commit 5f5c4c73bde3397301af5d4ea4c74d489e4fb662 Author: Dejan R. Date: Sun Nov 23 17:32:18 2025 +0000 first commit diff --git a/db-init/initdb.sql b/db-init/initdb.sql new file mode 100644 index 0000000..a69deb1 --- /dev/null +++ b/db-init/initdb.sql @@ -0,0 +1,793 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, +-- software distributed under the License is distributed on an +-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +-- KIND, either express or implied. See the License for the +-- specific language governing permissions and limitations +-- under the License. +-- + +-- +-- Connection group types +-- + +CREATE TYPE guacamole_connection_group_type AS ENUM( + 'ORGANIZATIONAL', + 'BALANCING' +); + +-- +-- Entity types +-- + +CREATE TYPE guacamole_entity_type AS ENUM( + 'USER', + 'USER_GROUP' +); + +-- +-- Object permission types +-- + +CREATE TYPE guacamole_object_permission_type AS ENUM( + 'READ', + 'UPDATE', + 'DELETE', + 'ADMINISTER' +); + +-- +-- System permission types +-- + +CREATE TYPE guacamole_system_permission_type AS ENUM( + 'CREATE_CONNECTION', + 'CREATE_CONNECTION_GROUP', + 'CREATE_SHARING_PROFILE', + 'CREATE_USER', + 'CREATE_USER_GROUP', + 'AUDIT', + 'ADMINISTER' +); + +-- +-- Guacamole proxy (guacd) encryption methods +-- + +CREATE TYPE guacamole_proxy_encryption_method AS ENUM( + 'NONE', + 'SSL' +); + +-- +-- Table of connection groups. Each connection group has a name. +-- + +CREATE TABLE guacamole_connection_group ( + + connection_group_id serial NOT NULL, + parent_id integer, + connection_group_name varchar(128) NOT NULL, + type guacamole_connection_group_type + NOT NULL DEFAULT 'ORGANIZATIONAL', + + -- Concurrency limits + max_connections integer, + max_connections_per_user integer, + enable_session_affinity boolean NOT NULL DEFAULT FALSE, + + PRIMARY KEY (connection_group_id), + + CONSTRAINT connection_group_name_parent + UNIQUE (connection_group_name, parent_id), + + CONSTRAINT guacamole_connection_group_ibfk_1 + FOREIGN KEY (parent_id) + REFERENCES guacamole_connection_group (connection_group_id) + ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_group_parent_id + ON guacamole_connection_group(parent_id); + +-- +-- Table of connections. Each connection has a name, protocol, and +-- associated set of parameters. +-- A connection may belong to a connection group. +-- + +CREATE TABLE guacamole_connection ( + + connection_id serial NOT NULL, + connection_name varchar(128) NOT NULL, + parent_id integer, + protocol varchar(32) NOT NULL, + + -- Concurrency limits + max_connections integer, + max_connections_per_user integer, + + -- Connection Weight + connection_weight integer, + failover_only boolean NOT NULL DEFAULT FALSE, + + -- Guacamole proxy (guacd) overrides + proxy_port integer, + proxy_hostname varchar(512), + proxy_encryption_method guacamole_proxy_encryption_method, + + PRIMARY KEY (connection_id), + + CONSTRAINT connection_name_parent + UNIQUE (connection_name, parent_id), + + CONSTRAINT guacamole_connection_ibfk_1 + FOREIGN KEY (parent_id) + REFERENCES guacamole_connection_group (connection_group_id) + ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_parent_id + ON guacamole_connection(parent_id); + +-- +-- Table of base entities which may each be either a user or user group. Other +-- tables which represent qualities shared by both users and groups will point +-- to guacamole_entity, while tables which represent qualities specific to +-- users or groups will point to guacamole_user or guacamole_user_group. +-- + +CREATE TABLE guacamole_entity ( + + entity_id serial NOT NULL, + name varchar(128) NOT NULL, + type guacamole_entity_type NOT NULL, + + PRIMARY KEY (entity_id), + + CONSTRAINT guacamole_entity_name_scope + UNIQUE (type, name) + +); + +-- +-- Table of users. Each user has a unique username and a hashed password +-- with corresponding salt. Although the authentication system will always set +-- salted passwords, other