snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/provision/000_base/compose_access_control.yaml

@@ -0,0 +1,148 @@
+allow:
+  authenticated:
+    corteza::compose/:
+      - namespaces.search
+
+    corteza::compose:namespace/*:
+      - read
+      - export
+      - modules.export
+      - charts.export
+      - pages.export
+      - pages.search
+      - modules.search
+      - charts.search
+
+    corteza::compose:module/*/*:
+      - read
+      - export
+      - records.search
+
+    corteza::compose:module-field/*/*/*:
+      - record.value.read
+
+    corteza::compose:page/*/*:
+      - read
+      - export
+
+    corteza::compose:page-layout/*/*/*:
+      - read
+
+    corteza::compose:chart/*/*:
+      - read
+      - export
+
+    corteza::compose:record/*/*/*:
+      - read
+
+  admin:
+    corteza::compose/:
+      - grant
+      - settings.read
+      - settings.manage
+      - namespace.create
+      - namespaces.search
+
+    corteza::compose:namespace/*:
+      - read
+      - update
+      - delete
+      - manage
+      - export
+      - modules.export
+      - charts.export
+      - pages.export
+      - page.create
+      - pages.search
+      - module.create
+      - modules.search
+      - chart.create
+      - charts.search
+
+    corteza::compose:module/*/*:
+      - read
+      - update
+      - delete
+      - export
+      - record.create
+      - records.search
+
+    corteza::compose:module-field/*/*/*:
+      - record.value.read
+      - record.value.update
+
+    corteza::compose:record/*/*/*:
+      - read
+      - update
+      - delete
+      - revisions.search
+
+    corteza::compose:chart/*/*:
+      - read
+      - update
+      - delete
+      - export
+
+    corteza::compose:page/*/*:
+      - read
+      - update
+      - delete
+      - export
+
+    corteza::compose:page-layout/*/*/*:
+      - read
+      - update
+      - delete
+
+  low-code-admin:
+    corteza::compose/:
+      - grant
+      - settings.read
+      - settings.manage
+      - namespace.create
+      - namespaces.search
+
+    corteza::compose:namespace/*:
+      - read
+      - update
+      - delete
+      - manage
+      - export
+      - modules.export
+      - charts.export
+      - pages.export
+      - page.create
+      - pages.search
+      - module.create
+      - modules.search
+      - chart.create
+      - charts.search
+
+    corteza::compose:module/*/*:
+      - read
+      - update
+      - delete
+      - export
+      - record.create
+      - records.search
+
+    corteza::compose:module-field/*/*/*:
+      - record.value.read
+      - record.value.update
+
+    corteza::compose:record/*/*/*:
+      - read
+      - update
+      - delete
+
+    corteza::compose:chart/*/*:
+      - read
+      - update
+      - delete
+      - export
+
+    corteza::compose:page/*/*:
+      - read
+      - update
+      - delete
+      - export

server/provision/000_base/roles.yaml

@@ -0,0 +1,72 @@
+roles:
+  # bypass and other system roles are
+  # programmatically (re)created on server start
+  admin:
+    name: Administrator
+
+  security-admin:
+    name: Security administrator
+
+  low-code-admin:
+    name: Namespace administrator
+
+  owner:
+    name: Owner
+    meta:
+      description: |-
+        Automatically assigned to resource owner
+        Applicable to compose records, auth clients and workflows
+
+      context:
+        expr: resource.ownedBy == userID
+        resourceType:
+          - corteza::compose:record
+          - corteza::system:authClient
+          - corteza::automation:workflow
+
+  creator:
+    name: Creator
+    meta:
+      description: |-
+        Automatically assigned to user created the resource.
+        Applicable on records, auth clients and workflows
+      context:
+        expr: resource.createdBy == userID
+        resourceType:
+          - corteza::compose:record
+          - corteza::system:authClient
+          - corteza::automation:workflow
+
+  updater:
+    name: Updater
+    meta:
+      description: |-
+        Automatically assigned to user that was the last to update the resource.
+        Applicable to compose records, auth clients and workflows
+
+      context:
+        expr: resource.updatedBy == userID
+        resourceType:
+          - corteza::compose:record
+          - corteza::system:authClient
+          - corteza::automation:workflow
+
+  deleter:
+    name: Deleter
+    meta:
+      description: |-
+        Automatically assigned to user that was the last to update the resource.
+        Applicable to compose records, auth clients and workflows
+
+      context:
+        expr: resource.deletedBy == userID
+        resourceType:
+          - corteza::compose:record
+          - corteza::system:authClient
+          - corteza::automation:workflow
+
+  data-privacy-officer:
+    name: Data Privacy Officer
+    meta:
+      description: |-
+        Users that are allowed to view and manage privacy requests.

