLEANUP_ADMIN_PWD=$(head -c 12 /dev/urandom | base64)
-envsubst <${SOURCE_DIR}/srv/crisiscleanup/config/database.yml >/srv/crisiscleanup/config/database.yml
-envsubst <${SOURCE_DIR}/srv/crisiscleanup/config/secrets.yml >/srv/crisiscleanup/config/secrets.yml
-envsubst <${SOURCE_DIR}/srv/crisiscleanup/config/initializers/devise.rb >/srv/crisiscleanup/config/initializers/devise.rb
-envsubst <${SOURCE_DIR}/srv/crisiscleanup/db/seeds.rb >/srv/crisiscleanup/db/seeds.rb
-cp ${SOURCE_DIR}/srv/crisiscleanup/config/environments/production.rb /srv/crisiscleanup/config/environments/production.rb
-cp ${SOURCE_DIR}/srv/crisiscleanup/.env /srv/crisiscleanup/.env
-rm /srv/crisiscleanup/.env.test
-sudo -u crisis -i /srv/crisiscleanup/bin/rake assets:precompile RAILS_ENV=production
-
-# Populate database
-sudo -u crisis -i /srv/crisiscleanup/bin/rake db:schema:load RAILS_ENV=production
-sudo -u crisis -i /srv/crisiscleanup/bin/rake db:seed RAILS_ENV=production
-
-# Create Rails service
-cp ${SOURCE_DIR}/lib/systemd/system/crisiscleanup.service /lib/systemd/system/crisiscleanup.service
-systemctl daemon-reload
-
-# Create nginx site definition
-cp ${SOURCE_DIR}/etc/nginx/sites-available/crisiscleanup /etc/nginx/sites-available/crisiscleanup
-ln -s /etc/nginx/sites-available/crisiscleanup /etc/nginx/sites-enabled/crisiscleanup
-
-# Restart services
-systemctl start crisiscleanup
-systemctl restart nginx
-
-# Add portal application definition
-portal-app-manager crisis-cleanup "https://{host}:8005/" "${CRISISCLEANUP_ADMIN_EMAIL}" "${CRISISCLEANUP_ADMIN_PWD}"

crisiscleanup/etc/nginx/sites-available/crisiscleanup

@@ -1,20 +0,0 @@
-server {
-    listen 8005 ssl http2;
-    listen [::]:8005 ssl http2;
-
-    access_log /var/log/nginx/crisiscleanup.access.log;
-    error_log /var/log/nginx/crisiscleanup.error.log;
-
-    root /srv/crisiscleanup/public;
-    try_files $uri/index.html $uri @crisiscleanup;
-
-    location @crisiscleanup {
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header X-Forwarded-Host $host:$server_port;
-        proxy_set_header X-Forwarded-Proto https;
-        proxy_pass http://127.0.0.1:3000;
-    }
-
-    error_page 404 /404.html;
-    error_page 500 502 503 504 /500.html;
-}

crisiscleanup/lib/systemd/system/crisiscleanup.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Crisis Cleanup Ruby on Rails server
-After=network.target
-
-[Service]
-User=crisis
-WorkingDirectory=/srv/crisiscleanup
-ExecStart=/srv/crisiscleanup/bin/rails server -b 127.0.0.1 -p 3000 -e production
-
-[Install]
-WantedBy=multi-user.target

crisiscleanup/srv/crisiscleanup/.env

@@ -1,2 +0,0 @@
-COMPOSE_PROJECT_NAME=crisiscleanup
-GOOGLE_MAPS_API_KEY=AIzaSyBvIF3D550tlpL6o1xRrDurGo-81VhHlOw

crisiscleanup/srv/crisiscleanup/config/database.yml

@@ -1,31 +0,0 @@
-development: &development
-  adapter: postgresql
-  encoding: unicode
-  database: crisiscleanup_development
-  pool: 5
-  username: crisiscleanup
-  password: crisiscleanup
-  host: localhost
-  port: 5432
-
-docker:
-  <<: *development
-  host: postgres
-
-test:
-  adapter: postgresql
-  encoding: unicode
-  database: crisiscleanup_test
-  pool: 5
-  username: crisiscleanup
-  password: crisiscleanup
-  host: localhost
-  port: 5432
-
-production:
-  adapter: postgresql
-  encoding: unicode
-  database: crisiscleanup
-  pool: 5
-  username: crisiscleanup
-  password: ${CRISISCLEANUP_PWD}

crisiscleanup/srv/crisiscleanup/config/secrets.yml

@@ -1,25 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# Your secret key is used for verifying the integrity of signed cookies.
-# If you change this key, all old signed cookies will become invalid!
-
-# Make sure the secret is at least 30 characters and all random,
-# no regular words or you'll be exposed to dictionary attacks.
-# You can use `rake secret` to generate a secure secret key.
-
-# Make sure the secrets in this file are kept private
-# if you're sharing your code publicly.
-
-development:
-  secret_key_base: 57e62ae63822f461997fa79e75462ba7316c44e03c80d003ef9f68b572b8755cb5a7221e6c4b4958f995c2b03a82112941ee8951b9f393e5ca2449ab480b572b
-
-docker:
-  secret_key_base: a6a0606f1a506b1a9e0059a1db833f2ee3d07ce86e2f938af1f5c0c120b2f5af73965610357edfb82afc90b024ed2ac7f39f25b38d3570d9e3cb76d4d096861b
-
-test:
-  secret_key_base: 055f7b3ef374b2c1c7469fab62d9bc38a8dc510b9f314cc401b75e52974b1422f7796e27d8ff1594468c65ee04493c13a249bcaf77a18e75f96ddec5dbd36ce9
-
-# Do not keep production secrets in the repository,
-# instead read values from the environment.
-production:
-  secret_key_base: ${CRISISCLEANUP_SECRET}

