diff --git a/comanage-registry-mailman/README.md b/comanage-registry-mailman/README.md
index bdaba4f..2b4e1fd 100644
--- a/comanage-registry-mailman/README.md
+++ b/comanage-registry-mailman/README.md
@@ -37,7 +37,7 @@ deployment. The suite of services include:
1. **postfix**: MTA needed for sending and receiving mail.
-1. **nginx**: Web proxy for GNU Mailman 3 REST and web interface.
+1. **apache**: Apache HTTP Server with Shibboleth SP as a web proxy for GNU Mailman 3 REST and web interface.
## How To
@@ -59,15 +59,15 @@ cd comanage-registry-docker
```
pushd comanage-registry-mailman/core
-docker build -t sphericalcowgroup/mailman-core:0.1.7 .
+docker build -t sphericalcowgroup/mailman-core:0.2.1 .
popd
pushd comanage-registry-mailman/web
-docker build -t sphericalcowgroup/mailman-web:0.1.7 .
+docker build -t sphericalcowgroup/mailman-web:0.2.1 .
popd
-pushd comanage-registry-mailman/nginx
-docker build -t sphericalcowgroup/mailman-core-nginx .
+pushd comanage-registry-mailman/apache-shib
+docker build -t sphericalcowgroup/mailman-core-apache-shib .
popd
pushd comanage-registry-mailman/postfix
@@ -87,17 +87,11 @@ to substitute your own secrets and do not use the examples below):
* A password for the GNU Mailman 3 REST user, eg. `K6gfcC9uHQMXr448Kmdi`.
- * An X.509 certificate for HTTPS for Nginx. The server certificate and any subordinate
+ * An X.509 certificate for HTTPS for Apache HTTP Server (Apache). The server certificate and any subordinate
CA signing certificates (except for the trust root) should be in a single file, eg. `fullchain.pem`.
* The associated private key for the X.509 HTTPS certificate, eg. `privkey.pem`.
- * A DH parameters file for Nginx. You can generate one by doing
-
-```
-openssl dhparam -out dhparam.pem 2048
-```
-
* Create the directory structure on the Docker engine hosts needed for the services
to save local state, eg.
@@ -105,7 +99,7 @@ to save local state, eg.
mkdir -p /opt/mailman/core
mkdir -p /opt/mailman/web
mkdir -p /opt/mailman/database
-mkdir -p /opt/mailman/nginx
+mkdir -p /opt/mailman/shib
```
* If you are using Docker Compose to deploy the service stack copy the file
@@ -141,9 +135,8 @@ echo "HbTKLdrhRxUX96f5bD2g" | docker secret create hyperkitty_api_key -
echo "K6gfcC9uHQMXr448Kmdi" | docker secret create mailman_rest_password -
echo "fPe7d9e0PKF8ryySOow0" | docker secret create mailman_web_secret_key -
echo "gECPnaqXVID80TlRS5ZG" | docker secret create postgres_password -
-docker secret create nginx_https_cert_file fullchain.pem
-docker secret create nginx_https_key_file privkey.pem
-docker secret create nginx_dh_param_file dhparam.pem
+docker secret create https_cert_file fullchain.pem
+docker secret create https_key_file privkey.pem
```
Additionally you MUST also make at least the following changes to the stack compose file `mailman-stack.yml`:
@@ -165,47 +158,40 @@ docker stack deploy --compose-file mailman-stack.yml mailman
```
* It can take as long as 30 seconds for the GNU Mailman 3 core service to be ready. The other
-services wait until detecting that core is ready. Monitor the `nginx` service with
+services wait until detecting that core is ready. Monitor the `apache` service with
```
-docker-compose logs -f --tail=100 nginx
+docker-compose logs -f --tail=100 apache
```
or
```
-docker service logs --tail=100 -f mailman_nginx
+docker service logs --tail=100 -f mailman_apache
```
-until Nginx is ready. You should see something like
+until Apache is ready. You should see something like
```
-mailman-nginx | Waiting for Mailman core container...
-mailman-nginx | Waiting for Mailman core container...
-mailman-nginx | Waiting for Mailman core container...
-mailman-nginx | Waiting for Mailman core container...
