README.md

<!--
COmanage Docker documentation

Portions licensed to the University Corporation for Advanced Internet
Development, Inc. ("UCAID") under one or more contributor license agreements.
See the NOTICE file distributed with this work for additional information
regarding copyright ownership.

UCAID licenses this file to you under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with the
License. You may obtain a copy of the License at:

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

# COmanage Match Internet2 TAP

Intended to build a COmanage Match image using the Shibboleth Native SP
for Apache HTTP Server (Shibboleth) as the authentication mechanism and that
meets the 
[TAP Docker Container Specification](https://spaces.at.internet2.edu/x/m4ZyBw)
(previously the TIER specification)
from the
[Internet2 TAP](https://www.incommon.org/tap/)
program.

## Build Arguments

Building the image requires the following build arguments:

```
--build-arg COMANAGE_MATCH_VERSION=<version number>
--build-arg COMANAGE_MATCH_BASE_IMAGE_VERSION=<base image version number>
--build-arg COMANAGE_MATCH_I2_BASE_IMAGE_VERSION=<I2 base image version number>
```

## Build Requirements

This image uses a [multi-stage build](https://docs.docker.com/develop/develop-images/multistage-build/).
It requires that the [COmanage Match base image](../comanage-match-base/README.md) 
and [Internet2 TAP base image](../comanage-match-internet2-tap-base/README.md) be built first.

## Building

```
docker build \
  --build-arg COMANAGE_MATCH_VERSION=<COmanage Match version number> \
  --build-arg COMANAGE_MATCH_BASE_IMAGE_VERSION=<base image version number> \
  --build-arg COMANAGE_MATCH_I2_BASE_IMAGE_VERSION=<base image version number> \
  -t comanage-match:<tag> .
```

## Building Example

```
export COMANAGE_MATCH_VERSION=1.2.1
export COMANAGE_MATCH_BASE_IMAGE_VERSION=1
export COMANAGE_MATCH_I2_BASE_IMAGE_VERSION=1
export COMANAGE_MATCH_I2_IMAGE_VERSION=1
TAG="${COMANAGE_MATCH_VERSION}-internet2-tap-${COMANAGE_MATCH_I2_IMAGE_VERSION}"
docker build \
  --build-arg COMANAGE_MATCH_VERSION=${COMANAGE_MATCH_VERSION} \
  --build-arg COMANAGE_MATCH_BASE_IMAGE_VERSION=${COMANAGE_MATCH_BASE_IMAGE_VERSION} \
  --build-arg COMANAGE_MATCH_I2_BASE_IMAGE_VERSION=${COMANAGE_MATCH_I2_BASE_IMAGE_VERSION} \
  -t comanage-match:$TAG .
```

## Volumes and Data Persistence

See [COmanage Match Volumes and Data Persistence](../docs/volumes-and-data-persistence.md).


## Environment Variables

See the [list of environment variables common to all images](../docs/comanage-match-common-environment-variables.md)
including this image.

See also the
[list of environment variables common to all images using Shibboleth](../../docs/comanage-common-shibboleth-environment-variables.md).

Additionally the Internet2 TAP image supports the following environment variables:

`ENV`

* Description: Environment
* Required: No
* Default: None
* Example: PROD
* Note: Usually one of PROD, TEST, or DEV. The value is included in log entries.

`USERTOKEN`

* Description: Deployer supplied
* Required: No
* Default: None
* Example: node01
* Note: The value is included in log entries.

## Authentication

This image supports using the Shibboleth Native SP for Apache HTTP Server (Shibboleth) as the
authentication mechanism. Deployers should configure Shibboleth so that the desired
asserted user attribute is written into `REMOTE_USER`.

## Ports

The image listens for web traffic on ports 80 and 443. All requests
on port 80 are redirected to port 443.

## Running

See other documentation in this repository for details on how to orchestrate
running this image with other images using an orchestration tool like
Docker Compose, Docker Swarm, or Kubernetes.

To run this image:

```
docker run -d \
  --name comanage-match \
  -e COMANAGE_MATCH_ADMIN_USERNAME=julia.janseen@my.org \
  -e SHIBBOLETH_SP_ENTITY_ID=https://myapp.my.org/shibboleth/sp \
  -e SHIBBOLETH_SP_METADATA_PROVIDER_XML_FILE=/etc/shibboleth/my-org-metadata.xml \
  -v /opt/comanage-match-local:/srv/comanage-match/local \
  -v /etc/shibboleth/sp-encrypt-cert.pem:/etc/shibboleth/sp-encrypt-cert.pem \
  -v /etc/shibboleth/sp-encrypt-key.pem:/etc/shibboleth/sp-encrypt-key.pem \
  -v /etc/shibboleth/my-org-metadata.xml:/etc/shibboleth/my-org-metadata.xml \
  -p 80:80 \
  -p 443:443 \
  comanage-match:1.2.1-internet2-tap-1
```

## Logging

Apache HTTP Server, COmanage Match, Shibboleth, and supervisord all log to the stdout and
stderr of the container.

The logging configuration meets version 1 of the
[TAP Docker Container Specification](https://spaces.at.internet2.edu/x/m4ZyBw)
(formerly the TIER Docker Container Specification).

## HTTPS Configuration

See the section on environment variables and the `HTTPS_CERT_FILE` and
`HTTPS_PRIVKEY_FILE` variables.

Additionally you may bind mount or COPY in an X.509 certificate file (containing the CA signing certificate(s), if any)
and associated private key file. For example

```
COPY cert.pem /etc/httpd/cert.pem
COPY privkey.pem /etc/httpd/privkey.pem
```