Skip to content

Commit 0e85faf

Browse files
LordRobinCbzLordRobinCbz
committed
fix(dockerfiles, config.inc.php): Add ENV in Dockerfile, edited templates, add PMA_SSLS in the README and add PMA_SSL_DIR to set output path for certificate generation
1 parent 35ad5ea commit 0e85faf

15 files changed

+140
-66
lines changed

‎Dockerfile-alpine.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ RUN set -ex; \
3939

4040
# set recommended PHP.ini settings
4141
# see https://secure.php.net/manual/en/opcache.installation.php
42+
ENV PMA_SSL_DIR /etc/phpmyadmin/ssl
4243
ENV MAX_EXECUTION_TIME 600
4344
ENV MEMORY_LIMIT 512M
4445
ENV UPLOAD_LIMIT 2048K

‎Dockerfile-debian.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ RUN set -ex; \
5050

5151
# set recommended PHP.ini settings
5252
# see https://secure.php.net/manual/en/opcache.installation.php
53+
ENV PMA_SSL_DIR /etc/phpmyadmin/ssl
5354
ENV MAX_EXECUTION_TIME 600
5455
ENV MEMORY_LIMIT 512M
5556
ENV UPLOAD_LIMIT 2048K

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,9 @@ docker run --name phpmyadmin -d -e PMA_HOSTS='sslhost,nosslhost' -e PMA_SSLS='1,
184184
* ``PMA_PORTS`` - define comma separated list of ports of the MySQL servers
185185
* ``PMA_SOCKET`` - define socket file for the MySQL connection
186186
* ``PMA_SOCKETS`` - define comma separated list of socket files for the MySQL connections
187+
* ``PMA_SSL_DIR`` - define the path used for SSL files generated from environement variables, default value is `/etc/phpmyadmin/ssl`
187188
* ``PMA_SSL`` - when set to 1, defines SSL usage for the MySQL connection
189+
* ``PMA_SSLS`` - comma separated list of `0` and `1` defining SSL usage for the corresponding MySQL connections
188190
* ``PMA_SSL_VERIFY`` - when set to 1, enables SSL certificate verification for the MySQL connection.
189191
* ``PMA_SSL_VERIFIES`` - comma-separated list of `0` and `1` to enable or disable SSL certificate verification for multiple MySQL connections.
190192
* ``PMA_SSL_CA_BASE64`` - in the context of mutual TLS security, allows setting your CA file as a base64 string inside the default `config.inc.php`.

‎apache/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ RUN set -ex; \
5151

5252
# set recommended PHP.ini settings
5353
# see https://secure.php.net/manual/en/opcache.installation.php
54+
ENV PMA_SSL_DIR /etc/phpmyadmin/ssl
5455
ENV MAX_EXECUTION_TIME 600
5556
ENV MEMORY_LIMIT 512M
5657
ENV UPLOAD_LIMIT 2048K
@@ -140,7 +141,6 @@ RUN set -ex; \
140141

141142
# Copy configuration
142143
COPY config.inc.php /etc/phpmyadmin/config.inc.php
143-
COPY helpers.php /etc/phpmyadmin/helpers.php
144144
RUN chown www-data:www-data -R /etc/phpmyadmin/
145145

146146
# Copy main script

‎apache/config.inc.php‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
<?php
22

3-
define('SSL_DIR', '/etc/phpmyadmin/ssl');
4-
53
require '/etc/phpmyadmin/config.secret.inc.php';
64
require '/etc/phpmyadmin/helpers.php';
75

@@ -39,7 +37,8 @@
3937
'PMA_SSL_VERIFIES',
4038
'PMA_SSL_CAS',
4139
'PMA_SSL_KEYS',
42-
'PMA_SSL_CERTS'
40+
'PMA_SSL_CERTS',
41+
'PMA_PMA_SSL_DIR'
4342
];
4443

4544
foreach ($vars as $var) {
@@ -67,29 +66,29 @@
6766
}
6867

6968
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
70-
if (!is_dir(SSL_DIR)) {
71-
mkdir(SSL_DIR, 0755, true);
69+
if (!is_dir(PMA_SSL_DIR)) {
70+
mkdir(PMA_SSL_DIR, 0755, true);
7271
}
73-
file_put_contents(SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
74-
$_ENV['PMA_SSL_CA'] = SSL_DIR . '/pma-ssl-ca.pem';
72+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
73+
$_ENV['PMA_SSL_CA'] = PMA_SSL_DIR . '/pma-ssl-ca.pem';
7574
}
7675

