Wolfgang
1a91f23044
- Add Wiki home page with navigation - Add Installation guide with all parameters - Add Credentials-Management documentation - Add Testing guide with all test suites - Add Architecture documentation with diagrams - Add Troubleshooting guide with solutions - Add FAQ with common questions Wiki includes: - Complete installation instructions - Credentials management workflows - Testing procedures (40+ tests) - System architecture diagrams - Troubleshooting for common issues - FAQ covering all aspects - Cross-referenced documentation
388 lines
9.4 KiB
Markdown
388 lines
9.4 KiB
Markdown
# Credentials-Management
|
|
|
|
Das Customer Installer System bietet ein umfassendes Credentials-Management-System für die sichere Verwaltung von Zugangsdaten.
|
|
|
|
## 📋 Übersicht
|
|
|
|
Das Credentials-Management-System ermöglicht:
|
|
|
|
- ✅ **Automatisches Speichern** von Credentials bei Installation
|
|
- ✅ **JSON-basierte Speicherung** für einfache Verarbeitung
|
|
- ✅ **Update ohne Container-Neustart** (z.B. Ollama-URL)
|
|
- ✅ **Sichere Speicherung** mit .gitignore-Schutz
|
|
- ✅ **Einfache Wiederverwendung** für Automatisierung
|
|
|
|
## 📁 Credential-Dateien
|
|
|
|
### Speicherort
|
|
|
|
```bash
|
|
credentials/
|
|
├── .gitignore # Schützt Credentials vor Git
|
|
├── example-credentials.json # Beispiel-Datei
|
|
└── sb-<timestamp>.json # Tatsächliche Credentials
|
|
```
|
|
|
|
### Dateiformat
|
|
|
|
```json
|
|
{
|
|
"ctid": 769276659,
|
|
"hostname": "sb-1769276659",
|
|
"fqdn": "sb-1769276659.userman.de",
|
|
"ip": "192.168.45.45",
|
|
"vlan": 90,
|
|
"urls": {
|
|
"n8n_internal": "http://192.168.45.45:5678/",
|
|
"n8n_external": "https://sb-1769276659.userman.de",
|
|
"postgrest": "http://192.168.45.45:3000",
|
|
"chat_webhook": "https://sb-1769276659.userman.de/webhook/rag-chat-webhook/chat",
|
|
"chat_internal": "http://192.168.45.45:5678/webhook/rag-chat-webhook/chat",
|
|
"upload_form": "https://sb-1769276659.userman.de/form/rag-upload-form",
|
|
"upload_form_internal": "http://192.168.45.45:5678/form/rag-upload-form"
|
|
},
|
|
"postgres": {
|
|
"host": "postgres",
|
|
"port": 5432,
|
|
"db": "customer",
|
|
"user": "customer",
|
|
"password": "HUmMLP8NbW2onmf2A1"
|
|
},
|
|
"supabase": {
|
|
"url": "http://postgrest:3000",
|
|
"url_external": "http://192.168.45.45:3000",
|
|
"anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"service_role_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"jwt_secret": "IM9/HRQR9mw63lU/1G7vXPMe7q0n3oLcr35dryv0ToU="
|
|
},
|
|
"ollama": {
|
|
"url": "http://192.168.45.3:11434",
|
|
"model": "ministral-3:3b",
|
|
"embedding_model": "nomic-embed-text:latest"
|
|
},
|
|
"n8n": {
|
|
"encryption_key": "d0c9c0ba0551d25e4ee95b6a4b6bc8d5b64e5e14f7f0972fe50332ca051edab5",
|
|
"owner_email": "admin@userman.de",
|
|
"owner_password": "FAmeVE7t9d1iMIXWA1",
|
|
"secure_cookie": false
|
|
},
|
|
"log_file": "/root/customer-installer/logs/sb-1769276659.log"
|
|
}
|
|
```
|
|
|
|
## 🔧 Verwendung
|
|
|
|
### 1. Automatisches Speichern bei Installation
|
|
|
|
Credentials werden automatisch gespeichert:
|
|
|
|
```bash
|
|
# Installation durchführen
|
|
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90
|
|
|
|
# Credentials werden automatisch gespeichert
|
|
# credentials/sb-<timestamp>.json
|
|
```
|
|
|
|
### 2. Manuelles Speichern
|
|
|
|
Falls Sie Credentials manuell speichern möchten:
|
|
|
|
```bash
|
|
# JSON-Output in Datei speichern
|
|
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90 > output.json
|
|
|
|
# Mit save_credentials.sh speichern
|
|
./save_credentials.sh output.json
|
|
```
|
|
|
|
### 3. Credentials laden
|
|
|
|
```bash
|
|
# Credentials laden
|
|
CREDS=$(cat credentials/sb-1769276659.json)
|
|
|
|
# Einzelne Werte extrahieren
|
|
CTID=$(echo "$CREDS" | jq -r '.ctid')
|
|
IP=$(echo "$CREDS" | jq -r '.ip')
