mirror of
https://github.com/Alfresco/SearchServices.git
synced 2026-09-16 18:12:56 +00:00
Restoring previous folder structure
Removing Enterprise Docker Compose templates
This commit is contained in:
Angel Borroy
@@ -0,0 +1,5 @@
|
||||
ALFRESCO_TAG=6.1.2-ga
|
||||
SHARE_TAG=6.1.0
|
||||
POSTGRES_TAG=10.1
|
||||
SEARCH_TAG=1.3.0.1
|
||||
ACTIVE_MQ_TAG=5.15.8
|
||||
@@ -1,22 +1,26 @@
|
||||
# Docker Compose Reference for ACS 6.x
|
||||
|
||||
This project includes a catalog of Docker Compose files for ACS 6.x Enterprise and Community versions:
|
||||
This project includes default configuration for ACS Community 6.1 and Search Services 1.2 using Plain HTTP communication between Repository and SOLR
|
||||
|
||||
* `community`
|
||||
## Running Docker Compose
|
||||
|
||||
* `docker-compose.yml` Template for ACS Community 6.1 and Search Services 1.3 with plain HTTP communication between Repository and SOLR
|
||||
Docker can be started using default command.
|
||||
|
||||
* `docker-compose-ssl.yml` Template for ACS Community 6.1 and Search Services 1.3 with Mutual TLS communication between Repository and SOLR
|
||||
```bash
|
||||
$ docker-compose up --build
|
||||
```
|
||||
|
||||
* `enterprise`
|
||||
Alfresco will be available at:
|
||||
|
||||
* `docker-compose.yml` Template for ACS Enterprise 6.1 and Insight Engine 1.1 with plain HTTP communication between Repository and SOLR
|
||||
http://localhost:8082/alfresco
|
||||
|
||||
* `docker-compose-ssl.yml` Template for ACS Enterprise 6.1 and Insight Engine 1.1 with Mutual TLS communication between Repository and SOLR
|
||||
http://localhost:8080/share
|
||||
|
||||
Using **enterprise** Docker Images requires `quay.io` credentials. Every customer or partner can ask for credentials at [Alfresco Support](https://support.alfresco.com).
|
||||
http://localhost:8083/solr
|
||||
|
||||
Plain HTTP Communication from SOLR is targeted inside Docker Network to http://alfresco:8080/alfresco
|
||||
|
||||
|
||||
## Generation Tool for custom SSL Certificates
|
||||
**Mutual TLS/SSL Communication**
|
||||
|
||||
A simple Script has been included in `ssl-tool` folder in order to generate custom *truststores*, *keystores* and *certificates*.
|
||||
Folder `ssl` includes default TLS/SSL Communication between SOLR and Repository.
|
||||
|
||||
+5
-5
@@ -10,7 +10,7 @@ version: "2"
|
||||
|
||||
services:
|
||||
alfresco:
|
||||
image: alfresco/alfresco-content-repository-community:6.1.2-ga
|
||||
image: alfresco/alfresco-content-repository-community:${ALFRESCO_TAG}
|
||||
mem_limit: 1500m
|
||||
environment:
|
||||
JAVA_OPTS : "
|
||||
@@ -36,7 +36,7 @@ services:
|
||||
- 8443:8443
|
||||
|
||||
share:
|
||||
image: alfresco/alfresco-share:6.1.0
|
||||
image: alfresco/alfresco-share:${SHARE_TAG}
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
- REPO_HOST=alfresco
|
||||
@@ -46,7 +46,7 @@ services:
|
||||
- 8080:8080
|
||||
|
||||
postgres:
|
||||
image: postgres:10.1
|
||||
image: postgres:${POSTGRES_TAG}
|
||||
mem_limit: 1500m
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=alfresco
|
||||
@@ -57,7 +57,7 @@ services:
|
||||
- 5432:5432
|
||||
|
||||
solr6:
|
||||
image: alfresco/alfresco-search-services:1.3.0.1
|
||||
image: alfresco/alfresco-search-services:${SEARCH_TAG}
|
||||
mem_limit: 2500m
|
||||
environment:
|
||||
#Solr needs to know how to register itself with Alfresco
|
||||
@@ -73,7 +73,7 @@ services:
|
||||
- 8083:8983 #Browser port
|
||||
|
||||
activemq:
|
||||
image: alfresco/alfresco-activemq:5.15.8
|
||||
image: alfresco/alfresco-activemq:${ACTIVE_MQ_TAG}
|
||||
mem_limit: 2048m
|
||||
ports:
|
||||
- 8161:8161 # Web Console
|
||||
@@ -1,97 +0,0 @@
|
||||
# Docker Templates for Community Edition
|
||||
|
||||
This project includes default configuration for ACS Enterprise 6.1 and Insight Engine 1.1.