server/provision/000_base/system_access_control.yaml

@@ -0,0 +1,172 @@
+allow:
+  authenticated:
+    corteza::system/:
+      - applications.search
+      - auth-clients.search
+      - users.search
+      - roles.search
+
+    corteza::system:user/*:
+      - read
+      - email.unmask
+      - name.unmask
+
+    corteza::system:application/*:
+      - read
+      - application.flag.self
+
+    corteza::system:role/*:
+      - read
+
+    corteza::system:auth-client/*:
+      - authorize
+
+  admin:
+    corteza::system/:
+      - grant
+      - action-log.read
+      - settings.read
+      - settings.manage
+      - application.create
+      - applications.search
+      - auth-client.create
+      - auth-clients.search
+      - user.create
+      - users.search
+      - template.create
+      - templates.search
+      - role.create
+      - roles.search
+      - reminder.assign
+      - queue.create
+      - queues.search
+      - application.flag.global
+      - apigw-route.create
+      - apigw-routes.search
+      - report.create
+      - reports.search
+
+    corteza::system:auth-client/*:
+      - read
+      - update
+      - delete
+      - authorize
+
+    corteza::system:application/*:
+      - read
+      - update
+      - delete
+
+    corteza::system:user/*:
+      - read
+      - update
+      - suspend
+      - unsuspend
+      - delete
+      - email.unmask
+      - name.unmask
+
+    corteza::system:role/*:
+      - read
+      - update
+      - delete
+      - members.manage
+
+    corteza::system:template/*:
+      - read
+      - update
+      - delete
+      - render
+
+    corteza::system:queue/*:
+      - read
+      - update
+      - delete
+      - queue.read
+      - queue.write
+
+    corteza::system:apigw-route/*:
+      - read
+      - update
+      - delete
+
+    corteza::system:report/*:
+      - read
+      - update
+      - delete
+      - run
+
+  security-admin:
+    corteza::compose/:
+      - grant
+      - action-log.read
+      - settings.read
+      - settings.manage
+
+    corteza::automation/:
+      - grant
+      - settings.read
+      - settings.manage
+
+    corteza::federation/:
+      - grant
+      - settings.read
+      - settings.manage
+
+    corteza::system/:
+      - grant
+      - settings.read
+      - settings.manage
+      - application.create
+      - applications.search
+      - auth-client.create
+      - auth-clients.search
+      - user.create
+      - users.search
+      - template.create
+      - templates.search
+      - role.create
+      - roles.search
+      - reminder.assign
+      - queue.create
+      - queues.search
+      - report.create
+      - reports.search
+
+    corteza::system:auth-client/*:
+      - read
+      - update
+      - delete
+      - authorize
+
+    corteza::system:application/*:
+      - read
+      - update
+      - delete
+
+    corteza::system:user/*:
+      - read
+      - update
+      - suspend
+      - unsuspend
+      - delete
+
+    corteza::system:role/*:
+      - read
+      - update
+      - delete
+      - members.manage
+
+    corteza::system:report/*:
+      - read
+      - update
+      - delete
+      - run
+
+  data-privacy-officer:
+    corteza::system:data-privacy-request/*:
+      - read
+      - approve
+
+    corteza::system/:
+      - data-privacy-requests.search

