|
| 1 | +FROM debian:trixie-slim |
| 2 | + |
| 3 | +ARG API_REPOSITORY="https://github.com/passbolt/passbolt_api" |
| 4 | +ARG IMAGE_DESCRIPTION="Passbolt CE Backend, a JSON API written with CakePHP" |
| 5 | +ARG BUILD_DATE="" |
| 6 | + |
| 7 | +LABEL org.opencontainers.image.created="${BUILD_DATE}" |
| 8 | +LABEL org.opencontainers.image.description="${IMAGE_DESCRIPTION}" |
| 9 | +LABEL org.opencontainers.image.documentation=https://help.passbolt.com/ |
| 10 | +LABEL org.opencontainers.image.authors="Passbolt SA < [email protected]>" |
| 11 | +LABEL org.opencontainers.image.licenses=AGPL-3.0-only |
| 12 | +LABEL org.opencontainers.image.source="${API_REPOSITORY}" |
| 13 | +LABEL org.opencontainers.image.title=passbolt/passbolt |
| 14 | +LABEL org.opencontainers.image.url=https://passbolt.com |
| 15 | + |
| 16 | +ARG SUPERCRONIC_ARCH=amd64 |
| 17 | +ARG SUPERCRONIC_SHA1SUM=bc072eba2ae083849d5f86c6bd1f345f6ed902d0 |
| 18 | + |
| 19 | +ARG PASSBOLT_DISTRO="buster" |
| 20 | +ARG PASSBOLT_COMPONENT="stable" |
| 21 | +ARG PASSBOLT_SERVER_KEY="https://download.passbolt.com" |
| 22 | +ARG PASSBOLT_FLAVOUR="ce" |
| 23 | +ARG PASSBOLT_PKG=passbolt-$PASSBOLT_FLAVOUR-server |
| 24 | +ARG PASSBOLT_REPO_URL="https://download.passbolt.com" |
| 25 | +ARG PASSBOLT_REPO_KEY_PATH="/usr/share/keyrings/passbolt-repository.gpg" |
| 26 | +ARG PASSBOLT_SOURCES_LIST_PATH="/etc/apt/sources.list.d/passbolt.sources" |
| 27 | + |
| 28 | +ARG PASSBOLT_USER_UID=33 |
| 29 | +ARG PASSBOLT_GROUP_GID=33 |
| 30 | + |
| 31 | +ENV PASSBOLT_PKG_KEY=0xDE8B853FC155581D |
| 32 | +ENV PHP_VERSION=8.4 |
| 33 | +ENV GNUPGHOME=/var/lib/passbolt/.gnupg |
| 34 | +ENV SUPERCRONIC_VERSION=0.2.38 |
| 35 | +ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v${SUPERCRONIC_VERSION}/supercronic-linux-${SUPERCRONIC_ARCH} \ |
| 36 | + SUPERCRONIC=supercronic-linux-${SUPERCRONIC_ARCH} |
| 37 | +ENV PASSBOLT_FLAVOUR="${PASSBOLT_FLAVOUR}" |
| 38 | +ENV LOG_ERROR_URL="console://?levels[]=warning&levels[]=error&levels[]=critical&levels[]=alert&levels[]=emergency" |
| 39 | + |
| 40 | +SHELL ["/bin/bash", "-o", "pipefail", "-c"] |
| 41 | + |
| 42 | +RUN usermod -u $PASSBOLT_USER_UID www-data \ |
| 43 | + && groupmod -g $PASSBOLT_GROUP_GID www-data |
| 44 | + |
| 45 | +RUN apt-get update \ |
| 46 | + && DEBIAN_FRONTEND=non-interactive apt-get -y install \ |
| 47 | + ca-certificates \ |
| 48 | + gnupg \ |
| 49 | + curl \ |
| 50 | + && curl -s $PASSBOLT_SERVER_KEY/pub.key |\ |
| 51 | + gpg --dearmor | tee $PASSBOLT_REPO_KEY_PATH > /dev/null \ |
| 52 | + && chmod 644 $PASSBOLT_REPO_KEY_PATH \ |
| 53 | + && echo -e "Types: deb \nURIs: $PASSBOLT_REPO_URL/$PASSBOLT_FLAVOUR/debian \nSuites: $PASSBOLT_DISTRO \nComponents: $PASSBOLT_COMPONENT \nSigned-By: $PASSBOLT_REPO_KEY_PATH" > $PASSBOLT_SOURCES_LIST_PATH \ |