|
||||
|
||||
Different Docker Compose templates are provided:
|
||||
|
||||
* `docker-compose.yml` to use Plain HTTP communication between Repository and SOLR
|
||||
|
||||
* `docker-compose-ssl.yml` to use Mutual TLS communication between Repository and SOLR
|
||||
|
||||
Every *truststores*, *keystores* and *certificates* are copied from sources.
|
||||
|
||||
## Components
|
||||
|
||||
* **alfresco** includes a `Dockerfile` with *Tomcat Connector* configuration and *Keystore* folder mapping as it's required for Connector. Default stores and certificates from source code (`alfresco-repository`) have been copied in keystore folder.
|
||||
|
||||
* **docker-compose-ssl.yml** includes a Docker Composition for ACS 6.1 and Insight Engine 1.1 using Mutual TLS
|
||||
|
||||
* **docker-compose.yml** includes a Docker Composition for ACS 6.1 and Insight Engine 1.1 using Plain HTTP
|
||||
|
||||
* **solr6** includes a `Dockerfile` to set *https* communications and to provide a volume for the keystore. The keystore folder includes default certificates for SOLR server copied from source code (`alfresco-search`)
|
||||
|
||||
* **zeppelin** includes a `Dockerfile` to provide a volume for the keystore. The keystore folder includes default certificates for SOLR server copied from source code (`alfresco-search`)
|
||||
|
||||
```
|
||||
├── alfresco
|
||||
│ ├── Dockerfile
|
||||
│ └── keystore
|
||||
│ ├── keystore
|
||||
│ ├── keystore-passwords.properties
|
||||
│ ├── ssl-keystore-passwords.properties
|
||||
│ ├── ssl-truststore-passwords.properties
|
||||
│ ├── ssl.keystore
|
||||
│ └── ssl.truststore
|
||||
├── docker-compose-ssl.yml
|
||||
├── docker-compose.yml
|
||||
├── solr6
|
||||
│ ├── Dockerfile
|
||||
│ └── keystore
|
||||
│ ├── ssl-keystore-passwords.properties
|
||||
│ ├── ssl-truststore-passwords.properties
|
||||
│ ├── ssl.repo.client.keystore
|
||||
│ └── ssl.repo.client.truststore
|
||||
└── zeppelin
|
||||
├── Dockerfile
|
||||
└── keystore
|
||||
├── ssl.repo.client.keystore
|
||||
└── ssl.repo.client.truststore
|
||||
```
|
||||
|
||||
|
||||
## Running Docker Compose
|
||||
|
||||
This project includes resources to start the platform in Plain HTTP or Mutual TLS (SSL).
|
||||
|
||||
**Plain HTTP**
|
||||
|
||||
Docker can be started using default command.
|
||||
|
||||
```bash
|
||||
$ docker-compose up --build
|
||||
```
|
||||
|
||||
Alfresco will be available at:
|
||||
|
||||
http://localhost:8080/alfresco
|
||||
|
||||
http://localhost:8080/share
|
||||
|
||||
http://localhost:8083/solr
|
||||
|
||||
http://localhost:9090/zeppelin
|
||||
|
||||
Plain HTTP Communication from SOLR and Zeppelin (JDBC Driver) is targeted inside Docker Network to http://alfresco:8080/alfresco
|
||||
|
||||
|
||||
**Mutual TLS (SSL)**
|
||||
|
||||
Docker can be started selecting SSL Docker Compose file.
