Credentials-Management hinzugefügt
@@ -0,0 +1,387 @@
|
||||
# Credentials-Management
|
||||
|
||||
Das Customer Installer System bietet ein umfassendes Credentials-Management-System für die sichere Verwaltung von Zugangsdaten.
|
||||
|
||||
## 📋 Übersicht
|
||||
|
||||
Das Credentials-Management-System ermöglicht:
|
||||
|
||||
- ✅ **Automatisches Speichern** von Credentials bei Installation
|
||||
- ✅ **JSON-basierte Speicherung** für einfache Verarbeitung
|
||||
- ✅ **Update ohne Container-Neustart** (z.B. Ollama-URL)
|
||||
- ✅ **Sichere Speicherung** mit .gitignore-Schutz
|
||||
- ✅ **Einfache Wiederverwendung** für Automatisierung
|
||||
|
||||
## 📁 Credential-Dateien
|
||||
|
||||
### Speicherort
|
||||
|
||||
```bash
|
||||
credentials/
|
||||
├── .gitignore # Schützt Credentials vor Git
|
||||
├── example-credentials.json # Beispiel-Datei
|
||||
└── sb-<timestamp>.json # Tatsächliche Credentials
|
||||
```
|
||||
|
||||
### Dateiformat
|
||||
|
||||
```json
|
||||
{
|
||||
"ctid": 769276659,
|
||||
"hostname": "sb-1769276659",
|
||||
"fqdn": "sb-1769276659.userman.de",
|
||||
"ip": "192.168.45.45",
|
||||
"vlan": 90,
|
||||
"urls": {
|
||||
"n8n_internal": "http://192.168.45.45:5678/",
|
||||
"n8n_external": "https://sb-1769276659.userman.de",
|
||||
"postgrest": "http://192.168.45.45:3000",
|
||||
"chat_webhook": "https://sb-1769276659.userman.de/webhook/rag-chat-webhook/chat",
|
||||
"chat_internal": "http://192.168.45.45:5678/webhook/rag-chat-webhook/chat",
|
||||
"upload_form": "https://sb-1769276659.userman.de/form/rag-upload-form",
|
||||
"upload_form_internal": "http://192.168.45.45:5678/form/rag-upload-form"
|
||||
},
|
||||
"postgres": {
|
||||
"host": "postgres",
|
||||
"port": 5432,
|
||||
"db": "customer",
|
||||
"user": "customer",
|
||||
"password": "HUmMLP8NbW2onmf2A1"
|
||||
},
|
||||
"supabase": {
|
||||
"url": "http://postgrest:3000",
|
||||
"url_external": "http://192.168.45.45:3000",
|
||||
"anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
||||
"service_role_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
||||
"jwt_secret": "IM9/HRQR9mw63lU/1G7vXPMe7q0n3oLcr35dryv0ToU="
|
||||
},
|
||||
"ollama": {
|
||||
"url": "http://192.168.45.3:11434",
|
||||
"model": "ministral-3:3b",
|
||||
"embedding_model": "nomic-embed-text:latest"
|
||||
},
|
||||
"n8n": {
|
||||
"encryption_key": "d0c9c0ba0551d25e4ee95b6a4b6bc8d5b64e5e14f7f0972fe50332ca051edab5",
|
||||
"owner_email": "admin@userman.de",
|
||||
"owner_password": "FAmeVE7t9d1iMIXWA1",
|
||||
"secure_cookie": false
|
||||
},
|
||||
"log_file": "/root/customer-installer/logs/sb-1769276659.log"
|
||||
}
|
||||
```
|
||||
|
||||
## 🔧 Verwendung
|
||||
|
||||
### 1. Automatisches Speichern bei Installation
|
||||
|
||||
Credentials werden automatisch gespeichert:
|
||||
|
||||
```bash
|
||||
# Installation durchführen
|
||||
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90
|
||||
|
||||
# Credentials werden automatisch gespeichert
|
||||