systems may set unsalted passwords by simply not +-- providing the salt. +-- + +CREATE TABLE guacamole_user ( + + user_id serial NOT NULL, + entity_id integer NOT NULL, + + -- Optionally-salted password + password_hash bytea NOT NULL, + password_salt bytea, + password_date timestamptz NOT NULL, + + -- Account disabled/expired status + disabled boolean NOT NULL DEFAULT FALSE, + expired boolean NOT NULL DEFAULT FALSE, + + -- Time-based access restriction + access_window_start time, + access_window_end time, + + -- Date-based access restriction + valid_from date, + valid_until date, + + -- Timezone used for all date/time comparisons and interpretation + timezone varchar(64), + + -- Profile information + full_name varchar(256), + email_address varchar(256), + organization varchar(256), + organizational_role varchar(256), + + PRIMARY KEY (user_id), + + CONSTRAINT guacamole_user_single_entity + UNIQUE (entity_id), + + CONSTRAINT guacamole_user_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) + ON DELETE CASCADE + +); + +-- +-- Table of user groups. Each user group may have an arbitrary set of member +-- users and member groups, with those members inheriting the permissions +-- granted to that group. +-- + +CREATE TABLE guacamole_user_group ( + + user_group_id serial NOT NULL, + entity_id integer NOT NULL, + + -- Group disabled status + disabled boolean NOT NULL DEFAULT FALSE, + + PRIMARY KEY (user_group_id), + + CONSTRAINT guacamole_user_group_single_entity + UNIQUE (entity_id), + + CONSTRAINT guacamole_user_group_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) + ON DELETE CASCADE + +); + +-- +-- Table of users which are members of given user groups. +-- + +CREATE TABLE guacamole_user_group_member ( + + user_group_id integer NOT NULL, + member_entity_id integer NOT NULL, + + PRIMARY KEY (user_group_id, member_entity_id), + + -- Parent must be a user group + CONSTRAINT guacamole_user_group_member_parent + FOREIGN KEY (user_group_id) + REFERENCES guacamole_user_group (user_group_id) ON DELETE CASCADE, + + -- Member may be either a user or a user group (any entity) + CONSTRAINT guacamole_user_group_member_entity + FOREIGN KEY (member_entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +-- +-- Table of sharing profiles. Each sharing profile has a name, associated set +-- of parameters, and a primary connection. The primary connection is the +-- connection that the sharing profile shares, and the parameters dictate the +-- restrictions/features which apply to the user joining the connection via the +-- sharing profile. +-- + +CREATE TABLE guacamole_sharing_profile ( + + sharing_profile_id serial NOT NULL, + sharing_profile_name varchar(128) NOT NULL, + primary_connection_id integer NOT NULL, + + PRIMARY KEY (sharing_profile_id), + + CONSTRAINT sharing_profile_name_primary + UNIQUE (sharing_profile_name, primary_connection_id), + + CONSTRAINT guacamole_sharing_profile_ibfk_1 + FOREIGN KEY (primary_connection_id) + REFERENCES guacamole_connection (connection_id) + ON DELETE CASCADE + +); + +CREATE INDEX guacamole_sharing_profile_primary_connection_id + ON guacamole_sharing_profile(primary_connection_id); + +-- +-- Table of connection parameters. Each parameter is simply a name/value pair +-- associated with a connection. +-- + +CREATE TABLE guacamole_connection_parameter ( + + connection_id integer NOT NULL, + parameter_name varchar(128) NOT NULL, + parameter_value varchar(4096) NOT NULL, + + PRIMARY KEY (connection_id,parameter_name), + + CONSTRAINT guacamole_connection_parameter_ibfk_1 + FOREIGN KEY (connection_id) + REFERENCES guacamole_connection (connection_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_parameter_connection_id + ON guacamole_connection_parameter(connection_id); + +-- +-- Table of sharing profile parameters. Each parameter is simply +-- name/value pair associated with a sharing profile. These parameters dictate +-- the restrictions/features