patch: Change env var mysql to mariadb based. Add secrets generation script for K8s. Improve K8s configuration

Author: uniuuu

.env_example

@@ -8,11 +8,11 @@ SERVER_IP='127.0.0.1'
 
 ## SECRETS
 # DB
-MYSQLROOTPASSWORD='' # Database root user password
+MARIADB_ROOT_PASSWORD='' # Database root user password
 
-MYSQLDATABASE='zotprimeprod' # Database name
-MYSQLUSER='' # Database user name i.e. 'zotprimeprod'
-MYSQLPASSWORD='' # Database user password
+MARIADB_DATABASE='zotprimeprod' # Database name
+MARIADB_USER='' # Database user name i.e. 'zotprimeprod'
+MARIADB_PASSWORD='' # Database user password
 
 
 # MinIO

.gitignore

@@ -10,6 +10,9 @@ docker-compose-test.yml
 **/cred.json
 .vscode/
 
+# Credentials
+**/credentials.txt
+
 # Next.js / TypeScript
 node_modules
 .next

README.md

@@ -88,7 +88,7 @@ The system will automatically initialize databases and services on first startup
 All credentials are configured in the `.env` file:
 - **Zotero API**: `ADMIN_USERNAME` / `ADMIN_PASSWORD`
 - **S3 Web UI**: `MINIOROOTUSER` / `MINIOROOTPASSWORD`
-- **PHPMyAdmin**: `root` / `MYSQLROOTPASSWORD`
+- **PHPMyAdmin**: `root` / `MARIADB_ROOT_PASSWORD`
 
 ---
 
@@ -210,7 +210,7 @@ Check the `ADDRESS` column and setup A records in your DNS hosting.
 Credentials are configured in the `.env` file:
 - **Zotero API**: `ADMIN_USERNAME` / `ADMIN_PASSWORD`
 - **S3 Web UI**: `MINIOROOTUSER` / `MINIOROOTPASSWORD`
-- **PHPMyAdmin**: `root` / `MYSQLROOTPASSWORD`
+- **PHPMyAdmin**: `root` / `MARIADB_ROOT_PASSWORD`
 
 ---
 

bin/install.sh

@@ -40,9 +40,9 @@ then
 
   # Generate secrets
   echo "Generating secrets..."
-  MYSQLROOTPASSWORD=$(openssl rand -hex 16)
-  MYSQLUSER="zotprimeprod"
-  MYSQLPASSWORD=$(openssl rand -hex 16)
+  MARIADB_ROOT_PASSWORD=$(openssl rand -hex 16)
+  MARIADB_USER="zotprimeprod"
+  MARIADB_PASSWORD=$(openssl rand -hex 16)
   MINIOROOTUSER="zotprimeminio"
   MINIOROOTPASSWORD=$(openssl rand -hex 16)
   API_SUPER_TOKEN=$(openssl rand -hex 32)
@@ -58,9 +58,9 @@ then
   PORTAL_SESSION_SECRET=$(openssl rand -hex 32)
 
   # Update .env (use printf to preserve $ characters in bcrypt hashes)
-  printf "s#MYSQLROOTPASSWORD=''#MYSQLROOTPASSWORD='%s'#g\n" "$MYSQLROOTPASSWORD" | sed -i -f - .env
-  printf "s#MYSQLUSER=''#MYSQLUSER='%s'#g\n" "$MYSQLUSER" | sed -i -f - .env
-  printf "s#MYSQLPASSWORD=''#MYSQLPASSWORD='%s'#g\n" "$MYSQLPASSWORD" | sed -i -f - .env
+  printf "s#MARIADB_ROOT_PASSWORD=''#MARIADB_ROOT_PASSWORD='%s'#g\n" "$MARIADB_ROOT_PASSWORD" | sed -i -f - .env
+  printf "s#MARIADB_USER=''#MARIADB_USER='%s'#g\n" "$MARIADB_USER" | sed -i -f - .env
+  printf "s#MARIADB_PASSWORD=''#MARIADB_PASSWORD='%s'#g\n" "$MARIADB_PASSWORD" | sed -i -f - .env
   printf "s#MINIOROOTUSER=''#MINIOROOTUSER='%s'#g\n" "$MINIOROOTUSER" | sed -i -f - .env
   printf "s#MINIOROOTPASSWORD=''#MINIOROOTPASSWORD='%s'#g\n" "$MINIOROOTPASSWORD" | sed -i -f - .env
   printf "s#API_SUPER_TOKEN=''#API_SUPER_TOKEN='%s'#g\n" "$API_SUPER_TOKEN" | sed -i -f - .env
@@ -93,7 +93,7 @@ then
   echo ""
   echo "PHPMyAdmin:"
   echo "  Username: root"
-  echo "  Password: $MYSQLROOTPASSWORD"
+  echo "  Password: $MARIADB_ROOT_PASSWORD"
   echo ""
   echo "=========================================="
   echo ""