7776
/* Decode and save the SSL key from base64 */
7877
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
79-
if (!is_dir(SSL_DIR)) {
80-
mkdir(SSL_DIR, 0755, true);
78+
if (!is_dir(PMA_SSL_DIR)) {
79+
mkdir(PMA_SSL_DIR, 0755, true);
8180
}
82-
file_put_contents(SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
83-
$_ENV['PMA_SSL_KEY'] = SSL_DIR . '/pma-ssl-key.key';
81+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
82+
$_ENV['PMA_SSL_KEY'] = PMA_SSL_DIR . '/pma-ssl-key.key';
8483
}
8584

8685
/* Decode and save the SSL certificate from base64 */
8786
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
88-
if (!is_dir(SSL_DIR)) {
89-
mkdir(SSL_DIR, 0755, true);
87+
if (!is_dir(PMA_SSL_DIR)) {
88+
mkdir(PMA_SSL_DIR, 0755, true);
9089
}
91-
file_put_contents(SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
92-
$_ENV['PMA_SSL_CERT'] = SSL_DIR . '/pma-ssl-cert.pem';
90+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
91+
$_ENV['PMA_SSL_CERT'] = PMA_SSL_DIR . '/pma-ssl-cert.pem';
9392
}
9493

9594
/* Decode and save multiple SSL CA certificates from base64 */

‎apache/helpers.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22

33

4-
define('OUTPUT_DIR', '/etc/phpmyadmin/ssl');
4+
define('PMA_SSL_DIR', $_ENV['PMA_SSL_DIR'] ?? '/etc/phpmyadmin/ssl');
55

66
/**
77
* Helper function to decode and save multiple SSL files from base64.
@@ -14,8 +14,8 @@
1414
*/
1515
function decodeAndSaveSslFiles(string $base64_string, string $prefix, string $extension): array {
1616
// Ensure the output directory exists
17-
if (!is_dir(OUTPUT_DIR)) {
18-
mkdir(OUTPUT_DIR, 0755, true);
17+
if (!is_dir(PMA_SSL_DIR)) {
18+
mkdir(PMA_SSL_DIR, 0755, true);
1919
}
2020

2121
// Split the base64 string into an array of files
@@ -25,7 +25,7 @@ function decodeAndSaveSslFiles(string $base64_string, string $prefix, string $ex
2525

2626
// Process each file
2727
foreach ($files as $file) {
28-
$output_file = OUTPUT_DIR . "/pma-ssl-$prefix-$counter.$extension";
28+
$output_file = PMA_SSL_DIR . "/pma-ssl-$prefix-$counter.$extension";
2929

3030
// Write the decoded file to the output directory
3131
if (file_put_contents($output_file, base64_decode($file)) === false) {

‎config.inc.php‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
require '/etc/phpmyadmin/config.secret.inc.php';
4+
require '/etc/phpmyadmin/helpers.php';
45

56
/* Ensure we got the environment */
67
$vars = [
@@ -28,7 +29,16 @@
2829
'PMA_UPLOADDIR',
2930
'PMA_SAVEDIR',
3031
'PMA_SSL',
32+
'PMA_SSL_VERIFY',
33+
'PMA_SSL_CA',
34+
'PMA_SSL_KEY',
35+
'PMA_SSL_CERT',
3136
'PMA_SSLS',
37+
'PMA_SSL_VERIFIES',
38+
'PMA_SSL_CAS',
39+
'PMA_SSL_KEYS',
40+
'PMA_SSL_CERTS',
41+
'PMA_PMA_SSL_DIR'
3242
];
3343

3444
foreach ($vars as $var) {
@@ -55,6 +65,47 @@
5565
$cfg['PmaAbsoluteUri'] = trim($_ENV['PMA_ABSOLUTE_URI']);
5666
}
5767

