Merge pull request #939 from timrabl/fix-931

Actually fix #471 and #931

.github/workflows/push.yml

@@ -55,6 +55,7 @@ jobs:
       fail-fast: false
     env:
       GH_ACTION: enable
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       IMAGE_NAMES: docker.io/netboxcommunity/netbox
     runs-on: ubuntu-latest
     name: Builds new NetBox Docker Images

.github/workflows/release.yml

@@ -25,6 +25,7 @@ jobs:
     name: Builds new NetBox Docker Images
     env:
       GH_ACTION: enable
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       IMAGE_NAMES: docker.io/netboxcommunity/netbox quay.io/netboxcommunity/netbox ghcr.io/netbox-community/netbox
     steps:
       - id: source-checkout
@@ -32,7 +33,7 @@ jobs:
         uses: actions/checkout@v3
       - id: set-netbox-docker-version
         name: Get Version of NetBox Docker
-        run: echo "::set-output name=version::$(cat VERSION)"
+        run: echo "version=$(cat VERSION)" >>"$GITHUB_OUTPUT"
         shell: bash
       - id: qemu-setup
         name: Set up QEMU

README.md

@@ -40,8 +40,8 @@ services:
     ports:
       - 8000:8080
 EOF
-docker-compose pull
-docker-compose up
+docker compose pull
+docker compose up
 ```
 
 The whole application will be available after a few minutes.
@@ -123,7 +123,7 @@ This project relies only on _Docker_ and _docker-compose_ meeting these requirem
 * The _containerd version_ must be at least `1.5.6`.
 * The _docker-compose version_ must be at least `1.28.0`.
 
-To check the version installed on your system run `docker --version` and `docker-compose --version`.
+To check the version installed on your system run `docker --version` and `docker compose version`.
 
 ## Updating
 

build-functions/gh-functions.sh

@@ -19,3 +19,14 @@ gh_env() {
     echo "${@}" >>"${GITHUB_ENV}"
   fi
 }
+
+###
+# Prints the output to the file defined in ${GITHUB_OUTPUT}.
+# Only executes if ${GH_ACTION} is defined.
+# Example Usage: gh_env "FOO_VAR=bar_value"
+###
+gh_out() {
+  if [ -n "${GH_ACTION}" ]; then
+    echo "${@}" >>"$GITHUB_OUTPUT"
+  fi
+}

build-latest.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 # Builds the latest released version
+source ./build-functions/gh-functions.sh
 
 echo "▶️ $0 $*"
 
@@ -11,16 +12,20 @@ if ! command -v jq; then
   exit 1
 fi
 
+CURL_ARGS=(
+  --silent
+)
+
 ###
-# Checking for the presence of GITHUB_OAUTH_CLIENT_ID
-# and GITHUB_OAUTH_CLIENT_SECRET
+# Checking for the presence of GITHUB_TOKEN
 ###
-if [ -n "${GITHUB_OAUTH_CLIENT_ID}" ] && [ -n "${GITHUB_OAUTH_CLIENT_SECRET}" ]; then
+if [ -n "${GITHUB_TOKEN}" ]; then
   echo "🗝 Performing authenticated Github API calls."
-  GITHUB_OAUTH_PARAMS="client_id=${GITHUB_OAUTH_CLIENT_ID}&client_secret=${GITHUB_OAUTH_CLIENT_SECRET}"
+  CURL_ARGS+=(
+    --header "Authorization: Bearer ${GITHUB_TOKEN}"
+  )
 else
   echo "🕶 Performing unauthenticated Github API calls. This might result in lower Github rate limits!"
-  GITHUB_OAUTH_PARAMS=""
 fi
 
 ###
@@ -42,31 +47,27 @@ fi
 ###
 ORIGINAL_GITHUB_REPO="netbox-community/netbox"
 GITHUB_REPO="${GITHUB_REPO-$ORIGINAL_GITHUB_REPO}"
-URL_RELEASES="https://api.github.com/repos/${GITHUB_REPO}/releases?${GITHUB_OAUTH_PARAMS}"
+URL_RELEASES="https://api.github.com/repos/${GITHUB_REPO}/releases"
 
 # Composing the JQ commans to extract the most recent version number
 JQ_LATEST="group_by(.prerelease) | .[] | sort_by(.published_at) | reverse | .[0] | select(.prerelease==${PRERELEASE-false}) | .tag_name"
 
-CURL="curl -sS"
+CURL="curl"
 
 # Querying the Github API to fetch the most recent version number
-VERSION=$($CURL "${URL_RELEASES}" | jq -r "${JQ_LATEST}")