server/provision/001_settings/auth.yaml

@@ -0,0 +1,15 @@
+settings:
+  auth.external.enabled: true
+  auth.mail.from-address: info@example.tld
+  auth.mail.from-name: Corteza
+  auth.internal.enabled: true
+  auth.internal.signup.enabled: true
+  auth.internal.profile-avatar.enabled: true
+
+  # We add this through provision procedures
+  # if we detect valid SMTP settings
+  # auth.internal.signup.email-confirmation-required: true
+
+  # We add this through provision procedures
+  # if we detect valid SMTP settings
+  # auth.internal.password-reset.enabled: true

server/provision/001_settings/compose.yaml

@@ -0,0 +1,10 @@
+settings:
+  compose.record.attachments.max-size: 10
+  compose.record.attachments.mimetypes: []
+
+  compose.page.attachments.max-size: 10
+  compose.page.attachments.mimetypes: []
+
+  compose.icon.attachments.max-size: 10
+  compose.icon.attachments.mimetypes: []
+

server/provision/001_settings/general.yaml

@@ -0,0 +1,2 @@
+settings:
+  general.mail.logo: data:image/png;base64,PHN2ZyBpZD0iTGF5ZXJfMSIgZGF0YS1uYW1lPSJMYXllciAxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNDEuNDUgMzguNjMiPjxkZWZzPjxzdHlsZT4uY2xzLTF7ZmlsbDojRkY5NjYxO308L3N0eWxlPjwvZGVmcz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik0yLjUxLDkuMzhBMTgsMTgsMCwwLDEsOS4zNywyLjUxLDE5LjQ5LDE5LjQ5LDAsMCwxLDE5LjEzLjA1LDE5LjE1LDE5LjE1LDAsMCwxLDMwLjIxLDMuM2ExNywxNywwLDAsMSw2LjY0LDloLTguN0E5LDksMCwwLDAsMjQuNSw4LjIxYTEwLjY3LDEwLjY3LDAsMCwwLTUuNDMtMS4zNUExMS4yNCwxMS4yNCwwLDAsMCwxMy4yMSw4LjRhMTAuNiwxMC42LDAsMCwwLTQsNC4zNSwxNC40MSwxNC40MSwwLDAsMC0xLjQzLDYuNTksMTQuNDQsMTQuNDQsMCwwLDAsMS40Myw2LjU3LDEwLjU1LDEwLjU1LDAsMCwwLDQsNC4zOCwxMS4yNCwxMS4yNCwwLDAsMCw1Ljg2LDEuNTQsMTAuNDksMTAuNDksMCwwLDAsNS40My0xLjM4LDkuMTYsOS4xNiwwLDAsMCwzLjY1LTQuMDhoOC43YTE2LjkyLDE2LjkyLDAsMCwxLTYuNjIsOSwxOS4yNywxOS4yNywwLDAsMS0xMS4xLDMuMjEsMTkuNDksMTkuNDksMCwwLDEtOS43Ni0yLjQ2LDE4LDE4LDAsMCwxLTYuODYtNi44M0ExOS42OSwxOS42OSwwLDAsMSwwLDE5LjM0LDE5Ljc2LDE5Ljc2LDAsMCwxLDIuNTEsOS4zOFoiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik01MC40MywzNi4xNWExOC41MywxOC41MywwLDAsMS03LTYuODksMTkuMjgsMTkuMjgsMCwwLDEtMi41OS0xMEExOS4xMywxOS4xMywwLDAsMSw0My40LDkuMzhhMTguNDYsMTguNDYsMCwwLDEsNy02Ljg5LDIwLjI5LDIwLjI5LDAsMCwxLDE5LjQ4LDAsMTguMzcsMTguMzcsMCwwLDEsNyw2Ljg5LDE5LjMxLDE5LjMxLDAsMCwxLDIuNTYsOS45MSwxOS40NSwxOS40NSwwLDAsMS0yLjU2LDEwLDE4LjM4LDE4LjM4LDAsMCwxLTcsNi44OSwyMC4zMSwyMC4zMSwwLDAsMS0xOS40NSwwWm0xNS43Mi01LjgxYTEwLjUzLDEwLjUzLDAsMCwwLDQtNC40LDE0LjM4LDE0LjM4LDAsMCwwLDEuNDYtNi42NSwxNC4yLDE0LjIsMCwwLDAtMS40Ni02LjYyLDEwLjQsMTAuNCwwLDAsMC00LTQuMzUsMTIuNzIsMTIuNzIsMCwwLDAtMTIsMCwxMC4zNCwxMC4zNCwwLDAsMC00LjA4LDQuMzUsMTQuMzIsMTQuMzIsMCwwLDAtMS40Niw2LjYyLDE0LjUxLDE0LjUxLDAsMCwwLDEuNDYsNi42NSwxMC40NywxMC40NywwLDAsMCw0LjA4LDQuNCwxMi41LDEyLjUsMCwwLDAsMTIsMFoiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik0xMDMuOTIsMzguMjYsOTUuNiwyMy41Nkg5MnYxNC43SDg0LjQ3Vi41NEg5OC42MmExNi40OSwxNi40OSwwLDAsMSw3LjQ2LDEuNTQsMTAuOCwxMC44LDAsMCwxLDQuNjIsNC4xNiwxMS4zMiwxMS4zMiwwLDAsMSwxLjU0LDUuODYsMTEuMjMsMTEuMjMsMCwwLDEtMi4xNiw2LjczQTExLDExLDAsMCwxLDEwMy42NSwyM2w5LDE1LjNaTTkyLDE3Ljg5aDYuMzJBNi4zMyw2LjMzLDAsMCwwLDEwMywxNi40YTUuNTIsNS41MiwwLDAsMCwxLjUxLTQuMTMsNS4yOSw1LjI5LDAsMCwwLTEuNTEtNCw2LjUsNi41LDAsMCwwLTQuNi0xLjQzSDkyWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTE0Mi44OC41NFY2LjY1aC0xMFYzOC4yNmgtNy41N1Y2LjY1SDExNS4yMVYuNTRaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMTU1LjMyLDYuNjVWMTYuMUgxNjh2NmgtMTIuN3YxMGgxNC4zMnY2LjE2SDE0Ny43NVYuNDloMjEuODlWNi42NVoiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik0xODUuNDIsMzEuODhoMTd2Ni4zOEgxNzYuNjZWMzIuNDJsMTYuODYtMjUuNUgxNzYuNjZWLjU0aDI1LjcyVjYuMzhaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMjMxLDMxLjA3SDIxNmwtMi40OSw3LjE5aC03Ljk0TDIxOS4wOC40OWg4LjgxbDEzLjU2LDM3Ljc3aC04Wk0yMjguOTEsMjUsMjIzLjQ2LDkuMjQsMjE4LDI1WiIvPjwvc3ZnPg==