cts.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-
-SOURCE_DIR=$(realpath $(dirname "${0}"))/cts
-
-# Install packages
-apt-get -y --no-install-recommends install build-essential libpq-dev python-dev python-virtualenv virtualenv zlib1g-dev
-
-# Clone CTS git repository
-git clone --depth 1 https://github.com/theirc/CTS /srv/cts
-
-# Install CTS python virtual environment
-virtualenv --no-site-packages --python=/usr/bin/python2.7 /srv/cts
-/srv/cts/bin/pip install -r /srv/cts/requirements/production.txt
-
-# Create database
-export CTS_PWD=$(head -c 18 /dev/urandom | base64)
-envsubst <${SOURCE_DIR}/tmp/cts-createdb.sql >/tmp/cts-createdb.sql
-sudo -u postgres psql -f /tmp/cts-createdb.sql
-rm -f /tmp/cts-createdb.sql
-
-# Configure CTS
-export CTS_SECRET=$(head -c 26 /dev/urandom | base64)
-envsubst <${SOURCE_DIR}/srv/cts/cts/settings/spotter.py >/srv/cts/cts/settings/spotter.py
-ln -s /srv/cts/lib/python2.7/site-packages/django/contrib/admin/static/admin /srv/cts/cts/static/admin
-ln -s /srv/cts/lib/python2.7/site-packages/django_extensions/static/django_extensions /srv/cts/cts/static/django_extensions
-ln -s /srv/cts/lib/python2.7/site-packages/django_tables2/static/django_tables2 /srv/cts/cts/static/django_tables2
-ln -s /srv/cts/lib/python2.7/site-packages/leaflet/static/leaflet /srv/cts/cts/static/leaflet
-ln -s /srv/cts/lib/python2.7/site-packages/rest_framework/static/rest_framework /srv/cts/cts/static/rest_framework
-ln -s /srv/cts/lib/python2.7/site-packages/rest_framework_swagger/static/rest_framework_swagger /srv/cts/cts/static/rest_framework_swagger
-ln -s /srv/cts/lib/python2.7/site-packages/selectable/static/selectable /srv/cts/cts/static/selectable
-ln -s /srv/cts/lib/python2.7/site-packages/session_security/static/session_security /srv/cts/cts/static/session_security
-
-# Set "production values" (increases performance) only if the DEBUG environment variable is not set
-if [ ${DEBUG:-0} -eq 0 ]; then
-    sed -i 's/DEBUG = True/DEBUG = False/' /srv/cts/cts/settings/spotter.py
-fi
-
-# Populate database
-DJANGO_SETTINGS_MODULE=cts.settings.spotter /srv/cts/bin/python /srv/cts/manage.py migrate
-
-# Create admin account
-export CTS_ADMIN_EMAIL=admin@example.com
-export CTS_ADMIN_PWD=$(head -c 12 /dev/urandom | base64)
-export CTS_ADMIN_HASH=$(cd /srv/cts && DJANGO_SETTINGS_MODULE=cts.settings.spotter /srv/cts/bin/python -c "from django.contrib.auth.hashers import make_password; print make_password('${CTS_ADMIN_PWD}')")
-export CTS_ADMIN_SECRET=$(head -c 12 /dev/urandom | sha256sum | cut -c1-13)
-envsubst <${SOURCE_DIR}/tmp/cts-adminpwd.sql >/tmp/cts-adminpwd.sql
-sudo -u postgres psql -f /tmp/cts-adminpwd.sql cts
-rm -f /tmp/cts-adminpwd.sql
-
-# Create CTS OS user
-adduser --system --group --home /srv/cts --shell /bin/false cts
-chown -R cts:cts /srv/cts
-
-# Create uwsgi and nginx app definition
-cp ${SOURCE_DIR}/etc/uwsgi/apps-available/cts.ini /etc/uwsgi/apps-available/cts.ini
-ln -s /etc/uwsgi/apps-available/cts.ini /etc/uwsgi/apps-enabled/cts.ini
-cp ${SOURCE_DIR}/etc/nginx/sites-available/cts /etc/nginx/sites-available/cts
-ln -s /etc/nginx/sites-available/cts /etc/nginx/sites-enabled/cts
-
-# Restart services
-systemctl restart uwsgi
-systemctl restart nginx
-
-# Add portal application definition
-portal-app-manager cts "https://{host}:8004/" "${CTS_ADMIN_EMAIL}" "${CTS_ADMIN_PWD}"