+VERSION=$($CURL "${CURL_ARGS[@]}" "${URL_RELEASES}" | jq -r "${JQ_LATEST}" 2>/dev/null)
 
 ###
 # Check if the prerelease version is actually higher than stable version
 ###
 if [ "${PRERELEASE}" == "true" ]; then
   JQ_STABLE="group_by(.prerelease) | .[] | sort_by(.published_at) | reverse | .[0] | select(.prerelease==false) | .tag_name"
-  STABLE_VERSION=$($CURL "${URL_RELEASES}" | jq -r "${JQ_STABLE}")
+  STABLE_VERSION=$($CURL "${CURL_ARGS[@]}" "${URL_RELEASES}" | jq -r "${JQ_STABLE}" 2>/dev/null)
 
-  # shellcheck disable=SC2003
-  MAJOR_STABLE=$(expr match "${STABLE_VERSION}" 'v\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MINOR_STABLE=$(expr match "${STABLE_VERSION}" 'v[0-9]\+\.\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MAJOR_UNSTABLE=$(expr match "${VERSION}" 'v\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MINOR_UNSTABLE=$(expr match "${VERSION}" 'v[0-9]\+\.\([0-9]\+\)')
+  MAJOR_STABLE=$(expr "${STABLE_VERSION}" : 'v\([0-9]\+\)')
+  MINOR_STABLE=$(expr "${STABLE_VERSION}" : 'v[0-9]\+\.\([0-9]\+\)')
+  MAJOR_UNSTABLE=$(expr "${VERSION}" : 'v\([0-9]\+\)')
+  MINOR_UNSTABLE=$(expr "${VERSION}" : 'v[0-9]\+\.\([0-9]\+\)')
 
   if {
     [ "${MAJOR_STABLE}" -eq "${MAJOR_UNSTABLE}" ] &&
@@ -75,10 +76,7 @@ if [ "${PRERELEASE}" == "true" ]; then
 
     echo "❎ Latest unstable version '${VERSION}' is not higher than the latest stable version '$STABLE_VERSION'."
     if [ -z "$DEBUG" ]; then
-      if [ -n "${GH_ACTION}" ]; then
-        echo "::set-output name=skipped::true"
-      fi
-
+      gh_out "skipped=true"
       exit 0
     else
       echo "⚠️ Would exit here with code '0', but DEBUG is enabled."

build.sh

@@ -170,7 +170,7 @@ if [ "${2}" != "--push-only" ] && [ -z "${SKIP_GIT}" ]; then
   REMOTE_EXISTS=$(git ls-remote --heads --tags "${URL}" "${NETBOX_BRANCH}" | wc -l)
   if [ "${REMOTE_EXISTS}" == "0" ]; then
     echo "❌ Remote branch '${NETBOX_BRANCH}' not found in '${URL}'; Nothing to do"
-    gh_echo "::set-output name=skipped::true"
+    gh_out "skipped=true"
     exit 0
   fi
   echo "🌐 Checking out '${NETBOX_BRANCH}' of NetBox from the url '${URL}' into '${NETBOX_PATH}'"
@@ -349,10 +349,10 @@ fi
 
 if [ "${SHOULD_BUILD}" != "true" ]; then
   echo "Build skipped because sources didn't change"
-  echo "::set-output name=skipped::true"
+  gh_out "skipped=true"
   exit 0 # Nothing to do -> exit
 else
-  gh_echo "::set-output name=skipped::false"
+  gh_out "skipped=false"
 fi
 gh_echo "::endgroup::"
 

configuration/configuration.py

@@ -58,6 +58,9 @@ _BASE_DIR = dirname(dirname(abspath(__file__)))
 #
 # Example: ALLOWED_HOSTS = ['netbox.example.com', 'netbox.internal.local']
 ALLOWED_HOSTS = environ.get('ALLOWED_HOSTS', '*').split(' ')
+# ensure that '*' or 'localhost' is always in ALLOWED_HOSTS (needed for health checks)
+if '*' not in ALLOWED_HOSTS and 'localhost' not in ALLOWED_HOSTS:
+    ALLOWED_HOSTS.append('localhost')
 
 # PostgreSQL database configuration. See the Django documentation for a complete list of available parameters:
 #   https://docs.djangoproject.com/en/stable/ref/settings/#databases
@@ -83,6 +86,7 @@ REDIS = {
     'tasks': {
         'HOST': environ.get('REDIS_HOST', 'localhost'),
         'PORT': _environ_get_and_map('REDIS_PORT', 6379, _AS_INT),
+        'USERNAME': environ.get('REDIS_USERNAME', ''),
         'PASSWORD': _read_secret('redis_password', environ.get('REDIS_PASSWORD', '')),
         'DATABASE': _environ_get_and_map('REDIS_DATABASE', 0, _AS_INT),
         'SSL': _environ_get_and_map('REDIS_SSL', 'False', _AS_BOOL),
@@ -91,6 +95,7 @@ REDIS = {
     'caching': {
