Skip to content

Commit dd36509

Browse files
quartjedanakimMKodde
authored
Docker: Create a parameters.yaml.dist that works in a docker dev env (#405)
* Docker: Create a paramaters.yaml.dist that works in a docker dev environment * parameters.yml.dist: Create sensible MariaDB usernames and secrets * Parameters.yaml.dist: Change secrets to a unique secret * Adding the Dockerfile and required configs * Adding the Github workflows * Testing the build * We were copying from the wrong places * GHA: Add dispatch option to the docker build action * Default docker config: Add mailcatcher host * Fix loas in the docker config * Add demo gssp to the docker config * Docker: Chown the var directory * Docker: Fix permissions on the cache dir * Docker: Add monolog configuration when running as a container This will let the logs go to stdout when running as a container, which is the Docker way to send logs * Correct uri for selfservice * Change the self-asserted loa to match the regular * Fix a typo * sed -i 's/authentication/assurance/' * Rename loa's to a more standard name --------- Co-authored-by: Dan <dan@hostatic.ro> Co-authored-by: Michiel Kodde <mkodde@ibuildings.nl>
1 parent 550e687 commit dd36509

6 files changed

Lines changed: 152 additions & 26 deletions

File tree

‎.github/workflows/build-push-docker-image.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: build-push-docker-image
2+
3+
#on: workflow_dispatch
4+
on:
5+
push:
6+
branches: feature/docker_configs
7+
workflow_dispatch:
8+
9+
jobs:
10+
build-push-docker-image:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
packages: write
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v3
17+
18+
- name: Get the latest release
19+
id: release
20+
uses: robinraju/release-downloader@v1.7
21+
with:
22+
latest: true
23+
fileName: "*.tar.bz2"
24+
25+
- name: Set up QEMU
26+
uses: docker/setup-qemu-action@v2
27+
28+
- name: Set up Docker Buildx
29+
uses: docker/setup-buildx-action@v2
30+
31+
- name: Login to GitHub Container Registry
32+
uses: docker/login-action@v2
33+
with:
34+
registry: ghcr.io
35+
username: ${{ github.repository_owner }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Build and push the Production image
39+
uses: docker/build-push-action@v4
40+
with:
41+
context: .
42+
file: docker/Dockerfile.prod
43+
platforms: linux/amd64,linux/arm64
44+
push: true
45+
tags: |
46+
ghcr.io/openconext/stepup-middleware/stepup-middleware:prod
47+
ghcr.io/openconext/stepup-middleware/stepup-middleware:${{ github.sha }}
48+
ghcr.io/openconext/stepup-middleware/stepup-middleware:${{ steps.release.outputs.tag_name }}

‎.github/workflows/tag-release.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,11 @@ jobs:
6262
with:
6363
release_id: ${{ steps.create_release.outputs.id }}
6464

65+
after_build:
66+
needs: build
67+
runs-on: ubuntu-latest
68+
steps:
69+
- name: Trigger Docker container build
70+
uses: benc-uk/workflow-dispatch@v1
71+
with:
72+
workflow: build-push-docker-image.yml

‎config/legacy/parameters.yaml.dist‎

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
parameters:
2-
application_name: StepUp Middleware
2+
application_name: OpenConext Middleware
33
# IP addresses of any HTTP proxies that are sitting in from of the application
44
# See: http://symfony.com/doc/current/request/load_balancer_reverse_proxy.html
55
trusted_proxies: ~
66

77
database_driver: pdo_mysql
8-
database_host: 10.10.0.100
8+
database_host: mariadb
99
database_port: ~
1010
# Enabling the STRICT_ALL_TABLES SQL mode. To prevent 'magic' truncation problems where string
1111
# values like the identity name id would be truncated after 255 characters without notice. Enabling
@@ -17,16 +17,16 @@ parameters:
1717
# Also see: https://symfony.com/doc/current/reference/configuration/doctrine.html#doctrine-dbal-configuration
1818
database_server_version: mariadb-10.0.38
1919
database_middleware_name: middleware
20-
database_middleware_user: middleware
21-
database_middleware_password: middleware
20+
database_middleware_user: middleware_user
21+
database_middleware_password: middleware_secret
2222
database_gateway_name: gateway
23-
database_gateway_user: gateway
24-
database_gateway_password: gateway
25-
database_deploy_user: deploy
26-
database_deploy_password: deploy
23+
database_gateway_user: mw_gateway_user
24+
database_gateway_password: mw_gateway_secret
25+
database_deploy_user: mw_deploy_user
26+
database_deploy_password: mw_deploy_secret
2727

2828
mailer_transport: smtp
29-
mailer_host: 127.0.0.1
29+
mailer_host: mailcatcher
3030
mailer_port: 25
3131
mailer_user: ''
3232
mailer_password: ''
@@ -46,35 +46,39 @@ parameters:
4646
# - readonly access to all endpoints - user "apireader"
4747
# - management - user "management"
4848
# - GDPR compliance: deprovision and retrieval of user information - user "lifecycle"
49-
selfservice_api_password: OI7Wr63wxx2-Pel
50-
registration_authority_api_password: BAeBxn813SB4_QX
51-
readonly_api_password: wkpTzg.CJzc5sWU
52-
management_password: UktsgjiFJOSP87d
53-
lifecycle_password: AXn0n9cOFymT_oF
49+
selfservice_api_password: sa_secret
50+
registration_authority_api_password: ra_secret
51+
readonly_api_password: secret
52+
management_password: secret
53+
lifecycle_password: secret
5454

