inteligr8/SearchServices
1
0
Fork 0
mirror of https://github.com/Alfresco/SearchServices.git synced 2026-09-16 18:12:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Search Services Docker Image is released with Mutual Auth TLS by default.

Browse Source
This commit is contained in:
Angel Borroy
2019-06-12 16:22:40 +02:00
parent a102d9fde3
commit 812653ed20
2 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
search-services/README.md
+29 -26
View File
@@ -36,9 +36,9 @@ $ unzip alfresco-search-services-*.zip
$ cd alfresco-search-services
```
From Alfresco *Search Services 1.3.0.3*, distribution ZIP is released with Mutual Auth TLS (SSL) by default. So before starting the service, generating secure keys for SSL communication is required. You can find detailed information for this step at [Alfresco documentation](https://docs.alfresco.com/search-enterprise/tasks/generate-keys-ssl.html).
From Alfresco *Search Services 1.3.0.3*, distribution ZIP is released with Mutual Authentication TLS (SSL) by default. So before starting the service, generating secure keys for SSL communication is required. You can find detailed information for this step at [Alfresco documentation](https://docs.alfresco.com/search-enterprise/tasks/generate-keys-ssl.html).
The `keystores` folder generated by the SSL Tool contains the keystores and truststores for SSL configuration. In the following steps, it's assumed that SSL Tool has been executed from `/tmp` or `C:\tmp` folder.
The `keystores` folder generated by the SSL Tool contains the keystores and truststores for SSL configuration. In the following steps, it's assumed that SSL Tool has been executed from `/tmp` or `C:\tmp` folder.
```bash
$ tree /tmp/keystores/
@@ -62,7 +62,7 @@ keystores/
└── ssl.repo.client.truststore
```
SOLR SSL configuration files are available in `/tmp/keystores/solr` folder.
SOLR SSL configuration files are available in `/tmp/keystores/solr` folder.
These files must be copied to `rerank` configuration folder.
@@ -178,49 +178,35 @@ $ cd packaging/target/docker-resources/
$ docker build -t searchservices:develop .
```
*Search Services* Docker image is configured with **Plain HTTP** by default.
*Search Services* Docker image is configured with with **Mutual Authentication TLS (SSL)** by default.
**Configuration**
To run the docker image:
To pass an environment variable, it can be used the "-e" argument:
```bash
$ docker run -p 8983:8983 -e SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive searchservices:develop
$ docker run -e SOLR_JAVA_MEM="-Xms4g -Xmx4g" -p 8983:8983 searchservices:develop
```
SOLR Web Console will be available at:
[http://localhost:8983/solr](http://localhost:8983/solr)
**Additional configuration**
To pass an environment variable:
```bash
$ docker run -e SOLR_JAVA_MEM=“-Xms4g -Xmx4g” -p 8983:8983 searchservices:develop
```
To pass several environment variables (e.g. SOLR\_ALFRESCO\_HOST, SOLR\_ALFRESCO\_PORT, SOLR\_SOLR\_HOST, SOLR\_SOLR\_PORT, SOLR\_CREATE\_ALFRESCO\_DEFAULTS, SOLR\_HEAP, etc.):
To pass several environment variables (e.g. SOLR\_ALFRESCO\_HOST, SOLR\_ALFRESCO\_PORT, SOLR\_SOLR\_HOST, SOLR\_SOLR\_PORT, SOLR\_CREATE\_ALFRESCO\_DEFAULTS, SOLR\_HEAP, etc.), just include the "-e" argument as times as required:
```bash
$ docker run -e SOLR_ALFRESCO_HOST=localhost -e SOLR_ALFRESCO_PORT=8080 -p 8983:8983 searchservices:develop
```
**Using Mutual Auth TLS (SSL)**
This Docker image is exposing as VOLUME the folder `/opt/alfresco-search-services/keystores`, that can be used to mount `keystores` folder from host.
When an environment variable `ALFRESCO_SECURE_COMMS=https` is passed to the Docker container, SOLR will be started using SSL mode.
