From 8da7d5ce4f1f8c24e269ff19e4e5036a818ba098 Mon Sep 17 00:00:00 2001 From: Tom Page Date: Tue, 14 May 2019 10:05:14 +0100 Subject: [PATCH 1/7] Revert "Revert "Merge pull request #160 from Alfresco/feature/SEARCH-1620_DockerSSL"" This reverts commit b8406d14f665dca9cb9d8b30938b92a75c46e16e. --- search-services/packaging/src/docker/6.x/.env | 9 +- .../packaging/src/docker/6.x/README.md | 26 ++++ .../src/docker/6.x/docker-compose.yml | 136 +++++++++++------- .../packaging/src/docker/6.x/ssl/.env | 5 + .../packaging/src/docker/6.x/ssl/README.md | 56 ++++++++ .../src/docker/6.x/ssl/alfresco/Dockerfile | 25 ++++ .../docker/6.x/ssl/alfresco/keystore/keystore | Bin 0 -> 645 bytes .../keystore/keystore-passwords.properties | 7 + .../ssl-keystore-passwords.properties | 7 + .../ssl-truststore-passwords.properties | 5 + .../6.x/ssl/alfresco/keystore/ssl.keystore | Bin 0 -> 2756 bytes .../6.x/ssl/alfresco/keystore/ssl.truststore | Bin 0 -> 740 bytes .../src/docker/6.x/ssl/docker-compose.yml | 109 ++++++++++++++ .../src/docker/6.x/ssl/solr6/Dockerfile | 11 ++ .../ssl-keystore-passwords.properties | 7 + .../ssl-truststore-passwords.properties | 5 + .../solr6/keystore/ssl.repo.client.keystore | Bin 0 -> 2766 bytes .../solr6/keystore/ssl.repo.client.truststore | Bin 0 -> 740 bytes 18 files changed, 348 insertions(+), 60 deletions(-) create mode 100644 search-services/packaging/src/docker/6.x/README.md create mode 100644 search-services/packaging/src/docker/6.x/ssl/.env create mode 100644 search-services/packaging/src/docker/6.x/ssl/README.md create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/Dockerfile create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/keystore create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/keystore-passwords.properties create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl-keystore-passwords.properties create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl-truststore-passwords.properties create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl.keystore create mode 100644 search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl.truststore create mode 100644 search-services/packaging/src/docker/6.x/ssl/docker-compose.yml create mode 100644 search-services/packaging/src/docker/6.x/ssl/solr6/Dockerfile create mode 100644 search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-keystore-passwords.properties create mode 100644 search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-truststore-passwords.properties create mode 100644 search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl.repo.client.keystore create mode 100644 search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl.repo.client.truststore diff --git a/search-services/packaging/src/docker/6.x/.env b/search-services/packaging/src/docker/6.x/.env index 72bef3e16..c2548ccd7 100644 --- a/search-services/packaging/src/docker/6.x/.env +++ b/search-services/packaging/src/docker/6.x/.env @@ -1,6 +1,5 @@ -# In order to start the community edition set the value of ALFRESCO_EDITION to -community -ALFRESCO_EDITION= -ALFRESCO_TAG=6.1.0-EA3 -SHARE_TAG=6.0 +ALFRESCO_TAG=6.1.2-ga +SHARE_TAG=6.1.0 POSTGRES_TAG=10.1 -SEARCH_TAG=latest \ No newline at end of file +SEARCH_TAG=1.3.0.1 +ACTIVE_MQ_TAG=5.15.8 diff --git a/search-services/packaging/src/docker/6.x/README.md b/search-services/packaging/src/docker/6.x/README.md new file mode 100644 index 000000000..0b330f980 --- /dev/null +++ b/search-services/packaging/src/docker/6.x/README.md @@ -0,0 +1,26 @@ +# Docker Compose Reference for ACS 6.x + +This project includes default configuration for ACS Community 6.1 and Search Services 1.2 using Plain HTTP