68+
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
69+
if (!is_dir(PMA_SSL_DIR)) {
70+
mkdir(PMA_SSL_DIR, 0755, true);
71+
}
72+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
73+
$_ENV['PMA_SSL_CA'] = PMA_SSL_DIR . '/pma-ssl-ca.pem';
74+
}
75+
76+
/* Decode and save the SSL key from base64 */
77+
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
78+
if (!is_dir(PMA_SSL_DIR)) {
79+
mkdir(PMA_SSL_DIR, 0755, true);
80+
}
81+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
82+
$_ENV['PMA_SSL_KEY'] = PMA_SSL_DIR . '/pma-ssl-key.key';
83+
}
84+
85+
/* Decode and save the SSL certificate from base64 */
86+
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
87+
if (!is_dir(PMA_SSL_DIR)) {
88+
mkdir(PMA_SSL_DIR, 0755, true);
89+
}
90+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
91+
$_ENV['PMA_SSL_CERT'] = PMA_SSL_DIR . '/pma-ssl-cert.pem';
92+
}
93+
94+
/* Decode and save multiple SSL CA certificates from base64 */
95+
if (isset($_ENV['PMA_SSL_CAS_BASE64'])) {
96+
$_ENV['PMA_SSL_CAS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CAS_BASE64'], 'CA', 'pem');
97+
}
98+
99+
/* Decode and save multiple SSL keys from base64 */
100+
if (isset($_ENV['PMA_SSL_KEYS_BASE64'])) {
101+
$_ENV['PMA_SSL_KEYS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_KEYS_BASE64'], 'CERT', 'cert');
102+
}
103+
104+
/* Decode and save multiple SSL certificates from base64 */
105+
if (isset($_ENV['PMA_SSL_CERTS_BASE64'])) {
106+
$_ENV['PMA_SSL_CERTS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CERTS_BASE64'], 'KEY', 'key');
107+
}
108+
58109
/* Figure out hosts */
59110

60111
/* Fallback to default linked */
@@ -66,11 +117,19 @@
66117
$verbose = [$_ENV['PMA_VERBOSE']];
67118
$ports = [$_ENV['PMA_PORT']];
68119
$ssls = [$_ENV['PMA_SSL']];
120+
$ssl_verifies = [$_ENV['PMA_SSL_VERIFY']];
121+
$ssl_cas = [$_ENV['PMA_SSL_CA']];
122+
$ssl_keys = [$_ENV['PMA_SSL_KEY']];
123+
$ssl_certs = [$_ENV['PMA_SSL_CERT']];
69124
} elseif (! empty($_ENV['PMA_HOSTS'])) {
70125
$hosts = array_map('trim', explode(',', $_ENV['PMA_HOSTS']));
71126
$verbose = array_map('trim', explode(',', $_ENV['PMA_VERBOSES']));
72127
$ports = array_map('trim', explode(',', $_ENV['PMA_PORTS']));
73128
$ssls = array_map('trim', explode(',', $_ENV['PMA_SSLS']));
129+
$ssl_verifies = array_map('trim', explode(',', $_ENV['PMA_SSL_VERIFIES']));
130+
$ssl_cas = array_map('trim', explode(',', $_ENV['PMA_SSL_CAS']));
131+
$ssl_keys = array_map('trim', explode(',', $_ENV['PMA_SSL_KEYS']));
132+
$ssl_certs = array_map('trim', explode(',', $_ENV['PMA_SSL_CERTS']));
74133
}
75134

76135
if (! empty($_ENV['PMA_SOCKET'])) {
@@ -84,6 +143,18 @@
84143
if (isset($ssls[$i - 1]) && $ssls[$i - 1] === '1') {
85144
$cfg['Servers'][$i]['ssl'] = $ssls[$i - 1];
86145
}
146+
if (isset($ssl_verifies[$i - 1]) && $ssl_verifies[$i - 1] === '1') {
147+
$cfg['Servers'][$i]['ssl_verify'] = $ssl_verifies[$i - 1];
148+
}
149+
if (isset($ssl_cas[$i - 1])) {
150+
$cfg['Servers'][$i]['ssl_ca'] = $ssl_cas[$i - 1];
151+
}
152+
if (isset($ssl_keys[$i - 1])) {
153+
$cfg['Servers'][$i]['ssl_key'] = $ssl_keys[$i - 1];
154+
}
155+
if (isset($ssl_certs[$i - 1])) {
156+
$cfg['Servers'][$i]['ssl_cert'] = $ssl_certs[$i - 1];
157+
}
87158
$cfg['Servers'][$i]['host'] = $hosts[$i - 1];
88159
if (isset($verbose[$i - 1])) {
89160
$cfg['Servers'][$i]['verbose'] = $verbose[$i - 1];

