On-premise configs for Retool

Repository for deploying Retool

Getting started

Quick and simple start.

Run ./install.shto install Docker and Docker Compose
Run sudo docker-compose up to start the Retool server

Running Retool using Docker

Install docker and docker-compose
1. Provided are two convenience scripts for making it easy to install docker and docker-compose: ./get-docker.sh and ./get-docker-compose.sh
Run ./docker_setup and use the default values provided
1. If you do not have bash, you can adapt the docker.env.template file
Run sudo docker-compose up to start the Retool server
Be sure to open up port 80 and port 443 on the virtual machine's host
Navigate to your server's ip address in a web browser to get started.

Updating Retool using docker-compose

Run ./update_retool.sh
Alternatively, stop the server, and run sudo docker-compose pull and then sudo docker-compose up -d

Running Retool on Kubernetes with Helm

A helm chart is included in this repository under the ./helm directory
The available parameters are documented using comments in the ./helm/values.yaml file

helm install ./helm

Persistent volumes are not reliable - we recommend that a long-term installation of Retool host the database on an externally managed database like RDS. Please disable the included postgresql chart by setting postgresql.enabled to false and then specifying your external database through the config.postgresql.* properties.

Running Retool on Kubernetes

Navigate into the kubernetes directory
Copy the retool-secrets.template.yaml file to retool-secrets.yaml and inside the {{ ... }} sections, replace with a suitable base64 encoded string.
1. If you do not wish to add google authentication, replace the templates with an empty string.
2. You will need a license key in order to proceed.
Run kubectl apply -f ./retool-secrets.yaml
Run kubectl apply -f ./retool-postgres.yaml
Run kubectl apply -f ./retool-container.yaml

For ease of use, this will create a postgres container with a persistent volume for the storage of Retool data. We recommend that you use a managed database service like RDS as a long-term solution. The application will be exposed on a public ip address on port 3000 - we leave it to the user to handle DNS and SSL.

Please note that by default Retool is configured to use Secure Cookies - that means that you will be unable to login unless https has been correctly setup.

To force Retool to send the auth cookies over HTTP, please set the COOKIE_INSECURE environment variable to 'true' in ./retool-container.yaml. Do this by adding the following two lines to the env section.

        - name: COOKIE_INSECURE
          value: 'true'

Then, to update the running deployment, run $ kubectl apply -f ./retool-container.yaml

Updating Retool on Kubernetes

To update Retool on Kubernetes, you can use the following command:

$ kubectl set image deploy/api api=tryretool/backend:X.XX.X

The list of available version numbers for X.XX.X are available here: https://updates.tryretool.com/

Deploying to Heroku

Just use the Deploy to Heroku button below!

Updating a Heroku deployment

To update a Heroku deployment that was created with the button above, you may first set up a git repo to push to Heroku

$ heroku login
$ git clone https://github.com/tryretool/retool-onpremise
$ cd retool-onpremise
$ heroku git:remote -a YOUR_HEROKU_APP_NAME

To update Retool (this will automatically fetch the latest version of Retool)

$ git commit --allow-empty -m 'Redeploying'
$ git push heroku master

Manually setting up Retool on Heroku

Alternatively, you may follow the following steps to deploy to Heroku

Install the Heroku CLI, and login. Documentation for this can be found here: https://devcenter.heroku.com/articles/getting-started-with-nodejs#set-up
Clone this repo git clone https://github.com/tryretool/retool-onpremise
Change the working directory to the newly cloned repository cd ./retool-onpremise
Create a new Heroku app with the stack set to container with heroku create your-app-name --stack=container
Add a free database: heroku addons:create heroku-postgresql:hobby-dev
In the Settings page of your Heroku app, add the following environment variables:
1. NODE_ENV - set to production
2. HEROKU_HOSTED set to true
3. JWT_SECRET - set to a long secure random string used to sign JSON Web Tokens
4. ENCRYPTION_KEY - a long secure random string used to encrypt database credentials
Push the code: git push heroku master

To lockdown the version of Retool used, just edit the first line under ./heroku/Dockerfile to:

FROM tryretool/backend:X.XX.X

Health check endpoint

Retool also has a health check endpoint that you can set up to monitor liveliness of Retool. You can configure your probe to make a GET request to /api/checkHealth.

Adding Google Login

Create a Google oauth client using the tutorial below:

https://developers.google.com/identity/sign-in/web/devconsole-project

The Oauth Client screen should end up looking something like this:

Add the following to your docker.env file

CLIENT_ID={YOUR_GOOGLE_CLIENT_ID}
CLIENT_SECRET={YOUR_GOOGLE_CLIENT_SECRET}
RESTRICTED_DOMAIN=yourcompany.com

Restart the server and you will have Google login for your org!

In Kubernetes, instead of editing the docker.env file, place the base64 encoded version of these strings inside the kubernetes secrets file

Integrating with SAML (e.g. Okta)

Retool also supports SAML authentication schemes. Below is a guide to integrating Retool with Okta.

Login into Okta as an admin. Make sure to use the Classic UI.
Navigate to the Applications section of Okta
Create a new application using the SAML wizard. More information can be found here: https://help.okta.com/en/prod/Content/Topics/Apps/Apps_App_Integration_Wizard.htm
When presented with the Create a New Appication Integration dialog, choose:
1. Platform: Web
2. Sign on method: SAML 2.0
You will then be directed to a 3 step wizard.
1. For the first step (General Settings) , name the application 'Retool', and then press next.
2. For the second step (Configure SAML):
  1. Single sign on URL: https://retool.yourcompany.com/saml/login
  2. Audience URI: retool.yourcompany.com
  3. Attribute Statements: Retool requires three attributes to be present:
    1. firstName: user.firstName
    2. lastName: user.lastName
    3. email: user.email
  4. Leave everything else as default. See below for an example of a valid configuration.
3. For the third step
  1. Check 'I'm an Okta customer adding an internal app"
  2. Check "This is an internal app that we have created"
  3. Click 'Finish'
The last step will be to provide the Retool instance with the Identity Provider metadata. To do this, press the 'View Setup Instructions' button. A new page with IDP metadata will appear. Copy the XML at the bottom of the page, and then:
1. If you are using the docker-compose setup, add the following line to your docker.env file. The XML content will contain multiple lines, so make sure to remove all line endings so that the entire XML string is one line in the docker.env file
```
SAML_IDP_METADATA=<?xml version="1.0" encoding="UTF-8"?>...</md:EntityDescriptor>
```
2. If you are using Heroku to deploy Retool, add a new environment variable called SAML_IDP_METADATA with the value of the XML document. No further steps are required.

Disabling password-based sign-in

To disable the use of email + password sign-in, define the RESTRICTED_DOMAIN environment variable. For example, using the docker.env file, use this:

RESTRICTED_DOMAIN=yourcompany.com

Note that, if you are using this in conjuction with Google login, Retool will compare the value supplied to RESTRICTED_DOMAIN with the domain of users that attempt to authenticate with Google SSO and reject accounts from different domains.

Troubleshooting:

On Kubernetes, I get the error SequelizeConnectionError: password authentication failed for user "..."
- Make sure that the secrets that you encoded in base64 don't have trailing whitespace! You can use kubectl exec printenv to help debug this issue.
I can't seem to login?
- If you have not enabled SSL yet, you will need to add the line COOKIE_INSECURE=true to your docker.env file / environment configuration so that the authentication cookies can be sent over http.

renderinc/retool-onpremise