|
||||
|
||||
```bash
|
||||
$ docker-compose -f docker-compose-ssl.yml up --build
|
||||
```
|
||||
|
||||
Alfresco will be available at:
|
||||
|
||||
http://localhost:8080/alfresco
|
||||
|
||||
https://localhost:8443/alfresco
|
||||
|
||||
http://localhost:8080/share
|
||||
|
||||
https://localhost:8083/solr
|
||||
|
||||
http://localhost:9090/zeppelin
|
||||
|
||||
SSL Communication from SOLR and Zeppelin (JDBC Driver) is targeted inside Docker Network to https://alfresco:8443/alfresco
|
||||
@@ -1,24 +0,0 @@
|
||||
FROM alfresco/alfresco-content-repository:6.1.0.3
|
||||
|
||||
USER root
|
||||
|
||||
ARG TOMCAT_DIR=/usr/local/tomcat
|
||||
ARG ALF_DATA_DIR=${TOMCAT_DIR}/alf_data
|
||||
|
||||
# Copy generated keystore to Image
|
||||
COPY keystore ${ALF_DATA_DIR}/keystore
|
||||
|
||||
# Default value in "repository.properties" is "dir.keystore=classpath:alfresco/keystore"
|
||||
RUN echo "dir.keystore=${ALF_DATA_DIR}/keystore" >> ${TOMCAT_DIR}/shared/classes/alfresco-global.properties
|
||||
|
||||
### Enable SSL by adding the proper Connector to server.xml
|
||||
RUN sed -i "s/\
|
||||
<\/Engine>/\n\
|
||||
<\/Engine>\n\
|
||||
<Connector port=\"8443\" protocol=\"org.apache.coyote.http11.Http11Protocol\"\n\
|
||||
SSLEnabled=\"true\" maxThreads=\"150\" scheme=\"https\"\n\
|
||||
keystoreFile=\"\/usr\/local\/tomcat\/alf_data\/keystore\/ssl.keystore\"\n\
|
||||
keystorePass=\"kT9X6oe68t\" keystoreType=\"JCEKS\" secure=\"true\" connectionTimeout=\"240000\"\n\
|
||||
truststoreFile=\"\/usr\/local\/tomcat\/alf_data\/keystore\/ssl.truststore\"\n\
|
||||
truststorePass=\"kT9X6oe68t\" truststoreType=\"JCEKS\" clientAuth=\"want\" sslProtocol=\"TLS\">\n\
|
||||
<\/Connector>/g" ${TOMCAT_DIR}/conf/server.xml
|
||||
Binary file not shown.
-7
@@ -1,7 +0,0 @@
|
||||
aliases=metadata
|
||||
# The password protecting the keystore entries
|
||||
keystore.password=mp6yc0UD9e
|
||||
# The password protecting the alias: metadata
|
||||
metadata.keyData=
|
||||
metadata.algorithm=DESede
|
||||
metadata.password=oKIWzVdEdA
|
||||
-7
@@ -1,7 +0,0 @@
|
||||
aliases=ssl.alfresco.ca,ssl.repo
|
||||
# The ssl keystore password
|
||||
keystore.password=kT9X6oe68t
|
||||
# The password protecting the ssl repository key
|
||||
ssl.repo.password=kT9X6oe68t
|
||||
# The password protecting the ssl Alfresco CA key
|
||||
ssl.alfresco.ca.password=kT9X6oe68t
|
||||
-5
@@ -1,5 +0,0 @@
|
||||
aliases=alfresco.ca
|
||||
# The ssl truststore password
|
||||
keystore.password=kT9X6oe68t
|
||||
# The password protecting the ssl Alfresco CA strust certificate
|
||||
alfresco.ca.password=kT9X6oe68t
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,240 +0,0 @@
|
||||
# This docker-compose file will spin up an ACS cluster on a local host or on a server and it requires a minimum of 16GB Memory to distribute among containers.
|
||||
# Limit container memory and assign X percentage to JVM. There are couple of ways to allocate JVM Memory for ACS Containers
|
||||
# For example: 'JAVA_OPTS: "$JAVA_OPTS -XX:+PrintFlagsFinal -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"'
|
||||
# See Oracle docs (https://docs.oracle.com/javase/9/gctuning/parallel-collector1.htm#JSGCT-GUID-CAB83393-3438-44ED-98F0-D15641B43C7D).