# credentials/sb-<timestamp>.json
|
||||
```
|
||||
|
||||
### 2. Manuelles Speichern
|
||||
|
||||
Falls Sie Credentials manuell speichern möchten:
|
||||
|
||||
```bash
|
||||
# JSON-Output in Datei speichern
|
||||
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90 > output.json
|
||||
|
||||
# Mit save_credentials.sh speichern
|
||||
./save_credentials.sh output.json
|
||||
```
|
||||
|
||||
### 3. Credentials laden
|
||||
|
||||
```bash
|
||||
# Credentials laden
|
||||
CREDS=$(cat credentials/sb-1769276659.json)
|
||||
|
||||
# Einzelne Werte extrahieren
|
||||
CTID=$(echo "$CREDS" | jq -r '.ctid')
|
||||
IP=$(echo "$CREDS" | jq -r '.ip')
|
||||
N8N_PASSWORD=$(echo "$CREDS" | jq -r '.n8n.owner_password')
|
||||
```
|
||||
|
||||
## 🔄 Credentials aktualisieren
|
||||
|
||||
### Ollama-URL aktualisieren
|
||||
|
||||
Häufiger Use-Case: Ollama-URL von IP zu Hostname ändern
|
||||
|
||||
```bash
|
||||
# Von IP zu Hostname
|
||||
./update_credentials.sh \
|
||||
--ctid 769276659 \
|
||||
--ollama-url http://ollama.local:11434
|
||||
|
||||
# Mit Credentials-Datei
|
||||
./update_credentials.sh \
|
||||
--credentials credentials/sb-1769276659.json \
|
||||
--ollama-url http://ollama.local:11434
|
||||
```
|
||||
|
||||
### Ollama-Modell ändern
|
||||
|
||||
```bash
|
||||
# Chat-Modell ändern
|
||||
./update_credentials.sh \
|
||||
--ctid 769276659 \
|
||||
--ollama-model llama2:latest
|
||||
|
||||
# Embedding-Modell ändern
|
||||
./update_credentials.sh \
|
||||
--ctid 769276659 \
|
||||
--embedding-model all-minilm:latest
|
||||
|
||||
# Beide gleichzeitig
|
||||
./update_credentials.sh \
|
||||
--ctid 769276659 \
|
||||
--ollama-model llama2:latest \
|
||||
--embedding-model all-minilm:latest
|
||||
```
|
||||
|
||||
### Alle Optionen
|
||||
|
||||
```bash
|
||||
./update_credentials.sh \
|
||||
--ctid 769276659 \
|
||||
--ollama-url http://ollama.local:11434 \
|
||||
--ollama-model llama2:latest \
|
||||
--embedding-model all-minilm:latest \
|
||||
--n8n-email admin@userman.de \
|
||||
--n8n-password "NewPassword123"
|
||||
```
|
||||
|
||||
## 📝 update_credentials.sh Optionen
|
||||
|
||||
| Parameter | Beschreibung | Beispiel |
|
||||
|-----------|--------------|----------|
|
||||
| `--ctid <id>` | Container-ID | `--ctid 769276659` |
|
||||
| `--credentials <file>` | Credentials-Datei | `--credentials credentials/sb-*.json` |
|
||||
| `--ollama-url <url>` | Ollama Server URL | `--ollama-url http://ollama.local:11434` |
|
||||
| `--ollama-model <model>` | Chat-Modell | `--ollama-model llama2:latest` |
|
||||
| `--embedding-model <model>` | Embedding-Modell | `--embedding-model all-minilm:latest` |
|
||||
| `--n8n-email <email>` | n8n Admin-Email | `--n8n-email admin@example.com` |
|
||||
| `--n8n-password <pass>` | n8n Admin-Passwort | `--n8n-password "NewPass123"` |
|
||||
|
||||
## 🔐 Sicherheit
|
||||
|
||||
### Git-Schutz
|
||||
|
||||
Credentials werden automatisch von Git ausgeschlossen:
|
||||
|
||||
```bash
|
||||