docker-compose.yml

@@ -3,15 +3,15 @@ services:
     image: "uniuu/zotprime-db:${VER}"
     restart: always
     environment:
-      - MARIADB_ROOT_PASSWORD=${MYSQLROOTPASSWORD}
-      - MARIADB_DATABASE=${MYSQLDATABASE}
-      - MARIADB_USER=${MYSQLUSER}
-      - MARIADB_PASSWORD=${MYSQLPASSWORD}
+      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD}
+      - MARIADB_DATABASE=${MARIADB_DATABASE}
+      - MARIADB_USER=${MARIADB_USER}
+      - MARIADB_PASSWORD=${MARIADB_PASSWORD}
     volumes:
       - dbdata:/var/lib/mysql
       - /etc/localtime:/etc/localtime:ro
     healthcheck:
-      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-p${MYSQLROOTPASSWORD}"]
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-p${MARIADB_ROOT_PASSWORD}"]
       interval: 5s
       timeout: 3s
       retries: 10
@@ -116,8 +116,8 @@ services:
       - S3_PUBLIC_ENDPOINT=http://${SERVER_IP}:9000
       - AUTH_SALT=${AUTH_SALT}
       - API_SUPER_TOKEN_HASH=${API_SUPER_TOKEN_HASH}
-      - MYSQLUSER=${MYSQLUSER}
-      - MYSQLPASSWORD=${MYSQLPASSWORD}
+      - MARIADB_USER=${MARIADB_USER}
+      - MARIADB_PASSWORD=${MARIADB_PASSWORD}
       - MINIO_ROOT_USER=${MINIOROOTUSER}
       - MINIO_ROOT_PASSWORD=${MINIOROOTPASSWORD}
     depends_on:
@@ -202,10 +202,10 @@ services:
     command: ["/auto-init.sh"]
     restart: "no"
     environment:
-      - MYSQLROOTPASSWORD=${MYSQLROOTPASSWORD}
-      - MYSQLDATABASE=${MYSQLDATABASE}
-      - MYSQLUSER=${MYSQLUSER}
-      - MYSQLPASSWORD=${MYSQLPASSWORD}
+      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD}
+      - MARIADB_DATABASE=${MARIADB_DATABASE}
+      - MARIADB_USER=${MARIADB_USER}
+      - MARIADB_PASSWORD=${MARIADB_PASSWORD}
       - AUTH_SALT=${AUTH_SALT}
       - API_SUPER_TOKEN_HASH=${API_SUPER_TOKEN_HASH}
       - MINIO_ROOT_USER=${MINIOROOTUSER}

docs/K8s/MICROK8S.md

@@ -23,112 +23,58 @@ kubectl apply -f clusterissuer.yaml
 
 ```bash
 cd zotprime-k8s/microk8s/helm-chart
-cp values-example.yaml values.yaml
 ```
 
-### 2. Configure TLS
+### 2. Generate Secrets
 
-Edit `values.yaml`:
-
-```yaml
-tls:
-  enabled: false  # Set true for HTTPS
-```
-
-### 3. Configure Credentials
-
-Generate auth secrets:
+**Automated (Recommended):**
 