communication between Repository and SOLR + +## Running Docker Compose + +Docker can be started using default command. + +```bash +$ docker-compose up --build +``` + +Alfresco will be available at: + +http://localhost:8082/alfresco + +http://localhost:8080/share + +http://localhost:8083/solr + +Plain HTTP Communication from SOLR is targeted inside Docker Network to http://alfresco:8080/alfresco + + +**Mutual TLS/SSL Communication** + +Folder `ssl` includes default TLS/SSL Communication between SOLR and Repository. diff --git a/search-services/packaging/src/docker/6.x/docker-compose.yml b/search-services/packaging/src/docker/6.x/docker-compose.yml index a200a0136..af08b7a68 100644 --- a/search-services/packaging/src/docker/6.x/docker-compose.yml +++ b/search-services/packaging/src/docker/6.x/docker-compose.yml @@ -1,56 +1,82 @@ -version: '3' +# This docker-compose file will spin up an ACS cluster on a local host or on a server and it requires a minimum of 12GB Memory to distribute among containers. +# Limit container memory and assign X percentage to JVM. There are couple of ways to allocate JVM Memory for ACS Containers +# For example: 'JAVA_OPTS: "$JAVA_OPTS -XX:+PrintFlagsFinal -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"' +# But, as per Oracle docs (https://docs.oracle.com/javase/9/gctuning/parallel-collector1.htm#JSGCT-GUID-CAB83393-3438-44ED-98F0-D15641B43C7D) +# If container memory is not explicitly set, then the above flags will default max heap to 1/4th of container's memory which may not be ideal. +# Hence, setting up explicit Container memory and then assigning a percentage of it to the JVM for performance tuning. + +# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose +version: "2" + services: - alfresco: - image: alfresco/alfresco-content-repository${ALFRESCO_EDITION}:${ALFRESCO_TAG} - environment: - JAVA_OPTS : " - -Ddb.driver=org.postgresql.Driver - -Ddb.username=alfresco - -Ddb.password=alfresco - -Ddb.url=jdbc:postgresql://postgres:5432/alfresco - -Dsolr.host=search - -Dsolr.port=8983 - -Dsolr.secureComms=none - -Dsolr.base.url=/solr - -Dindex.subsystem.name=solr6 - -Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\" - " - ports: - - "7203:7203" #JMX connect via service:jmx:rmi:///jndi/rmi://localhost:7203/jmxrmi - - "5005:5005" #Java debugging - - "8081:8080" #Browser port for Alfresco - share: - image: alfresco/alfresco-share:${SHARE_TAG} - environment: - - REPO_HOST=alfresco - - REPO_PORT=8080 - ports: - - 8082:8080 #Browser port for Share - postgres: - image: postgres:${POSTGRES_TAG} - environment: - - POSTGRES_PASSWORD=alfresco - - POSTGRES_USER=alfresco - - POSTGRES_DB=alfresco - ports: - - 5432:5432 - search: - image: quay.io/alfresco/search-services:${SEARCH_TAG} - environment: - #Solr needs to know how to register itself with Alfresco - - SOLR_ALFRESCO_HOST=alfresco - - SOLR_ALFRESCO_PORT=8080 - #Alfresco needs to know how to call solr - - SOLR_SOLR_HOST=search - - SOLR_SOLR_PORT=8983 - #Create the default alfresco and archive cores - - SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive - ports: - - 8083:8983 #Browser port - activemq: - image: alfresco/alfresco-activemq:5.15.6 - ports: - - 8161:8161 # Web Console - - 5672:5672 # AMQP - - 61616:61616 # OpenWire - - 61613:61613 # STOMP \ No newline at end of file + alfresco: + image: alfresco/alfresco-content-repository-community:${ALFRESCO_TAG} + mem_limit: 1500m + environment: + JAVA_OPTS : " + -Ddb.driver=org.postgresql.Driver + -Ddb.username=alfresco + -Ddb.password=alfresco + -Ddb.url=jdbc:postgresql://postgres:5432/alfresco + -Dsolr.host=solr6 + -Dsolr.port=8983 + -Dsolr.secureComms=none + -Dsolr.base.url=/solr + -Dindex.subsystem.name=solr6 + -Dshare.host=localhost + -Dalfresco.port=8082 + -Daos.baseUrlOverwrite=http://localhost:8082/alfresco/aos + -Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\" + -Ddeployment.method=DOCKER_COMPOSE + -Dcsrf.filter.enabled=false + -Xms1g -Xmx1g + " + ports: + - 8082:8080 #Browser port + - 8443:8443 + + share: + image: alfresco/alfresco-share:${SHARE_TAG} + mem_limit: 1g + environment: + - REPO_HOST=alfresco + - REPO_PORT=8080 + - "CATALINA_OPTS= -Xms500m -Xmx500m" + ports: + - 8080:8080 + + postgres: + image: postgres:${POSTGRES_TAG} + mem_limit: 1500m + environment: + - POSTGRES_PASSWORD=alfresco + - POSTGRES_USER=alfresco + - POSTGRES_DB=alfresco + command: postgres -c max_connections=300 -c log_min_messages=LOG + ports: + - 5432:5432 + + solr6: + image: alfresco/alfresco-search-services:${SEARCH_TAG} + mem_limit: 2500m + environment: + #Solr needs to know how to register itself with Alfresco + SOLR_ALFRESCO_HOST: "alfresco" + SOLR_ALFRESCO_PORT: "8080" + #Alfresco needs to know how to call solr + SOLR_SOLR_HOST: "solr6" + SOLR_SOLR_PORT: "8983" + #Create the default alfresco and archive cores + SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive" + SOLR_JAVA_MEM: "-Xms2g -Xmx2g" + ports: + - 8083:8983 #Browser port + + activemq: + image: alfresco/alfresco-activemq:${ACTIVE_MQ_TAG} + mem_limit: 2048m + ports: + - 8161:8161 # Web Console + - 5672:5672 # AMQP + - 61616:61616 # OpenWire + - 61613:61613 # STOMP diff --git a/search-services/packaging/src/docker/6.x/ssl/.env b/search-services/packaging/src/docker/6.x/ssl/.env new file mode 100644 index 000000000..c2548ccd7 --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/.env @@ -0,0 +1,5 @@ +ALFRESCO_TAG=6.1.2-ga +SHARE_TAG=6.1.0 +POSTGRES_TAG=10.1 +SEARCH_TAG=1.3.0.1 +ACTIVE_MQ_TAG=5.15.8 diff --git a/search-services/packaging/src/docker/6.x/ssl/README.md b/search-services/packaging/src/docker/6.x/ssl/README.md new file mode 100644 index 000000000..481619f2b --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/README.md @@ -0,0 +1,56 @@ +# Docker Templates for Community Edition + +This project includes default configuration to use Mutual TLS communication between ACS Community 6.1 and Search Services 1.3. + +Every *truststores*, *keystores* and *certificates* are copied from sources. + +## Components + +* **alfresco** includes a `Dockerfile` with *Tomcat Connector* configuration and *Keystore* folder mapping as it's required for Connector. Default stores and certificates from source code (`alfresco-repository`) have been copied in keystore folder. + +* **docker-compose.yml** includes a Docker Composition for ACS 6.1 and Search Services 1.3 using Mutual TLS + +* **solr6** includes a `Dockerfile` to set *https* communications and to provide a volume for the keystore. The keystore folder includes default certificates for SOLR server copied from source code (`alfresco-search`) + +``` +├── alfresco +│   ├── Dockerfile +│   └── keystore +│   ├── keystore +│   ├── keystore-passwords.properties +│   ├── ssl-keystore-passwords.properties +│   ├── ssl-truststore-passwords.properties +│   ├── ssl.keystore +│   └── ssl.truststore +├── docker-compose.yml +└── solr6 + ├── Dockerfile + └── keystore + ├── ssl-keystore-passwords.properties + ├── ssl-truststore-passwords.properties + ├── ssl.repo.client.keystore + └── ssl.repo.client.truststore +``` + + +## Running Docker Compose + +This project includes resources to start the platform in Mutual TLS (SSL). + +Docker can be started selecting SSL Docker Compose file. + +```bash +$ docker-compose up --build +``` + +Alfresco will be available at: + +http://localhost:8082/alfresco + +https://localhost:8443/alfresco + +http://localhost:8080/share + +https://localhost:8083/solr + +SSL Communication from SOLR is targeted inside Docker Network to https://alfresco:8443/alfresco diff --git a/search-services/packaging/src/docker/6.x/ssl/alfresco/Dockerfile b/search-services/packaging/src/docker/6.x/ssl/alfresco/Dockerfile new file mode 100644 index 000000000..172d30f58 --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/alfresco/Dockerfile @@ -0,0 +1,25 @@ +ARG ALFRESCO_TAG +FROM alfresco/alfresco-content-repository-community:${ALFRESCO_TAG} + +USER root + +ARG TOMCAT_DIR=/usr/local/tomcat +ARG ALF_DATA_DIR=${TOMCAT_DIR}/alf_data + +# Copy generated keystore to Image +COPY keystore ${ALF_DATA_DIR}/keystore + +# Default value in "repository.properties" is "dir.keystore=classpath:alfresco/keystore" +RUN echo "dir.keystore=${ALF_DATA_DIR}/keystore" >> ${TOMCAT_DIR}/shared/classes/alfresco-global.properties + +### Enable SSL by adding the proper Connector to server.xml +RUN sed -i "s/\ + <\/Engine>/\n\ + <\/Engine>\n\ + \n\ + <\/Connector>/g" ${TOMCAT_DIR}/conf/server.xml diff --git a/search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/keystore b/search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/keystore new file mode 100644 index 0000000000000000000000000000000000000000..22d2b69a4125591ab9a9a64175644d3e129e81d7 GIT binary patch literal 645 zcmX?i?%X*B1_mY|W&~np29Dg+lEjq6l0=|@!Q72M9<6!Hz*=0yV4R$vt5;l_rP?TQ+xNzE%MWT<0c@?qdC0IPD$NiSg#@&Q?(pOcuEt{+@dl$n=q?Zd!c40Ik)8l;}N zqM)=0WZs(3;y>6pLLPwJRRHugzX2}`2fK1w)a_2z3MNL8Qjls^U;rp2RaaL(Ex#G= zYLIcsrttHD??FrQGnN-NEZrwH=kPV7%;P#IBrX`Q*)m)IQ{cyce^$?M6!!a*!uy$J z!J6zCqt`J%UjE>@`}am{yRxv!$1oAb3&+0SoOn3xY>2H@iEi#u`|eKLcT*hxr7Enl z+(GIhD632^8){040?KfKDYMO*G$4|wmdS6(`cTt(c|$=(&AC zXodf6IkwVBC*7VsUN@HCkrXvd-skc8c|fE1&XwvK%YRL-zq7MWPVkBB@J)~$Aa)H&PZv(ha6_Wk5K{!ZnX-7oe!Vb$Aj*3VzJq&Upto+*=V&XlJQR@f*$ zPTwb*b7+FVfx3VDCf_hDs9*9;gfF8w#wRhdro(++$SoG-5(cpVC)e=Ik_=xLQ^&lN kkfO|joKzRrV4M=WgY)7Vxi@TF-`^#{lDqfGi%FQ# zfR}}%DbQ!ZKbcBVCPopKCZ-1G_nLR+7#}pKI8|bGC2*b26RVS%(sxfb{k-$zT>tL! zcW1Oz^h+1%o;tO3i==h!uBkoy1ulL|7gd}ayV54EBH-DrO>68Xd4|_G3LSfPz<49u z;oe%?!>(K(I6aQ*Oh5dBRqC+Blbu{mel1B?7C20)TWa<%I85b@((NX9vDSbZ*K38B zk8Wd9n=gHoqn~1+;|PolGs=G^s(( zNpwnKy~~CANiXz;zs8w}IlT5(&@!$od}9AO_5X(JKSX|Y{fU%)zg6#N4(oHiiPh=J zQyh=JlvjOR{OTkd=d5E4PyejGe(`z#YV*qbr{|hR&HWYN{^Zj`v0x{a1DBJxh`uxV z(y{CX`~Ju;dOU9h=XgAJUzy*S8DBN^`sI7a9T{IMHGAe+i8&Zs$#ca=&BzY;D0y;r z`?DuGW?TD$@~>D-0~3di&s!f|{5khfU&FbhuAuaoBIFV-qXs|G@H=&p|%@6Du|!Fwh7wwrWVL zvrRf`zFBUDV%sdWTl4(x@Awuz=}G1(#swG3xI;9}e}+1pSUEw@RDE0Vn&06(sd-ob zDw#hhZI;MlpBiR=t~Pqzue*AE44W>@I%@FtUG2fhQ`L6w{LXcq*z`tzJ6n~^>O|fR z4nJpq`1~lwX@Y;z)R&=c_rWQcHA2tSz!I2bQ-Db}!JvupBoimY|Id4FJ+0oQWWdYD zsnzDu_MMlJk(HIfAkC25fRl|ml!Z;0$=wOY;oxBk^)?hX5CqAv^KkhlW~QX(Wuzvi z7|I*Sf&{sE#2jg(@M${i&7PQN>cO;MGS;M3YdAg;R>7`4HU$A4UG&e z3=Is;j0_D7q9pi@41ogXhUQQKgT@A!?Wj%>Ms|uYHm3;Va*BWfAIK@(!t9}W*?IZp zd4@8;91L=turS@Xi6X3b;Ll%;bnai%adP1wx^|Mp1b_= zSNjHak-m$TE3JRN(qH9o*UA#5_%w88kC2>NHxMaV675pu=YDbFY zS2dYxpVf1e^fta(E1COf-7>CjCT2zkV3C6od(1$0CGcMUpQgjvB);fDLiDmz4L8zq zUIipv-n(Fvg22vKr-Q27>Y^T-{A-(ho+m-`r_RpH2PN3BJmu8>f3KcQqgm?QcVdMhdzSIr1uuMg%jn`xxio3^UA+pg~wi%u9bz?0hoU~-!S#H z*Y##{zh0S12Hj4jK@BE}-Z zEH&TW!p*v2Pc55B{cVn()>oo84dj72M^>3d!a%G6y8<4N0$~eUjzQ0NtG$ zvG#`r8JibIzj*nte}h(I>6^q&msjofw4e7%*Wy;Q7K@DdX8HJ;y1}c`-E+HSe*uUGytY*4DypS)5#)qG>r6L9Is531V}p+%Qoaw52jFMBs}G#wLB hijSt_!H|w$-#dKpq}C#r|29z>XOl}WoHcpW4*-@>^f&+j literal 0 HcmV?d00001 diff --git a/search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl.truststore b/search-services/packaging/src/docker/6.x/ssl/alfresco/keystore/ssl.truststore new file mode 100644 index 0000000000000000000000000000000000000000..67273aff4f6f17507ea3de302153ac2dd6150fc7 GIT binary patch literal 740 zcmX?i?