# credentials/.gitignore
|
||||
*.json
|
||||
!example-credentials.json
|
||||
```
|
||||
|
||||
### Berechtigungen
|
||||
|
||||
```bash
|
||||
# Credentials-Verzeichnis schützen
|
||||
chmod 700 credentials/
|
||||
chmod 600 credentials/*.json
|
||||
```
|
||||
|
||||
### Passwort-Richtlinien
|
||||
|
||||
Automatisch generierte Passwörter erfüllen:
|
||||
- Mindestens 14 Zeichen
|
||||
- Groß- und Kleinbuchstaben
|
||||
- Zahlen
|
||||
- Keine Sonderzeichen (für bessere Kompatibilität)
|
||||
|
||||
## 🔄 Workflow
|
||||
|
||||
### Typischer Workflow
|
||||
|
||||
```bash
|
||||
# 1. Installation
|
||||
./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90
|
||||
|
||||
# 2. Credentials werden automatisch gespeichert
|
||||
# credentials/sb-<timestamp>.json
|
||||
|
||||
# 3. Später: Ollama-URL aktualisieren
|
||||
./update_credentials.sh \
|
||||
--credentials credentials/sb-*.json \
|
||||
--ollama-url http://ollama.local:11434
|
||||
|
||||
# 4. Credentials für Automatisierung verwenden
|
||||
CTID=$(jq -r '.ctid' credentials/sb-*.json)
|
||||
IP=$(jq -r '.ip' credentials/sb-*.json)
|
||||
```
|
||||
|
||||
### Automatisierung
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# Beispiel: Automatische Deployment-Pipeline
|
||||
|
||||
# Installation
|
||||
OUTPUT=$(./install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90)
|
||||
|
||||
# Credentials extrahieren
|
||||
CTID=$(echo "$OUTPUT" | jq -r '.ctid')
|
||||
IP=$(echo "$OUTPUT" | jq -r '.ip')
|
||||
N8N_URL=$(echo "$OUTPUT" | jq -r '.urls.n8n_external')
|
||||
|
||||
# Credentials-Datei finden
|
||||
CREDS_FILE=$(ls -t credentials/sb-*.json | head -1)
|
||||
|
||||
# Ollama-URL aktualisieren
|
||||
./update_credentials.sh \
|
||||
--credentials "$CREDS_FILE" \
|
||||
--ollama-url http://ollama.local:11434
|
||||
|
||||
# Tests durchführen
|
||||
./test_complete_system.sh "$CTID" "$IP" "$(basename "$CREDS_FILE" .json)"
|
||||
|
||||
# Monitoring einrichten
|
||||
# ...
|
||||
```
|
||||
|
||||
## 📊 Credential-Typen
|
||||
|
||||
### PostgreSQL Credentials
|
||||
|
||||
```json
|
||||
"postgres": {
|
||||
"host": "postgres",
|
||||
"port": 5432,
|
||||
"db": "customer",
|
||||
"user": "customer",
|
||||
"password": "HUmMLP8NbW2onmf2A1"
|
||||
}
|
||||
```
|
||||
|
||||
**Verwendung:**
|
||||
```bash
|
||||
# Verbindung zur Datenbank
|
||||
pct exec <ctid> -- docker exec customer-postgres \
|
||||
psql -U customer -d customer
|
||||
```
|
||||
|
||||
### Supabase/PostgREST Credentials
|
||||
|
||||
```json
|
||||
"supabase": {
|
||||
"url": "http://postgrest:3000",
|
||||
"url_external": "http://192.168.45.45:3000",
|
||||
"anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
||||
"service_role_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
||||
"jwt_secret": "IM9/HRQR9mw63lU/1G7vXPMe7q0n3oLcr35dryv0ToU="
|
||||
}
|
||||
```
|
||||
|
||||
**Verwendung:**
|
||||
```bash
|
||||
# API-Zugriff mit anon_key
|
||||
curl http://192.168.45.45:3000/documents \
|
||||