server/provision/001_settings/privacy.yaml

@@ -0,0 +1,3 @@
+settings:
+  privacy.mask.email: true
+  privacy.mask.name: true

server/provision/002_templates/auth.yml

@@ -0,0 +1,71 @@
+templates:
+  auth_email_password_reset_subject:
+    type: text/plain
+    meta:
+      short: Password reset subject
+    template: Reset your password
+
+  auth_email_password_reset_content:
+    type: text/html
+    meta:
+      short: Password reset content
+    template: |-
+      {{template "email_general_header" .}}
+        <h2 style="color: #FF9661;text-align: center;">Reset your password</h2>
+        <p>Hello,</p>
+        <p>Follow <a href="{{ .URL }}" style="color:#FF9661;">this link</a> and reset your password.</p>
+        <p>You will be logged in after successful reset.</p>
+      {{template "email_general_footer" .}}
+
+  auth_email_confirm_subject:
+    type: text/plain
+    meta:
+      short: Email confirmation subject
+    template: Confirm your email address
+
+  auth_email_confirm_content:
+    type: text/html
+    meta:
+      short: Email confirmation content
+    template: |-
+      {{template "email_general_header" .}}
+        <h2 style="color: #FF9661;text-align: center;">Confirm your email address</h2>
+        <p>Hello,</p>
+        <p>Follow <a href="{{ .URL }}" style="color:#FF9661;">this link</a> to confirm your email address.</p>
+        <p>You will be logged in after successful confirmation.</p>
+      {{template "email_general_footer" .}}
+
+  auth_email_mfa_subject:
+    type: text/plain
+    meta:
+      short: MFA login code subject
+    template: Login code
+
+  auth_email_mfa_content:
+    type: text/html
+    meta:
+      short: MFA login code content
+    template: |-
+      {{template "email_general_header" .}}
+        <h2 style="color: #FF9661;text-align: center;">Your login code</h2>
+        <p>Hello,</p>
+        <p>Enter this code into your login form: <code>{{.Code}}</code></p>
+      {{template "email_general_footer" .}}
+
+  auth_email_user_invite_subject:
+    type: text/plain
+    meta:
+      short: User invite subject
+    template: Invitation to join our platform
+
+  auth_email_user_invite_content:
+    type: text/html
+    meta:
+      short: User invite content
+    template: |-
+      {{template "email_general_header" .}}
+        <h2 style="color: #FF9661;text-align: center;">Invitation to join our platform</h2>
+        <p>Hello,</p>
+        <p>To get started, please follow <a href="{{ .URL }}" style="color:#FF9661;">this link</a> to accept the invitation and set up your password</p>
+        <p>Once you accept the invitation, you will be able to logged in to your account.</p>
+      {{template "email_general_footer" .}}

server/provision/002_templates/general.yml

@@ -0,0 +1,63 @@
+templates:
+  email_general_header:
+    type: text/html
+    partial: true
+    meta:
+      short: General template header
+      description: General template header to use with system email notifications
+    template: |-
+      <div style="width:100%;min-height:100%;margin:0;padding:0;color:#3a393c;font-size:12px;line-height:18px;font-family:Verdana,Arial,sans-serif">
+        <table width="100%" align="center" style="width:100%;height:100%;border-collapse:collapse;border:0;padding:60px" border="0" cellspacing="0" cellpadding="0" summary="">
+          <tbody>
+            <tr>
+              <td valign="top" align="center" style="padding: 20px 0;">
+                <table width="800" cellspacing="0" cellpadding="0" border="0">
+                  <tbody>
+                    <tr>
+                      <td width="800" bgcolor="#FFFFFF" style="color:#3a393c;font-size:14px;line-height:20px;font-family:Helvetica Neue,Helvetica,Arial,sans-serif;text-align:left">
+                        <table width="800" cellspacing="0" cellpadding="0" border="0">
+                          <tbody>
+                            <tr style="background-color:#FFFFFF;height:50px;">
+                              <td style="border-bottom: 2px solid #E4E9EF;">
+                                <a href="{{ .BaseURL }}" style="text-decoration:none" target="_blank">
+                                  <img src="{{ .Logo }}" style="display: block;margin: 0 auto;padding: 10px; width: 50%;">
+                                </a>
+                              </td>
+                            </tr>
+                            <tr>
+                              <td width="800" style="padding:40px 30px">
+
+  email_general_footer:
+    type: text/html
+    partial: true
+    meta:
+      short: General template footer
+      description: General template footer to use with system email notifications
+    template: |-
+      </td>
+                            </tr>
+                            <tr>
+                              <td style="padding:30px;border-top: 1px solid #E4E9EF">
+                                <p>If you have any questions, please contact <a href="mailto:{{ .SignatureEmail }}" style="color:#FF9661;">{{ .SignatureEmail }}</a>.</p>
+                                <p>Kind regards, <br>
+                                {{ .SignatureName }}</p>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
+                      </td>
+                    </tr>
+                  </tbody>
+                </table>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+  record_table:
+    type: text/html
+    partial: true
+    template: "<table width=\"800\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\" style=\"margin: 0 auto;\">\n  <thead>\n    <tr>\n      <th>Field</th>\n      <th>Value</th>\n    </tr>\n  </thead>\n  <tbody>\n{{range $key, $value := .values}}\n    <tr>\n      <td>{{ $key }}</td>\n{{if $value }}\n  {{if typeIs \"[]interface {}\" $value}}\n      <td>{{ $value | join \", \"  }}</td>\n  {{else}}\n      <td>{{ $value }}</td>\n  {{end}}\n{{else}}\n      <td>&nbsp;</td>\n{{end}}\n    </tr>\n{{end}}\n    \n  </tbody>\n</table>\n"
+    meta:
+        short: Tablefy Record
+        description: Displays the provided record as a table.