which apply to the user joining the associated +-- connection via the sharing profile. +-- + +CREATE TABLE guacamole_sharing_profile_parameter ( + + sharing_profile_id integer NOT NULL, + parameter_name varchar(128) NOT NULL, + parameter_value varchar(4096) NOT NULL, + + PRIMARY KEY (sharing_profile_id, parameter_name), + + CONSTRAINT guacamole_sharing_profile_parameter_ibfk_1 + FOREIGN KEY (sharing_profile_id) + REFERENCES guacamole_sharing_profile (sharing_profile_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_sharing_profile_parameter_sharing_profile_id + ON guacamole_sharing_profile_parameter(sharing_profile_id); + +-- +-- Table of arbitrary user attributes. Each attribute is simply a name/value +-- pair associated with a user. Arbitrary attributes are defined by other +-- extensions. Attributes defined by this extension will be mapped to +-- properly-typed columns of a specific table. +-- + +CREATE TABLE guacamole_user_attribute ( + + user_id integer NOT NULL, + attribute_name varchar(128) NOT NULL, + attribute_value varchar(4096) NOT NULL, + + PRIMARY KEY (user_id, attribute_name), + + CONSTRAINT guacamole_user_attribute_ibfk_1 + FOREIGN KEY (user_id) + REFERENCES guacamole_user (user_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_user_attribute_user_id + ON guacamole_user_attribute(user_id); + +-- +-- Table of arbitrary user group attributes. Each attribute is simply a +-- name/value pair associated with a user group. Arbitrary attributes are +-- defined by other extensions. Attributes defined by this extension will be +-- mapped to properly-typed columns of a specific table. +-- + +CREATE TABLE guacamole_user_group_attribute ( + + user_group_id integer NOT NULL, + attribute_name varchar(128) NOT NULL, + attribute_value varchar(4096) NOT NULL, + + PRIMARY KEY (user_group_id, attribute_name), + + CONSTRAINT guacamole_user_group_attribute_ibfk_1 + FOREIGN KEY (user_group_id) + REFERENCES guacamole_user_group (user_group_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_user_group_attribute_user_group_id + ON guacamole_user_group_attribute(user_group_id); + +-- +-- Table of arbitrary connection attributes. Each attribute is simply a +-- name/value pair associated with a connection. Arbitrary attributes are +-- defined by other extensions. Attributes defined by this extension will be +-- mapped to properly-typed columns of a specific table. +-- + +CREATE TABLE guacamole_connection_attribute ( + + connection_id integer NOT NULL, + attribute_name varchar(128) NOT NULL, + attribute_value varchar(4096) NOT NULL, + + PRIMARY KEY (connection_id, attribute_name), + + CONSTRAINT guacamole_connection_attribute_ibfk_1 + FOREIGN KEY (connection_id) + REFERENCES guacamole_connection (connection_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_attribute_connection_id + ON guacamole_connection_attribute(connection_id); + +-- +-- Table of arbitrary connection group attributes. Each attribute is simply a +-- name/value pair associated with a connection group. Arbitrary attributes are +-- defined by other extensions. Attributes defined by this extension will be +-- mapped to properly-typed columns of a specific table. +-- + +CREATE TABLE guacamole_connection_group_attribute ( + + connection_group_id integer NOT NULL, + attribute_name varchar(128) NOT NULL, + attribute_value varchar(4096) NOT NULL, + + PRIMARY KEY (connection_group_id, attribute_name), + + CONSTRAINT guacamole_connection_group_attribute_ibfk_1 + FOREIGN KEY (connection_group_id) + REFERENCES guacamole_connection_group (connection_group_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_group_attribute_connection_group_id + ON guacamole_connection_group_attribute(connection_group_id); + +-- +-- Table of arbitrary sharing profile attributes. Each attribute is simply a +-- name/value pair associated with a sharing profile. Arbitrary attributes are +-- defined by other extensions. Attributes defined by