diff --git a/Dockerfile b/Dockerfile index aeda570..a828b5a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,8 +9,8 @@ ENV JAVA_VERSION=8u171 \ BUILD_VERSION=b11 \ JAVA_BUNDLE_ID=512cd62ec5174c3487ac17c61aaa89e8 \ ##tomcat \ - TOMCAT_MAJOR=8 \ - TOMCAT_VERSION=8.5.31 \ + TOMCAT_MAJOR=9 \ + TOMCAT_VERSION=9.0.8 \ ##shib-idp \ VERSION=3.3.3 \ ##TIER \ @@ -23,7 +23,7 @@ ENV JAVA_VERSION=8u171 \ IMAGENAME=shibboleth_idp \ MAINTAINER=tier \ #java \ - JAVA_HOME=/usr/java/latest \ + JAVA_HOME=/usr \ JAVA_OPTS=-Xmx3000m -XX:MaxPermSize=256m \ #tomcat \ CATALINA_HOME=/usr/local/tomcat @@ -53,7 +53,8 @@ RUN ln -sf /usr/share/zoneinfo/UTC /etc/localtime \ && echo "NETWORKING=yes" > /etc/sysconfig/network # Install base deps -RUN rm -fr /var/cache/yum/* && yum clean all && yum -y update && yum -y install --setopt=tsflags=nodocs epel-release && \ +#RUN rm -fr /var/cache/yum/* && yum clean all && yum -y update && yum -y install --setopt=tsflags=nodocs epel-release && \ +RUN rm -fr /var/cache/yum/* && yum clean all && yum -y install --setopt=tsflags=nodocs epel-release && \ yum -y install net-tools wget curl tar unzip mlocate logrotate strace telnet man unzip vim wget rsyslog cronie krb5-workstation openssl-devel wget supervisor && \ yum -y clean all && \ mkdir -p /opt/tier && \ @@ -72,7 +73,13 @@ RUN update-ca-trust extract ##### ENV TIER_BEACON_OPT_OUT True -# Install java/JCE +# Install Zulu Java +RUN rpm --import http://repos.azulsystems.com/RPM-GPG-KEY-azulsystems \ + && curl -o /etc/yum.repos.d/zulu.repo http://repos.azulsystems.com/rhel/zulu.repo \ + && yum -y install zulu-8 + + +# Install Oracle java/JCE # # Uncomment the following commands to download the JDK to your Shibboleth IDP image. # ==> By uncommenting these next 6 lines, you agree to the Oracle Binary Code License Agreement for Java SE (http://www.oracle.com/technetwork/java/javase/terms/license/index.html) @@ -94,9 +101,9 @@ RUN update-ca-trust extract # && chmod -R 640 $JAVA_HOME/jre/lib/security/ # Copy IdP installer properties file(s) -ADD container_files/idp/idp.installer.properties /tmp/idp.installer.properties -ADD container_files/idp/idp.merge.properties /tmp/idp.merge.properties -ADD container_files/idp/ldap.merge.properties /tmp/ldap.merge.properties +ADD container_files/idp/idp.installer.properties container_files/idp/idp.merge.properties container_files/idp/ldap.merge.properties /tmp/ +#ADD container_files/idp/idp.merge.properties /tmp/idp.merge.properties +#ADD container_files/idp/ldap.merge.properties /tmp/ldap.merge.properties # Install IdP RUN mkdir -p /tmp/shibboleth && cd /tmp/shibboleth && \ @@ -145,8 +152,9 @@ RUN cd /usr/local/tomcat/; \ chmod +r bin/log4j-*.jar; ADD container_files/tomcat/log4j2.xml /usr/local/tomcat/conf/ ADD container_files/tomcat/setenv.sh /usr/local/tomcat/bin/ - - +RUN mkdir -p /usr/local/tomcat/webapps/ROOT +ADD container_files/tomcat/robots.txt /usr/local/tomcat/webapps/ROOT +ADD container_files/tomcat/keystore.jks /opt/certs/ # Copy TIER helper scripts ADD container_files/system/startup.sh /usr/bin/ @@ -161,20 +169,23 @@ RUN chmod +x /opt/tier/setenv.sh \ # setup cron && /usr/bin/setupcron.sh +#set cron to not require a login session +RUN sed -i '/session required pam_loginuid.so/c\#session required pam_loginuid.so' /etc/pam.d/crond + ############################################### ### Settings for a mounted config (default) ### ############################################### -VOLUME ["/usr/local/tomcat/conf", \ - "/usr/local/tomcat/webapps/ROOT", \ - "/usr/local/tomcat/logs", \ - "/opt/certs", \ - "/opt/shibboleth-idp/conf", \ - "/opt/shibboleth-idp/credentials", \ - "/opt/shibboleth-idp/views", \ - "/opt/shibboleth-idp/edit-webapp", \ - "/opt/shibboleth-idp/messages", \ - "/opt/shibboleth-idp/metadata", \ - "/opt/shibboleth-idp/logs"] +#VOLUME ["/usr/local/tomcat/conf", \ +# "/usr/local/tomcat/webapps/ROOT", \ +# "/usr/local/tomcat/logs", \ +# "/opt/certs", \ +# "/opt/shibboleth-idp/conf", \ +# "/opt/shibboleth-idp/credentials", \ +# "/opt/shibboleth-idp/views", \ +# "/opt/shibboleth-idp/edit-webapp", \ +# "/opt/shibboleth-idp/messages", \ +# "/opt/shibboleth-idp/metadata", \ +# "/opt/shibboleth-idp/logs"] ################################################# diff --git a/Jenkinsfile b/Jenkinsfile new file mode 100644 index 0000000..0c04d9d --- /dev/null +++ b/Jenkinsfile @@ -0,0 +1,92 @@ +// Licensed to the University Corporation for Advanced Internet Development, +// Inc. (UCAID) under one or more contributor license agreements. See the +// NOTICE file distributed with this work for additional information regarding +// copyright ownership. The UCAID licenses this file to You under the Apache +// License, Version 2.0 (the "License"); you may not use this file except in +// compliance with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +node('docker') { + + stage 'Checkout' + + checkout scm + + stage 'Acquire util' + + sh 'mkdir -p tmp && mkdir -p bin' + dir('tmp'){ + git([ url: "https://github.internet2.edu/docker/util.git", + credentialsId: "jenkins-github-access-token" ]) + sh 'mv ./bin/* ../bin/.' + } + sh 'rm -rf tmp' + + stage 'Setting build context' + + def maintainer = maintainer() + def imagename = imagename() + def tag + + // Tag images created on master branch with 'latest' + if(env.BRANCH_NAME == "master"){ + tag = "latest" + }else{ + tag = env.BRANCH_NAME + } + + if(!imagename){ + echo "You must define an imagename in common.bash" + currentBuild.result = 'FAILURE' + } + if(maintainer){ + echo "Building ${imagename}:${tag} for ${maintainer}" + } + + stage 'Build' + try{ + sh 'bin/rebuild.sh &> debug' + } catch(error) { + def error_details = readFile('./debug'); + def message = "BUILD ERROR: There was a problem building ${imagename}:${tag}. \n\n ${error_details}" + sh "rm -f ./debug" + handleError(message) + } + + stage 'Push' + + docker.withRegistry('https://registry.hub.docker.com/', "dockerhub-$maintainer") { + def baseImg = docker.build("$maintainer/$imagename") + baseImg.push("$tag") + } + + stage 'Notify' + + slackSend color: 'good', message: "$maintainer/$imagename:$tag pushed to DockerHub" + +} + +def maintainer() { + def matcher = readFile('common.bash') =~ 'maintainer="(.+)"' + matcher ? matcher[0][1] : 'tier' +} + +def imagename() { + def matcher = readFile('common.bash') =~ 'imagename="(.+)"' + matcher ? matcher[0][1] : null +} + +def handleError(String message){ + echo "${message}" + currentBuild.setResult("FAILED") + slackSend color: 'danger', message: "${message}" + sh 'exit 1' +} + diff --git a/common.bash b/common.bash new file mode 100644 index 0000000..7ff214b --- /dev/null +++ b/common.bash @@ -0,0 +1,3 @@ +maintainer="tier" +imagename="shib-idp" + diff --git a/container_files/tomcat/keystore.jks b/container_files/tomcat/keystore.jks new file mode 100644 index 0000000..6a28c4f Binary files /dev/null and b/container_files/tomcat/keystore.jks differ diff --git a/container_files/tomcat/robots.txt b/container_files/tomcat/robots.txt new file mode 100644 index 0000000..6ffbc30 --- /dev/null +++ b/container_files/tomcat/robots.txt @@ -0,0 +1,3 @@ +User-agent: * +Disallow: / + diff --git a/container_files/tomcat/server.xml b/container_files/tomcat/server.xml index 8272b19..f27e9cf 100644 --- a/container_files/tomcat/server.xml +++ b/container_files/tomcat/server.xml @@ -1,144 +1,26 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - - - - - - - - - - - - - \ No newline at end of file + +