From 4a82b639f493a5b3f724df3e8978b8c3a021ad9e Mon Sep 17 00:00:00 2001
From: Subroto <subroto@ebdesk.com>
Date: Wed, 14 Oct 2026 01:20:29 +0700
Subject: [PATCH] fix ca export & mount

---
 deploy/stack/docker-compose.yml |  4 +++
 deploy/stack/env.example        | 10 +++++++
 deploy/stack/up.sh              | 47 +++++++++++++++++++++++++++++++++
 scripts/export-trino-ca.sh      |  6 ++++-
 4 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100755 deploy/stack/up.sh

diff --git a/deploy/stack/docker-compose.yml b/deploy/stack/docker-compose.yml
index 95820cc..57c44c2 100644
--- a/deploy/stack/docker-compose.yml
+++ b/deploy/stack/docker-compose.yml
@@ -160,6 +160,8 @@ services:
       KEYCLOAK_WEB_URL: ${KEYCLOAK_WEB_URL:-}
       TRINO_URL: ${TRINO_URL:-}
       TRINO_WEB_URL: ${TRINO_WEB_URL:-}
+      # CA Trino (file di host, dibuat scripts/export-trino-ca.sh) → dilihat panel.
+      TRINO_CA_FILE: ${TRINO_CA_FILE:-/app/.ca/trino.crt}
       NESSIE_URL: ${NESSIE_URL:-}
       AIRFLOW_URL: ${AIRFLOW_URL:-}
       STARROCKS_HOST: ${STARROCKS_HOST:-}
@@ -173,6 +175,8 @@ services:
       SICABE_STATE_FILE: data/state.json
     volumes:
       - panel-data:/app/data
+      # CA Trino: direktori host berisi trino.crt → /app/.ca (read-only).
+      - ${TRINO_CA_DIR:-../../.ca}:/app/.ca:ro
     restart: unless-stopped
     logging:
       driver: json-file
diff --git a/deploy/stack/env.example b/deploy/stack/env.example
index 369e059..64357ca 100644
--- a/deploy/stack/env.example
+++ b/deploy/stack/env.example
@@ -75,3 +75,13 @@ OPENMETADATA_URL=http://127.0.0.1:12085
 GRAFANA_URL=http://127.0.0.1:12300
 MINIO_CONSOLE_URL=http://localhost:12901
 SICABE_COMPOSE_PROJECTS=sicabe
+
+PANEL_LOCAL_USER=admin
+PANEL_LOCAL_PASSWORD_HASH_B64=JDJiJDEwJGZ3WFVUdUdRbnUuYjlhUkkzRkNTcE95SG90aXFBMHhQcDNCajJFdkJDcXRoM1VPWWtZQWhH
+PANEL_LOCAL_ROLE=data-admin
+TRINO_SERVICE_ACCOUNT=svc_dbt
+TRINO_SERVICE_PASSWORD=3ef17c293f145843
+SICABE_TRINO_HOST=remote-trino
+TRINO_CA_FETCH_HOST=localhost:8443
+TRINO_CA_DIR=/home/user/sicabe-control-panel/.ca
+TRINO_CA_FILE=/app/.ca/trino.crt
diff --git a/deploy/stack/up.sh b/deploy/stack/up.sh
new file mode 100755
index 0000000..d1e975b
--- /dev/null
+++ b/deploy/stack/up.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# =============================================================================
+# up.sh — siapkan CA Trino (pakai openssl di HOST) lalu jalankan stack.
+#
+# Menjalankan `scripts/export-trino-ca.sh` (mengambil cert dari endpoint Trino
+# yang hidup) bila `TRINO_CA_FETCH_HOST` di-set, lalu `docker compose up -d`.
+# Tujuannya: CA selalu sinkron saat container dibuat/di-recreate — terutama di
+# server baru, cukup satu perintah.
+#
+# Pemakaian:
+#   ./up.sh                        # host gateway (docker-proxy+agent+nginx)
+#   ./up.sh --profile panel        # host panel (menambahkan panel)
+#
+# Env di .env (lihat env.example):
+#   TRINO_CA_FETCH_HOST=100.123.123.71:8443   → sumber cert (kosong = lewati)
+#   TRINO_CA_DIR=../../.ca                    → direktori host berisi trino.crt
+#                                               (di-mount ke /app/.ca panel)
+# =============================================================================
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+REPO_ROOT="$(cd ../.. && pwd)"
+
+# Baca nilai dari .env per baris (TIDAK `source` — nilai JSON bisa merusak shell).
+read_env() {
+    [ -f .env ] && grep -E "^$1=" .env | head -1 | cut -d= -f2- || true
+}
+
+CA_FETCH_HOST="$(read_env TRINO_CA_FETCH_HOST)"
+CA_DIR="$(read_env TRINO_CA_DIR)"
+
+# Default: CA di <repo>/.ca ; file yang di-mount = <CA_DIR>/trino.crt
+[ -z "$CA_DIR" ] && CA_DIR="$REPO_ROOT/.ca"
+CA_FILE_HOST="$CA_DIR/trino.crt"
+
+if [ -n "$CA_FETCH_HOST" ]; then
+    echo "→ Ambil sertifikat Trino dari ${CA_FETCH_HOST} (openssl di host)"
+    TRINO_CA_HOST="$CA_FETCH_HOST" TRINO_CA_FILE="$CA_FILE_HOST" \
+        "$REPO_ROOT/scripts/export-trino-ca.sh"
+else
+    echo "! TRINO_CA_FETCH_HOST kosong — lewati pengambilan CA."
+    echo "  Pastikan file CA sudah ada: ${CA_FILE_HOST}"
+fi
+
+echo "→ docker compose up -d $*"
+docker compose "$@" up -d
+echo
+echo "✔ Selesai. Cek: docker compose ps"
diff --git a/scripts/export-trino-ca.sh b/scripts/export-trino-ca.sh
index 8740a95..1665bd4 100755
--- a/scripts/export-trino-ca.sh
+++ b/scripts/export-trino-ca.sh
@@ -11,6 +11,10 @@
 #     → /api/query mengembalikan 500 "fetch failed"
 #     → kartu "Data Catalog" di SQL IDE tampil "gagal load catalog"
 #
+# Mode file 0644 (sertifikat PUBLIK, bukan secret) supaya terbaca oleh proses
+# panel yang berjalan sebagai user LAIN di container (uid 1001) — dengan 0600
+# panel di container mendapat "Permission denied" → CA dianggap tak ada.
+#
 # Script ini mengekspor cert Trino yang berlaku ke file pin, dengan backup, dan
 # idempoten (tidak menulis bila sudah sinkron).
 #
@@ -96,7 +100,7 @@ if [ -f "$TRINO_CA_FILE" ]; then
     echo "→ Backup pin lama: $BAK"
     echo "   (fingerprint lama: $(fp_of "$BAK"))"
 fi
-install -m 600 "$TMP" "$TRINO_CA_FILE"
+install -m 644 "$TMP" "$TRINO_CA_FILE"
 echo "✓ Pin CA diperbarui: $TRINO_CA_FILE"
 
 # ── 3. Cross-check dengan endpoint live (bila sumbernya keystore) ────────────