adding base image for COmanage

docker · Nov 8, 2019 · 7f8ae0c · 7f8ae0c
1 parent 252a3c8
commit 7f8ae0c
Showing 8 changed files with 1,174 additions and 95 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -16,91 +16,96 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM centos:centos7 AS php-build
+FROM php:7.3.6-apache-stretch
 
-ARG PHP_VERSION=7.3.6
-ARG PHP_SRC_URL=https://github.com/php/php-src/archive/php-${PHP_VERSION}.tar.gz
+# Official PHP image with Apache HTTPD includes
+# --with-openssl
+# --with-mbstring
+# but xls, pdo, pdo_mysql, pdo_pgsql, mysqli, pgsql, 
+# and ldap extensions must be built.
+RUN apt-get update && apt-get install -y \
+         libldap-2.4-2 \
+         libldap2-dev \
+         libmariadbclient18 \
+         libmariadbclient-dev \
+         libpq-dev \
+         libxml2 \
+         libxslt1-dev \
+         libxslt1.1 \
+         ssl-cert \
+         wget \
+         zlib1g \
+         libpcre3-dev \
+      && docker-php-ext-configure pgsql -with-pgsql=/usr/local/pgsql \
+      && docker-php-ext-configure ldap --with-libdir=lib/x86_64-linux-gnu \
+      && docker-php-ext-configure mysqli \
+      && docker-php-ext-install xsl pdo pdo_mysql pdo_pgsql mysqli pgsql ldap \
+      && docker-php-source delete \
+      && apt-get purge -y \
+         libldap2-dev \
+         libmysqlclient-dev \
+         libpq-dev \
+      && apt-get clean
 
-RUN yum -y install epel-release \
-        && yum clean all
+ARG COMANAGE_REGISTRY_VERSION
+ENV COMANAGE_REGISTRY_VERSION ${COMANAGE_REGISTRY_VERSION:-develop}
+LABEL comanage_registry_version=${COMANAGE_REGISTRY_VERSION}
 
-RUN yum -y update \
-        && yum -y install \
-            autoconf \
-            bison \
-            gcc \
-            httpd-devel \
-            libargon2-devel \
-            libcurl-devel \
-            libedit-devel \
-            libsodium-devel \
-            libxml2-devel \
-            libxslt-devel \
-            make \
-            mariadb-devel \
-            openldap-devel \
-            openssl-devel \
-            postgresql-devel \
-            re2c \
-            wget \
-        && yum clean all
+ENV COMANAGE_REGISTRY_SRC_URL=https://github.com/Internet2/comanage-registry/archive/${COMANAGE_REGISTRY_VERSION}.tar.gz
 
-WORKDIR /usr/local/src
+ARG COMANAGE_REGISTRY_DIR
+ENV COMANAGE_REGISTRY_DIR ${COMANAGE_REGISTRY_DIR:-/srv/comanage-registry}
+LABEL comanage_registry_dir=${COMANAGE_REGISTRY_DIR}
 
-RUN mkdir php-src \
-        && wget -O php-src.tar.gz ${PHP_SRC_URL} \
-        && tar zxf php-src.tar.gz -C php-src --strip-components=1 \
-        && rm php-src.tar.gz
+WORKDIR $COMANAGE_REGISTRY_DIR
 
-ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
-ENV PHP_CPPFLAGS="$PHP_CFLAGS"
-ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+RUN mkdir -p ${COMANAGE_REGISTRY_DIR} \
+      && wget -O comanage.tar.gz ${COMANAGE_REGISTRY_SRC_URL} \
+      && tar -zxf comanage.tar.gz -C ${COMANAGE_REGISTRY_DIR} --strip-components=1 \
+      && rm -f comanage.tar.gz \
+      && rm -f ${COMANAGE_REGISTRY_DIR}/app/tmp \
+      && cp -r ${COMANAGE_REGISTRY_DIR}/app/tmp.dist ${COMANAGE_REGISTRY_DIR}/app/tmp \
+      && chown -R www-data:www-data ${COMANAGE_REGISTRY_DIR}/app/tmp \
+      && cd /var/www/html \
+      && ln -s ${COMANAGE_REGISTRY_DIR}/app/webroot registry \
+      && rm -rf ${COMANAGE_REGISTRY_DIR}/local/*
 
-RUN cd php-src \
-        && ./buildconf --force \
-        && ./configure \
-            --disable-cgi \
-            --enable-mbstring \
-            --enable-mysqlnd \
-            --with-apxs2=/usr/bin/apxs \
-            --with-config-file-path=/usr/local/etc/php \
-            --with-config-file-scan-dir=/usr/local/etc/php/conf.d \
-            --with-curl \
-            --with-ldap \
-            --with-libdir=lib64 \
-            --with-libedit \
-            --with-mysqli \
-            --with-openssl \
-            --with-password-argon2 \
-            --with-pdo-mysql \
-            --with-pdo-pgsql \
-            --with-pgsql \
-            --with-sodium \
-            --with-xsl \
-            --with-zlib \
-        && export CFLAGS="$PHP_CFLAGS" \
-        && export CPPFLAGS="$PHP_CPPFLAGS" \
-        && export LDFLAGS="$PHP_LDFLAGS" \
-        && make -j "$(nproc)" \
-        && make install 
+RUN a2enmod headers \
+      && a2enmod ssl \
+      && a2enmod rewrite \
+      && a2dissite 000-default.conf \
+      && a2disconf other-vhosts-access-log \
+      && cd /etc/apache2 \
+      && ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem cert.pem \
+      && ln -s /etc/ssl/private/ssl-cert-snakeoil.key privkey.pem
 