%X*B1_mY|W(3pRi8*OSsm00pddZ1EF-yUUl9LRq5qhQumOy0-44Rnc05R(V zW+p}^CQgQ?E6Lw-)NHOB@Un4gwRyCC=VfGMWo0l(GvqelWMd9xVH0L@cY<*^c$h-H z4TTK^K{D(-T)v5!DXDoGsfj6u@&>XXK`tIKN2mi7g7ec#$`gxH6?{rk^bAD|gg^?I zdAQ*UoE;4m#CZ*k3@i){49yJ9jZLB?_>ByK0_KM1PyxERq;WoS7%;LjFgNxx7&LY= zH8wK5(kLo9$R=-dhV7E6+qdtD6>>as|2tltki4S&d-09gR=4{u?Fv`>((xcq@!844AKfj}Ih-2*K3-Uz{=R7O$%zT7mDib=85tNC2N?K)16h`jMT|v+ zS!%w$g`0K5o?14M`r8~mt*=CH8ps2KSXP-u!a%G6y8<4N0$~ElT)T1a&@}PRYn|IIE{C!89-m_7n$+}tlI6|- z-JKe-_J;)-n-@mEc=@k?gH~hdo5W3*SMBz+pZ7}F;#RX3i;VbY`S_W-!K>2Wmp}ej zWWB4mr2bdY+dm=NZn^BQSN<_l literal 0 HcmV?d00001 diff --git a/search-services/packaging/src/docker/6.x/ssl/docker-compose.yml b/search-services/packaging/src/docker/6.x/ssl/docker-compose.yml new file mode 100644 index 000000000..ddc724ffc --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/docker-compose.yml @@ -0,0 +1,109 @@ +# This docker-compose file will spin up an ACS cluster on a local host or on a server and it requires a minimum of 12GB Memory to distribute among containers. +# Limit container memory and assign X percentage to JVM. There are couple of ways to allocate JVM Memory for ACS Containers +# For example: 'JAVA_OPTS: "$JAVA_OPTS -XX:+PrintFlagsFinal -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"' +# But, as per Oracle docs (https://docs.oracle.com/javase/9/gctuning/parallel-collector1.htm#JSGCT-GUID-CAB83393-3438-44ED-98F0-D15641B43C7D) +# If container memory is not explicitly set, then the above flags will default max heap to 1/4th of container's memory which may not be ideal. +# Hence, setting up explicit Container memory and then assigning a percentage of it to the JVM for performance tuning. + +# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose +version: "2" + +services: + alfresco: + build: + context: ./alfresco + args: + ALFRESCO_TAG: ${ALFRESCO_TAG} + mem_limit: 1500m + environment: + JAVA_OPTS : " + -Ddb.driver=org.postgresql.Driver + -Ddb.username=alfresco + -Ddb.password=alfresco + -Ddb.url=jdbc:postgresql://postgres:5432/alfresco + -Dsolr.host=solr6 + -Dsolr.port.ssl=8983 + -Dsolr.secureComms=https + -Dsolr.base.url=/solr + -Dindex.subsystem.name=solr6 + -Dshare.host=localhost + -Dalfresco.port=8082 + -Daos.baseUrlOverwrite=http://localhost:8082/alfresco/aos + -Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\" + -Ddeployment.method=DOCKER_COMPOSE + -Dcsrf.filter.enabled=false + -Xms1g -Xmx1g + " + ports: + - 8082:8080 #Browser port + - 8443:8443 + + share: + image: alfresco/alfresco-share:${SHARE_TAG} + mem_limit: 1g + environment: + - REPO_HOST=alfresco + - REPO_PORT=8080 + - "CATALINA_OPTS= -Xms500m -Xmx500m" + ports: + - 8080:8080 + + postgres: + image: postgres:${POSTGRES_TAG} + mem_limit: 1500m + environment: + - POSTGRES_PASSWORD=alfresco + - POSTGRES_USER=alfresco + - POSTGRES_DB=alfresco + command: postgres -c max_connections=300 -c log_min_messages=LOG + ports: + - 5432:5432 + + solr6: + build: + context: ./solr6 + args: + - SEARCH_TAG=${SEARCH_TAG} + mem_limit: 2500m + environment: + #Solr needs to know how to register itself with Alfresco + SOLR_ALFRESCO_HOST: "alfresco" + SOLR_ALFRESCO_PORT: "8443" + #Alfresco needs to know how to call solr + SOLR_SOLR_HOST: "solr6" + SOLR_SOLR_PORT: "8983" + SOLR_SSL_TRUST_STORE: "/opt/alfresco-search-services/keystore/ssl.repo.client.truststore" + SOLR_SSL_TRUST_STORE_PASSWORD: "kT9X6oe68t" + SOLR_SSL_TRUST_STORE_TYPE: "JCEKS" + SOLR_SSL_KEY_STORE: "/opt/alfresco-search-services/keystore/ssl.repo.client.keystore" + SOLR_SSL_KEY_STORE_PASSWORD: "kT9X6oe68t" + SOLR_SSL_KEY_STORE_TYPE: "JCEKS" + SOLR_SSL_NEED_CLIENT_AUTH: "true" + #Create the default alfresco and archive cores + SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive" + SOLR_JAVA_MEM: "-Xms2g -Xmx2g" + SOLR_OPTS: " + -Djavax.net.ssl.keyStoreType=JCEKS + -Djavax.net.ssl.trustStoreType=JCEKS + -Dsolr.ssl.checkPeerName=false + -Dsolr.allow.unsafe.resourceloading=true + -Dalfresco.encryption.ssl.keystore.location=/opt/alfresco-search-services/keystore/ssl.repo.client.keystore + -Dalfresco.encryption.ssl.keystore.passwordFileLocation=/opt/alfresco-search-services/keystore/ssl-keystore-passwords.properties + -Dalfresco.encryption.ssl.keystore.type=JCEKS + -Dalfresco.encryption.ssl.truststore.location=/opt/alfresco-search-services/keystore/ssl.repo.client.truststore + -Dalfresco.encryption.ssl.truststore.passwordFileLocation=/opt/alfresco-search-services/keystore/ssl-truststore-passwords.properties + -Dalfresco.encryption.ssl.truststore.type=JCEKS + " + ports: + - 8083:8983 #Browser port + volumes: + - ./solr6/keystore:/opt/alfresco-search-services/keystore + + activemq: + image: alfresco/alfresco-activemq:${ACTIVE_MQ_TAG} + mem_limit: 2048m + ports: + - 8161:8161 # Web Console + - 5672:5672 # AMQP + - 61616:61616 # OpenWire + - 61613:61613 # STOMP diff --git a/search-services/packaging/src/docker/6.x/ssl/solr6/Dockerfile b/search-services/packaging/src/docker/6.x/ssl/solr6/Dockerfile new file mode 100644 index 000000000..3c93212ce --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/solr6/Dockerfile @@ -0,0 +1,11 @@ +ARG SEARCH_TAG +FROM alfresco/alfresco-search-services:${SEARCH_TAG} + +# Configure SOLR cores to run in HTTPs mode from template +RUN sed -i '/^bash.*/i sed -i "'"s/alfresco.secureComms=none/alfresco.secureComms=https/g"'" ${DIST_DIR}/solrhome/templates/rerank/conf/solrcore.properties\n' \ + ${DIST_DIR}/solr/bin/search_config_setup.sh + +RUN mkdir ${DIST_DIR}/keystore \ + && chown -R solr:solr ${DIST_DIR}/keystore + +VOLUME ["${DIST_DIR}/keystore"] diff --git a/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-keystore-passwords.properties b/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-keystore-passwords.properties new file mode 100644 index 000000000..3a32c534d --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-keystore-passwords.properties @@ -0,0 +1,7 @@ +aliases=ssl.alfresco.ca,ssl.repo +# The ssl keystore password +keystore.password=kT9X6oe68t +# The password protecting the ssl repository key +ssl.repo.password=kT9X6oe68t +# The password protecting the ssl Alfresco CA key +ssl.alfresco.ca.password=kT9X6oe68t \ No newline at end of file diff --git a/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-truststore-passwords.properties b/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-truststore-passwords.properties new file mode 100644 index 000000000..e5510fb03 --- /dev/null +++ b/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl-truststore-passwords.properties @@ -0,0 +1,5 @@ +aliases=alfresco.ca +# The ssl truststore password +keystore.password=kT9X6oe68t +# The password protecting the ssl Alfresco CA strust certificate +alfresco.ca.password=kT9X6oe68t \ No newline at end of file diff --git a/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl.repo.client.keystore b/search-services/packaging/src/docker/6.x/ssl/solr6/keystore/ssl.repo.client.keystore new file mode 100644 index 0000000000000000000000000000000000000000..a2faa8cc8c74c09773c6e719043e5b93092473a9 GIT binary patch literal 2766 zcmX?i?%X*B1_mZL=1$B>D@rX+&euy$WME*l6r5!r$iNz*XKG*xRJOpNiD?cHvo2s} zVq{|CWN5mQ{4Gb#=DGnd8>d#AN85K^Mn+av27@$1ZUas>=1>+kVJ3Gc7>9$0Db(9g z*gy~@!_LFyo0yrBnwOE9m|`ezAPW-Y;t_L%IzS;fKdq!Zu_#r+rzAzsP{cq8q=1=+ z8?M0F(Lh0**U-qo!qC9b%+TD}Buawc$Pg%CZfFh_pqon?