From 2d41540111b05c3f1865bea0c09b7a93e7d72731 Mon Sep 17 00:00:00 2001 From: Thomas Boksberger Date: Fri, 3 Mar 2023 15:20:27 +0100 Subject: [PATCH] init docker files --- .space.kts | 34 +++++ CODEOWNERS | 25 ---- Dockerfile | 75 ++++++++++ apache2.conf | 358 +++++++++++++++++++++++++++++++++++++++++++++++ httpd-foreground | 9 ++ index.html | 26 ++++ 6 files changed, 502 insertions(+), 25 deletions(-) create mode 100644 .space.kts delete mode 100644 CODEOWNERS create mode 100644 Dockerfile create mode 100644 apache2.conf create mode 100755 httpd-foreground create mode 100644 index.html diff --git a/.space.kts b/.space.kts new file mode 100644 index 0000000..0914982 --- /dev/null +++ b/.space.kts @@ -0,0 +1,34 @@ +job("Docker") { + host("Build and push a Docker image") { + dockerBuildPush { + // by default, the step runs not only 'docker build' but also 'docker push' + // to disable pushing, add the following line: + // push = false + + // path to Docker context (by default, context is working dir) + // context = "backend" + + // path to Dockerfile relative to the project root + // if 'file' is not specified, Docker will look for it in 'context'/Dockerfile + //file = "docker/config/Dockerfile" + + // build-time variables + //args["HTTP_PROXY"] = "http://10.20.30.2:1234" + + // image labels + //labels["vendor"] = "mycompany" + + // to add a raw list of additional build arguments, use + // extraArgsForBuildCommand = listOf("...") + + // to add a raw list of additional push arguments, use + // extraArgsForPushCommand = listOf("...") + + // image tags + tags { + // use current job run number as a tag - '0.0.run_number' + +"boxi.registry.jetbrains.space/p/boxit/containers/boxit-apacheOIDC:0.0.${"$"}JB_SPACE_EXECUTION_NUMBER" + } + } + } +} diff --git a/CODEOWNERS b/CODEOWNERS deleted file mode 100644 index 682f5ad..0000000 --- a/CODEOWNERS +++ /dev/null @@ -1,25 +0,0 @@ -# Each line represents a rule, followed by a list of members. -# These members are the default owners for all files that match the specified pattern. -# The pattern generally follows the same syntax used for .gitignore files. -# The last matching rule always wins; those that appear lower in the file take precedence over rules that appear higher up. -# Specify owners by their username, email, or role assignment in the project. - -# Examples: - -# Member with username "john.smith" and member with email "alex@mycompany.com" -# own any JavaScript file in repository -# *.js john.smith alex@mycompany.com - -# Bob owns all files under "subdir" directory at the repository root and all its subdirectories -# /subdir/ Bob - -# All members from team named "Product Team" file under root "Product Documentation" directory -# "/Product Documentation" "Product Team" - -# All members who are assigned the Project Collaborator role own any file under docs/ directory -# anywhere in the repository, but not further nested files -# docs/* "Project Collaborator" - -# This file itself is owned by members who are assigned the Project Admin role in this project. -CODEOWNERS "Project Admin" -`` diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..6047581 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,75 @@ +FROM ubuntu:20.04 +MAINTAINER ich@boxi.ch + +LABEL name="Apache HTTPD Reverse-Proxy with OpenID Connect Authentication support based on Ubuntu 20.04" + +ARG DEBIAN_FRONTEND=noninteractive + +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + apache2 curl wget \ + ca-certificates \ + libjansson4 \ + libapache2-mod-auth-openidc \ + vim apt-utils && \ + rm -rf /var/lib/apt/lists/* && \ + a2enmod auth_openidc && \ + a2enmod headers && \ + a2enmod proxy && \ + a2enmod proxy_http && \ + a2enmod rewrite && \ + a2enmod ssl && \ + a2enmod env && \ + a2enmod mime && \ + a2enmod proxy_wstunnel && \ + a2enmod negotiation + +ADD apache2.conf /etc/apache2/apache2.conf + +ENV APACHE_RUN_GROUP www-data +ENV APACHE_RUN_USER www-data +ENV APACHE_RUN_DIR /var/run/apache2 +ENV APACHE_PID_FILE /var/run/apache2/pid +ENV APACHE_LOG_DIR /var/log/apache2 + +# set to debug to debug apache oid problems +# BE AWARE: loglevel debug will log all tokens and MUST NEVER be used in production +ENV APACHE_DEBUG_LEVEL warn + +# add and configure default ssl certs +#ADD apache.crt /etc/ssl/certs/ssl.crt +#ADD apache.key /etc/ssl/private/ssl.key +#ENV SSL_CERTIFICATE_FILE "/etc/ssl/certs/ssl.crt" +#ENV SSL_CERTIFICATE_KEY_FILE "/etc/ssl/private/ssl.key" + +ENV SERVER_NAME "localhost" + +ENV KC_ADDR "http://kubernetes.docker.internal:8081" +ENV KC_REALM "boxit" +ENV OIDC_CLIENT_ID "c7300da4-df95-412d-8fc7-0759ac4e781c" +ENV OIDC_CLIENT_SECRET 'e08f6a4d-e2f0-4929-a85f-29c817a17168' +ENV OIDC_AUDIENCE "audience=https%3A%2F%2Fdev.7mal8.ch%2F" +ENV OIDC_SCOPE "openid name email" +ENV OIDC_REDIRECT_URI "http://localhost/openidc" +ENV OIDC_CRYPTO_PASSPHRASE 'some_random_secret_4321' +ENV OIDC_INFO_HOOK "iat access_token access_token_expires id_token userinfo" +ENV OIDC_PROVIDER_URL "http://id.boxi.ch" +ENV OIDC_PROVIDER_ENDSESSION_ENDPOINT "/v2/logout" +ENV OIDC_RETURN_TO "http://localhost/openidc?logout=get" + +RUN mkdir -p /var/run/apache2 /var/www/html/app && \ + mkdir -p /config/global.d && \ + mkdir -p /config/vhost-80.d && \ + mkdir -p /config/vhost-443.d && \ + chmod -R 755 /var/www/html/app && \ + chown -R www-data /var/run/apache2 /var/log/apache2 /var/www/html/app && \ + rm /etc/apache2/sites-enabled/000-default.conf + +ADD index.html /var/www/html/app +# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop +STOPSIGNAL WINCH + +COPY httpd-foreground /usr/local/bin/ + +EXPOSE 80 +CMD ["httpd-foreground"] diff --git a/apache2.conf b/apache2.conf new file mode 100644 index 0000000..d825c15 --- /dev/null +++ b/apache2.conf @@ -0,0 +1,358 @@ +# This is the main Apache server configuration file. It contains the +# configuration directives that give the server its instructions. +# See http://httpd.apache.org/docs/2.4/ for detailed information about +# the directives and /usr/share/doc/apache2/README.Debian about Debian specific +# hints. +# +# +# Summary of how the Apache 2 configuration works in Debian: +# The Apache 2 web server configuration in Debian is quite different to +# upstream's suggested way to configure the web server. This is because Debian's +# default Apache2 installation attempts to make adding and removing modules, +# virtual hosts, and extra configuration directives as flexible as possible, in +# order to make automating the changes and administering the server as easy as +# possible. + +# It is split into several files forming the configuration hierarchy outlined +# below, all located in the /etc/apache2/ directory: +# +# /etc/apache2/ +# |-- apache2.conf +# | `-- ports.conf +# |-- mods-enabled +# | |-- *.load +# | `-- *.conf +# |-- conf-enabled +# | `-- *.conf +# `-- sites-enabled +# `-- *.conf +# +# +# * apache2.conf is the main configuration file (this file). It puts the pieces +# together by including all remaining configuration files when starting up the +# web server. +# +# * ports.conf is always included from the main configuration file. It is +# supposed to determine listening ports for incoming connections which can be +# customized anytime. +# +# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/ +# directories contain particular configuration snippets which manage modules, +# global configuration fragments, or virtual host configurations, +# respectively. +# +# They are activated by symlinking available configuration files from their +# respective *-available/ counterparts. These should be managed by using our +# helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See +# their respective man pages for detailed information. +# +# * The binary is called apache2. Due to the use of environment variables, in +# the default configuration, apache2 needs to be started/stopped with +# /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not +# work with the default configuration. + + +# Global configuration +# + +# +# ServerRoot: The top of the directory tree under which the server's +# configuration, error, and log files are kept. +# +# NOTE! If you intend to place this on an NFS (or otherwise network) +# mounted filesystem then please read the Mutex documentation (available +# at ); +# you will save yourself a lot of trouble. +# +# Do NOT add a slash at the end of the directory path. +# +#ServerRoot "/etc/apache2" + +# +# The accept serialization lock file MUST BE STORED ON A LOCAL DISK. +# +#Mutex file:${APACHE_LOCK_DIR} default + +# +# The directory where shm and other runtime files will be stored. +# + +DefaultRuntimeDir ${APACHE_RUN_DIR} + +# +# PidFile: The file in which the server should record its process +# identification number when it starts. +# This needs to be set in /etc/apache2/envvars +# +PidFile ${APACHE_PID_FILE} + +# +# Timeout: The number of seconds before receives and sends time out. +# +Timeout 300 + +# +# KeepAlive: Whether or not to allow persistent connections (more than +# one request per connection). Set to "Off" to deactivate. +# +KeepAlive On + +# +# MaxKeepAliveRequests: The maximum number of requests to allow +# during a persistent connection. Set to 0 to allow an unlimited amount. +# We recommend you leave this number high, for maximum performance. +# +MaxKeepAliveRequests 100 + +# +# KeepAliveTimeout: Number of seconds to wait for the next request from the +# same client on the same connection. +# +KeepAliveTimeout 5 + + +# These need to be set in /etc/apache2/envvars +User ${APACHE_RUN_USER} +Group ${APACHE_RUN_GROUP} + +# +# HostnameLookups: Log the names of clients or just their IP addresses +# e.g., www.apache.org (on) or 204.62.129.132 (off). +# The default is off because it'd be overall better for the net if people +# had to knowingly turn this feature on, since enabling it means that +# each client request will result in AT LEAST one lookup request to the +# nameserver. +# +HostnameLookups Off + +# ErrorLog: The location of the error log file. +# If you do not specify an ErrorLog directive within a +# container, error messages relating to that virtual host will be +# logged here. If you *do* define an error logfile for a +# container, that host's errors will be logged there and not here. +# +ErrorLog /dev/stderr + +# +# LogLevel: Control the severity of messages logged to the error_log. +# Available values: trace8, ..., trace1, debug, info, notice, warn, +# error, crit, alert, emerg. +# It is also possible to configure the log level for particular modules, e.g. +# "LogLevel info ssl:warn" +# +LogLevel ${APACHE_DEBUG_LEVEL} + +# Include module configuration: +IncludeOptional mods-enabled/*.load +IncludeOptional mods-enabled/*.conf + +# Include list of ports to listen on +Include ports.conf + + +# Sets the default security model of the Apache2 HTTPD server. It does +# not allow access to the root filesystem outside of /usr/share and /var/www. +# The former is used by web applications packaged in Debian, +# the latter may be used for local directories served by the web server. If +# your system is serving content from a sub-directory in /srv you must allow +# access here, or in any related virtual host. + + Options FollowSymLinks + AllowOverride None + Require all denied + + + + AllowOverride None + Require all granted + + + + Options Indexes FollowSymLinks + AllowOverride None + Require all granted + + +# +# Options Indexes FollowSymLinks +# AllowOverride None +# Require all granted +# + + + + +# AccessFileName: The name of the file to look for in each directory +# for additional configuration directives. See also the AllowOverride +# directive. +# +AccessFileName .htaccess + +# +# The following lines prevent .htaccess and .htpasswd files from being +# viewed by Web clients. +# + + Require all denied + + + +# +# The following directives define some format nicknames for use with +# a CustomLog directive. +# +# These deviate from the Common Log Format definitions in that they use %O +# (the actual bytes sent including headers) instead of %b (the size of the +# requested file), because the latter makes it impossible to detect partial +# requests. +# +# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended. +# Use mod_remoteip instead. +# +LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined +LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined +LogFormat "%h %l %u %t \"%r\" %>s %O" common +LogFormat "%{Referer}i -> %U" referer +LogFormat "%{User-agent}i" agent + +# Include of directories ignores editors' and dpkg's backup files, +# see README.Debian for details. + +# Include generic snippets of statements +IncludeOptional conf-enabled/*.conf + + +IncludeOptional /config/global-*.conf + +# Include the virtual host configurations: +#IncludeOptional sites-enabled/*.conf + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet + +# hide Apache version and OS information +ServerTokens Prod +ServerSignature Off + +LimitRequestFieldSize 32760 + +ServerName ${SERVER_NAME} + +#Listen 80 + + DocumentRoot "/var/www/html/app" + LogLevel ${APACHE_DEBUG_LEVEL} + + Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" + Header always set Content-Security-Policy "default-src 'self' ; \ + script-src 'self' 'unsafe-inline' 'unsafe-eval'; \ + style-src 