cts/etc/nginx/sites-available/cts

@@ -1,44 +0,0 @@
-server {
-    listen 8004 ssl http2;
-    listen [::]:8004 ssl http2;
-
-    root /srv/cts/cts;
-
-    access_log /var/log/nginx/cts.access.log;
-    error_log /var/log/nginx/cts.error.log;
-
-    location /robots.txt {
-        alias /srv/cts/cts/static/robots.txt;
-    }
-
-    location /media {
-        alias /srv/cts/cts/media;
-    }
-
-    location /static {
-        gzip on;
-        alias /srv/cts/cts/static;
-        expires max;
-        add_header Cache-Control public;
-
-        location /static/protected {
-            return 401;
-        }
-    }
-
-    location /protected {
-        internal;
-        root /srv/cts/cts/static;
-    }
-
-    error_page 502 503 504 /502.html;
-
-    location /502.html {
-        alias /srv/cts/cts/static/502.html;
-    }
-
-    location / {
-        uwsgi_pass unix:///run/uwsgi/app/cts/socket;
-        include uwsgi_params;
-    }
-}

cts/etc/uwsgi/apps-available/cts.ini

@@ -1,9 +0,0 @@
-[uwsgi]
-uid = cts
-gid = cts
-chown-socket = www-data:www-data
-chdir = /srv/cts
-home = /srv/cts
-disable-logging = true
-module = cts.wsgi:application
-env = DJANGO_SETTINGS_MODULE=cts.settings.spotter

doc/Makefile

@@ -0,0 +1,19 @@
+# Minimal makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build-3
+SOURCEDIR     = .
+BUILDDIR      = /srv/build/doc
+
+# Put it first so that "make" without argument is like "make help".
+help:
+	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: help Makefile
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

doc/applications/attachments/images-list-apps.csv

@@ -0,0 +1,21 @@
+Application,Container,Host
+CKAN,ckan,ckan
+Crisis Cleanup,crisiscleanup,cc
+CTS,cts,cts
+EcoGIS,ecogis,ecogis
+FrontlineSMS,frontlinesms,sms
+GNU Health,gnuhealth,gh
+Kanboard,kanboard,kb
+Mifos X,mifosx,mifosx
+Motech,motech,motech
+ODK Aggregate,opendatakit,odk
+ODK Build,opendatakit-build,odkbuild
+Odoo,odoo,odoo
+OpenMapKit,openmapkit,omk
+Pan.do/ra,pandora,pandora
+Sahana,sahana,sahana
+Sahana - Demo,sahana-demo,sahana-demo
+SAMBRO,sambro,sambro
+SeedDMS,seeddms,dms
+Sigmah,sigmah,sigmah
+Ushahidi,ushahidi,ush

doc/applications/attachments/images-list-basic.csv

@@ -0,0 +1,13 @@
+Product,Layer
+Alpine 3.8,alpine3.8
+Alpine 3.8 - PHP 5.6,alpine3.8-php5.6
+Alpine 3.9 - Ruby 2.4,alpine3.8-ruby2.4
+Alpine 3.9,alpine3.9
+Alpine 3.9 - Java 8,alpine3.9-java8
+Alpine 3.9 - PHP 7.2,alpine3.9-php7.2
+Alpine 3.9 - Python 2.7,alpine3.9-python2.7
+Alpine 3.9 - Python 3.6,alpine3.9-python3.6
+Alpine 3.9 - Ruby 2.4,alpine3.9-ruby2.4
+Alpine 3.9 - Ruby 2.6,alpine3.9-ruby2.6
+Alpine 3.9 - Tomcat 7,alpine3.9-tomcat7
+Alpine 3.9 - Tomcat 8.5,alpine3.9-tomcat8.5

doc/applications/attachments/images-list-services.csv

@@ -0,0 +1,8 @@
+Product,Layer,UID/GID,Internal Port
+ActiveMQ,activemq,61616,61616 (ActiveMQ)
+MariaDB,mariadb,3306,3306 (MySQL)
+Postgres,postgres,5432,5432 (Postgres)
+PostGIS,postgis,5432,5432 (Postgres)
+RabbitMQ,rabbitmq,5672,5672 (AMQP)
+Redis,redis,6379,6379 (Redis)
+Solr 6,solr6,8983,8983 (HTTP)

doc/applications/attachments/map-services.csv

@@ -0,0 +1,12 @@
+Application,Data sources,Map viewer,Configurable,Notes
+CKAN,OSM (`Stamen <http://maps.stamen.com>`_),Leaflet,No,[1]
+CrisisCleanup v2,Google Maps,Google Maps,No,
+CrisisCleanup v3,OSM,Leaflet,No,
+Crismapp,OSM,Leaflet,,
+CTS,"OSM, `ArcGIS <http://server.arcgisonline.com/arcgis/rest/services>`_",Leaflet,No,
+EcoGIS,,FreeGIS + OpenLayers 2,Probably,[2]
+Odoo,Google Maps,Google Maps,No,[3]
+OpenMapKit,OSM,N/A,Yes,[4]
+Pan.do/ra,Google Maps,Google Maps + OxMap,No,
+Sahana Eden,OSM (`HOT <https://www.hotosm.org/>`_),OpenLayers 2,"Yes, very",[5]
+Ushahidi,"OSM (`Mapbox <https://www.mapbox.com/about/maps/>`_, `HOT`_)",Leaflet,No,