-H "apikey: ${ANON_KEY}" \
|
||||
-H "Authorization: Bearer ${ANON_KEY}"
|
||||
|
||||
# API-Zugriff mit service_role_key (volle Rechte)
|
||||
curl http://192.168.45.45:3000/documents \
|
||||
-H "apikey: ${SERVICE_KEY}" \
|
||||
-H "Authorization: Bearer ${SERVICE_KEY}"
|
||||
```
|
||||
|
||||
### n8n Credentials
|
||||
|
||||
```json
|
||||
"n8n": {
|
||||
"encryption_key": "d0c9c0ba0551d25e4ee95b6a4b6bc8d5b64e5e14f7f0972fe50332ca051edab5",
|
||||
"owner_email": "admin@userman.de",
|
||||
"owner_password": "FAmeVE7t9d1iMIXWA1",
|
||||
"secure_cookie": false
|
||||
}
|
||||
```
|
||||
|
||||
**Verwendung:**
|
||||
```bash
|
||||
# n8n API Login
|
||||
curl -X POST http://192.168.45.45:5678/rest/login \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"emailOrLdapLoginId\":\"${N8N_EMAIL}\",\"password\":\"${N8N_PASSWORD}\"}"
|
||||
```
|
||||
|
||||
### Ollama Credentials
|
||||
|
||||
```json
|
||||
"ollama": {
|
||||
"url": "http://192.168.45.3:11434",
|
||||
"model": "ministral-3:3b",
|
||||
"embedding_model": "nomic-embed-text:latest"
|
||||
}
|
||||
```
|
||||
|
||||
**Verwendung:**
|
||||
```bash
|
||||
# Ollama-Modelle auflisten
|
||||
curl http://192.168.45.3:11434/api/tags
|
||||
|
||||
# Chat-Completion
|
||||
curl -X POST http://192.168.45.3:11434/api/generate \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"model\":\"ministral-3:3b\",\"prompt\":\"Hello\"}"
|
||||
```
|
||||
|
||||
## 🔍 Troubleshooting
|
||||
|
||||
### Credentials-Datei nicht gefunden
|
||||
|
||||
```bash
|
||||
# Alle Credentials-Dateien auflisten
|
||||
ls -la credentials/
|
||||
|
||||
# Nach Hostname suchen
|
||||
ls credentials/sb-*.json
|
||||
```
|
||||
|
||||
### Update schlägt fehl
|
||||
|
||||
```bash
|
||||
# n8n-Container prüfen
|
||||
pct exec <ctid> -- docker ps | grep n8n
|
||||
|
||||
# n8n-Logs prüfen
|
||||
pct exec <ctid> -- docker logs n8n
|
||||
|
||||
# Manuell in n8n einloggen und prüfen
|
||||
curl -X POST http://<ip>:5678/rest/login \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"emailOrLdapLoginId":"admin@userman.de","password":"..."}'
|
||||
```
|
||||
|
||||
### Credentials wiederherstellen
|
||||
|
||||
```bash
|
||||
# Aus Log-Datei extrahieren
|
||||
grep "JSON_OUTPUT" logs/sb-*.log
|
||||
|
||||
# Oder aus Container extrahieren
|
||||
pct exec <ctid> -- cat /opt/customer-stack/.env
|
||||
```
|
||||
|
||||
## 📚 Weiterführende Dokumentation
|
||||
|
||||
- [Installation](Installation.md) - Installations-Anleitung
|
||||
- [API-Referenz](API-Reference.md) - API-Dokumentation
|
||||
- [Troubleshooting](Troubleshooting.md) - Problemlösung
|
||||
- [n8n](n8n.md) - n8n-Konfiguration
|
||||
|
||||
---
|
||||
|
||||
**Best Practices:**
|
||||
1. Credentials-Dateien regelmäßig sichern
|
||||
2. Passwörter nicht in Scripts hardcoden
|
||||
3. Service-Role-Key nur für administrative Aufgaben verwenden
|
||||
4. Credentials-Verzeichnis mit restriktiven Berechtigungen schützen
|
||||
Reference in New Issue
Block a user