this extension will be +-- mapped to properly-typed columns of a specific table. +-- + +CREATE TABLE guacamole_sharing_profile_attribute ( + + sharing_profile_id integer NOT NULL, + attribute_name varchar(128) NOT NULL, + attribute_value varchar(4096) NOT NULL, + + PRIMARY KEY (sharing_profile_id, attribute_name), + + CONSTRAINT guacamole_sharing_profile_attribute_ibfk_1 + FOREIGN KEY (sharing_profile_id) + REFERENCES guacamole_sharing_profile (sharing_profile_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_sharing_profile_attribute_sharing_profile_id + ON guacamole_sharing_profile_attribute(sharing_profile_id); + +-- +-- Table of connection permissions. Each connection permission grants a user or +-- user group specific access to a connection. +-- + +CREATE TABLE guacamole_connection_permission ( + + entity_id integer NOT NULL, + connection_id integer NOT NULL, + permission guacamole_object_permission_type NOT NULL, + + PRIMARY KEY (entity_id, connection_id, permission), + + CONSTRAINT guacamole_connection_permission_ibfk_1 + FOREIGN KEY (connection_id) + REFERENCES guacamole_connection (connection_id) ON DELETE CASCADE, + + CONSTRAINT guacamole_connection_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_permission_connection_id + ON guacamole_connection_permission(connection_id); + +CREATE INDEX guacamole_connection_permission_entity_id + ON guacamole_connection_permission(entity_id); + +-- +-- Table of connection group permissions. Each group permission grants a user +-- or user group specific access to a connection group. +-- + +CREATE TABLE guacamole_connection_group_permission ( + + entity_id integer NOT NULL, + connection_group_id integer NOT NULL, + permission guacamole_object_permission_type NOT NULL, + + PRIMARY KEY (entity_id, connection_group_id, permission), + + CONSTRAINT guacamole_connection_group_permission_ibfk_1 + FOREIGN KEY (connection_group_id) + REFERENCES guacamole_connection_group (connection_group_id) ON DELETE CASCADE, + + CONSTRAINT guacamole_connection_group_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_connection_group_permission_connection_group_id + ON guacamole_connection_group_permission(connection_group_id); + +CREATE INDEX guacamole_connection_group_permission_entity_id + ON guacamole_connection_group_permission(entity_id); + +-- +-- Table of sharing profile permissions. Each sharing profile permission grants +-- a user or user group specific access to a sharing profile. +-- + +CREATE TABLE guacamole_sharing_profile_permission ( + + entity_id integer NOT NULL, + sharing_profile_id integer NOT NULL, + permission guacamole_object_permission_type NOT NULL, + + PRIMARY KEY (entity_id, sharing_profile_id, permission), + + CONSTRAINT guacamole_sharing_profile_permission_ibfk_1 + FOREIGN KEY (sharing_profile_id) + REFERENCES guacamole_sharing_profile (sharing_profile_id) ON DELETE CASCADE, + + CONSTRAINT guacamole_sharing_profile_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_sharing_profile_permission_sharing_profile_id + ON guacamole_sharing_profile_permission(sharing_profile_id); + +CREATE INDEX guacamole_sharing_profile_permission_entity_id + ON guacamole_sharing_profile_permission(entity_id); + +-- +-- Table of system permissions. Each system permission grants a user or user +-- group a system-level privilege of some kind. +-- + +CREATE TABLE guacamole_system_permission ( + + entity_id integer NOT NULL, + permission guacamole_system_permission_type NOT NULL, + + PRIMARY KEY (entity_id, permission), + + CONSTRAINT guacamole_system_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_system_permission_entity_id + ON guacamole_system_permission(entity_id); + +-- +-- Table of user permissions. Each user permission grants a user or user group +-- access to another user (the "affected" user) for a specific type of +-- operation. +-- + +CREATE TABLE guacamole_user_permission ( + + entity_id integer NOT NULL, + affected_user_id