'self' fonts.googleapis.com use.fontawesome.com 'unsafe-inline'; \ + font-src 'self' data: fonts.googleapis.com fonts.googleapis.com use.fontawesome.com fonts.gstatic.com; \ + base-uri 'self'; \ + form-action 'self'; \ + frame-ancestors 'none'; \ + img-src 'self' api.mapbox.com data:; \ + #upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i" + Header always append X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Referrer-Policy "same-origin" + # this feature is not yet used and must be extended if needed, currently only a sample config + Header always set Feature-Policy "payment 'none';" + + AddType text/css .css + AddType text/html .html .htm + AddType application/javascript .js .jsonp + AddType application/json .json + AddType image/svg+xml .svg .svgz + AddType application/octet-stream .xyz + AddEncoding gzip .svgz + + RequestHeader set X-Forwarded-User expr=%{REMOTE_USER} + RequestHeader set X-Forwarded-Proto "https" + RequestHeader set Authorization "Bearer %{oidc_access_token}e" + Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e" + + # mods-available/auth_openidc.conf + #OIDCOAuthServerMetadataURL ${OIDC_PROVIDER_METADATA_URL} + OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration + OIDCClientID ${OIDC_CLIENT_ID} + OIDCClientSecret ${OIDC_CLIENT_SECRET} + #OIDCAuthRequestParams ${OIDC_AUDIENCE} + #OIDCScope "${OIDC_SCOPE}" + + #OIDCSessionInactivityTimeout 1800 + #OIDCSessionMaxDuration 28800 + #OIDCUserInfoRefreshInterval 60 + OIDCRefreshAccessTokenBeforeExpiry 10 + + OIDCRedirectURI ${OIDC_REDIRECT_URI} + OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE} + OIDCInfoHook ${OIDC_INFO_HOOK} + OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fkubernetes.docker.internal%3A8800 + + # maps the prefered_username claim to the REMOTE_USER environment variable + OIDCRemoteUserClaim preferred_username + + OIDCCookieSameSite On # used for localdeployment -> set cookie with SameSite=lax + OIDCStateMaxNumberOfCookies 3 true + +# +# Satisfy Any +# AuthType None +# Require all granted +# Allow from all +# +# RewriteEngine on +# RewriteCond $1 .*/ws/.* +# RewriteRule "^(/ws/(.*))$" "ws://host.docker.internal:4200/ws/$2" [P,L] +# +# ProxyPass ws://.*/ws +# ProxyPassReverse ws://host.docker.internal:4200/ws +# LogLevel debug +# + + + AuthType openid-connect + Require valid-user + + + # If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance + # to check whether or not the user is even authenticated, leading to many failed requests. + # Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full + # authentication mechanic is being run. + # See also https://github.com/zmartzone/mod_auth_openidc/issues/113 + + FileETag None + Header unset ETag + Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate" + Header set Pragma "no-cache" + Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC" + + + # When loading non html assets (i.e. scripts, images etc) we do not want to start the full authentication process, + # we simply return a 401. Otherwise return unauthorized error if not authenticated for all HTML requests. + # By default it is a 302 redirect to id.7mal8.ch, which can lead to a build-up of mod_auth_openidc_state cookies + # during XHR calls or resource loads. + # See also PURPID-647 + # + # OIDCUnAuthAction 401 + # + + + ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400 + ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws + + ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0 + ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ + + ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0 + ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT} + + # This entry must be below any other custom configuration to the location + # otherwise the server status page will be accessible to any authenticated user + + SetHandler server-status + + Require claim email~^(.*)@boxi.ch$ + + + diff --git a/httpd-foreground b/httpd-foreground new file mode 100755 index 0000000..a6383ac --- /dev/null +++ b/httpd-foreground @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# Apache gets grumpy about PID files pre-existing +rm -f /usr/local/apache2/logs/httpd.pid + + + +exec /usr/sbin/apache2 -DFOREGROUND "$@" \ No newline at end of file diff --git a/index.html b/index.html new file mode 100644 index 0000000..c38ecec --- /dev/null +++ b/index.html @@ -0,0 +1,26 @@ + + + + + Logged in! + + + +

Logged In

+

Logout

+ + +