‎fpm-alpine/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ RUN set -ex; \
4040

4141
# set recommended PHP.ini settings
4242
# see https://secure.php.net/manual/en/opcache.installation.php
43+
ENV PMA_SSL_DIR /etc/phpmyadmin/ssl
4344
ENV MAX_EXECUTION_TIME 600
4445
ENV MEMORY_LIMIT 512M
4546
ENV UPLOAD_LIMIT 2048K
@@ -120,7 +121,6 @@ RUN set -ex; \
120121

121122
# Copy configuration
122123
COPY config.inc.php /etc/phpmyadmin/config.inc.php
123-
COPY helpers.php /etc/phpmyadmin/helpers.php
124124
RUN chown www-data:www-data -R /etc/phpmyadmin/
125125

126126
# Copy main script

‎fpm-alpine/config.inc.php‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
<?php
22

3-
define('SSL_DIR', '/etc/phpmyadmin/ssl');
4-
53
require '/etc/phpmyadmin/config.secret.inc.php';
64
require '/etc/phpmyadmin/helpers.php';
75

@@ -39,7 +37,8 @@
3937
'PMA_SSL_VERIFIES',
4038
'PMA_SSL_CAS',
4139
'PMA_SSL_KEYS',
42-
'PMA_SSL_CERTS'
40+
'PMA_SSL_CERTS',
41+
'PMA_PMA_SSL_DIR'
4342
];
4443

4544
foreach ($vars as $var) {
@@ -67,29 +66,29 @@
6766
}
6867

6968
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
70-
if (!is_dir(SSL_DIR)) {
71-
mkdir(SSL_DIR, 0755, true);
69+
if (!is_dir(PMA_SSL_DIR)) {
70+
mkdir(PMA_SSL_DIR, 0755, true);
7271
}
73-
file_put_contents(SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
74-
$_ENV['PMA_SSL_CA'] = SSL_DIR . '/pma-ssl-ca.pem';
72+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
73+
$_ENV['PMA_SSL_CA'] = PMA_SSL_DIR . '/pma-ssl-ca.pem';
7574
}
7675

7776
/* Decode and save the SSL key from base64 */
7877
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
79-
if (!is_dir(SSL_DIR)) {
80-
mkdir(SSL_DIR, 0755, true);
78+
if (!is_dir(PMA_SSL_DIR)) {
79+
mkdir(PMA_SSL_DIR, 0755, true);
8180
}
82-
file_put_contents(SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
83-
$_ENV['PMA_SSL_KEY'] = SSL_DIR . '/pma-ssl-key.key';
81+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
82+
$_ENV['PMA_SSL_KEY'] = PMA_SSL_DIR . '/pma-ssl-key.key';
8483
}
8584

8685
/* Decode and save the SSL certificate from base64 */
8786
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
88-
if (!is_dir(SSL_DIR)) {
89-
mkdir(SSL_DIR, 0755, true);
87+
if (!is_dir(PMA_SSL_DIR)) {
88+
mkdir(PMA_SSL_DIR, 0755, true);
9089
}
91-
file_put_contents(SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
92-
$_ENV['PMA_SSL_CERT'] = SSL_DIR . '/pma-ssl-cert.pem';
90+
file_put_contents(PMA_SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
91+
$_ENV['PMA_SSL_CERT'] = PMA_SSL_DIR . '/pma-ssl-cert.pem';
9392
}
9493

9594
/* Decode and save multiple SSL CA certificates from base64 */

‎fpm-alpine/docker-entrypoint.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ if [ ! -z "${PMA_USER_CONFIG_BASE64}" ]; then
2929
echo "${PMA_USER_CONFIG_BASE64}" | base64 -d > /etc/phpmyadmin/config.user.inc.php
3030
fi
3131

32+
3233
get_docker_secret() {
3334
local env_var="${1}"
3435
local env_var_file="${env_var}_FILE"

0 commit comments

Comments
 (0)