integer NOT NULL, + permission guacamole_object_permission_type NOT NULL, + + PRIMARY KEY (entity_id, affected_user_id, permission), + + CONSTRAINT guacamole_user_permission_ibfk_1 + FOREIGN KEY (affected_user_id) + REFERENCES guacamole_user (user_id) ON DELETE CASCADE, + + CONSTRAINT guacamole_user_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_user_permission_affected_user_id + ON guacamole_user_permission(affected_user_id); + +CREATE INDEX guacamole_user_permission_entity_id + ON guacamole_user_permission(entity_id); + +-- +-- Table of user group permissions. Each user group permission grants a user +-- or user group access to a another user group (the "affected" user group) for +-- a specific type of operation. +-- + +CREATE TABLE guacamole_user_group_permission ( + + entity_id integer NOT NULL, + affected_user_group_id integer NOT NULL, + permission guacamole_object_permission_type NOT NULL, + + PRIMARY KEY (entity_id, affected_user_group_id, permission), + + CONSTRAINT guacamole_user_group_permission_affected_user_group + FOREIGN KEY (affected_user_group_id) + REFERENCES guacamole_user_group (user_group_id) ON DELETE CASCADE, + + CONSTRAINT guacamole_user_group_permission_entity + FOREIGN KEY (entity_id) + REFERENCES guacamole_entity (entity_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_user_group_permission_affected_user_group_id + ON guacamole_user_group_permission(affected_user_group_id); + +CREATE INDEX guacamole_user_group_permission_entity_id + ON guacamole_user_group_permission(entity_id); + +-- +-- Table of connection history records. Each record defines a specific user's +-- session, including the connection used, the start time, and the end time +-- (if any). +-- + +CREATE TABLE guacamole_connection_history ( + + history_id serial NOT NULL, + user_id integer DEFAULT NULL, + username varchar(128) NOT NULL, + remote_host varchar(256) DEFAULT NULL, + connection_id integer DEFAULT NULL, + connection_name varchar(128) NOT NULL, + sharing_profile_id integer DEFAULT NULL, + sharing_profile_name varchar(128) DEFAULT NULL, + start_date timestamptz NOT NULL, + end_date timestamptz DEFAULT NULL, + + PRIMARY KEY (history_id), + + CONSTRAINT guacamole_connection_history_ibfk_1 + FOREIGN KEY (user_id) + REFERENCES guacamole_user (user_id) ON DELETE SET NULL, + + CONSTRAINT guacamole_connection_history_ibfk_2 + FOREIGN KEY (connection_id) + REFERENCES guacamole_connection (connection_id) ON DELETE SET NULL, + + CONSTRAINT guacamole_connection_history_ibfk_3 + FOREIGN KEY (sharing_profile_id) + REFERENCES guacamole_sharing_profile (sharing_profile_id) ON DELETE SET NULL + +); + +CREATE INDEX guacamole_connection_history_user_id + ON guacamole_connection_history(user_id); + +CREATE INDEX guacamole_connection_history_connection_id + ON guacamole_connection_history(connection_id); + +CREATE INDEX guacamole_connection_history_sharing_profile_id + ON guacamole_connection_history(sharing_profile_id); + +CREATE INDEX guacamole_connection_history_start_date + ON guacamole_connection_history(start_date); + +CREATE INDEX guacamole_connection_history_end_date + ON guacamole_connection_history(end_date); + +CREATE INDEX guacamole_connection_history_connection_id_start_date + ON guacamole_connection_history(connection_id, start_date); + +-- +-- User login/logout history +-- + +CREATE TABLE guacamole_user_history ( + + history_id serial NOT NULL, + user_id integer DEFAULT NULL, + username varchar(128) NOT NULL, + remote_host varchar(256) DEFAULT NULL, + start_date timestamptz NOT NULL, + end_date timestamptz DEFAULT NULL, + + PRIMARY KEY (history_id), + + CONSTRAINT guacamole_user_history_ibfk_1 + FOREIGN KEY (user_id) + REFERENCES guacamole_user (user_id) ON DELETE SET NULL + +); + +CREATE INDEX guacamole_user_history_user_id + ON guacamole_user_history(user_id); + +CREATE INDEX guacamole_user_history_start_date + ON guacamole_user_history(start_date); + +CREATE INDEX