|
|
N8N_PASSWORD=$(echo "$CREDS" | jq -r '.n8n.owner_password')
|
|
```
|
|
|
|
## 🔄 Credentials aktualisieren
|
|
|
|
### Ollama-URL aktualisieren
|
|
|
|
Häufiger Use-Case: Ollama-URL von IP zu Hostname ändern
|
|
|
|
```bash
|
|
# Von IP zu Hostname
|
|
./update_credentials.sh \
|
|
--ctid 769276659 \
|
|
--ollama-url http://ollama.local:11434
|
|
|
|
# Mit Credentials-Datei
|
|
./update_credentials.sh \
|
|
--credentials credentials/sb-1769276659.json \
|
|
--ollama-url http://ollama.local:11434
|
|
```
|
|
|
|
### Ollama-Modell ändern
|
|
|
|
```bash
|
|
# Chat-Modell ändern
|
|
./update_credentials.sh \
|
|
--ctid 769276659 \
|
|
--ollama-model llama2:latest
|
|
|
|
# Embedding-Modell ändern
|
|
./update_credentials.sh \
|
|
--ctid 769276659 \
|
|
--embedding-model all-minilm:latest
|
|
|
|
# Beide gleichzeitig
|
|
./update_credentials.sh \
|
|
--ctid 769276659 \
|
|
--ollama-model llama2:latest \
|
|
--embedding-model all-minilm:latest
|
|
```
|
|
|
|
### Alle Optionen
|
|
|
|
```bash
|
|
./update_credentials.sh \
|
|
--ctid 769276659 \
|
|
--ollama-url http://ollama.local:11434 \
|
|
--ollama-model llama2:latest \
|
|
--embedding-model all-minilm:latest \
|
|
--n8n-email admin@userman.de \
|
|
--n8n-password "NewPassword123"
|
|
```
|
|
|
|
## 📝 update_credentials.sh Optionen
|
|
|
|
| Parameter | Beschreibung | Beispiel |
|
|
|-----------|--------------|----------|
|
|
| `--ctid <id>` | Container-ID | `--ctid 769276659` |
|
|
| `--credentials <file>` | Credentials-Datei | `--credentials credentials/sb-*.json` |
|
|
| `--ollama-url <url>` | Ollama Server URL | `--ollama-url http://ollama.local:11434` |
|
|
| `--ollama-model <model>` | Chat-Modell | `--ollama-model llama2:latest` |
|
|
| `--embedding-model <model>` | Embedding-Modell | `--embedding-model all-minilm:latest` |
|
|
| `--n8n-email <email>` | n8n Admin-Email | `--n8n-email admin@example.com` |
|
|
| `--n8n-password <pass>` | n8n Admin-Passwort | `--n8n-password "NewPass123"` |
|
|
|
|
## 🔐 Sicherheit
|
|
|
|
### Git-Schutz
|
|
|
|
Credentials werden automatisch von Git ausgeschlossen:
|
|
|
|
```bash
|
|
# credentials/.gitignore
|
|
*.json
|
|
!example-credentials.json
|
|
```
|
|
|
|
### Berechtigungen
|
|
|
|
```bash
|
|
# Credentials-Verzeichnis schützen
|
|
chmod 700 credentials/
|
|
chmod 600 credentials/*.json
|
|
```
|
|
|
|
### Passwort-Richtlinien
|
|
|
|
Automatisch generierte Passwörter erfüllen:
|
|
- Mindestens 14 Zeichen
|
|
- Groß- und Kleinbuchstaben
|
|
- Zahlen
|
|
- Keine Sonderzeichen (für bessere Kompatibilität)
|
|
|
|
## 🔄 Workflow
|
|
|
|
### Typischer Workflow
|
|
|
|
```bash
|
|
# 1. Installation
|
|
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90
|
|
|
|
# 2. Credentials werden automatisch gespeichert
|
|
# credentials/sb-<timestamp>.json
|
|
|
|
# 3. Später: Ollama-URL aktualisieren
|
|
./update_credentials.sh \
|
|
--credentials credentials/sb-*.json \
|
|
--ollama-url http://ollama.local:11434
|
|
|
|
# 4. Credentials für Automatisierung verwenden
|
|
CTID=$(jq -r '.ctid' credentials/sb-*.json)
|
|
IP=$(jq -r '.ip' credentials/sb-*.json)
|
|
```
|
|
|
|
### Automatisierung
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
# Beispiel: Automatische Deployment-Pipeline
|
|
|
|
# Installation
|
|
OUTPUT=$(./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90)
|
|
|
|
# Credentials extrahieren
|
|
CTID=$(echo "$OUTPUT" | jq -r '.ctid')
|
|
IP=$(echo "$OUTPUT" | jq -r '.ip')
|
|
N8N_URL=$(echo "$OUTPUT" | jq -r '.urls.n8n_external')
|
|
|
|
# Credentials-Datei finden
|
|
CREDS_FILE=$(ls -t credentials/sb-*.json | head -1)
|
|
|
|
# Ollama-URL aktualisieren
|
|
./update_credentials.sh \
|
|
--credentials "$CREDS_FILE" \
|
|
--ollama-url http://ollama.local:11434
|
|
|
|
# Tests durchführen
|
|
./test_complete_system.sh "$CTID" "$IP" "$(basename "$CREDS_FILE" .json)"