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: using the "epoll" event method
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: nginx/1.10.3
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: OS: Linux 4.9.0-6-amd64
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: start worker processes
-mailman-nginx | 2018/04/23 18:07:27 [notice] 1#1: start worker process 48
+2019-04-03 12:27:55,389 CRIT Set uid to user 0
+2019-04-03 12:27:55,391 INFO supervisord started with pid 1
+2019-04-03 12:27:56,394 INFO spawned: 'shibd' with pid 8
+2019-04-03 12:27:56,399 INFO spawned: 'apache2' with pid 9
+Waiting for Mailman core container...
+2019-04-03 12:27:57,491 INFO success: shibd entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
+2019-04-03 12:27:57,492 INFO success: apache2 entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
+Waiting for Mailman core container...
+Waiting for Mailman core container...
+Waiting for Mailman core container...
+Waiting for Mailman web container...
+Waiting for Mailman web container...
+Waiting for Mailman web container...
+[Wed Apr 03 13:48:41.263252 2019] [mpm_event:notice] [pid 9:tid 140569797922880] AH00489: Apache/2.4.38 (Unix) OpenSSL/1.1.0j configured -- resuming normal operations
+[Wed Apr 03 13:48:41.284857 2019] [core:notice] [pid 9:tid 140569797922880] AH00094: Command line: 'httpd -D FOREGROUND'
```
-* Browse to port 443 on the host.
-
-* Click `Login` and then `Forgot Password?`. Enter the email address you injected as the first
-Mailman 3 administrator and then click `Reset My Password`.
-
-* You will receive an email at that administrator password with a link. Follow the link to reset
-the administrator password.
-
-* Browse again to port 443 on the host and click `Login`. Enter the administrator name you injected
-and the password you just set. Click `Sign In`. You will be sent another email with a link in it to verify the account.
-Follow the link to verify the account.
-
-* Browse again to port 443 on the host and click `Login`. Enter the administrator name and password
-you just verified. Click `Sign In`.
+* Browse to port 443 on the host and authenticate using an identity provider (IdP) federated
+with the Shibboleth SP.
* Visit the [COmanage wiki](https://spaces.internet2.edu/display/COmanage/Mailman+Provisioning+Plugin)
to learn how to enable and configure the Mailman Provisioning Plugin for COmanage Registry.
@@ -237,7 +223,7 @@ docker-compose logs mailman-web
docker-compose logs postfix
-docker-compose logs nginx
+docker-compose logs apache
docker-compose logs -f --tail=100 mailman-core
@@ -247,7 +233,7 @@ docker-compose logs -f --tail=100 mailman-web
docker-compose logs -f --tail=100 postfix
-docker-compose logs -f --tail=100 nginx
+docker-compose logs -f --tail=100 apache
docker-compose down
```
@@ -267,7 +253,7 @@ docker service logs mailman_mailman-core
docker service logs mailman_mailman-web
-docker service logs mailman_nginx
+docker service logs mailman_apache
docker service logs mailman_database
@@ -277,7 +263,7 @@ docker service logs --tail=100 -f mailman_mailman-core
docker service logs --tail=100 -f mailman_mailman-web
-docker service logs --tail=100 -f mailman_nginx
+docker service logs --tail=100 -f mailman_apache
docker service logs --tail=100 -f mailman_postfix
diff --git a/comanage-registry-mailman/apache-shib/Dockerfile b/comanage-registry-mailman/apache-shib/Dockerfile
new file mode 100644
index 0000000..56b9bb8
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/Dockerfile
@@ -0,0 +1,66 @@
+# COmanage Registry Dockerfile
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+ARG COMANAGE_REGISTRY_VERSION=develop
+ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION="3.0.4"
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION=1
+
+FROM comanage-registry-shibboleth-sp-base:${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}-${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION} AS shib-base