| 54 | + && apt-get update \ |
| 55 | + && DEBIAN_FRONTEND=non-interactive apt-get -y install --no-install-recommends \ |
| 56 | + nginx \ |
| 57 | + $PASSBOLT_PKG \ |
| 58 | + supervisor \ |
| 59 | + && rm -f /etc/passbolt/jwt/* \ |
| 60 | + && curl -fsSLO "$SUPERCRONIC_URL" \ |
| 61 | + && echo "${SUPERCRONIC_SHA1SUM} ${SUPERCRONIC}" | sha1sum -c - \ |
| 62 | + && chmod +x "$SUPERCRONIC" \ |
| 63 | + && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \ |
| 64 | + && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic |
| 65 | + |
| 66 | +COPY conf/supervisor/cron.conf.rootless /etc/supervisor/conf.d/cron.conf |
| 67 | +COPY conf/supervisor/nginx.conf /etc/supervisor/conf.d/nginx.conf |
| 68 | +COPY conf/supervisor/php.conf /etc/supervisor/conf.d/php.conf |
| 69 | + |
| 70 | +RUN sed -i 's,listen 80;,listen 8080;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \ |
| 71 | + && sed -i 's,listen \[\:\:\]\:80;,listen \[\:\:\]\:8080;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \ |
| 72 | + && rm /etc/nginx/sites-enabled/default \ |
| 73 | + && cp /usr/share/passbolt/examples/nginx-passbolt-ssl.conf /etc/nginx/snippets/passbolt-ssl.conf \ |
| 74 | + && sed -i 's,;clear_env = no,clear_env = no,' /etc/php/$PHP_VERSION/fpm/pool.d/www.conf \ |
| 75 | + && sed -i 's,# include __PASSBOLT_SSL__,include /etc/nginx/snippets/passbolt-ssl.conf;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \ |
| 76 | + && sed -i 's,listen \[\:\:\]\:443 ssl http2;,listen \[\:\:\]\:4433 ssl http2;,' /etc/nginx/snippets/passbolt-ssl.conf \ |
| 77 | + && sed -i '/listen \[\:\:\]\:4433 ssl http2;/a \ \ listen 4433 ssl http2;' /etc/nginx/snippets/passbolt-ssl.conf \ |
| 78 | + && sed -i 's,__CERT_PATH__,/etc/passbolt/certs/certificate.crt;,' /etc/nginx/snippets/passbolt-ssl.conf \ |
| 79 | + && sed -i 's,__KEY_PATH__,/etc/passbolt/certs/certificate.key;,' /etc/nginx/snippets/passbolt-ssl.conf \ |
| 80 | + && sed -i '/user www-data;/d' /etc/nginx/nginx.conf \ |
| 81 | + && sed -i 's,/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \ |
| 82 | + && sed -i "/^http {/a \ proxy_temp_path /tmp/proxy_temp;\n client_body_temp_path /tmp/client_temp;\n fastcgi_temp_path /tmp/fastcgi_temp;\n uwsgi_temp_path /tmp/uwsgi_temp;\n scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \ |
| 83 | + && sed -i "s,listen = /run/php/php$PHP_VERSION-fpm.sock,listen = 127.0.0.1:9000," /etc/php/$PHP_VERSION/fpm/pool.d/www.conf \ |
| 84 | + && sed -i "s,unix:/run/php/php$PHP_VERSION-fpm.sock,127.0.0.1:9000," /etc/nginx/sites-enabled/nginx-passbolt.conf \ |
| 85 | + && sed -i "s,pid = /run/php/php$PHP_VERSION-fpm.pid,pid = /tmp/php$PHP_VERSION-fpm.pid," /etc/php/$PHP_VERSION/fpm/php-fpm.conf \ |