server/provision/002_templates/healthcheck.yml

@@ -0,0 +1,17 @@
+templates:
+  smtp_configuration_check_subject:
+    type: text/plain
+    meta:
+      short: SMTP configuration check content
+    template: SMTP connection check
+
+  smtp_configuration_check_content:
+    type: text/html
+    meta:
+      short: SMTP configuration check content
+    template: |-
+      {{template "email_general_header" .}}
+        <h2 style="color: #FF9661;text-align: center;">SMTP configurations check</h2>
+        <p>Hello,</p>
+        <p>Your SMTP configuration test passed</p>
+      {{template "email_general_footer" .}}

server/provision/101_applications/0200_applications.yaml

@@ -0,0 +1,54 @@
+applications:
+  - name: Namespaces
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/low-code-platform.png
+      logo: applications/low-code-platform.png
+      url: compose/
+
+  - name: Admin Area
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/admin-area.png
+      logo: applications/admin-area.png
+      url: admin/
+
+  - name: Workflows
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/workflows.png
+      logo: applications/workflows.png
+      url: workflow/
+
+  - name: Jitsi Video Conferencing
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/video-conference.png
+      logo: applications/video-conference.png
+      url: bridge/jitsi/
+
+  - name: Reporter
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/reporter.png
+      logo: applications/reporter.png
+      url: reporter/
+
+  - name: Privacy
+    (envoy): { skipIf: "!missing" }
+    enabled: true
+    unify:
+      listed: true
+      icon: applications/privacy.png
+      logo: applications/privacy.png
+      url: privacy/

server/provision/200_federation/1000_roles.yaml

@@ -0,0 +1,3 @@
+roles:
+  federation:
+    name: Federation

server/provision/200_federation/2000_access_control.yaml

@@ -0,0 +1,38 @@
+allow:
+  admin:
+    corteza::federation/:
+      - grant
+      - pair
+      - settings.read
+      - settings.manage
+      - node.create
+      - nodes.search
+
+    corteza::federation:node/*:
+      - manage
+      - module.create
+
+    corteza::federation:exposed-module/*:
+      - manage
+
+    corteza::federation:shared-module/*:
+      - map
+
+  federation:
+    corteza::federation/:
+      - grant
+      - pair
+      - settings.read
+      - settings.manage
+      - node.create
+      - nodes.search
+
+    corteza::federation:node/*:
+      - manage
+      - module.create
+
+    corteza::federation:exposed-module/*/*:
+      - manage
+
+    corteza::federation:shared-module/*/*:
+      - map

server/provision/300_automation/1000_roles.yaml

@@ -0,0 +1,3 @@
+roles:
+  developer:
+    name: Developer

server/provision/300_automation/2000_access_control.yaml

@@ -0,0 +1,34 @@
+allow:
+  admin:
+    corteza::automation/:
+      - grant
+      - workflow.create
+      - workflows.search
+      - triggers.search
+      - sessions.search
+
+    corteza::automation:workflow/*:
+      - read
+      - update
+      - delete
+      - undelete
+      - execute
+      - triggers.manage
+      - sessions.manage
+
+  developer:
+    corteza::automation/:
+      - grant
+      - workflow.create
+      - workflows.search
+      - triggers.search
+      - sessions.search
+
+    corteza::automation:workflow/*:
+      - read
+      - update
+      - delete
+      - undelete
+      - execute
+      - triggers.manage
+      - sessions.manage

