Outline 自用部署：Keycloak、MinIO 和 OpenResty

openssl x509 -in /etc/ssl/example/fullchain.pem -noout -dates -subject
nginx -t
systemctl reload openresty

SELECT name, default_version, installed_version
FROM pg_available_extensions
WHERE name IN ('uuid-ossp', 'unaccent', 'pg_trgm');

CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS unaccent;
CREATE EXTENSION IF NOT EXISTS pg_trgm;

sudo apt-get install -y libossp-uuid-dev
cd /data/tools/oneinstack/src/postgresql-12.7/contrib/uuid-ossp
make
make install
service postgresql restart

CREATE DATABASE keycloak_db;
CREATE USER keycloak_user WITH PASSWORD :'keycloak_db_password';
GRANT ALL PRIVILEGES ON DATABASE keycloak_db TO keycloak_user;

CREATE DATABASE outlinedb;
CREATE USER outlinedbuser WITH PASSWORD :'outline_db_password';
GRANT ALL PRIVILEGES ON DATABASE outlinedb TO outlinedbuser;

\c outlinedb
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS unaccent;
CREATE EXTENSION IF NOT EXISTS pg_trgm;

services:
  openldap:
    image: osixia/openldap:latest
    restart: always
    environment:
      LDAP_ORGANISATION: "example"
      LDAP_DOMAIN: "example.com"
      LDAP_ADMIN_PASSWORD: "${LDAP_ADMIN_PASSWORD:?set LDAP_ADMIN_PASSWORD}"
      LDAP_CONFIG_PASSWORD: "${LDAP_CONFIG_PASSWORD:?set LDAP_CONFIG_PASSWORD}"
    volumes:
      - ./data:/var/lib/ldap
      - ./config:/etc/ldap/slapd.d
    ports:
      - "389:389"

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    restart: always
    links:
      - openldap
    environment:
      PHPLDAPADMIN_HTTPS: "false"
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"
    ports:
      - "30000:80"

python3 - <<'PY'
from urllib.parse import quote
import os

print(quote(os.environ["OUTLINE_DB_PASSWORD"], safe=""))
PY

openssl rand -hex 32
openssl rand -hex 32

services:
  minio:
    image: ${OUTLINE_MINIO_IMAGE_TAG}
    command: server /data --console-address :9001
    volumes:
      - ./data/minio:/data
    environment:
      MINIO_ROOT_USER: ${OUTLINE_MINIO_ADMIN}
      MINIO_ROOT_PASSWORD: ${OUTLINE_MINIO_ADMIN_PASSWORD}
      MINIO_BROWSER_REDIRECT_URL: ${OUTLINE_MINIO_CONSOLE_URL}
    ports:
      - "9000:9000"
      - "9001:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: always

  minio-init:
    image: ${OUTLINE_MINIO_IMAGE_TAG}
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: /bin/sh
    command:
      - -c
      - |
        set -eu
        export MC_HOST_minio="http://${OUTLINE_MINIO_ADMIN}:${OUTLINE_MINIO_ADMIN_PASSWORD}@minio:9000"
        mc ls minio/${OUTLINE_MINIO_BUCKET_NAME} >/dev/null 2>&1 || mc mb minio/${OUTLINE_MINIO_BUCKET_NAME}
        mc admin user info minio ${OUTLINE_MINIO_USER} >/dev/null 2>&1 || mc admin user add minio ${OUTLINE_MINIO_USER} ${OUTLINE_MINIO_USER_PASSWORD}
        cat > outline-policy.json <<POLICY
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads"
              ],
              "Resource": ["arn:aws:s3:::${OUTLINE_MINIO_BUCKET_NAME}"]
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:ListMultipartUploadParts",
                "s3:PutObject"
              ],
              "Resource": ["arn:aws:s3:::${OUTLINE_MINIO_BUCKET_NAME}/*"]
            }
          ]
        }
        POLICY
        mc admin policy info minio OutlineAppFullAccess >/dev/null 2>&1 || mc admin policy create minio OutlineAppFullAccess outline-policy.json
        if ! mc admin policy entities minio --user ${OUTLINE_MINIO_USER} | grep -q 'OutlineAppFullAccess'; then
          mc admin policy attach minio OutlineAppFullAccess --user=${OUTLINE_MINIO_USER}
        fi
        mc admin user info minio ${OUTLINE_MINIO_USER}
    environment:
      OUTLINE_MINIO_ADMIN: ${OUTLINE_MINIO_ADMIN}
      OUTLINE_MINIO_ADMIN_PASSWORD: ${OUTLINE_MINIO_ADMIN_PASSWORD}
      OUTLINE_MINIO_USER: ${OUTLINE_MINIO_USER}
      OUTLINE_MINIO_USER_PASSWORD: ${OUTLINE_MINIO_USER_PASSWORD}
      OUTLINE_MINIO_BUCKET_NAME: ${OUTLINE_MINIO_BUCKET_NAME}
    restart: "no"