+
+FROM comanage-registry-base:${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION} AS comanage-registry-base
+
+FROM httpd:2.4
+
+RUN apt-get update && apt-get install -y \
+ curl \
+ libssl1.0.2 \
+ netcat-traditional \
+ procps \
+ supervisor \
+ && apt-get clean \
+ && mkdir -p /var/log/supervisor
+
+COPY --from=shib-base /opt/shibboleth-sp /opt/shibboleth-sp/
+
+RUN /usr/sbin/useradd --system _shibd \
+ && mkdir -p /var/run/shibboleth \
+ && chown _shibd:_shibd /var/run/shibboleth \
+ && chown -R _shibd:_shibd /opt/shibboleth-sp/var \
+ && cp -a /opt/shibboleth-sp/etc/shibboleth /etc/shibboleth \
+ && rm -f /etc/shibboleth/shibboleth2.xml \
+ && chown _shibd:_shibd /etc/shibboleth/sp-signing-cert.pem \
+ && chown _shibd:_shibd /etc/shibboleth/sp-signing-key.pem \
+ && chown _shibd:_shibd /etc/shibboleth/sp-encrypt-cert.pem \
+ && chown _shibd:_shibd /etc/shibboleth/sp-encrypt-key.pem \
+ && cd /opt/shibboleth-sp/etc \
+ && rm -rf shibboleth \
+ && ln -s /etc/shibboleth shibboleth
+
+COPY --chown=_shibd:_shibd shibd.logger /etc/shibboleth/shibd.logger
+COPY --chown=_shibd:_shibd native.logger /etc/shibboleth/native.logger
+
+COPY --from=comanage-registry-base /usr/local/lib/comanage_shibboleth_sp_utils.sh /usr/local/lib/comanage_shibboleth_sp_utils.sh
+
+COPY supervisord.conf /usr/local/etc/supervisord.conf
+
+COPY httpd.conf /usr/local/apache2/conf/
+COPY start.sh /usr/local/bin/apache-httpd-start.sh
+COPY shibd-start.sh /usr/local/bin/shibd-start.sh
+
+ENTRYPOINT ["/usr/bin/supervisord", "-c", "/usr/local/etc/supervisord.conf"]
diff --git a/comanage-registry-mailman/apache-shib/httpd.conf b/comanage-registry-mailman/apache-shib/httpd.conf
new file mode 100644
index 0000000..c33363d
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/httpd.conf
@@ -0,0 +1,184 @@
+ServerRoot "/usr/local/apache2"
+
+Listen 80
+
+LoadModule mpm_event_module modules/mod_mpm_event.so
+LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_core_module modules/mod_authn_core.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_user_module modules/mod_authz_user.so
+LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule auth_basic_module modules/mod_auth_basic.so
+LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+LoadModule reqtimeout_module modules/mod_reqtimeout.so
+LoadModule filter_module modules/mod_filter.so
+LoadModule substitute_module modules/mod_substitute.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule env_module modules/mod_env.so
+LoadModule headers_module modules/mod_headers.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule unixd_module modules/mod_unixd.so
+LoadModule status_module modules/mod_status.so
+LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule dir_module modules/mod_dir.so
+LoadModule alias_module modules/mod_alias.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule mod_shib /opt/shibboleth-sp/lib/shibboleth/mod_shib_24.so
+
+
+User daemon
+Group daemon
+
+
+ServerAdmin you@example.com
+
+ServerName http://${VIRTUAL_HOST_FQDN}:80
+
+
+ AllowOverride none
+ Require all denied
+
+
+DocumentRoot "/usr/local/apache2/htdocs"
+
+
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+
+
+
+ DirectoryIndex index.html
+
+
+
+ Require all denied
+
+
+ErrorLog /proc/self/fd/2
+
+LogLevel warn
+
+
+ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+ LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+
+ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+
+
+ CustomLog /proc/self/fd/1 common
+
+
+
+
+
+ TypesConfig conf/mime.types
+
+ AddType application/x-compress .Z
+ AddType application/x-gzip .gz .tgz
+
+
+
+ServerName http://${VIRTUAL_HOST_FQDN}:80
+UseCanonicalName On
+
+RewriteEngine On
+RewriteCond %{HTTPS} off
+RewriteRule ^ https://%{HTTP_HOST}:443%{REQUEST_URI} [R=302,L,QSA]
+
+
+Listen 443
+
+SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
+SSLHonorCipherOrder on
+SSLProtocol all -SSLv3
+SSLPassPhraseDialog builtin
+SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
+SSLSessionCacheTimeout 300
+
+
+
+DocumentRoot "/usr/local/apache2/htdocs"
+
+ServerName https://${VIRTUAL_HOST_FQDN}:443
+
+ServerAdmin you@example.com
+
+ErrorLog /proc/self/fd/2
+TransferLog /proc/self/fd/1
+
+SSLEngine on
+SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+
+BrowserMatch "MSIE [2-5]" \
+ nokeepalive ssl-unclean-shutdown \
+ downgrade-1.0 force-response-1.0
+
+CustomLog /proc/self/fd/1 \
+ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+
+RedirectMatch "^/$" "https://${VIRTUAL_HOST_FQDN}/postorius/lists/"
+
+Alias "/static/" "/opt/mailman-web-data/static/"
+
+Require all granted
+
+
+
+SetHandler shib
+
+
+
+ProxyPass http://mailman-core:8001/
+ProxyPassReverse http://mailman-core:8001/
+
+RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+RequestHeader set "Host" expr=%{HTTP_HOST}
+
+AddOutputFilterByType SUBSTITUTE application/json
+Substitute "s|\"self_link\": \"http://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:8001|\"self_link\": \"https://${VIRTUAL_HOST_FQDN}/api|"
+
+
+
+AuthType Shibboleth
+ShibRequestSetting requireSession 1
+ShibUseHeaders On
+Require shib-attr mail ${MAILMAN_ADMIN_EMAIL}
+
+ProxyPass http://mailman-web:8000/postorius/
+ProxyPassReverse http://mailman-web:8000/postorius/
+
+RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+RequestHeader set "Host" expr=%{HTTP_HOST}
+
+
+
+
+AuthType Shibboleth
+ShibRequestSetting requireSession 1
+ShibUseHeaders On
+Require shib-session
+
+ProxyPass http://mailman-web:8000/hyperkitty/
+ProxyPassReverse http://mailman-web:8000/hyperkitty/
+
+RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+RequestHeader set "Host" expr=%{HTTP_HOST}
+
+
+
+
+
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+
+
diff --git a/comanage-registry-mailman/apache-shib/native.logger b/comanage-registry-mailman/apache-shib/native.logger
new file mode 100644
index 0000000..f8300c8
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/native.logger
@@ -0,0 +1,32 @@
+# set overall behavior
+log4j.rootCategory=INFO, native_log
+
+# fairly verbose for DEBUG, so generally leave at WARN/INFO
+log4j.category.XMLTooling.XMLObject=WARN
+log4j.category.XMLTooling.KeyInfoResolver=WARN
+log4j.category.Shibboleth.IPRange=WARN
+log4j.category.Shibboleth.PropertySet=WARN
+
+# raise for low-level tracing of SOAP client HTTP/SSL behavior
+log4j.category.XMLTooling.libcurl=WARN
+
+# useful categories to tune independently:
+#
+# tracing of SAML messages and security policies
+#log4j.category.OpenSAML.MessageDecoder=DEBUG
+#log4j.category.OpenSAML.MessageEncoder=DEBUG
+#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
+# interprocess message remoting
+#log4j.category.Shibboleth.Listener=DEBUG
+# mapping of requests to applicationId
+#log4j.category.Shibboleth.RequestMapper=DEBUG
+# high level session cache operations
+#log4j.category.Shibboleth.SessionCache=DEBUG
+# persistent storage and caching
+#log4j.category.XMLTooling.StorageService=DEBUG
+
+# define the appender
+
+log4j.appender.native_log=org.apache.log4j.ConsoleAppender
+log4j.appender.native_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.native_log.layout.ConversionPattern=native_log %p %c %x: %m%n
diff --git a/comanage-registry-mailman/apache-shib/shibd-start.sh b/comanage-registry-mailman/apache-shib/shibd-start.sh
new file mode 100755
index 0000000..28dc7b6
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/shibd-start.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# COmanage Registry Shibboleth SP Dockerfile entrypoint
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+source /usr/local/lib/comanage_shibboleth_sp_utils.sh
+
+comanage_shibboleth_sp_utils::exec_shibboleth_sp_daemon