=Oc#!BP#=QV=se2V<%H% zBf~3=qLPDb@-}DKE}6Q0`<_@K$0PT@iutD@Am&vYIh!LPnpxDA@=jU>8`-J&pt;i7dfW1w}GqJ?dB?mSr0Oe z8x=&$?Ohn3ojm-}-7=lSsqydQh1Kcrix!`pn4nsDor#%|fpKwwfgd=KW%*ddSVWkm z=G$AiSvTydWfQ5t&C%2PO7y0IJTQo5m02VV#2T|tP}GXs6P zXhZA)IlcPz9sY}Ajd-sresmEy`S{JX8}|-P6Ysp%x!vM&7+df0DQ2!oP2VS3?hMe~ zsS#^`Sdg)KVf2fa|N1v*HI}|f+;n->ZcqDpuXHVLHEXfRh;NpUpQ#(XD*b)=<9|ig zyLwCNe-*v`6Qb>w%l>-hAHxQvO8vnxEHs)g>#>;4_DUY(t9kdn#4hzw z)xP-7XV1aYLZ3QjEfMrC7Z+4t)xMvDb<(_`;zgBPswKlxs`kzm|e4?L+lgwS9hFwbya_3;}Xux*P|C4e_Cg;r0z*^pvIQPiHlCI z{Plo&L#JM`(m~@LqTM>PF0WZzp!H;?!2afc_l}-Z+*T2LLM(Ep_xU-TQf{{WY&vUY zZNqmwQ&n5+_rX22g6sP0Rp-{oeD$nRDto?p?b!qTt?a)e-&H-IzIMOPHy4p97h^w% zRQBbs_B6gUWm?oU!H9_u?f)@WnmybeID7UIaoGv}6Mmh&H78MuRqfk#qb~yLCl0<& z%-Wx-YHY4^#?j}6UiW=DAA7gOb1L37IP!dxZAyKeUK(?KW^`BgW`Q+iPM_LSm2MuFLvwUt1csRL^J8lU-z3wYT%gM1?sU zSIyP&VRgHjx=t)Ecjmn@c4j`d>UqIKKdlu951f8E zZR4u*Ia2r5%M89KAx-(Z+} z$ExCVnra4Pk}ms_**8v0$35~tXW!Yk$Z_L_bSuHwHCHUReGCg!d1v&=vAUo@=hXay zYGo!iAy@P;?JM&$970x%e~Mc>6muzUsyL+^qIz#H&b`m z2G2F*;!2yu62|kZM0L-C`LhMSXB8{(3- z#jI9JPwrcmrLkM@kZqII&pV51{y(|tEwD+q;P-6CZ66nkJPp(?;6LTv!z5E+=fRR< zvL$A&WK^1ai9_mAk<1&S&XMy%P3tBFJc=<>vCQf9J<+l{qJ~nLh_38@5MJ}Tix!vv@2ZgOUHvejZ@e4 zW^%t~tF&QsYN~qw+t<7Ozm(dYhuTx-bZLnFJa4)yaPG6u5z9r6DeZ0GDt5cMiec7+ zOyfoc(Qk>`un2ACnqMTR$gafW@KPo9AMxF4rEzA7BLnP zW~ur17H-xJdurK4>Th%Ow7wF(X&?^_Vp(Mt2?MbP>xE#jTdwhzSYf{tqNtQbU zba!gR+8-8VY+e}s;^n{o4O)$*ZxT0MUbWlPe%>oxi(AcFEHdJo<>P1S2CqtgU;g-C zk@c?LlKNjoZ~ug7yXCUKUirtcL8(%I@=EPg^NmqYmiV1K=Gt;}*You^q!`z3T3IBT G?Fj(wruG#8 literal 0 HcmV?d00001 From 376a33359654e320b4592d4917cd22a8e04d867b Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Tue, 14 May 2019 14:30:43 +0200 Subject: [PATCH 2/7] Bamboo uses internal releases to quay.io, so images should be pulled from this repository. --- search-services/packaging/src/docker/6.x/docker-compose.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/search-services/packaging/src/docker/6.x/docker-compose.yml b/search-services/packaging/src/docker/6.x/docker-compose.yml index af08b7a68..aaebe68ee 100644 --- a/search-services/packaging/src/docker/6.x/docker-compose.yml +++ b/search-services/packaging/src/docker/6.x/docker-compose.yml @@ -57,7 +57,8 @@ services: - 5432:5432 solr6: - image: alfresco/alfresco-search-services:${SEARCH_TAG} + # Also alfresco/alfresco-search-services:${SEARCH_TAG} can be used for external developers + image: quay.io/alfresco/search-services:${SEARCH_TAG} mem_limit: 2500m environment: #Solr needs to know how to register itself with Alfresco From b7b1d151ff35e8ff8fce92834bb47881acbefc19 Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Thu, 16 May 2019 09:40:47 +0200 Subject: [PATCH 3/7] Restore default port configuration --- .../packaging/src/docker/6.x/docker-compose.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/search-services/packaging/src/docker/6.x/docker-compose.yml b/search-services/packaging/src/docker/6.x/docker-compose.yml index aaebe68ee..9eed69869 100644 --- a/search-services/packaging/src/docker/6.x/docker-compose.yml +++ b/search-services/packaging/src/docker/6.x/docker-compose.yml @@ -32,8 +32,9 @@ services: -Xms1g -Xmx1g " ports: - - 8082:8080 #Browser port - - 8443:8443 + - 7203:7203 # JMX + - 5005:5005 # Java debugging + - 8081:8080 # Browser port share: image: alfresco/alfresco-share:${SHARE_TAG} @@ -43,7 +44,7 @@ services: - REPO_PORT=8080 - "CATALINA_OPTS= -Xms500m -Xmx500m" ports: - - 8080:8080 + - 8082:8080 # Browser port postgres: image: postgres:${POSTGRES_TAG} @@ -71,7 +72,7 @@ services: SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive" SOLR_JAVA_MEM: "-Xms2g -Xmx2g" ports: - - 8083:8983 #Browser port + - 