55-
self_service_email_verification_url_template: https://selfservice.tld/verify-email?n={nonce}
56-
email_sender_name: SURFnet bv
57-
email_sender_email: noreply@surfnet.nl
55+
self_service_email_verification_url_template: https://selfservice.dev.openconext.local/verify-email?n={nonce}
56+
email_sender_name: OpenConext DEV environment
57+
email_sender_email: noreply@dev.openconext.local
5858

59-
email_verification_window: 3600 # the amout of seconds the email verification email/url is valid
59+
email_verification_window: 3600 # the amount of seconds the email verification email/url is valid
6060

61-
stepup_loa_loa1: https://gateway.tld/authentication/loa1
62-
stepup_loa_loa2: https://gateway.tld/authentication/loa2
63-
stepup_loa_loa3: https://gateway.tld/authentication/loa3
64-
stepup_loa_self_asserted: 'http://stepup.example.com/assurance/loa-self-asserted'
61+
stepup_loa_loa1: http://dev.openconext.local/assurance/loa1
62+
stepup_loa_loa2: http://dev.openconext.local/assurance/loa2
63+
stepup_loa_loa3: http://dev.openconext.local/assurance/loa3
64+
stepup_loa_self_asserted: 'http://dev.openconext.local/assurance/loa1.5'
6565

66-
self_service_url: https://selfservice.tld
66+
self_service_url: https://selfservice.dev.openconext.local
6767

6868
enabled_generic_second_factors:
69-
biometric:
70-
loa: 3
69+
azuremfa:
70+
loa: 2
7171
tiqr:
72+
loa: 2
73+
webauthn:
74+
loa: 3
75+
demo_gssp:
7276
loa: 3
7377

7478
second_factors_display_name:
7579
yubikey: Yubikey
7680
azuremfa: AzureMFA
77-
webauthn: WebAuthn
81+
webauthn: FIDO2
7882
tiqr: Tiqr
7983
demo_gssp: GSSP Demo
8084
demo_gssp_2: GSSP Demo 2

‎config/packages/prod/monolog.yaml.docker‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
monolog:
2+
handlers:
3+
prod-signaler:
4+
type: fingers_crossed
5+
action_level: ERROR
6+
passthru_level: NOTICE # this means that all message of level NOTICE or higher are always logged
7+
handler: main_syslog
8+
bubble: false # if we handle it, nothing else should
9+
main_syslog:
10+
type: stream
11+
path: "php://stderr"
12+
formatter: surfnet_stepup.monolog.json_formatter

‎docker/Dockerfile.prod‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM ghcr.io/openconext/openconext-basecontainers/php72-apache2:latest AS php-build
2+
COPY *.tar.bz2 /tmp/
3+
RUN tar -xvjf /tmp/*.tar.bz2 -C /var/www/html/ && \
4+
rm -rf /tmp/*.tar.bz2
5+
6+
# Add the application configuration files
7+
COPY .env .env
8+
COPY config/legacy/parameters.yaml.dist config/legacy/parameters.yaml
9+
COPY config/packages/prod/monolog.yaml.docker config/packages/prod/monolog.yaml
10+
11+
# Add the config files for Apache2
12+
RUN rm -rf /etc/apache2/sites-enabled/*
13+
COPY ./docker/conf/middleware-apache2.conf /etc/apache2/sites-enabled/middleware.conf
14+
RUN rm -rf /var/www/html/var/cache/prod && chown -R www-data /var/www/html/var
15+
EXPOSE 80
16+
17+
# Set the default workdir
18+
WORKDIR /var/www/html
19+
20+
CMD ["apache2-foreground"]

‎docker/conf/middleware-apache2.conf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<Virtualhost *:80>
2+
ServerName middleware
3+
ServerAdmin admin@surf.nl
4+
5+
DocumentRoot /var/www/html/public
6+
SetEnv HTTPS on
7+
SetEnv APP_ENV prod
8+
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
9+
10+
<Directory "/var/www/html/public">
11+
Require all granted
12+
13+
Options -MultiViews
14+
RewriteEngine On
15+
RewriteCond %{REQUEST_FILENAME} !-f
16+
RewriteRule ^(.*)$ index.php [QSA,L]
17+
</Directory>
18+
<Location />
19+
Require all granted
20+
</Location>
21+
22+
Header always set X-Content-Type-Options "nosniff"
23+
24+
# Set the php application handler so mod_php interpets the files
25+
<FilesMatch \.php$>
26+
SetHandler application/x-httpd-php
27+
</FilesMatch>
28+
29+
ExpiresActive on
30+
ExpiresByType font/* "access plus 1 year"
31+
ExpiresByType image/* "access plus 6 months"
32+
ExpiresByType text/css "access plus 1 year"
33+
ExpiresByType text/js "access plus 1 year"
34+
</VirtualHost>

0 commit comments

Comments
 (0)