guacamole_user_history_end_date + ON guacamole_user_history(end_date); + +CREATE INDEX guacamole_user_history_user_id_start_date + ON guacamole_user_history(user_id, start_date); + +-- +-- User password history +-- + +CREATE TABLE guacamole_user_password_history ( + + password_history_id serial NOT NULL, + user_id integer NOT NULL, + + -- Salted password + password_hash bytea NOT NULL, + password_salt bytea, + password_date timestamptz NOT NULL, + + PRIMARY KEY (password_history_id), + + CONSTRAINT guacamole_user_password_history_ibfk_1 + FOREIGN KEY (user_id) + REFERENCES guacamole_user (user_id) ON DELETE CASCADE + +); + +CREATE INDEX guacamole_user_password_history_user_id + ON guacamole_user_password_history(user_id); + +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, +-- software distributed under the License is distributed on an +-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +-- KIND, either express or implied. See the License for the +-- specific language governing permissions and limitations +-- under the License. +-- + +-- Create default user "guacadmin" with password "guacadmin" +INSERT INTO guacamole_entity (name, type) VALUES ('guacadmin', 'USER'); +INSERT INTO guacamole_user (entity_id, password_hash, password_salt, password_date) +SELECT + entity_id, + decode('CA458A7D494E3BE824F5E1E175A1556C0F8EEF2C2D7DF3633BEC4A29C4411960', 'hex'), -- 'guacadmin' + decode('FE24ADC5E11E2B25288D1704ABE67A79E342ECC26064CE69C5B3177795A82264', 'hex'), + CURRENT_TIMESTAMP +FROM guacamole_entity WHERE name = 'guacadmin' AND guacamole_entity.type = 'USER'; + +-- Grant this user all system permissions +INSERT INTO guacamole_system_permission (entity_id, permission) +SELECT entity_id, permission::guacamole_system_permission_type +FROM ( + VALUES + ('guacadmin', 'CREATE_CONNECTION'), + ('guacadmin', 'CREATE_CONNECTION_GROUP'), + ('guacadmin', 'CREATE_SHARING_PROFILE'), + ('guacadmin', 'CREATE_USER'), + ('guacadmin', 'CREATE_USER_GROUP'), + ('guacadmin', 'ADMINISTER') +) permissions (username, permission) +JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'; + +-- Grant admin permission to read/update/administer self +INSERT INTO guacamole_user_permission (entity_id, affected_user_id, permission) +SELECT guacamole_entity.entity_id, guacamole_user.user_id, permission::guacamole_object_permission_type +FROM ( + VALUES + ('guacadmin', 'guacadmin', 'READ'), + ('guacadmin', 'guacadmin', 'UPDATE'), + ('guacadmin', 'guacadmin', 'ADMINISTER') +) permissions (username, affected_username, permission) +JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER' +JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER' +JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id; + diff --git a/docker-compose-backup.yml b/docker-compose-backup.yml new file mode 100644 index 0000000..36d581b --- /dev/null +++ b/docker-compose-backup.yml @@ -0,0 +1,85 @@ +services: + db: + image: postgres:16-alpine + container_name: guacamole-postgres + restart: unless-stopped + environment: + - POSTGRES_DB=guacamole_db + - POSTGRES_USER=guacamole_user + - POSTGRES_PASSWORD=YourSecureDBPassword123 + - TZ=Europe/Ljubljana + volumes: + - db_data:/var/lib/postgresql/data + - ./db-init:/docker-entrypoint-initdb.d:ro + networks: [default] + + guacd: + image: guacamole/guacd:latest + platform: linux/amd64 + container_name: guacamole-guacd + restart: unless-stopped + networks: [default] + healthcheck: + test: ["CMD", "sh", "-lc", "echo ping | nc -w 1 127.0.0.1 4822"] + interval: 30s + timeout: 5s + retries: 5 + + guacamole: + image: guacamole/guacamole:latest + platform: linux/amd64 + container_name: guacamole-app + restart: unless-stopped + environment: + - TZ=Europe/Ljubljana + - GUACD_HOSTNAME=guacd + - GUACD_PORT=4822 + - POSTGRES_HOSTNAME=db + - POSTGRES_PORT=5432 + - POSTGRES_DATABASE=guacamole_db + - POSTGRES_USER=guacamole_user + - POSTGRES_PASSWORD=YourSecureDBPassword123 + # NOTE: no WEBAPP_CONTEXT → default