By default Docker image is using SSL, but an environment variable `ALFRESCO_SECURE_COMMS=https` can be also passed to the Docker container to declare explicitly the SSL mode.
Additionally, SOLR Jetty server must be configured to start in SSL Mode using `SOLR_SSL_*` environment variables and Search Services must be configured by using Java environment variables starting with `alfresco.encryption.ssl.*`
Additionally, SOLR Jetty server must be configured to start in SSL Mode using `SOLR_SSL_*` environment variables and Search Services must be configured by using Java environment variables starting with `alfresco.encryption.ssl.*`
Following command will start Search Services with SSL using keystores located at `/tmp/keystores/solr/tmp/keystores/solr`. Note that the internal folders are relative to `/opt/alfresco-search-services/keystores`, as this is the Docker container folder exposed to hold the keystores.
```bash
$ docker run -p 8983:8983 \
-v /tmp/keystores/solr:/opt/alfresco-search-services/keystores \
-e ALFRESCO_SECURE_COMMS=https \
-e SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive \
-e SOLR_SSL_KEY_STORE=/opt/alfresco-search-services/keystores/ssl.repo.client.keystore \
-e SOLR_SSL_KEY_STORE_PASSWORD=keystore \
@@ -245,6 +231,22 @@ SOLR Web Console will be available at:
[https://localhost:8983/solr](https://localhost:8983/solr)
*Note* You must install the `browser.p12` certificate in your browser in order to access to this URL.
**Using Plain HTTP**
By default Docker image is using SSL, so it's required to add an environment variable `ALFRESCO_SECURE_COMMS=none` to use SOLR in plain HTTP mode.
To run the docker image:
```bash
$ docker run -p 8983:8983 -e ALFRESCO_SECURE_COMMS=none -e SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive searchservices:develop
```
SOLR Web Console will be available at:
[http://localhost:8983/solr](http://localhost:8983/solr)
**Public Docker repository**
@@ -270,7 +272,8 @@ solr6:
# Alfresco needs to know how to call solr
SOLR_SOLR_HOST: "solr6"
SOLR_SOLR_PORT: "8983"
# SSL settings
# HTTP settings
ALFRESCO_SECURE_COMMS: "none"
#Create the default alfresco and archive cores
SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive"
SOLR_JAVA_MEM: "-Xms2g -Xmx2g"
@@ -344,7 +347,7 @@ This will start up Alfresco, Postgres, Share and SearchServices. You can access
* Alfresco: http://localhost:8081/alfresco
* Share: http://localhost:8082/share
* Solr: http://localhost:8083/solr
If you start version 5.x instead you can also access the API Explorer:
* API Explorer: http://localhost:8084/api-explorer
search-services/packaging/src/docker/search_config_setup.sh
+3 -3
View File
@@ -18,9 +18,9 @@ if [[ ! -z "$SOLR_JAVA_MEM" ]]; then
sed -i -e "s/.*SOLR_JAVA_MEM=.*/SOLR_JAVA_MEM=\"$SOLR_JAVA_MEM\"/g" $SOLR_IN_FILE
fi
# By default Docker Image is using plain HTTP for communications with Repository
# TLS Mutual Auth can be enabled by setting ALFRESCO_SECURE_COMMS to any value different from 'none' ('https' is recommended)
if [[ -z "$ALFRESCO_SECURE_COMMS" || "none" == "$ALFRESCO_SECURE_COMMS" ]]; then
# By default Docker Image is using TLS Mutual Authentication (SSL) for communications with Repository
# Plain HTTP can be enabled by setting ALFRESCO_SECURE_COMMS to 'none'
if [[ "none" == "$ALFRESCO_SECURE_COMMS" ]]; then
sed -i 's/alfresco.secureComms=https/alfresco.secureComms=none/' ${PWD}/solrhome/templates/rerank/conf/solrcore.properties
sed -i 's/alfresco.secureComms=https/alfresco.secureComms=none/' ${PWD}/solrhome/templates/noRerank/conf/solrcore.properties
# Apply also the setting to existing SOLR cores property files when existing