doc/applications/ckan.rst

@@ -0,0 +1,78 @@
+CKAN
+====
+
+Overview
+--------
+
+CKAN is an open-source DMS (data management system) for powering data hubs and data portals. CKAN makes it easy to publish, share and use data. It is written in python, has Flask-based web interface and uses Postgres database with PostGIS extension. CKAN exposes API which allows third parties to create extensions.
+
+The project is split to several components. The most important ones are:
+
+- **ckan** - https://github.com/ckan/ckan - The main DMS component with Flask frontend.
+- **datapusher** - https://github.com/ckan/datapusher - A standalone web service that pushes data files from a CKAN site's resources into its DataStore.
+- **ckan-service-provider** - https://github.com/ckan/ckan-service-provider - A library for making web services that make functions available as synchronous or asynchronous jobs.
+
+Apart from that, CKAN requires a *Redis* in-memory data store and *Solr* search platform instance. Note that CKAN is shipped with Solr schemas which don't work well with up-to-date versions of Solr, therefore we use older Solr 6.5.1.
+
+DataPusher
+----------
+
+DataPusher is running as a separate service. Its development is a bit out of sync with the core ckan component. SKAN has already moved to python 3, however datapusher is still working only with python 2.7. Due to that, DataPusher has its own image and is running as a separate container.
+
+Alpine, being a progressive linux distribution, stopped supporting uwsgi connector for python 2.7 in Alpine 3.11, therefore the container needs to be based on older Alpine 3.10 which still ships with *uwsgi-python2*.
+
+The connection between CKAN and DataPusher is done via HTTPS endpoints. There is a possibility to disable TLS certificate verification, but a better solution seems to be import any self-signed certificate into the DataPusher's trust store. There is a script which automatically handles the import whenever the DataPusher container starts.
+
+Extensions
+----------
+
+CKAN container comes with several preinstalled and preconfigured extensions. Historically, there were more extensions, but over the time CKAN's API evolved and the development has moved to python 3, so majority of the historical extensions are no longer operational.
+
+ckan/ckanext-basiccharts
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/ckan/ckanext-basiccharts
+
+Adds Line, Bar and Pie charts. It uses Flot Charts, which is compatible with all major browsers (including IE6+).
+
+ckan/ckanext-spatial
+^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/ckan/ckanext-spatial
+
+Contains plugins that add geospatial capabilities to CKAN. E.g. a spatial field on the default CKAN dataset schema which allows to perform spatial queries and to display the dataset extent on the frontend.
+
+ckan/ckanext-geoview
+^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/ckan/ckanext-geoview
+
+Contains view plugins to display geospatial files and services in CKAN. It contains an OpenLayers based viewer and other view plugins that used to be part of ckanext-spatial.
+
+ckan/ckanext-mapviews
+^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/ckan/ckanext-mapviews
+
+Adds regular and choropleth maps to CKAN, using the new CKAN Resource View. It uses LeafletJS, which is compatible with all major browsers (including IE7+).
+
+XVTSolutions/ckanext-spatialUI
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/XVTSolutions/ckanext-spatialUI
+
+Provides the UI elements for spatial search. Spatial search widget and dataset extent map.
+
+aptivate/ckanext-datasetthumbnail
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/aptivate/ckanext-datasetthumbnail
+
+Adds support for generation and display of thumbnail images.
+
+datagvat/ckanext-dgvat_xls
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/datagvat/ckanext-dgvat_xls
+
+Allows group admin to export datasets from their organizations to export all datasets to a .xls worksheet. Sysadmins may choose to export datasets from any organization they want or to export all datasets of all groups.

doc/applications/crisiscleanup.rst

@@ -0,0 +1,21 @@
+CrisisCleanup
+=============
+
+Overview
+--------
+
+Crisis Cleanup is a collaboration platform that connects disaster recovery organization volunteers with people who need help after a disaster. It is a Ruby on Rails application written for Ruby 2.6 with NodeJS-dependent web frontend.
+
+Upstream URL: https://github.com/CrisisCleanup/crisiscleanup-2
+
+Version 2 maintenance
+---------------------
+
+As of 2020-03-27, CrisisCleanup v2 is no longer maintained. The maintenance has been discontinued in favor of CrisisCleanup v3, which splits the backend and frontend into two separate projects. Unfortunately the source of the backend part hasn't been opened and the creator has no plants to do so, so currently only the frontend application as available on https://github.com/CrisisCleanup/crisiscleanup-3-web.
+
+Version 3 uses OpenStreetMap and Leaflet, whereas version 2 used Google Maps.
+
+NodeJS compatibility
+--------------------
+
+The application uses NodeJS to generate and pack assets, however due to its age, yarn dependencies installation fails on NodeJS versions newer than 8, therefore the NodeJS version has been frozen on 8.14.0 provided by Alpine 3.8.