is /guacamole + depends_on: + - guacd + - db + networks: + - default + - traefik_default + labels: + - "traefik.enable=true" + # critical when a service is on multiple networks: + - "traefik.docker.network=traefik_default" + + # Main router → only /guacamole… + - "traefik.http.routers.guacamole.rule=Host(`guac.rozic-dev.com`) && PathPrefix(`/guacamole`)" + - "traefik.http.routers.guacamole.entrypoints=websecure" + - "traefik.http.routers.guacamole.tls=true" + - "traefik.http.routers.guacamole.tls.certresolver=letsencrypt" + - "traefik.http.services.guacamole.loadbalancer.server.port=8080" + + # Root redirect: / → /guacamole/ + - "traefik.http.routers.guacamole-root.rule=Host(`guac.rozic-dev.com`) && Path(`/`)" + - "traefik.http.routers.guacamole-root.entrypoints=websecure" + - "traefik.http.routers.guacamole-root.tls=true" + - "traefik.http.routers.guacamole-root.tls.certresolver=letsencrypt" + - "traefik.http.routers.guacamole-root.middlewares=guac-redirect" + - "traefik.http.middlewares.guac-redirect.redirectregex.regex=^https?://([^/]+)(/)?$" + - "traefik.http.middlewares.guac-redirect.redirectregex.replacement=https://$${1}/guacamole/" + - "traefik.http.middlewares.guac-redirect.redirectregex.permanent=true" + + # HTTP → HTTPS + - "traefik.http.routers.guacamole-http.rule=Host(`guac.rozic-dev.com`)" + - "traefik.http.routers.guacamole-http.entrypoints=web" + - "traefik.http.routers.guacamole-http.middlewares=https-redirect" + - "traefik.http.middlewares=https-redirect.redirectscheme.scheme=https" + - "traefik.http.middlewares=https-redirect.redirectscheme.permanent=true" + +volumes: + db_data: + +networks: + traefik_default: + external: true + default: + driver: bridge diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..29a9ae3 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,85 @@ +services: + db: + image: postgres:16-alpine + container_name: guacamole-postgres + restart: unless-stopped + environment: + - POSTGRES_DB=guacamole_db + - POSTGRES_USER=guacamole_user + - POSTGRES_PASSWORD=YourSecureDBPassword123 + - TZ=Europe/Ljubljana + volumes: + - db_data:/var/lib/postgresql/data + - ./db-init:/docker-entrypoint-initdb.d:ro + networks: [default] + + guacd: + image: guacamole/guacd:latest + platform: linux/amd64 + container_name: guacamole-guacd + restart: unless-stopped + networks: [default] + healthcheck: + test: ["CMD", "sh", "-lc", "echo ping | nc -w 1 127.0.0.1 4822"] + interval: 30s + timeout: 5s + retries: 5 + + guacamole: + image: guacamole/guacamole:latest + # platform: linux/amd64 + container_name: guacamole-app + restart: unless-stopped + environment: + - TZ=Europe/Ljubljana + - GUACD_HOSTNAME=guacd + - GUACD_PORT=4822 + - POSTGRES_HOSTNAME=db + - POSTGRES_PORT=5432 + - POSTGRES_DATABASE=guacamole_db + - POSTGRES_USER=guacamole_user + - POSTGRES_PASSWORD=YourSecureDBPassword123 + # NOTE: no WEBAPP_CONTEXT → default is /guacamole + depends_on: + - guacd + - db + networks: + - default + - traefik_default + labels: + - "traefik.enable=true" + # critical when a service is on multiple networks: + - "traefik.docker.network=traefik_default" + + # Main router → only /guacamole… + - "traefik.http.routers.guacamole.rule=Host(`guac.rozic-dev.com`) && PathPrefix(`/guacamole`)" + - "traefik.http.routers.guacamole.entrypoints=websecure" + - "traefik.http.routers.guacamole.tls=true" + - "traefik.http.routers.guacamole.tls.certresolver=letsencrypt" + - "traefik.http.services.guacamole.loadbalancer.server.port=8080" + + # Root redirect: / → /guacamole/ + - "traefik.http.routers.guacamole-root.rule=Host(`guac.rozic-dev.com`) && Path(`/`)" + - "traefik.http.routers.guacamole-root.entrypoints=websecure" + - "traefik.http.routers.guacamole-root.tls=true" + - "traefik.http.routers.guacamole-root.tls.certresolver=letsencrypt" + - "traefik.http.routers.guacamole-root.middlewares=guac-redirect" + - "traefik.http.middlewares.guac-redirect.redirectregex.regex=^https?://([^/]+)(/)?