diff --git a/comanage-registry-mailman/apache-shib/shibd.logger b/comanage-registry-mailman/apache-shib/shibd.logger
new file mode 100644
index 0000000..5fd332b
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/shibd.logger
@@ -0,0 +1,57 @@
+# set overall behavior
+log4j.rootCategory=INFO, shibd_log
+
+# fairly verbose for DEBUG, so generally leave at INFO
+log4j.category.XMLTooling.XMLObject=INFO
+log4j.category.XMLTooling.KeyInfoResolver=INFO
+log4j.category.Shibboleth.IPRange=INFO
+log4j.category.Shibboleth.PropertySet=INFO
+
+# raise for low-level tracing of SOAP client HTTP/SSL behavior
+log4j.category.XMLTooling.libcurl=INFO
+
+# useful categories to tune independently:
+#
+# tracing of SAML messages and security policies
+#log4j.category.OpenSAML.MessageDecoder=DEBUG
+#log4j.category.OpenSAML.MessageEncoder=DEBUG
+#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
+#log4j.category.XMLTooling.SOAPClient=DEBUG
+# interprocess message remoting
+#log4j.category.Shibboleth.Listener=DEBUG
+# mapping of requests to applicationId
+#log4j.category.Shibboleth.RequestMapper=DEBUG
+# high level session cache operations
+#log4j.category.Shibboleth.SessionCache=DEBUG
+# persistent storage and caching
+#log4j.category.XMLTooling.StorageService=DEBUG
+
+# logs XML being signed or verified if set to DEBUG
+log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log
+log4j.additivity.XMLTooling.Signature.Debugger=false
+log4j.ownAppenders.XMLTooling.Signature.Debugger=true
+
+# the tran log blocks the "default" appender(s) at runtime
+# Level should be left at INFO for this category
+log4j.category.Shibboleth-TRANSACTION=INFO, tran_log
+log4j.additivity.Shibboleth-TRANSACTION=false
+log4j.ownAppenders.Shibboleth-TRANSACTION=true
+
+# uncomment to suppress particular event types
+#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN
+#log4j.category.Shibboleth-TRANSACTION.Login=WARN
+#log4j.category.Shibboleth-TRANSACTION.Logout=WARN
+
+# define the appenders
+
+log4j.appender.shibd_log=org.apache.log4j.ConsoleAppender
+log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.shibd_log.layout.ConversionPattern=shibd_log %d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n
+
+log4j.appender.tran_log=org.apache.log4j.ConsoleAppender
+log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.tran_log.layout.ConversionPattern=tran_log %d{%Y-%m-%d %H:%M:%S}|%c|%m%n
+
+log4j.appender.sig_log=org.apache.log4j.ConsoleAppender
+log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.sig_log.layout.ConversionPattern=sig_log %m
diff --git a/comanage-registry-mailman/apache-shib/start.sh b/comanage-registry-mailman/apache-shib/start.sh
new file mode 100755
index 0000000..b03b276
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/start.sh
@@ -0,0 +1,73 @@
+#! /bin/bash
+
+# Nginx for GNU Mailman 3 Core for COmanage Registry Dockerfile entrypoint
+#
+# Portions licensed to the University Corporation for Advanced Internet
+# Development, Inc. ("UCAID") under one or more contributor license agreements.
+# See the NOTICE file distributed with this work for additional information
+# regarding copyright ownership.
+#
+# UCAID licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Configuration details that may be injected through environment
+# variables or the contents of files.
+
+injectable_config_vars=(
+ MAILMAN_CORE_HOST
+ MAILMAN_CORE_PORT
+ MAILMAN_WEB_HOST
+ MAILMAN_WEB_PORT
+)
+
+# Default values.
+MAILMAN_CORE_HOST="mailman-core"
+MAILMAN_CORE_PORT="8001"
+MAILMAN_WEB_HOST="mailman-web"
+MAILMAN_WEB_PORT="8000"
+
+# If the file associated with a configuration variable is present then
+# read the value from it into the appropriate variable.
+
+for config_var in "${injectable_config_vars[@]}"
+do
+ eval file_name=\$"${config_var}_FILE";
+
+ if [ -e "$file_name" ]; then
+ declare "${config_var}"=`cat $file_name`
+ fi
+done
+
+# Copy HTTPS certificate and key into place.