-RUN rm -rf php-src \
-    && yum -y remove \
-            autoconf \
-            bison \
-            gcc \
-            httpd-devel \
-            libargon2-devel \
-            libcurl-devel \
-            libedit-devel \
-            libsodium-devel \
-            libxml2-devel \
-            libxslt-devel \
-            make \
-            mariadb-devel \
-            openldap-devel \
-            openssl-devel \
-            postgresql-devel \
-            re2c \
-            wget \
-    && yum clean all
+COPY apache-include-directory-registry /etc/apache2/
+COPY apache-include-virtual-host-port443-base /etc/apache2/
+COPY apache-include-virtual-host-port80-redirect /etc/apache2/
+
+COPY comanage_utils.sh /usr/local/lib/
+COPY comanage_shibboleth_sp_utils.sh /usr/local/lib/
+COPY docker-comanage-entrypoint /usr/local/bin/
+
+VOLUME ${COMANAGE_REGISTRY_DIR}/local
+
+EXPOSE 80 443
+
+# Allow values for first administrator bootstrapped into the
+# platform to be specified at image build time, in addition to
+# being injected at run time through the entrypoint script.
+ARG COMANAGE_REGISTRY_ADMIN_GIVEN_NAME
+ARG COMANAGE_REGISTRY_ADMIN_FAMILY_NAME
+ARG COMANAGE_REGISTRY_ADMIN_USERNAME
+ARG COMANAGE_REGISTRY_ENABLE_POOLING
+
+# Set simple defaults for first administrator bootstrapped into the
+# platform to make simple evaluation of the platform easier.
+ENV COMANAGE_REGISTRY_ADMIN_GIVEN_NAME ${COMANAGE_REGISTRY_ADMIN_GIVEN_NAME:-Registry}
+ENV COMANAGE_REGISTRY_ADMIN_FAMILY_NAME ${COMANAGE_REGISTRY_ADMIN_FAMILY_NAME:-Admin}
+ENV COMANAGE_REGISTRY_ADMIN_USERNAME ${COMANAGE_REGISTRY_ADMIN_USERNAME:-registry.admin}
+ENV COMANAGE_REGISTRY_ENABLE_POOLING ${COMANAGE_REGISTRY_ENABLE_POOLING:-No}
+
+ENTRYPOINT ["docker-comanage-entrypoint"]
+
+CMD ["apache2-foreground"]
diff --git a/README.md b/README.md
@@ -19,40 +19,44 @@ See the License for the specific language governing permissions and
 limitations under the License.
 -->
 
-# COmanage Registry Internet2 TIER Base Image
+# COmanage Registry Base Image
 
-Intended to build a COmanage Registry for Internet2 TIER base image
-using CentOS 7 as the operating system and building PHP from source.
+Intended to build a COmanage Registry base image
+using the official PHP with Apache image as the foundation.
 
-By itself the image built from this Dockerfile does **not** provide
-COmanage Registry.
+By itself the image built from this Dockerfile does **not** provide any
+method for authentication and is not suitable for deployment. 
 
 The image built from this Dockerfile is used as the base
-for the Internet2 TIER image that includes COmanage Registry
-with the Shibboleth Native SP for Apache HTTP Server (Shibboleth)
-as the authentication mechanism.
+for images that include an authentication mechanism.
+See other documentation in this
+repository for examples on how to build images on this
+one that include authentication methods like Basic Auth,
+Shibboleth SP, and mod\_auth\_openidc.
 
 ## Build Arguments
 
-No arguments are required for the build but the following argument
-may be provided to override the default:
+Building the image requires the following build argument:
 
 ```
---build-arg PHP_VERSION=<PHP version number>
+--build-arg COMANAGE_REGISTRY_VERSION=<COmanage Registry version number>
 ```
 
 ## Building
 
 ```
 docker build \
-    -t comanage-registry-internet2-tier-base:<tag> .
+    --build-arg COMANAGE_REGISTRY_VERSION=<COmanage Registry version number> \
+    -t comanage-registry-base:<tag> .
 ```
 
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=1
-TAG="${COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION}"
+export COMANAGE_REGISTRY_VERSION=3.2.1
+export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
+TAG="${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}"
 docker build \
-    -t comanage-registry-internet2-tier-base:${TAG} .
+  --build-arg COMANAGE_REGISTRY_VERSION=${COMANAGE_REGISTRY_VERSION} \
+  -t comanage-registry-base:${TAG} .
 ```
diff --git a/apache-include-directory-registry b/apache-include-directory-registry
@@ -0,0 +1,6 @@
+<Directory /var/www/html/registry>
+Options Indexes FollowSymLinks
+DirectoryIndex index.php
+AllowOverride All
+Require all granted
+</Directory>
diff --git a/apache-include-virtual-host-port443-base b/apache-include-virtual-host-port443-base
@@ -0,0 +1,14 @@
+ServerName https://${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}:443
+
+DocumentRoot /var/www/html
+
+RedirectMatch ^/$ /registry/
+
+LogLevel warn
+
+Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+
+SSLEngine on
+SSLProtocol all -SSLv2 -SSLv3
+SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
+SSLHonorCipherOrder on
diff --git a/apache-include-virtual-host-port80-redirect b/apache-include-virtual-host-port80-redirect
@@ -0,0 +1,6 @@
+<VirtualHost *:80>
+ServerName http://${COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN}:80
+RewriteEngine On
+RewriteCond %{HTTPS} off
+RewriteRule ^ https://%{HTTP_HOST}:443%{REQUEST_URI} [R=302,L,QSA]
+</VirtualHost>