doc/applications/decidim.rst

@@ -0,0 +1,26 @@
+Decidim
+=======
+
+Overview
+--------
+
+Decidim is a participatory democracy platform for cities and organizations. Decidim is written and runs on Ruby 2.6, where it is installed as Ruby Gem. Incoming HTTP requests are handled via passenger nginx plugin.
+
+Upstream URL: https://github.com/decidim/decidim
+
+Passenger nginx plugin
+----------------------
+
+The passenger plugin work as application proxy between HTTP server and Ruby on Rails applications. Nginix doesn't have modules API like Apache does, so all nginx module must be present at compile time and only then they can be loaded and unloaded at runtime. Passenger plugin is not present in the standard Alpine nginx packages, therefore for passenger to work, a custom version of nginx including the passenger plugin needs to be compiled. Passenger sources contain ``passenger-install-nginx-module`` script which eases and semi-automates the compilation.
+
+Database upgrades
+-----------------
+
+Decidim creates a series of database migration scripts under ``db/migrate`` directory. Unfortunately, these script are not created deterministically as their file names are always created with current build's timestamp. The same script using the same Decidim version therefore always ends up with different database migration scripts. Newly added scripts in a new version of Decidim are not sorted at the end, so it's impossible to determine which scripts need to applied from the filenames alone.
+
+During manual upgrade, the workaround is to compare the directories between the old and the new image, stripping the timestamp and running only the scripts which don't exist in the old directory, however this is impossible to be done during automatic upgrade, as the old image is removed before the upgrade script is executed.
+
+Additional site creation
+------------------------
+
+Decidim allows to create managed sites using the superadmin interface on ``https://<Decidim URL>/system/``. The sites require their own (sub)domains, therefore some additional considerations must be taken when setting up HTTP reverse proxies and TLS certificates.

doc/applications/frontlinesms.rst

@@ -0,0 +1,97 @@
+FrontlineSMS
+============
+
+Overview
+--------
+
+FrontlineSMS is a system for both manual and automatic processing of SMS, supporting creation of various SMS workflows. The application is written in Java (resp. Groovy) and uses Grails layout engine. It has its own installer which deploys single-tenant Jetty lightweight applicaiton server. To work efficiently, FrontlineSMS requires a device with SMS capabilities or a connection to third-party service such as Twilio.
+
+The version of FrontlineSMS is no longer maintained by the original developers and no new updates are expected to appear. The manufacturer currently offers and supports only a cloud version of FrontlineSMS.
+
+Upstream URL: https://github.com/frontlinesms/frontlinesms2
+
+Fork URL: https://github.com/trendspotter/frontlinesms2 - the fork contains the last known working version of installer as a release.
+
+Modem capabilities
+------------------
+
+There are special considerations to be taken whenever an application witch direct access to hardware is run in a container. Currently FrontlineSMS has not been tested with such device and it is expected that some extra work or container configuration not present in any other application needs to be done in order to make the hardware device available and usable by the container.
+
+Localization
+------------
+
+FrontlineSMS is localized to Czech only locally on SpoterVM. Upstream doesn't contain the localization as the application is not developed anymore. The localization is supplied as a Java property file ``WEB-INF/grails-app/i18n/messages_cs.properties`` and then once again as the same file packed and minifies as ``assets/i18n/frontlinesms-core_messages_cs.js``. The minified file can be created using ``frontlinesms-lang-js.py`` helper script in SpotterVM repository.
+
+Java support
+------------
+
+Due to the age of the application (latest release somewhere in 2014), FrontlineSMS doesn't work well with current versions of Java runtime. The last know working version is Java 8.222.10 supplied by Alpine 3.8. More recent version, e.g. Java 8.242 cause HTTP connection accept failures.
+
+X server
+--------
+
+Although FrontlineSMS is a web application, it requires X server as it attempts to install a systray icon. On a headless server, this requirement can be worked around using ``xf86-video-dummy`` package which works as a *blackhole* display driver.
+
+The X server is then started as
+
+.. code-block:: bash
+
+    Xorg -noreset +extension GLX +extension RANDR +extension RENDER -config dummy.conf :10
+
+Where the ``dummy.conf`` looks as follows
+
+.. code-block:: xorg.conf
+
+    Section "ServerFlags"
+      Option "DontVTSwitch" "true"
+      Option "AllowMouseOpenFail" "true"
+      Option "PciForceNone" "true"
+      Option "AutoEnableDevices" "false"
+      Option "AutoAddDevices" "false"
+    EndSection
+
+    Section "InputDevice"
+      Identifier "dummy_mouse"
+      Option "CorePointer" "true"
+      Driver "void"
+    EndSection
+
+    Section "InputDevice"
+      Identifier "dummy_keyboard"
+      Option "CoreKeyboard" "true"
+      Driver "void"
+    EndSection
+
+    Section "Device"
+      Identifier "dummy_videocard"
+      Driver "dummy"
+      Option "ConstantDPI" "true"
+      VideoRam 192000
+    EndSection
+
+    Section "Monitor"
+      Identifier "dummy_monitor"
+      HorizSync   5.0 - 1000.0
+      VertRefresh 5.0 - 200.0
+      Modeline "1280x720" 27.41 1280 1312 1416 1448 720 737 740 757
+    EndSection
+
+    Section "Screen"
+      Identifier "dummy_screen"
+      Device "dummy_videocard"
+      Monitor "dummy_monitor"
+      DefaultDepth 24
+      SubSection "Display"
+        Viewport 0 0
+        Depth 24
+        Modes "1280x720"
+        Virtual 8192 4096
+      EndSubSection
+    EndSection
+
+    Section "ServerLayout"
+      Identifier   "dummy_layout"
+      Screen       "dummy_screen"
+      InputDevice  "dummy_mouse"
+      InputDevice  "dummy_keyboard"
+    EndSection