+if [ -n "${HTTPS_CERT_FILE}" ] && [ -n "${HTTPS_KEY_FILE}" ]; then
+ cp "${HTTPS_CERT_FILE}" /usr/local/apache2/conf/server.crt
+ cp "${HTTPS_KEY_FILE}" /usr/local/apache2/conf/server.key
+ chmod 644 /usr/local/apache2/conf/server.crt
+ chmod 600 /usr/local/apache2/conf/server.key
+fi
+
+# Wait for the mailman core container to be ready.
+until nc -z -w 1 "${MAILMAN_CORE_HOST}" "${MAILMAN_CORE_PORT}"
+do
+ echo "Waiting for Mailman core container..."
+ sleep 1
+done
+
+# Wait for the mailman web container to be ready.
+until nc -z -w 1 "${MAILMAN_WEB_HOST}" "${MAILMAN_WEB_PORT}"
+do
+ echo "Waiting for Mailman web container..."
+ sleep 1
+done
+
+# Start Apache HTTP Server
+exec "$@"
diff --git a/comanage-registry-mailman/apache-shib/supervisord.conf b/comanage-registry-mailman/apache-shib/supervisord.conf
new file mode 100644
index 0000000..c373a01
--- /dev/null
+++ b/comanage-registry-mailman/apache-shib/supervisord.conf
@@ -0,0 +1,36 @@
+; COmanage Registry Docker supervisord configuration
+;
+; Portions licensed to the University Corporation for Advanced Internet
+; Development, Inc. ("UCAID") under one or more contributor license agreements.
+; See the NOTICE file distributed with this work for additional information
+; regarding copyright ownership.
+;
+; UCAID licenses this file to you under the Apache License, Version 2.0
+; (the "License"); you may not use this file except in compliance with the
+; License. You may obtain a copy of the License at:
+;
+; http://www.apache.org/licenses/LICENSE-2.0
+;
+; Unless required by applicable law or agreed to in writing, software
+; distributed under the License is distributed on an "AS IS" BASIS,
+; WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+; See the License for the specific language governing permissions and
+; limitations under the License.
+
+[supervisord]
+nodaemon=true
+user=root
+
+[program:apache2]
+command=/usr/local/bin/apache-httpd-start.sh httpd-foreground
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:shibd]
+command=/usr/local/bin/shibd-start.sh
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
diff --git a/comanage-registry-mailman/mailman-stack.yml b/comanage-registry-mailman/mailman-stack.yml
index afe7e7e..da8d801 100644
--- a/comanage-registry-mailman/mailman-stack.yml
+++ b/comanage-registry-mailman/mailman-stack.yml
@@ -1,30 +1,16 @@
-# Docker Swarm stack compose file for Mailman 3 for COmanage Registry
-#
-# Portions licensed to the University Corporation for Advanced Internet
-# Development, Inc. ("UCAID") under one or more contributor license agreements.
-# See the NOTICE file distributed with this work for additional information
-# regarding copyright ownership.
-#
-# UCAID licenses this file to you under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with the
-# License. You may obtain a copy of the License at:
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# This is an example compose file. Be sure to modify it as necessary
-# for your own deployment.
+version: '3.3'
-version: '3.2'
+networks:
+ default:
+ driver: overlay
+ ipam:
+ driver: default
+ config:
+ - subnet: 10.1.0.0/24
services:
mailman-core:
- image: sphericalcowgroup/mailman-core:0.1.7
+ image: sphericalcowgroup/mailman-core:0.2.1
volumes:
- /srv/docker/mailman/core:/opt/mailman/
environment:
@@ -43,18 +29,21 @@ services:
- hyperkitty_api_key
- mailman_database_url
- mailman_rest_password
+ deploy:
+ endpoint_mode: dnsrr
mailman-web:
- image: sphericalcowgroup/mailman-web:0.1.7
+ image: sphericalcowgroup/mailman-web:0.2.1
volumes:
- /srv/docker/mailman/web:/opt/mailman-web-data