+Linux/Mac:
 ```bash
-# Auth salt
-openssl rand -hex 16 | base64
-
-# API super token hash
-php -r "echo password_hash('YOUR_TOKEN', PASSWORD_BCRYPT);" | base64
+cd ../scripts
+./generate-secrets.py
 ```
 
-Generate base64-encoded secrets:
-
-**Linux/Mac:**
+Windows (WSL):
 ```bash
-echo "MINIO_ROOT_PASSWORD=your_password" | base64
-printf "MARIADB_ROOT_PASSWORD=root_pass\nMARIADB_PASSWORD=user_pass" | base64
+cd ../scripts
+wsl ./generate-secrets.py
 ```
 
-**Windows PowerShell:**
-```powershell
-[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("MINIO_ROOT_PASSWORD=your_password"))
-[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("MARIADB_ROOT_PASSWORD=root_pass`nMARIADB_PASSWORD=user_pass"))
-```
-
-Edit `values.yaml`:
-
-```yaml
-authSecret:
-  authSalt: "<base64_output>"
-  apiSuperTokenHash: "<base64_output>"
-
-minioSecret:
-  minioRootPassword: "<base64_password>"
-
-dbSecret:
-  mysqlRootPassword: "<base64_password>"
-  mysqlPassword: "<base64_password>"
-
-dbConfig:
-  mariadbUser: your_db_user
-  mariadbDatabasename: your_db_name
-
-zoteroAdmin:
-  adminUsername: admin
-  adminPassword: admin
-  adminEmail: admin@example.com
-```
-
-### 3a. Configure Basic Auth
-
-Protect PHPMyAdmin and MinIO web console with HTTP Basic Authentication. This adds a second layer of security at the ingress level before reaching the application's own authentication.
-
-**Install htpasswd:**
-
-Linux:
+Requires: `python3-yaml` package
 ```bash
-sudo apt install apache2-utils
+sudo apt install python3-yaml
 ```
 
-Mac:
-```bash
-brew install httpd
-```
+**Manual:**
 
-Windows (WSL):
+Copy template and edit all empty `""` fields:
 ```bash
-wsl --install
-wsl sudo apt install apache2-utils
+cp values-example.yaml values.yaml
 ```
 
-**Generate password hash:**
+Populate in `values.yaml`:
+- `authSecret` (authSalt, apiSuperToken, apiSuperTokenHash, appKey)
+- `webAdminConfig` (username)
+- `webAdminSecret` (password)
+- `minioSecret` (secretTxt)
+- `blobSecret` (awsAccessKeyId, awsSecretAccessKey)
+- `dbSecret` (mariadbRootPassword, mariadbPassword)
+- `zoteroSecret` (adminPassword)
+- `webPortalSecret` (sessionSecret)
+- `basicAuth` (htpasswd, if enabled)
 
-Linux/Mac:
-```bash
-htpasswd -nb admin yourpassword | base64
-```
+See `values-example.yaml` comments for generation commands.
 
-Windows (WSL):
-```bash
-wsl htpasswd -nb admin yourpassword | base64
-```
+### 3. Configure TLS
 
-**Edit `values.yaml`:**
+Edit `values.yaml`:
 
 ```yaml
-basicAuth:
-  enabled: true
-  htpasswd: "<base64_output>"
+tls:
+  enabled: false  # Set true for HTTPS
 ```
 
-Users will authenticate twice: first at ingress (basic auth), then at application login (PHPMyAdmin/MinIO credentials).
-
 ### 4. Configure Domains
 
 Edit `values.yaml` - replace all `yoursub*.yourdomain.tld`:

stack/dataserver/config/dbconnect.inc.php

@@ -4,11 +4,11 @@ function Zotero_dbConnectAuth($db) {
 
 	$host = 'mysql';
 	$port = 3306;
-	$user = getenv('MYSQLUSER');
-	$pass = getenv('MYSQLPASSWORD');
+	$user = getenv('MARIADB_USER');
+	$pass = getenv('MARIADB_PASSWORD');
 
 	if (!$user || !$pass) {
-		throw new Exception("MYSQLUSER and MYSQLPASSWORD must be set");
+		throw new Exception("MARIADB_USER and MARIADB_PASSWORD must be set");
 	}
 
 	if ($db == 'master') {

stack/dataserver/dbconfig/db_update.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -uex
 