doc/applications/images-list.rst

@@ -0,0 +1,25 @@
+List of existing container images
+=================================
+
+Basic and runtime images
+------------------------
+
+.. csv-table::
+   :file: attachments/images-list-basic.csv
+   :header-rows: 1
+
+Common service images
+---------------------
+
+.. csv-table::
+   :file: attachments/images-list-services.csv
+   :header-rows: 1
+
+List of application images
+--------------------------
+
+All application images have the application user UID/GID 8080 and listen on internal port 8080 (HTTP).
+
+.. csv-table::
+   :file: attachments/images-list-apps.csv
+   :header-rows: 1

doc/applications/index.rst

@@ -0,0 +1,21 @@
+Applications and containers
+===========================
+
+.. toctree::
+   :maxdepth: 2
+
+   images-list
+   tech-knowledge
+   map-services
+   ckan
+   crisiscleanup
+   decidim
+   frontlinesms
+   kanboard
+   opendatakit
+   openmapkit
+   pandora
+   sahana
+   sahana-configuration-report
+   seeddms
+   taarifa

doc/applications/kanboard.rst

@@ -0,0 +1,121 @@
+Kanboard
+========
+
+Overview
+--------
+
+Kanboard is a Kanban project management tool written in PHP. It supports creation of projects and their population with tasks, provides Kanban boards with swimlanes, charts etc. It is extensile via plugins.
+
+Upstream URL: https://github.com/kanboard/kanboard
+
+Localization
+------------
+
+Kanboard is localized via PHP files containing associative arrays with original English string and the translation in the respective language. Every plugin has its own localization files. Due to this, we currently maintain forks or 4 repositories with plugins where the original maintainer decided to discontinue support.
+
+Plugins
+-------
+
+Following list summarizes state of Kanboard plugins used or requested in our container as of 05/2020.
+
+BlueTeck/kanboard_plugin_overwrite_translation
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/BlueTeck/kanboard_plugin_overwrite_translation
+
+Supplies translation strings via additional configuration file for other plugins which are missing or have incorrect translations. Not updated anymore, however the maintainer is active on GitHub. This plugin has initially been requested to be included in our installation, but due to its purpose, it's mostly useless as all translations were done in the respective plugin localization files.
+
+BlueTeck/kanboard_plugin_coverimage
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/BlueTeck/kanboard_plugin_coverimage
+
+This plugin adds a cover image function to tasks on the board, and allows you to set a project image to use as a logo for projects. Development is active.
+
+BlueTeck/kanboard_plugin_metadata
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/BlueTeck/kanboard_plugin_metadata
+
+This plugin adds a basic GUI for Plugin Metadata. Not updated anymore, however the maintainer is active on GitHub.
+
+eSkiSo/Subtaskdate
+^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/eSkiSo/Subtaskdate
+
+Adds a new due date field for subtasks, including events, API and search functions. Development is active.
+
+kanboard/plugin-budget
+^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-budget
+- Fork URL: https://github.com/trendspotter/kanboard-plugin-budget
+
+Allows to create budget lines, see expenses based on sub-task time tracking and manage user hourly rates. Repository has been forked. The original repository is archived.
+
+kanboard/plugin-calendar
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-calendar
+
+Adds embedded calendar view for Kanboard. Development is active.
+
+kanboard/plugin-chat
+^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-chat
+- Fork URL: https://github.com/trendspotter/kanboard-plugin-chat
+
+Minimalist internal chat for Kanboard. Allows only one room for all users. Repository has been forked. The original repository is archived.
+
+kanboard/plugin-gantt
+^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-gantt
+
+Adds Gantt charts for Kanboard. Development is active.
+
+kanboard/plugin-gravatar
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-gravatar
+
+Enables Gravatar icons for Kanboard users. Repository is archived. There are no strings for translation, so it hasn't been forked.
+
+kanboard/plugin-registration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-registration
+
+Allows new user to sign up to Kanboard. Development is active.
+
+kanboard/plugin-sms-2fa
+^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-sms-2fa
+- Fork URL: https://github.com/trendspotter/kanboard-plugin-sms-2fa
+
+Allows to use text messages (SMS) instead of the default TOTP system (Time-based One-time Password Algorithm). Works with Twilio service. Repository has been forked. The original repository is archived.
+
+kanboard/plugin-task-board-date
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/kanboard/plugin-task-board-date
+
+Adds new date field for tasks to define the visibility on the board and dashboard. Repository is archived. There are no strings for translation, so it hasn't been forked.
+
+oliviermaridat/kanboard-milestone-plugin
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/oliviermaridat/kanboard-milestone-plugin
+
+Adds section for milestones to show their related tasks. Development is active.
+
+xavividal/kanboard-plugin-relationgraph
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- URL: https://github.com/xavividal/kanboard-plugin-relationgraph
+- Fork URL: https://github.com/trendspotter/kanboard-plugin-relationgraph
+
+Shows relations between tasks using a graph library. Repository has been forked. The original repository is inactive.