+ - /srv/docker/mailman/settings.py:/opt/mailman-web/settings.py
environment:
- MAILMAN_DATABASE_URL_FILE=/run/secrets/mailman_database_url
- MAILMAN_DATABASE_TYPE=postgres
- HYPERKITTY_API_KEY_FILE=/run/secrets/hyperkitty_api_key
- - SERVE_FROM_DOMAIN=lists-dev.sphericalcowgroup.com
- - MAILMAN_ADMIN_USER=mailman_admin
- - MAILMAN_ADMIN_EMAIL=admin@local
+ - SERVE_FROM_DOMAIN=
+ - MAILMAN_ADMIN_USER=
+ - MAILMAN_ADMIN_EMAIL=
- MAILMAN_WEB_SECRET_KEY_FILE=/run/secrets/mailman_web_secret_key
- MAILMAN_REST_USER=restadmin
- MAILMAN_REST_PASSWORD_FILE=/run/secrets/mailman_rest_password
@@ -67,6 +56,8 @@ services:
- mailman_database_url
- mailman_rest_password
- mailman_web_secret_key
+ deploy:
+ endpoint_mode: dnsrr
database:
image: postgres:9.6
@@ -80,30 +71,49 @@ services:
- default
secrets:
- postgres_password
+ deploy:
+ endpoint_mode: dnsrr
postfix:
- image: sphericalcowgroup/mailman-postfix
+ image: sphericalcowgroup/mailman-postfix:2
volumes:
- /srv/docker/mailman:/opt/mailman
environment:
- - POSTFIX_MAILNAME=lists-dev.sphericalcowgroup.com
+ - POSTFIX_MYHOSTNAME=lists-dev.sphericalcowgroup.com
+ - POSTFIX_MYNETWORKS=!10.255.0.0/16 10.1.0.0/24
ports:
- - "25:25"
+ - target: 25
+ published: 25
+ # 'host' mode is necessary for Postfix to receive the connection IP address
+ # instead of the ingress network IP address. This is only a useful workaround
+ # when not truly leveraging the load balancing capabilities of swarm mode.
+ # Normally with more than a single mode swarm the upstream load balancer in
+ # front of the swarm would be used for the definitive access log.
+ # See discussion at https://github.com/moby/moby/issues/25526 .
+ mode: host
networks:
- default
+ deploy:
+ endpoint_mode: dnsrr
- nginx:
- image: sphericalcowgroup/mailman-core-nginx
+ apache:
+ image: sphericalcowgroup/mailman-core-apache-shib:1
volumes:
- /srv/docker/mailman/web:/opt/mailman-web-data
+ - /srv/docker/mailman/shib/etc/shibboleth2.xml:/etc/shibboleth/shibboleth2.xml
+ - /srv/docker/mailman/shib/etc/attribute-map.xml:/etc/shibboleth/attribute-map.xml
environment:
- - NGINX_HTTPS_CERT_FILE=/run/secrets/nginx_https_cert_file
- - NGINX_HTTPS_KEY_FILE=/run/secrets/nginx_https_key_file
- - NGINX_DH_PARAM_FILE=/run/secrets/nginx_dh_param_file
+ - HTTPS_CERT_FILE=/run/secrets/https_cert_file
+ - HTTPS_KEY_FILE=/run/secrets/https_key_file
+ - MAILMAN_ADMIN_EMAIL=
+ - SHIBBOLETH_SP_ENCRYPT_CERT=/run/secrets/shibboleth_sp_encrypt_cert
+ - SHIBBOLETH_SP_ENCRYPT_PRIVKEY=/run/secrets/shibboleth_sp_encrypt_privkey
+ - VIRTUAL_HOST_FQDN=
secrets:
- - nginx_https_cert_file
- - nginx_https_key_file
- - nginx_dh_param_file
+ - https_cert_file
+ - https_key_file
+ - shibboleth_sp_encrypt_cert
+ - shibboleth_sp_encrypt_privkey
networks:
- default
ports:
@@ -123,8 +133,13 @@ services:
mode: host
deploy:
replicas: 1
+ endpoint_mode: dnsrr
secrets:
+ https_cert_file:
+ external: true
+ https_key_file:
+ external: true
hyperkitty_api_key:
external: true
mailman_database_url:
@@ -133,11 +148,9 @@ secrets:
external: true
mailman_web_secret_key:
external: true
- nginx_https_cert_file:
- external: true
- nginx_https_key_file:
+ postgres_password:
external: true
- nginx_dh_param_file:
+ shibboleth_sp_encrypt_cert:
external: true
- postgres_password:
+ shibboleth_sp_encrypt_privkey:
external: true
diff --git a/comanage-registry-mailman/web/Dockerfile b/comanage-registry-mailman/web/Dockerfile
index 95c082a..25a493f 100644
--- a/comanage-registry-mailman/web/Dockerfile
+++ b/comanage-registry-mailman/web/Dockerfile
@@ -44,11 +44,16 @@ RUN apt-get update \
xapian-haystack \
&& adduser --system --no-create-home --group mailman