|
||||
# If the container memory is not explicitly set then the flags above will set the max heap default to 1/4 of the container's memory, which may not be ideal.
|
||||
# For performance tuning, assign the container memory and give a percentage of it to the JVM.
|
||||
|
||||
# Note: The docker-compose file from github.com is a limited trial that goes into read-only mode after 2 days.
|
||||
# Get the latest docker-compose.yml file with a 30-day trial license by accessing the Alfresco Content Services trial download page at:
|
||||
# https://www.alfresco.com/platform/content-services-ecm/trial/download
|
||||
|
||||
# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
|
||||
version: "2"
|
||||
|
||||
services:
|
||||
alfresco:
|
||||
build: ./alfresco
|
||||
mem_limit: 1700m
|
||||
environment:
|
||||
JAVA_OPTS: "
|
||||
-Ddb.driver=org.postgresql.Driver
|
||||
-Ddb.username=alfresco
|
||||
-Ddb.password=alfresco
|
||||
-Ddb.url=jdbc:postgresql://postgres:5432/alfresco
|
||||
-Dsolr.host=solr6
|
||||
-Dsolr.port.ssl=8983
|
||||
-Dsolr.secureComms=https
|
||||
-Dsolr.base.url=/solr
|
||||
-Dindex.subsystem.name=solr6
|
||||
-Dalfresco-pdf-renderer.url=http://alfresco-pdf-renderer:8090/
|
||||
-Djodconverter.url=http://libreoffice:8090/
|
||||
-Dimg.url=http://imagemagick:8090/
|
||||
-Dtika.url=http://tika:8090/
|
||||
-Dsfs.url=http://shared-file-store:8099/
|
||||
-Dshare.host=127.0.0.1
|
||||
-Dshare.port=8080
|
||||
-Dalfresco.host=localhost
|
||||
-Dalfresco.port=8080
|
||||
-Daos.baseUrlOverwrite=http://localhost:8080/alfresco/aos
|
||||
-Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\"
|
||||
-Ddeployment.method=DOCKER_COMPOSE
|
||||
-Dlocal.transform.service.enabled=true
|
||||
-Dtransform.service.enabled=true
|
||||
-Dcsrf.filter.enabled=false
|
||||
-Xms1500m -Xmx1500m
|
||||
"
|
||||
ports:
|
||||
- 8443:8443
|
||||
|
||||
transform-router:
|
||||
mem_limit: 512m
|
||||
image: quay.io/alfresco/alfresco-transform-router:1.0.1
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
IMAGEMAGICK_URL: "http://imagemagick:8090"
|
||||
PDF_RENDERER_URL : "http://alfresco-pdf-renderer:8090"
|
||||
LIBREOFFICE_URL : "http://libreoffice:8090"
|
||||
TIKA_URL : "http://tika:8090"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
links:
|
||||
- activemq
|
||||
|
||||
alfresco-pdf-renderer:
|
||||
image: quay.io/alfresco/alfresco-pdf-renderer:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8090:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
imagemagick:
|
||||
image: quay.io/alfresco/alfresco-imagemagick:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8091:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
libreoffice:
|
||||
image: quay.io/alfresco/alfresco-libreoffice:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8092:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
tika:
|
||||
image: quay.io/alfresco/alfresco-tika:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8093:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
shared-file-store:
|
||||
image: alfresco/alfresco-shared-file-store:0.5.3
|
||||
mem_limit: 512m
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
scheduler.content.age.millis: 86400000
|
||||
scheduler.cleanup.interval: 86400000