|
|
|
|
# Monitoring einrichten
|
|
# ...
|
|
```
|
|
|
|
## 📊 Credential-Typen
|
|
|
|
### PostgreSQL Credentials
|
|
|
|
```json
|
|
"postgres": {
|
|
"host": "postgres",
|
|
"port": 5432,
|
|
"db": "customer",
|
|
"user": "customer",
|
|
"password": "HUmMLP8NbW2onmf2A1"
|
|
}
|
|
```
|
|
|
|
**Verwendung:**
|
|
```bash
|
|
# Verbindung zur Datenbank
|
|
pct exec <ctid> -- docker exec customer-postgres \
|
|
psql -U customer -d customer
|
|
```
|
|
|
|
### Supabase/PostgREST Credentials
|
|
|
|
```json
|
|
"supabase": {
|
|
"url": "http://postgrest:3000",
|
|
"url_external": "http://192.168.45.45:3000",
|
|
"anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"service_role_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"jwt_secret": "IM9/HRQR9mw63lU/1G7vXPMe7q0n3oLcr35dryv0ToU="
|
|
}
|
|
```
|
|
|
|
**Verwendung:**
|
|
```bash
|
|
# API-Zugriff mit anon_key
|
|
curl http://192.168.45.45:3000/documents \
|
|
-H "apikey: ${ANON_KEY}" \
|
|
-H "Authorization: Bearer ${ANON_KEY}"
|
|
|
|
# API-Zugriff mit service_role_key (volle Rechte)
|
|
curl http://192.168.45.45:3000/documents \
|
|
-H "apikey: ${SERVICE_KEY}" \
|
|
-H "Authorization: Bearer ${SERVICE_KEY}"
|
|
```
|
|
|
|
### n8n Credentials
|
|
|
|
```json
|
|
"n8n": {
|
|
"encryption_key": "d0c9c0ba0551d25e4ee95b6a4b6bc8d5b64e5e14f7f0972fe50332ca051edab5",
|
|
"owner_email": "admin@userman.de",
|
|
"owner_password": "FAmeVE7t9d1iMIXWA1",
|
|
"secure_cookie": false
|
|
}
|
|
```
|
|
|
|
**Verwendung:**
|
|
```bash
|
|
# n8n API Login
|
|
curl -X POST http://192.168.45.45:5678/rest/login \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"emailOrLdapLoginId\":\"${N8N_EMAIL}\",\"password\":\"${N8N_PASSWORD}\"}"
|
|
```
|
|
|
|
### Ollama Credentials
|
|
|
|
```json
|
|
"ollama": {
|
|
"url": "http://192.168.45.3:11434",
|
|
"model": "ministral-3:3b",
|
|
"embedding_model": "nomic-embed-text:latest"
|
|
}
|
|
```
|
|
|
|
**Verwendung:**
|
|
```bash
|
|
# Ollama-Modelle auflisten
|
|
curl http://192.168.45.3:11434/api/tags
|
|
|
|
# Chat-Completion
|
|
curl -X POST http://192.168.45.3:11434/api/generate \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"model\":\"ministral-3:3b\",\"prompt\":\"Hello\"}"
|
|
```
|
|
|
|
## 🔍 Troubleshooting
|
|
|
|
### Credentials-Datei nicht gefunden
|
|
|
|
```bash
|
|
# Alle Credentials-Dateien auflisten
|
|
ls -la credentials/
|
|
|
|
# Nach Hostname suchen
|
|
ls credentials/sb-*.json
|
|
```
|
|
|
|
### Update schlägt fehl
|
|
|
|
```bash
|
|
# n8n-Container prüfen
|
|
pct exec <ctid> -- docker ps | grep n8n
|
|
|
|
# n8n-Logs prüfen
|
|
pct exec <ctid> -- docker logs n8n
|
|
|
|
# Manuell in n8n einloggen und prüfen
|
|
curl -X POST http://<ip>:5678/rest/login \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"emailOrLdapLoginId":"admin@userman.de","password":"..."}'
|
|
```
|
|
|
|
### Credentials wiederherstellen
|
|
|
|
```bash
|
|
# Aus Log-Datei extrahieren
|
|
grep "JSON_OUTPUT" logs/sb-*.log
|
|
|
|
# Oder aus Container extrahieren
|
|
pct exec <ctid> -- cat /opt/customer-stack/.env
|
|
```
|
|
|
|
## 📚 Weiterführende Dokumentation
|
|
|
|
- [Installation](Installation.md) - Installations-Anleitung
|
|
- [API-Referenz](API-Reference.md) - API-Dokumentation
|
|
- [Troubleshooting](Troubleshooting.md) - Problemlösung
|
|
- [n8n](n8n.md) - n8n-Konfiguration
|
|
|
|
---
|
|
|
|
**Best Practices:**
|
|
1. Credentials-Dateien regelmäßig sichern
|
|
2. Passwörter nicht in Scripts hardcoden
|
|
3. Service-Role-Key nur für administrative Aufgaben verwenden
|
|
4. Credentials-Verzeichnis mit restriktiven Berechtigungen schützen
|