+COPY django-mail-header /tmp/django-mail-header
+RUN pip install /tmp/django-mail-header \
+ && rm -rf /tmp/django-mail-header
+
# Add needed files for uwsgi server + settings for django
COPY mailman-web /opt/mailman-web
-# Overlay customized template for Postorius login
-#COPY login.html /usr/local/lib/python2.7/site-packages/django_mailman3/templates/account/
+# Overlay modified templates
+COPY postorius.base.html /usr/local/lib/python3.6/site-packages/postorius/templates/postorius/base.html
+COPY hyperkitty.base.html /usr/local/lib/python3.6/site-packages/hyperkitty/templates/hyperkitty/base.html
RUN chown -R mailman:mailman /opt/mailman-web/ \
&& chmod u+x /opt/mailman-web/manage.py
diff --git a/comanage-registry-mailman/web/django-mail-header/setup.py b/comanage-registry-mailman/web/django-mail-header/setup.py
new file mode 100644
index 0000000..b002890
--- /dev/null
+++ b/comanage-registry-mailman/web/django-mail-header/setup.py
@@ -0,0 +1,15 @@
+import setuptools
+
+setuptools.setup(
+ name="django-mail-header",
+ version="1.0.0",
+ author="Scott Koranda",
+ author_email="skoranda@gmail.com",
+ description="Custom HTTP_MAIL header for Django authentication",
+ packages=setuptools.find_packages('src'),
+ package_dir={'': 'src'},
+ classifiers=[
+ "Programming Language :: Python :: 3",
+ "Operating System :: OS Independent",
+ ],
+)
diff --git a/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/__init__.py b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/__init__.py
new file mode 100644
index 0000000..5becc17
--- /dev/null
+++ b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/__init__.py
@@ -0,0 +1 @@
+__version__ = "1.0.0"
diff --git a/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/backends.py b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/backends.py
new file mode 100644
index 0000000..efda55a
--- /dev/null
+++ b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/backends.py
@@ -0,0 +1,16 @@
+"""
+Django backend that uses the RemoteUserBackend as a base
+class and that sets the email field on the user model
+to be the same as the username field each time a new
+user is created.
+"""
+
+from django.contrib.auth.backends import RemoteUserBackend
+
+class MailHeaderBackend(RemoteUserBackend):
+ def configure_user(self, user):
+ username = user.get_username()
+ user.email = username;
+ user.save()
+
+ return user
diff --git a/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/middleware.py b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/middleware.py
new file mode 100644
index 0000000..4426532
--- /dev/null
+++ b/comanage-registry-mailman/web/django-mail-header/src/django_mail_header/middleware.py
@@ -0,0 +1,10 @@
+"""
+Django middleware that builds on the RemoteUserMiddleware
+base class and sets the header to inspect for the username
+to HTTP_MAIL.
+"""
+
+from django.contrib.auth.middleware import RemoteUserMiddleware
+
+class MailHeaderMiddleware(RemoteUserMiddleware):
+ header = 'HTTP_MAIL'
diff --git a/comanage-registry-mailman/web/hyperkitty.base.html b/comanage-registry-mailman/web/hyperkitty.base.html
new file mode 100644
index 0000000..950956d
--- /dev/null
+++ b/comanage-registry-mailman/web/hyperkitty.base.html
@@ -0,0 +1,209 @@
+{% load i18n %}
+{% load compress %}
+{% load static %}
+{% load gravatar %}
+
+
+
+
+
+
+ {% block head_title %}{{ site_name }}{% endblock %}
+
+
+
+
+
+ {% compress css %}
+
+
+
+
+ {% endcompress %}
+ {% block additional_stylesheets %} {% endblock %}
+ {% include 'hyperkitty/headers.html' %}
+
+
+
+
+ {% include 'hyperkitty/top.html' %}
+
+
+
+ {% if messages %}
+