doc/applications/map-services.rst

@@ -0,0 +1,12 @@
+Map services used in applications
+=================================
+
+.. csv-table::
+   :file: attachments/map-services.csv
+   :header-rows: 1
+
+1. Used by CKAN extensions *reclineview*, *spatial* and *geoview*.
+2. Untested as the EcoGIS source code is not fully open. Looks like the data sources are configurable, but the full documentation is only in Italian.
+3. Used by Odoo *Google Maps* module to display company/partner address on map.
+4. Map is used by OMK and ODK Android clients. OMK Server only offers API.
+5. Sahana Eden supports multitude of connectors and protocols to process map and feature data. ArcGIS REST, Bing maps, GeoJSON, GeoRSS, Google Maps, GPX, KML, MGRS, OSM, OWM, Shapefile, TMS, WFS, WMS and XYZ.

doc/applications/opendatakit.rst

@@ -0,0 +1,24 @@
+OpenDataKit
+===========
+
+Overview
+--------
+
+OpenDataKit is a suite of tools that help organizations collect and manage data, typically via mobile application. The most interesting components used on SpotterVM are
+
+- **ODK Aggregate** - Main data storage server and analysis tool, written in Java, running on Apache Tomcat using PostgreSQL database.
+- **ODK Build** - Drag-and-drop form designer, written in Ruby 2.4, requires NodeJS for frontend assets.
+- **build2xlsform** - Service to convert ODK Build forms to xlsform-compliant XLSX, written in LiveScript (NodeJS).
+
+Upstream URLs:
+
+- **ODK Aggregate** - https://github.com/getodk/build
+- **ODK Build** - https://github.com/getodk/build
+- **build2xlsform** - https://github.com/getodk/build2xlsform
+
+ODK Build exports
+-----------------
+
+ODK Build runs in a container separate from ODK Aggregate and doesn't use any database engine for its persistent storage. ODK Build can however export the designed form to ODK Aggregate via HTTP endpoint. In case HTTPS is used with self-signed certificate, it needs to be imported to OpenSSL trust store prior to first communication attempt. In our container, this is ensured by ``add-ca-cert`` script.
+
+build2xlsform lives in the same container as ODK Build and allows for export of ODK Build JSON forms to XLSX files editable via any modern office suite.

doc/applications/openmapkit.rst

@@ -0,0 +1,12 @@
+OpenMapKit
+==========
+
+Overview
+--------
+
+OpenMapKit is a standalone extension to OpenDataKit providing mapping features and handles collection and aggregation of OpenStreetMap and OpenDataKit data generated via mobile applications.
+
+NodeJS compatibility
+--------------------
+
+OpenMapKit is purely NodeJS application. Unfortunately it depends on a libxmljs module in version incompatible with NodeJS version newer that 10. Due to that OpenMapKit is currently frozen on NodeJS 10.19.0 provided by Alpine 3.10.

doc/applications/pandora.rst

@@ -0,0 +1,25 @@
+Pan.do/ra
+=========
+
+Overview
+--------
+
+Pan.do/ra is a free, open source media archive platform. It allows to manage large, decentralized collections of video and collaboratively create metadata and time-based annotations. Pan.do/ra is a Django-based application written in python and is split to several components, most notably OxJS javascript framework and oxtimelines. It heavily relies on *ffmpeg* and uses *RabbitMQ* to pass messages between the components.
+
+Upstream URLs
+^^^^^^^^^^^^^
+
+- Pan.do/ra: https://code.0x2620.org/0x2620/pandora
+- OxJS: https://code.0x2620.org/0x2620/oxjs
+- python-ox: https://code.0x2620.org/0x2620/python-ox
+- oxtimelines: https://code.0x2620.org/0x2620/oxtimelines
+
+Localization
+------------
+
+Czech localtization for Pan.do/ra currently exists only in SpotterVM repository. Separate localization is required for Pan.do/ra and OxJS framework which it uses. Moreover, the list of supported languages is hardcoded, so localization entails also modification of this fixed list of languages.
+
+Python 3.8 compatibility
+------------------------
+
+Pandora uses Celery message broker, however depends on a version with known incompatibility with python 3.8, see https://github.com/celery/celery/issues/5761. This can be worked around by setting environment variable ``COLUMNS`` to value ``80`` prior to launching the celery process. The affected services run by container's s6 daemon supervisor are currently configured to use this workaround.