8083:8983 # Browser port activemq: image: alfresco/alfresco-activemq:${ACTIVE_MQ_TAG} From 41e412aff2f48f63b890dd2aa1afa0764c0c060a Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Thu, 16 May 2019 09:44:52 +0200 Subject: [PATCH 4/7] Restore default port configuration --- search-services/packaging/src/docker/6.x/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/search-services/packaging/src/docker/6.x/README.md b/search-services/packaging/src/docker/6.x/README.md index 0b330f980..cf00a8f6a 100644 --- a/search-services/packaging/src/docker/6.x/README.md +++ b/search-services/packaging/src/docker/6.x/README.md @@ -12,9 +12,9 @@ $ docker-compose up --build Alfresco will be available at: -http://localhost:8082/alfresco +http://localhost:8081/alfresco -http://localhost:8080/share +http://localhost:8082/share http://localhost:8083/solr From d92436485c7edace0c610cf6ad47671eb2105403 Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Thu, 16 May 2019 14:38:26 +0200 Subject: [PATCH 5/7] Let the REST API be accessed using HTTP Basic Auth --- search-services/packaging/src/docker/6.x/docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/search-services/packaging/src/docker/6.x/docker-compose.yml b/search-services/packaging/src/docker/6.x/docker-compose.yml index 9eed69869..29f5c7acc 100644 --- a/search-services/packaging/src/docker/6.x/docker-compose.yml +++ b/search-services/packaging/src/docker/6.x/docker-compose.yml @@ -30,6 +30,7 @@ services: -Ddeployment.method=DOCKER_COMPOSE -Dcsrf.filter.enabled=false -Xms1g -Xmx1g + -Dalfresco.restApi.basicAuthScheme=true " ports: - 7203:7203 # JMX From f078ce586068b45b0cdba4da825f930c9884cdcd Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Fri, 17 May 2019 11:59:50 +0200 Subject: [PATCH 6/7] Restore "search" as solr6 service name --- search-services/packaging/src/docker/6.x/docker-compose.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/search-services/packaging/src/docker/6.x/docker-compose.yml b/search-services/packaging/src/docker/6.x/docker-compose.yml index 29f5c7acc..82adbec74 100644 --- a/search-services/packaging/src/docker/6.x/docker-compose.yml +++ b/search-services/packaging/src/docker/6.x/docker-compose.yml @@ -18,7 +18,7 @@ services: -Ddb.username=alfresco -Ddb.password=alfresco -Ddb.url=jdbc:postgresql://postgres:5432/alfresco - -Dsolr.host=solr6 + -Dsolr.host=search -Dsolr.port=8983 -Dsolr.secureComms=none -Dsolr.base.url=/solr @@ -58,7 +58,7 @@ services: ports: - 5432:5432 - solr6: + search: # Also alfresco/alfresco-search-services:${SEARCH_TAG} can be used for external developers image: quay.io/alfresco/search-services:${SEARCH_TAG} mem_limit: 2500m @@ -67,7 +67,7 @@ services: SOLR_ALFRESCO_HOST: "alfresco" SOLR_ALFRESCO_PORT: "8080" #Alfresco needs to know how to call solr - SOLR_SOLR_HOST: "solr6" + SOLR_SOLR_HOST: "search" SOLR_SOLR_PORT: "8983" #Create the default alfresco and archive cores SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive" From 5bbc8980ee5131cc687cd40b961c623e2f9e20bf Mon Sep 17 00:00:00 2001 From: Angel Borroy Date: Fri, 17 May 2019 12:20:24 +0200 Subject: [PATCH 7/7] As we are switching to quay.io for Search Services Docker Image, we can use "latest" tag --- search-services/packaging/src/docker/6.x/.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/search-services/packaging/src/docker/6.x/.env b/search-services/packaging/src/docker/6.x/.env index c2548ccd7..30363483d 100644 --- a/search-services/packaging/src/docker/6.x/.env +++ b/search-services/packaging/src/docker/6.x/.env @@ -1,5 +1,5 @@ ALFRESCO_TAG=6.1.2-ga SHARE_TAG=6.1.0 POSTGRES_TAG=10.1 -SEARCH_TAG=1.3.0.1 +SEARCH_TAG=latest ACTIVE_MQ_TAG=5.15.8