  redis:
    image: ${OUTLINE_REDIS_IMAGE_TAG}
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: always

  outline:
    image: ${OUTLINE_IMAGE_TAG}
    environment:
      DATABASE_URL: postgres://${OUTLINE_DB_USER}:${OUTLINE_DB_PASSWORD_URLENCODED}@postgres.example.internal:5432/${OUTLINE_DB_NAME}?sslmode=${OUTLINE_DB_SSLMODE}&connect_timeout=10
      PGSSLMODE: ${OUTLINE_DB_SSLMODE}
      REDIS_URL: redis://redis:6379
      URL: ${OUTLINE_URL}
      PORT: 3000
      SECRET_KEY: ${OUTLINE_SECRET_KEY}
      UTILS_SECRET: ${OUTLINE_UTILS_SECRET}
      FORCE_HTTPS: "false"
      ENABLE_UPDATES: "true"
      AWS_REGION: eu-east-1
      AWS_ACCESS_KEY_ID: ${OUTLINE_MINIO_USER}
      AWS_SECRET_ACCESS_KEY: ${OUTLINE_MINIO_USER_PASSWORD}
      AWS_S3_UPLOAD_BUCKET_URL: ${OUTLINE_AWS_S3_UPLOAD_BUCKET_URL}
      AWS_S3_ACCELERATE_URL: ${OUTLINE_AWS_S3_UPLOAD_BUCKET_URL}
      AWS_S3_UPLOAD_BUCKET_NAME: ${OUTLINE_MINIO_BUCKET_NAME}
      AWS_S3_UPLOAD_MAX_SIZE: ${FILE_STORAGE_UPLOAD_MAX_SIZE}
      FILE_STORAGE_UPLOAD_MAX_SIZE: ${FILE_STORAGE_UPLOAD_MAX_SIZE}
      AWS_S3_FORCE_PATH_STYLE: "false"
      AWS_S3_ACL: private
      OIDC_CLIENT_ID: outline
      OIDC_CLIENT_SECRET: ${OUTLINE_OIDC_CLIENT_SECRET}
      OIDC_AUTH_URI: ${OUTLINE_OIDC_AUTH_URI}
      OIDC_TOKEN_URI: ${OUTLINE_OIDC_TOKEN_URI}
      OIDC_USERINFO_URI: ${OUTLINE_OIDC_USERINFO_URI}
      OIDC_DISPLAY_NAME: ${OUTLINE_OIDC_DISPLAY_NAME}
      OIDC_USERNAME_CLAIM: ${OUTLINE_OIDC_USERNAME_CLAIM}
      OIDC_SCOPES: ${OUTLINE_OIDC_SCOPES}
    ports:
      - "3000:3000"
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/3000' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    restart: always
    depends_on:
      minio:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

docker compose config
docker compose up -d
docker compose ps
docker compose logs --tail=100 outline

server {
  listen 443 ssl;
  server_name outline.example.com;

  ssl_certificate /etc/ssl/example/fullchain.pem;
  ssl_certificate_key /etc/ssl/example/privkey.pem;

  location / {
    proxy_pass http://127.0.0.1:3000/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_redirect off;
  }
}

location / {
  proxy_set_header Host $http_host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_pass http://127.0.0.1:9001/;
}

pg_dump -Fc outlinedb > outlinedb-before-change.dump
tar czf outline-compose-backup-$(date +%F-%H%M%S).tar.gz .env compose.yaml data/minio

docker compose down

nginx -t
systemctl reload openresty