doc/applications/sahana.rst

@@ -0,0 +1,92 @@
+Sahana Eden
+===========
+
+Overview
+--------
+
+Sahana Eden is a flexible and extensible humanitarian platform written in python, running on web2py platform and PostgreSQL with PostGIS extension. Sahana Eden is extremely highly customizable and configurable which unfortunately often leads to various bugs and misunderstandings in the configuration. For the description of the individual configuration options and their effect, see `Sahana Eden configuration usability report <sahana-configuration-report.html>`_. The application is usually configured via templates, which contain all the configuration, forms and logic customizations and some basic data relevant for the intended deployment.
+
+The application supports various interfaces, protocols and formats for data exchange - CAP (Common Alerting Protocol), XML/Atom feeds, WMS, WFS, WCS and other map services, KML exports, XML and CSV tabular data etc. Maps can be configured and adjusted to use virtually any tile, layer and feature sets. See `map services <map-services.html>`_.
+
+Upstream URL: https://github.com/sahana/eden
+
+Setup module
+------------
+
+Sahana deployment functions are based on Ansible. Ansible is provisioning, configuration management, and application-deployment tool written in python. It uses YAML files to define the desired actions or states. These files are called *playbooks*. There is a whole separate sahana_deploy project focusing on rapid Sahana Eden deployment and parts of it are used also in the Setup module. The setup module allows to control Sahana instances and adjust their configuration in terms of setting simple values and enabling/disabling modules in ``000_config.py``. The module, as well as the Ansible playbooks for the whole deployment are a bit too strict when it comes to assumptions and discovery of Sahana's environment. E.g. the path to the instance is expected to be always under ``/home/prod``. The Setup module is enabled and can be used, however due to its limitations and expectations it sets, it can't be considered reliable in the environment of Alpine container.
+
+Python 3.8 compatibility
+------------------------
+
+Sahana Eden is currently recommended to be run on web2py R2.18.5 (commit hash `59700b8 <https://github.com/web2py/web2py/commit/59700b8>`_). Recommended version is tracked in eden_deploy project in `main.yml for common playbook <https://github.com/sahana/eden_deploy/blob/master/roles/common/tasks/main.yml>`_. This version however doesn't fully support python 3.8, so a series of patches needs to applied to achieve the full support for python 3.8. This includes compatibility patches for gluon and pydal tracked in `_compat.patch <https://github.com/sahana/eden_deploy/blob/master/roles/common/files/_compat.patch>`_ and scheduler patch tracked separately in `scheduler.diff <https://github.com/sahana/eden_deploy/blob/master/roles/common/files/scheduler.diff>`_.
+
+Localization
+------------
+
+Czech localization for Sahana Eden is currently not a part of upstream code. It is currently held in SpotterVM repository and there are currently no plans to submit a pull request with the translation.
+
+The localization is done via translation export function of Sahana Eden found in the administration menu. The exported CSV or XLS file is then manually translated and fed back to ``sahana-lang-convert.py`` helper script which generated the appropriate python dictionary file used as translation. Some strings are not output by the translation function and are either hardcoded or composed, so there is also ``sahana-lang-compare.py`` helper script which traverses installed Sahana Eden instance and tries to locate and supply all missing strings from the previous translation file. Both helper scripts are also contained in the SpotterVM repository.
+
+Local development
+-----------------
+
+Since Sahana Eden is the crown jewel of the whole environment and unfortunately also the most buggy application, it may be needed to work on some development tasks and bugfixes outsite of the VM environment. Following are a few tips to important tasks and gotchas you may encounter.
+
+To enable debug mode for Sahana, set ``settings.base.debug = True`` in ``applications/eden/models/000_config.py``.
+
+Database migration
+^^^^^^^^^^^^^^^^^^
+
+New commits (both upstream and local) can require a modification of database structure. If this is not done, Sahana may report internal server errors or corrupt the database. Migration to the up-to-date schema version can be achieved via following steps.
+
+.. code-block:: bash
+
+    # Change directory to web2py root
+    cd /srv/web2py
+
+    # Allow database migration (normally denied in prod)
+    sed -i 's/settings.base.migrate = False/settings.base.migrate = True/g' applications/eden/models/000_config.py
+
+    # Remove old cached bytecode
+    rm -rf applications/eden/compiled
+
+    # Run the migration task
+    python web2py.py -S eden -M -R applications/eden/static/scripts/tools/noop.py
+
+    # Deny database migration (improves performance)
+    sed -i 's/settings.base.migrate = True/settings.base.migrate = False/g' applications/eden/models/000_config.py
+
+    # Precompile fresh bytecode
+    python web2py.py -S eden -M -R applications/eden/static/scripts/tools/compile.py
+
+Factory reset
+^^^^^^^^^^^^^
+
+In case you'd like to wipe all data and restore your Sahana instance to pre-installation phase, stop all Sahana (uWSGI) processes and run the following.
+
+.. code-block:: bash
+
+    # Drop and recreate database
+    cat <<EOF | sudo -u postgres psql
+    DROP DATABASE sahana
+    REVOKE ALL ON DATABASE sahana FROM public;
+    ALTER DATABASE sahana OWNER TO sahana;
+    \c sahana;
+    CREATE EXTENSION postgis;
+    GRANT ALL ON geometry_columns TO sahana;
+    GRANT ALL ON spatial_ref_sys TO sahana;
+    EOF
+
+    # Change directory to web2py root
+    cd /srv/web2py
+
+    # Wipe file caches
+    rm -rf applications/eden/compiled
+    rm -rf applications/eden/databases/*
+    rm -rf applications/eden/uploads/*
+    rm -rf applications/eden/errors/*
+    rm -f applications/eden/config/0000_update_check.py
+
+    # Allow database migration and prepopulation
+    sed -i 's/settings.base.migrate = True/settings.base.migrate = False/' applications/eden/models/000_config.py
+    sed -i 's/#settings.base.prepopulate = 0/settings.base.prepopulate = 0/' applications/eden/models/000_config.py