diff --git a/Dockerfile b/Dockerfile index aeda570..0254fed 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,12 +9,12 @@ ENV JAVA_VERSION=8u171 \ BUILD_VERSION=b11 \ JAVA_BUNDLE_ID=512cd62ec5174c3487ac17c61aaa89e8 \ ##tomcat \ - TOMCAT_MAJOR=8 \ - TOMCAT_VERSION=8.5.31 \ + TOMCAT_MAJOR=9 \ + TOMCAT_VERSION=9.0.8 \ ##shib-idp \ VERSION=3.3.3 \ ##TIER \ - TIERVERSION=180502 \ + TIERVERSION=180601 \ ################## \ ### OTHER VARS ### \ ################## \ @@ -23,7 +23,7 @@ ENV JAVA_VERSION=8u171 \ IMAGENAME=shibboleth_idp \ MAINTAINER=tier \ #java \ - JAVA_HOME=/usr/java/latest \ + JAVA_HOME=/usr \ JAVA_OPTS=-Xmx3000m -XX:MaxPermSize=256m \ #tomcat \ CATALINA_HOME=/usr/local/tomcat @@ -72,9 +72,15 @@ RUN update-ca-trust extract ##### ENV TIER_BEACON_OPT_OUT True -# Install java/JCE +# Install Zulu Java +RUN rpm --import http://repos.azulsystems.com/RPM-GPG-KEY-azulsystems \ + && curl -o /etc/yum.repos.d/zulu.repo http://repos.azulsystems.com/rhel/zulu.repo \ + && yum -y install zulu-8 && alternatives --install /usr/bin/java java $JAVA_HOME/bin/java 200000 + + +# To use Oracle java/JCE # -# Uncomment the following commands to download the JDK to your Shibboleth IDP image. +# Uncomment the following commands to download the Oracle JDK to your Shibboleth IDP image. # ==> By uncommenting these next 6 lines, you agree to the Oracle Binary Code License Agreement for Java SE (http://www.oracle.com/technetwork/java/javase/terms/license/index.html) # RUN wget -nv --no-cookies --no-check-certificate --header "Cookie: oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/$JAVA_VERSION-$BUILD_VERSION/$JAVA_BUNDLE_ID/jdk-$JAVA_VERSION-linux-x64.rpm" -O /tmp/jdk-$JAVA_VERSION-$BUILD_VERSION-linux-x64.rpm && \ # yum -y install /tmp/jdk-$JAVA_VERSION-$BUILD_VERSION-linux-x64.rpm && \ @@ -83,7 +89,7 @@ RUN update-ca-trust extract # alternatives --install /usr/bin/javaws javaws $JAVA_HOME/bin/javaws 200000 && \ # alternatives --install /usr/bin/javac javac $JAVA_HOME/bin/javac 200000 -# Uncomment the following commands to download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files. +# For Oracle Java, also uncomment the following commands to download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files. # ==> By uncommenting these next 7 lines, you agree to the Oracle Binary Code License Agreement for Java SE Platform Products (http://www.oracle.com/technetwork/java/javase/terms/license/index.html) # RUN wget --no-check-certificate --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie" \ # http://download.oracle.com/otn-pub/java/jce/8/jce_policy-8.zip \ @@ -94,9 +100,7 @@ RUN update-ca-trust extract # && chmod -R 640 $JAVA_HOME/jre/lib/security/ # Copy IdP installer properties file(s) -ADD container_files/idp/idp.installer.properties /tmp/idp.installer.properties -ADD container_files/idp/idp.merge.properties /tmp/idp.merge.properties -ADD container_files/idp/ldap.merge.properties /tmp/ldap.merge.properties +ADD container_files/idp/idp.installer.properties container_files/idp/idp.merge.properties container_files/idp/ldap.merge.properties /tmp/ # Install IdP RUN mkdir -p /tmp/shibboleth && cd /tmp/shibboleth && \ @@ -145,8 +149,9 @@ RUN cd /usr/local/tomcat/; \ chmod +r bin/log4j-*.jar; ADD container_files/tomcat/log4j2.xml /usr/local/tomcat/conf/ ADD container_files/tomcat/setenv.sh /usr/local/tomcat/bin/ - - +RUN mkdir -p /usr/local/tomcat/webapps/ROOT +ADD container_files/tomcat/robots.txt /usr/local/tomcat/webapps/ROOT +ADD container_files/tomcat/keystore.jks /opt/certs/ # Copy TIER helper scripts ADD container_files/system/startup.sh /usr/bin/ @@ -161,20 +166,23 @@ RUN chmod +x /opt/tier/setenv.sh \ # setup cron && /usr/bin/setupcron.sh +#set cron to not require a login session +RUN sed -i '/session required pam_loginuid.so/c\#session required pam_loginuid.so' /etc/pam.d/crond + ############################################### ### Settings for a mounted config (default) ### ############################################### -VOLUME ["/usr/local/tomcat/conf", \ - "/usr/local/tomcat/webapps/ROOT", \ - "/usr/local/tomcat/logs", \ - "/opt/certs", \ - "/opt/shibboleth-idp/conf", \ - "/opt/shibboleth-idp/credentials", \ - "/opt/shibboleth-idp/views", \ - "/opt/shibboleth-idp/edit-webapp", \ - "/opt/shibboleth-idp/messages", \ - "/opt/shibboleth-idp/metadata", \ - "/opt/shibboleth-idp/logs"] +#VOLUME ["/usr/local/tomcat/conf", \ +# "/usr/local/tomcat/webapps/ROOT", \ +# "/usr/local/tomcat/logs", \ +# "/opt/certs", \ +# "/opt/shibboleth-idp/conf", \ +# "/opt/shibboleth-idp/credentials", \ +# "/opt/shibboleth-idp/views", \ +# "/opt/shibboleth-idp/edit-webapp", \ +# "/opt/shibboleth-idp/messages", \ +# "/opt/shibboleth-idp/metadata", \ +# "/opt/shibboleth-idp/logs"] ################################################# @@ -189,17 +197,17 @@ VOLUME ["/usr/local/tomcat/conf", \ # they represent the folder names/paths on your build host of the relevant config material needed to run the container # The paths below must be relative to (subdirectories of) the directory where the Dockerfile is located. # The paths below are just the default values. They are typically overriden by "build-args" in the 'docker build' command. -ARG TOMCFG=config/tomcat -ARG TOMLOG=logs/tomcat -ARG TOMCERT=credentials/tomcat -ARG TOMWWWROOT=wwwroot -ARG SHBCFG=config/shib-idp/conf -ARG SHBCREDS=credentials/shib-idp -ARG SHBVIEWS=config/shib-idp/views -ARG SHBEDWAPP=config/shib-idp/edit-webapp -ARG SHBMSGS=config/shib-idp/messages -ARG SHBMD=config/shib-idp/metadata -ARG SHBLOG=logs/shib-idp +#ARG TOMCFG=config/tomcat +#ARG TOMLOG=logs/tomcat +#ARG TOMCERT=credentials/tomcat +#ARG TOMWWWROOT=wwwroot +#ARG SHBCFG=config/shib-idp/conf +#ARG SHBCREDS=credentials/shib-idp +#ARG SHBVIEWS=config/shib-idp/views +#ARG SHBEDWAPP=config/shib-idp/edit-webapp +#ARG SHBMSGS=config/shib-idp/messages +#ARG SHBMD=config/shib-idp/metadata +#ARG SHBLOG=logs/shib-idp # ## ADD ${TOMCFG} /usr/local/tomcat/conf ## ADD ${TOMCERT} /opt/certs diff --git a/Jenkinsfile b/Jenkinsfile new file mode 100644 index 0000000..0c04d9d --- /dev/null +++ b/Jenkinsfile @@ -0,0 +1,92 @@ +// Licensed to the University Corporation for Advanced Internet Development, +// Inc. (UCAID) under one or more contributor license agreements. See the +// NOTICE file distributed with this work for additional information regarding +// copyright ownership. The UCAID licenses this file to You under the Apache +// License, Version 2.0 (the "License"); you may not use this file except in +// compliance with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +node('docker') { + + stage 'Checkout' + + checkout scm + + stage 'Acquire util' + + sh 'mkdir -p tmp && mkdir -p bin' + dir('tmp'){ + git([ url: "https://github.internet2.edu/docker/util.git", + credentialsId: "jenkins-github-access-token" ]) + sh 'mv ./bin/* ../bin/.' + } + sh 'rm -rf tmp' + + stage 'Setting build context' + + def maintainer = maintainer() + def imagename = imagename() + def tag + + // Tag images created on master branch with 'latest' + if(env.BRANCH_NAME == "master"){ + tag = "latest" + }else{ + tag = env.BRANCH_NAME + } + + if(!imagename){ + echo "You must define an imagename in common.bash" + currentBuild.result = 'FAILURE' + } + if(maintainer){ + echo "Building ${imagename}:${tag} for ${maintainer}" + } + + stage 'Build' + try{ + sh 'bin/rebuild.sh &> debug' + } catch(error) { + def error_details = readFile('./debug'); + def message = "BUILD ERROR: There was a problem building ${imagename}:${tag}. \n\n ${error_details}" + sh "rm -f ./debug" + handleError(message) + } + + stage 'Push' + + docker.withRegistry('https://registry.hub.docker.com/', "dockerhub-$maintainer") { + def baseImg = docker.build("$maintainer/$imagename") + baseImg.push("$tag") + } + + stage 'Notify' + + slackSend color: 'good', message: "$maintainer/$imagename:$tag pushed to DockerHub" + +} + +def maintainer() { + def matcher = readFile('common.bash') =~ 'maintainer="(.+)"' + matcher ? matcher[0][1] : 'tier' +} + +def imagename() { + def matcher = readFile('common.bash') =~ 'imagename="(.+)"' + matcher ? matcher[0][1] : null +} + +def handleError(String message){ + echo "${message}" + currentBuild.setResult("FAILED") + slackSend color: 'danger', message: "${message}" + sh 'exit 1' +} + diff --git a/common.bash b/common.bash new file mode 100644 index 0000000..7ff214b --- /dev/null +++ b/common.bash @@ -0,0 +1,3 @@ +maintainer="tier" +imagename="shib-idp" + diff --git a/container_files/tomcat/keystore.jks b/container_files/tomcat/keystore.jks new file mode 100644 index 0000000..6a28c4f Binary files /dev/null and b/container_files/tomcat/keystore.jks differ diff --git a/container_files/tomcat/robots.txt b/container_files/tomcat/robots.txt new file mode 100644 index 0000000..6ffbc30 --- /dev/null +++ b/container_files/tomcat/robots.txt @@ -0,0 +1,3 @@ +User-agent: * +Disallow: / + diff --git a/container_files/tomcat/server.xml b/container_files/tomcat/server.xml index 8272b19..f27e9cf 100644 --- a/container_files/tomcat/server.xml +++ b/container_files/tomcat/server.xml @@ -1,144 +1,26 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - - - - - - - - - - - - - \ No newline at end of file + +