|
||||
ports:
|
||||
- 8099:8099
|
||||
volumes:
|
||||
- shared-file-store-volume:/tmp/Alfresco/sfs
|
||||
|
||||
share:
|
||||
image: alfresco/alfresco-share:6.1.0
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
REPO_HOST: "alfresco"
|
||||
REPO_PORT: "8080"
|
||||
JAVA_OPTS: "
|
||||
-Xms500m
|
||||
-Xmx500m
|
||||
-Dalfresco.host=localhost
|
||||
-Dalfresco.port=8080
|
||||
-Dalfresco.context=alfresco
|
||||
-Dalfresco.protocol=http
|
||||
"
|
||||
|
||||
postgres:
|
||||
image: postgres:10.1
|
||||
mem_limit: 512m
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=alfresco
|
||||
- POSTGRES_USER=alfresco
|
||||
- POSTGRES_DB=alfresco
|
||||
command: postgres -c max_connections=300 -c log_min_messages=LOG
|
||||
ports:
|
||||
- 5432:5432
|
||||
|
||||
solr6:
|
||||
build: ./solr6
|
||||
mem_limit: 2g
|
||||
environment:
|
||||
#Solr needs to know how to register itself with Alfresco
|
||||
SOLR_ALFRESCO_HOST: "alfresco"
|
||||
SOLR_ALFRESCO_PORT: "8443"
|
||||
#Alfresco needs to know how to call solr
|
||||
SOLR_SOLR_HOST: "solr6"
|
||||
SOLR_SOLR_PORT: "8983"
|
||||
SOLR_SSL_TRUST_STORE: "/opt/alfresco-insight-engine/keystore/ssl.repo.client.truststore"
|
||||
SOLR_SSL_TRUST_STORE_PASSWORD: "kT9X6oe68t"
|
||||
SOLR_SSL_TRUST_STORE_TYPE: "JCEKS"
|
||||
SOLR_SSL_KEY_STORE: "/opt/alfresco-insight-engine/keystore/ssl.repo.client.keystore"
|
||||
SOLR_SSL_KEY_STORE_PASSWORD: "kT9X6oe68t"
|
||||
SOLR_SSL_KEY_STORE_TYPE: "JCEKS"
|
||||
SOLR_SSL_NEED_CLIENT_AUTH: "true"
|
||||
#Create the default alfresco and archive cores
|
||||
SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive"
|
||||
SOLR_JAVA_MEM: "-Xms2g -Xmx2g"
|
||||
SOLR_OPTS: "
|
||||
-Djavax.net.ssl.keyStoreType=JCEKS
|
||||
-Djavax.net.ssl.trustStoreType=JCEKS
|
||||
-Dsolr.ssl.checkPeerName=false
|
||||
-Dsolr.allow.unsafe.resourceloading=true
|
||||
-Dalfresco.encryption.ssl.keystore.location=/opt/alfresco-insight-engine/keystore/ssl.repo.client.keystore
|
||||
-Dalfresco.encryption.ssl.keystore.passwordFileLocation=/opt/alfresco-insight-engine/keystore/ssl-keystore-passwords.properties
|
||||
-Dalfresco.encryption.ssl.keystore.type=JCEKS
|
||||
-Dalfresco.encryption.ssl.truststore.location=/opt/alfresco-insight-engine/keystore/ssl.repo.client.truststore
|
||||
-Dalfresco.encryption.ssl.truststore.passwordFileLocation=/opt/alfresco-insight-engine/keystore/ssl-truststore-passwords.properties
|
||||
-Dalfresco.encryption.ssl.truststore.type=JCEKS
|
||||
"
|
||||
ports:
|
||||
- 8083:8983 #Browser port
|
||||
volumes:
|
||||
- ./solr6/keystore:/opt/alfresco-insight-engine/keystore
|
||||
|
||||
zeppelin:
|
||||
build: ./zeppelin
|
||||
environment:
|
||||
REPO_PROTOCOL: "https"
|
||||
REPO_HOST: "alfresco"
|
||||
REPO_PORT: "8443"
|
||||
JAVA_OPTS: "
|
||||
-Dalfresco.enable.ssl=true
|
||||
-Dsolr.ssl.checkPeerName=false
|
||||
-Djavax.net.ssl.keyStore=/zeppelin/keystore/ssl.repo.client.keystore
|
||||
-Djavax.net.ssl.keyStorePassword=kT9X6oe68t
|
||||
-Djavax.net.ssl.keyStoreType=JCEKS
|
||||
-Djavax.net.ssl.trustStore=/zeppelin/keystore/ssl.repo.client.truststore
|
||||
-Djavax.net.ssl.trustStorePassword=kT9X6oe68t
|
||||
-Djavax.net.ssl.trustStoreType=JCEKS
|
||||
"
|
||||
ports:
|
||||