server/provision/400_discovery/1000_roles.yaml

@@ -0,0 +1,4 @@
+roles:
+  indexer_private:   { name: Indexer of private data }
+  indexer_protected: { name: Indexer of protected data }
+  indexer_public:    { name: Indexer of public data }

server/provision/400_discovery/2000_access_control.yaml

@@ -0,0 +1,24 @@
+deny:
+  indexer_private:
+    corteza::system/:
+      - applications.search
+      - auth-clients.search
+      - users.search
+      - templates.search
+      - roles.search
+
+  indexer_protected:
+    corteza::system/:
+      - applications.search
+      - auth-clients.search
+      - users.search
+      - templates.search
+      - roles.search
+
+  indexer_public:
+    corteza::system/:
+      - applications.search
+      - auth-clients.search
+      - users.search
+      - templates.search
+      - roles.search

server/provision/400_discovery/discovery.yaml

@@ -0,0 +1,12 @@
+settings:
+  discovery.enabled: true
+  discovery.system-users.enabled: true
+  discovery.system-applications.enabled: true
+  discovery.system-roles.enabled: true
+  discovery.system-templates.enabled: true
+  discovery.automation-workflows.enabled: true
+  discovery.compose-namespaces.enabled: true
+  discovery.compose-charts.enabled: true
+  discovery.compose-pages.enabled: true
+  discovery.compose-modules.enabled: true
+  discovery.compose-records.enabled: true

server/provision/README.adoc

@@ -0,0 +1,28 @@
+= Provision config files
+
+By default, Corteza provisions itself with all config files found in this directory.
+Provisioning process can be configured via `PROVISION_CONFIG_PATHS`.
+
+Extensions (`8xx-xxxxx`) are installed from https://github.com/cortezaproject/corteza-ext by release procedure.
+Manual installation of extensions is also possible by running `./update.sh` shell script in this directory
+
+== Naming/numeration rules
+
+0xx::
+Base resources, configuration, access control rules
+
+1xx::
+Additional resources
+
+2xx..6xx::
+Reserved
+
+7xx::
+Reserved for extensions
+
+8xx::
+Reserved for custom/user configuration
+
+9xx::
+Temporary, deprecated, obsolete
+

server/provision/update.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -eu
+
+cd "$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+
+BRANCH=${BRANCH:-"2022.3.x"}
+ZIP="${BRANCH}.zip"
+URL=${URL:-"https://github.com/cortezaproject/corteza-ext/archive/${ZIP}"}
+DIR="corteza-ext-${BRANCH}"
+
+function download {
+  echo -ne "\033[32mDownloading ${URL}\033[39m ... "
+
+  curl -s --location "${URL}" > "${ZIP}"
+  unzip -qq "${ZIP}"
+
+  echo "done"
+}
+
+function copyExtConfig {
+  echo -e "\033[32mCopying ${3} ${2}\033[39m ... "
+  mkdir -p "./${1}_${2}"
+  cp -f "${DIR}/${2}/config/${3}.yaml" "./${1}_${2}/${3}.yaml"
+}
+
+function cleanup {
+  echo -ne "\033[32mCleaning up\033[39m ... "
+  rm -rf "${ZIP}" "${DIR}"
+  echo "done"
+}
+
+download
+
+copyExtConfig 700 crm 0001_templates
+copyExtConfig 700 crm 1000_namespace
+copyExtConfig 700 crm 1100_modules
+copyExtConfig 700 crm 1200_charts
+copyExtConfig 700 crm 1400_pages
+copyExtConfig 700 crm 1500_record_settings
+copyExtConfig 700 crm 1600_workflows
+
+copyExtConfig 701 service-solution 0001_templates
+copyExtConfig 701 service-solution 1000_namespace
+copyExtConfig 701 service-solution 1100_modules
+copyExtConfig 701 service-solution 1200_charts
+copyExtConfig 701 service-solution 1400_pages
+copyExtConfig 701 service-solution 1500_record_settings
+copyExtConfig 701 service-solution 1600_workflows
+
+cleanup
+