-MYSQL="mariadb -h mysql -P 3306 -u root -p${MYSQLROOTPASSWORD}"
+MYSQL="mariadb -h mysql -P 3306 -u root -p${MARIADB_ROOT_PASSWORD}"
 echo "ALTER TABLE libraries ADD hasData TINYINT( 1 ) NOT NULL DEFAULT '0' AFTER version , ADD INDEX ( hasData )" | $MYSQL zotero_master
 echo "UPDATE libraries SET hasData=1 WHERE version > 0 OR lastUpdated != '0000-00-00 00:00:00'" | $MYSQL zotero_master
 echo "ALTER TABLE libraries DROP COLUMN lastUpdated, DROP COLUMN version" | $MYSQL zotero_master

stack/dataserver/dbconfig/db_update2.sh

@@ -5,7 +5,7 @@ for i in db-updates/*/; do
     cd /var/www/zotero/misc/$i
     for j in *; do
         find . -type f \( ! -name *.sql \) -exec php {} \;
-        find . -type f -name *.sql -exec bash -c 'mariadb -h mysql -P 3306 -u root -p${MYSQLROOTPASSWORD} zotero_master < {}' \;
+        find . -type f -name *.sql -exec bash -c 'mariadb -h mysql -P 3306 -u root -p${MARIADB_ROOT_PASSWORD} zotero_master < {}' \;
     done    
 done;
 cd ../../

stack/dataserver/dbconfig/init-mysql.sh

@@ -3,7 +3,7 @@
 set -ux
 
 
-MYSQL="mariadb -h mysql -P 3306 -u root -p${MYSQLROOTPASSWORD}"
+MYSQL="mariadb -h mysql -P 3306 -u root -p${MARIADB_ROOT_PASSWORD}"
 
 echo "DROP DATABASE IF EXISTS zotero_master" | $MYSQL
 echo "DROP DATABASE IF EXISTS zotero_shard_1" | $MYSQL
@@ -56,10 +56,10 @@ echo "INSERT INTO shardLibraries VALUES (2, 'group', '0000-00-00 00:00:00', 0, 0
 $MYSQL zotero_ids < ids.sql
 
 # Grant permissions to application user
-echo "GRANT ALL PRIVILEGES ON zotero_master.* TO '${MYSQLUSER}'@'%'" | $MYSQL
-echo "GRANT ALL PRIVILEGES ON zotero_shard_1.* TO '${MYSQLUSER}'@'%'" | $MYSQL
-echo "GRANT ALL PRIVILEGES ON zotero_shard_2.* TO '${MYSQLUSER}'@'%'" | $MYSQL
-echo "GRANT ALL PRIVILEGES ON zotero_ids.* TO '${MYSQLUSER}'@'%'" | $MYSQL
-echo "GRANT ALL PRIVILEGES ON zotero_www.* TO '${MYSQLUSER}'@'%'" | $MYSQL
+echo "GRANT ALL PRIVILEGES ON zotero_master.* TO '${MARIADB_USER}'@'%'" | $MYSQL
+echo "GRANT ALL PRIVILEGES ON zotero_shard_1.* TO '${MARIADB_USER}'@'%'" | $MYSQL
+echo "GRANT ALL PRIVILEGES ON zotero_shard_2.* TO '${MARIADB_USER}'@'%'" | $MYSQL
+echo "GRANT ALL PRIVILEGES ON zotero_ids.* TO '${MARIADB_USER}'@'%'" | $MYSQL
+echo "GRANT ALL PRIVILEGES ON zotero_www.* TO '${MARIADB_USER}'@'%'" | $MYSQL
 echo "FLUSH PRIVILEGES" | $MYSQL