- 9090:9090
|
||||
volumes:
|
||||
- ./zeppelin/keystore:/zeppelin/keystore
|
||||
|
||||
activemq:
|
||||
image: alfresco/alfresco-activemq:5.15.8
|
||||
mem_limit: 1g
|
||||
ports:
|
||||
- 8161:8161 # Web Console
|
||||
- 5672:5672 # AMQP
|
||||
- 61616:61616 # OpenWire
|
||||
- 61613:61613 # STOMP
|
||||
|
||||
digital-workspace:
|
||||
image: quay.io/alfresco/alfresco-digital-workspace:1.1.0
|
||||
mem_limit: 128m
|
||||
environment:
|
||||
BASEPATH: ./
|
||||
|
||||
proxy:
|
||||
image: quay.io/alfresco/alfresco-acs-nginx:3.0.0
|
||||
mem_limit: 128m
|
||||
depends_on:
|
||||
- alfresco
|
||||
- digital-workspace
|
||||
ports:
|
||||
- 8080:8080
|
||||
links:
|
||||
- digital-workspace
|
||||
- alfresco
|
||||
- share
|
||||
|
||||
volumes:
|
||||
shared-file-store-volume:
|
||||
driver_opts:
|
||||
type: tmpfs
|
||||
device: tmpfs
|
||||
@@ -1,206 +0,0 @@
|
||||
# This docker-compose file will spin up an ACS cluster on a local host or on a server and it requires a minimum of 16GB Memory to distribute among containers.
|
||||
# Limit container memory and assign X percentage to JVM. There are couple of ways to allocate JVM Memory for ACS Containers
|
||||
# For example: 'JAVA_OPTS: "$JAVA_OPTS -XX:+PrintFlagsFinal -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"'
|
||||
# See Oracle docs (https://docs.oracle.com/javase/9/gctuning/parallel-collector1.htm#JSGCT-GUID-CAB83393-3438-44ED-98F0-D15641B43C7D).
|
||||
# If the container memory is not explicitly set then the flags above will set the max heap default to 1/4 of the container's memory, which may not be ideal.
|
||||
# For performance tuning, assign the container memory and give a percentage of it to the JVM.
|
||||
|
||||
# Note: The docker-compose file from github.com is a limited trial that goes into read-only mode after 2 days.
|
||||
# Get the latest docker-compose.yml file with a 30-day trial license by accessing the Alfresco Content Services trial download page at:
|
||||
# https://www.alfresco.com/platform/content-services-ecm/trial/download
|
||||
|
||||
# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
|
||||
version: "2"
|
||||
|
||||
services:
|
||||
alfresco:
|
||||
image: alfresco/alfresco-content-repository:6.1.0.3
|
||||
mem_limit: 1700m
|
||||
environment:
|
||||
JAVA_OPTS: "
|
||||
-Ddb.driver=org.postgresql.Driver
|
||||
-Ddb.username=alfresco
|
||||
-Ddb.password=alfresco
|
||||
-Ddb.url=jdbc:postgresql://postgres:5432/alfresco
|
||||
-Dsolr.host=solr6
|
||||
-Dsolr.port.ssl=8983
|
||||
-Dsolr.secureComms=none
|
||||
-Dsolr.base.url=/solr
|
||||
-Dindex.subsystem.name=solr6
|
||||
-Dalfresco-pdf-renderer.url=http://alfresco-pdf-renderer:8090/
|
||||
-Djodconverter.url=http://libreoffice:8090/
|
||||
-Dimg.url=http://imagemagick:8090/
|
||||
-Dtika.url=http://tika:8090/
|
||||
-Dsfs.url=http://shared-file-store:8099/
|
||||
-Dshare.host=127.0.0.1
|
||||
-Dshare.port=8080
|
||||
-Dalfresco.host=localhost
|
||||
-Dalfresco.port=8080
|
||||
-Daos.baseUrlOverwrite=http://localhost:8080/alfresco/aos
|
||||
-Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\"
|
||||
-Ddeployment.method=DOCKER_COMPOSE
|
||||
-Dlocal.transform.service.enabled=true
|
||||
-Dtransform.service.enabled=true
|
||||