| 86 | + && sed -i 's,/var/run/supervisor.sock,/tmp/supervisor.sock,' /etc/supervisor/supervisord.conf \ |
| 87 | + && chown -R www-data:0 /etc/nginx \ |
| 88 | + && chmod -R g+w /etc/nginx \ |
| 89 | + && mkdir /etc/passbolt/certs \ |
| 90 | + && chown www-data:0 /etc/passbolt/certs \ |
| 91 | + && chown www-data:0 /etc/passbolt/jwt \ |
| 92 | + && chown www-data:0 /var/log/supervisor \ |
| 93 | + && chown www-data:0 /etc/supervisor/conf.d/cron.conf \ |
| 94 | + && chown www-data:0 /etc/supervisor/conf.d/php.conf \ |
| 95 | + && chown www-data:0 /etc/supervisor/conf.d/nginx.conf \ |
| 96 | + && chown -R www-data:0 /var/log/nginx \ |
| 97 | + && ln -sf /dev/stdout /var/log/nginx/passbolt-access.log \ |
| 98 | + && ln -sf /dev/stderr /var/log/nginx/passbolt-error.log \ |
| 99 | + && chown -R www-data:0 /var/log/supervisor \ |
| 100 | + && touch /var/www/.profile \ |
| 101 | + && chown www-data:0 /var/www/.profile \ |
| 102 | + && sed -i 's,www-data\s,,' /etc/cron.d/$PASSBOLT_PKG \ |
| 103 | + && sed -i "s,__PASSBOLT_PACKAGE__,$PASSBOLT_PKG," /etc/supervisor/conf.d/cron.conf \ |
| 104 | + && touch /etc/environment \ |
| 105 | + && chown www-data:0 /etc/environment \ |
| 106 | + && chmod 600 /etc/environment |
| 107 | + |
| 108 | +COPY conf/php/zz-docker.conf /etc/php/$PHP_VERSION/fpm/pool.d/zz-docker.conf |
| 109 | +COPY scripts/entrypoint/docker-entrypoint.openshift.sh /docker-entrypoint.sh |
| 110 | +COPY scripts/entrypoint/passbolt/entrypoint-openshift.sh /passbolt/entrypoint-openshift.sh |
| 111 | +COPY scripts/entrypoint/passbolt/env.sh /passbolt/env.sh |
| 112 | +COPY scripts/entrypoint/passbolt/deprecated_paths.sh /passbolt/deprecated_paths.sh |
| 113 | +COPY scripts/wait-for.sh /usr/bin/wait-for.sh |
| 114 | + |
| 115 | +RUN chmod 0644 /etc/supervisor/conf.d/* \ |
| 116 | + && chmod 0755 /docker-entrypoint.sh \ |
| 117 | + && chmod 0755 /passbolt/* \ |
| 118 | + && chmod 0755 /usr/bin/wait-for.sh |
| 119 | + |
| 120 | +# Changes ownership of some files for Openshift compatibility |
| 121 | +RUN chgrp -R 0 /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \ |
| 122 | + chmod -R g=u /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \ |
| 123 | + chgrp 0 /var/run && \ |
| 124 | + chmod g=u /var/run && \ |
| 125 | + mkdir /var/run/php && \ |
| 126 | + chgrp -R 0 /var/run/php && \ |
| 127 | + chmod -R g=u /var/run/php |
| 128 | + |
| 129 | +# Openshift uses a random UID which is added to the root group. This mimics the functionality with the default user we provide. |
| 130 | +RUN usermod -a -G root www-data |
| 131 | + |
| 132 | +EXPOSE 8080 4433 |
| 133 | + |
| 134 | +WORKDIR /usr/share/php/passbolt |
| 135 | + |
| 136 | +USER www-data |
| 137 | + |
| 138 | +CMD ["/docker-entrypoint.sh"] |
0 commit comments