         'HOST': environ.get('REDIS_CACHE_HOST', environ.get('REDIS_HOST', 'localhost')),
         'PORT': _environ_get_and_map('REDIS_CACHE_PORT', environ.get('REDIS_PORT', '6379'), _AS_INT),
+        'USERNAME': environ.get('REDIS_CACHE_USERNAME', environ.get('REDIS_USERNAME', '')),
         'PASSWORD': _read_secret('redis_cache_password', environ.get('REDIS_CACHE_PASSWORD', environ.get('REDIS_PASSWORD', ''))),
         'DATABASE': _environ_get_and_map('REDIS_CACHE_DATABASE', '1', _AS_INT),
         'SSL': _environ_get_and_map('REDIS_CACHE_SSL', environ.get('REDIS_SSL', 'False'), _AS_BOOL),

configuration/ldap/ldap_config.py

@@ -61,18 +61,26 @@ LDAP_CA_CERT_FILE = environ.get('LDAP_CA_CERT_FILE', None)
 
 AUTH_LDAP_USER_SEARCH_BASEDN = environ.get('AUTH_LDAP_USER_SEARCH_BASEDN', '')
 AUTH_LDAP_USER_SEARCH_ATTR = environ.get('AUTH_LDAP_USER_SEARCH_ATTR', 'sAMAccountName')
+AUTH_LDAP_USER_SEARCH_FILTER: str = environ.get(
+    'AUTH_LDAP_USER_SEARCH_FILTER', f'({AUTH_LDAP_USER_SEARCH_ATTR}=%(user)s)'
+)
+
 AUTH_LDAP_USER_SEARCH = LDAPSearch(
-    AUTH_LDAP_USER_SEARCH_BASEDN,
-    ldap.SCOPE_SUBTREE,
-    "(" + AUTH_LDAP_USER_SEARCH_ATTR + "=%(user)s)"
+    AUTH_LDAP_USER_SEARCH_BASEDN, ldap.SCOPE_SUBTREE, AUTH_LDAP_USER_SEARCH_FILTER
 )
 
 # This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
 # heirarchy.
+
 AUTH_LDAP_GROUP_SEARCH_BASEDN = environ.get('AUTH_LDAP_GROUP_SEARCH_BASEDN', '')
 AUTH_LDAP_GROUP_SEARCH_CLASS = environ.get('AUTH_LDAP_GROUP_SEARCH_CLASS', 'group')
-AUTH_LDAP_GROUP_SEARCH = LDAPSearch(AUTH_LDAP_GROUP_SEARCH_BASEDN, ldap.SCOPE_SUBTREE,
-                                    "(objectClass=" + AUTH_LDAP_GROUP_SEARCH_CLASS + ")")
+
+AUTH_LDAP_GROUP_SEARCH_FILTER: str = environ.get(
+    'AUTH_LDAP_GROUP_SEARCH_FILTER', f'(objectclass={AUTH_LDAP_GROUP_SEARCH_CLASS})'
+)
+AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+    AUTH_LDAP_GROUP_SEARCH_BASEDN, ldap.SCOPE_SUBTREE, AUTH_LDAP_GROUP_SEARCH_FILTER
+)
 AUTH_LDAP_GROUP_TYPE = _import_group_type(environ.get('AUTH_LDAP_GROUP_TYPE', 'GroupOfNamesType'))
 
 # Define a group required to login.

docker-compose.override.yml.example

@@ -3,3 +3,11 @@ services:
   netbox:
     ports:
       - 8000:8080
+    healthcheck:
+      # Time for which the health check can fail after the container is started.
+      # This depends mostly on the performance of your database. On the first start,
+      # when all tables need to be created the start_period should be higher than on
+      # subsequent starts. For the first start after major version upgrades of NetBox
+      # the start_period might also need to be set higher.
+      # Default value in our docker-compose.yml is 60s
+      start_period: 90s

docker-compose.yml

@@ -1,7 +1,7 @@
 version: '3.4'
 services:
   netbox: &netbox
-    image: netboxcommunity/netbox:${VERSION-v3.4-2.4.0}
+    image: docker.io/netboxcommunity/netbox:${VERSION-v3.4-2.4.0}
     depends_on:
     - postgres
     - redis
@@ -47,14 +47,14 @@ services:
 
   # postgres
   postgres:
-    image: postgres:15-alpine
+    image: docker.io/postgres:15-alpine
     env_file: env/postgres.env
     volumes:
     - netbox-postgres-data:/var/lib/postgresql/data
 
   # redis
   redis:
-    image: redis:7-alpine
+    image: docker.io/redis:7-alpine
     command:
     - sh
     - -c # this is to evaluate the $REDIS_PASSWORD from the env

requirements-container.txt

@@ -1,6 +1,6 @@
 django-auth-ldap==4.1.0
-django-storages[azure,boto3,dropbox,google,libcloud,sftp]==1.13.1
+django-storages[azure,boto3,dropbox,google,libcloud,sftp]==1.13.2
 napalm==4.0.0
 psycopg2==2.9.5
-python3-saml==1.14.0
+python3-saml==1.15.0
 social-auth-core[all]==4.3.0