$" + - "traefik.http.middlewares.guac-redirect.redirectregex.replacement=https://$${1}/guacamole/" + - "traefik.http.middlewares.guac-redirect.redirectregex.permanent=true" + + # HTTP → HTTPS + - "traefik.http.routers.guacamole-http.rule=Host(`guac.rozic-dev.com`)" + - "traefik.http.routers.guacamole-http.entrypoints=web" + - "traefik.http.routers.guacamole-http.middlewares=https-redirect" + - "traefik.http.middlewares=https-redirect.redirectscheme.scheme=https" + - "traefik.http.middlewares=https-redirect.redirectscheme.permanent=true" + +volumes: + db_data: + +networks: + traefik_default: + external: true + default: + driver: bridge diff --git a/install.sh b/install.sh new file mode 100755 index 0000000..6c7abcc --- /dev/null +++ b/install.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +# --- Configuration Variables (YOU MUST CHANGE THESE) --- +# These variables configure the database connection for Guacamole. +# Note: These map to the POSTGRESQL_* variables in the Guacamole container. +export POSTGRES_DATABASE="guacamole_db" +export POSTGRES_USER="guacamole_user" +export POSTGRES_PASSWORD="YourSecureDBPassword123" # <<< CHANGE THIS PASSWORD +# -------------------------------------------------------- + +echo "Starting Apache Guacamole Docker deployment setup..." + +# 1. Create the docker-compose.yml file +echo "Creating docker-compose.yml..." +cat << EOF > docker-compose.yml +services: + guacd: + image: guacamole/guacd:latest + container_name: guacamole-guacd + restart: always + # Optional: Add basic healthcheck for better reliability status (recommended) + healthcheck: + test: ["CMD", "sh", "-c", "echo 'guacd is alive' | nc -w 1 localhost 4822"] + interval: 30s + timeout: 10s + retries: 5 + + db: + image: postgres:13-alpine + container_name: guacamole-postgres + restart: always + environment: + POSTGRES_DB: ${POSTGRES_DATABASE} + POSTGRES_USER: ${POSTGRES_USER} + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} + volumes: + - guacamole_db_data:/var/lib/postgresql/data + + guacamole: + image: guacamole/guacamole:latest + container_name: guacamole-app + restart: always + ports: + - 8080:8080 + environment: + GUACD_HOSTNAME: guacd + # --- FIX: Use POSTGRESQL_ prefix and explicitly define hostname for reliability --- + POSTGRESQL_HOSTNAME: db + POSTGRESQL_DATABASE: ${POSTGRES_DATABASE} + POSTGRESQL_USERNAME: ${POSTGRES_USER} # Guacamole uses USERNAME, not USER + POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD} + depends_on: + - guacd + - db + +volumes: + guacamole_db_data: +EOF + +# 2. Start the database and guacd services +echo "Starting Guacamole Proxy (guacd) and Database (db)..." +docker compose up -d guacd db + +# 3. Wait for PostgreSQL to be ready +echo "Waiting for the database to be ready..." +until docker compose exec db pg_isready -U "${POSTGRES_USER}" -d "${POSTGRES_DATABASE}"; do + echo "Postgres is unavailable - sleeping (5s)..." + sleep 5 +done +echo "Postgres is now ready." + +# 4. Generate the Guacamole database initialization script +echo "Generating database initialization script (initdb.sql)..." +# --- FIX: Changed --postgres to the correct --postgresql flag --- +docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgresql > initdb.sql + +# 5. Execute the initialization script on the PostgreSQL database +echo "Executing the initialization script on the database..." +docker compose exec -T db psql -U "${POSTGRES_USER}" -d "${POSTGRES_DATABASE}" < initdb.sql + +# 6. Start the Guacamole web application +echo "Starting the Guacamole web application..." +docker compose up -d guacamole + +# 7. Clean up the SQL script +rm initdb.sql + +# 8. Final message +echo -e "\n--- DEPLOYMENT COMPLETE ---" +echo "Apache Guacamole is now running." +echo "Access it at: http://:8080/guacamole/" +echo "Default Credentials: guacadmin / guacadmin" +echo "!!! IMPORTANT: Log in and change the default password immediately. !!!" +echo "---------------------------"