-Dcsrf.filter.enabled=false
|
||||
-Xms1500m -Xmx1500m
|
||||
"
|
||||
ports:
|
||||
- 8443:8443
|
||||
|
||||
transform-router:
|
||||
mem_limit: 512m
|
||||
image: quay.io/alfresco/alfresco-transform-router:1.0.1
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
IMAGEMAGICK_URL: "http://imagemagick:8090"
|
||||
PDF_RENDERER_URL : "http://alfresco-pdf-renderer:8090"
|
||||
LIBREOFFICE_URL : "http://libreoffice:8090"
|
||||
TIKA_URL : "http://tika:8090"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
links:
|
||||
- activemq
|
||||
|
||||
alfresco-pdf-renderer:
|
||||
image: quay.io/alfresco/alfresco-pdf-renderer:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8090:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
imagemagick:
|
||||
image: quay.io/alfresco/alfresco-imagemagick:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8091:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
libreoffice:
|
||||
image: quay.io/alfresco/alfresco-libreoffice:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8092:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
tika:
|
||||
image: quay.io/alfresco/alfresco-tika:2.0.10
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
ACTIVEMQ_URL: "nio://activemq:61616"
|
||||
FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
|
||||
ports:
|
||||
- 8093:8090
|
||||
links:
|
||||
- activemq
|
||||
|
||||
shared-file-store:
|
||||
image: alfresco/alfresco-shared-file-store:0.5.3
|
||||
mem_limit: 512m
|
||||
environment:
|
||||
JAVA_OPTS: " -Xms256m -Xmx512m"
|
||||
scheduler.content.age.millis: 86400000
|
||||
scheduler.cleanup.interval: 86400000
|
||||
ports:
|
||||
- 8099:8099
|
||||
volumes:
|
||||
- shared-file-store-volume:/tmp/Alfresco/sfs
|
||||
|
||||
share:
|
||||
image: alfresco/alfresco-share:6.1.0
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
REPO_HOST: "alfresco"
|
||||
REPO_PORT: "8080"
|
||||
JAVA_OPTS: "
|
||||
-Xms500m
|
||||
-Xmx500m
|
||||
-Dalfresco.host=localhost
|
||||
-Dalfresco.port=8080
|
||||
-Dalfresco.context=alfresco
|
||||
-Dalfresco.protocol=http
|
||||
"
|
||||
|
||||
postgres:
|
||||
image: postgres:10.1
|
||||
mem_limit: 512m
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=alfresco
|
||||
- POSTGRES_USER=alfresco
|
||||
- POSTGRES_DB=alfresco
|
||||
command: postgres -c max_connections=300 -c log_min_messages=LOG
|
||||
ports:
|
||||
- 5432:5432
|
||||
|
||||
solr6:
|
||||
image: quay.io/alfresco/insight-engine:1.1.0.1
|
||||
mem_limit: 2g
|
||||
environment:
|
||||
#Solr needs to know how to register itself with Alfresco
|
||||
SOLR_ALFRESCO_HOST: "alfresco"
|
||||
SOLR_ALFRESCO_PORT: "8080"
|
||||
#Alfresco needs to know how to call solr
|
||||
SOLR_SOLR_HOST: "solr6"
|
||||
SOLR_SOLR_PORT: "8983"
|
||||
#Create the default alfresco and archive cores
|
||||
SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive"
|
||||
SOLR_JAVA_MEM: "-Xms2g -Xmx2g"
|
||||
ports:
|
||||
- 8083:8983 #Browser port
|
||||
|
||||
zeppelin:
|
||||
image: quay.io/alfresco/insight-zeppelin:1.1.0.1
|
||||
environment:
|
||||
REPO_HOST: "alfresco"
|
||||
REPO_PORT: "8080"
|
||||
ports:
|
||||
- 9090:9090
|
||||
|
||||
activemq:
|
||||
image: alfresco/alfresco-activemq:5.15.8
|
||||
mem_limit: 1g
|
||||
ports:
|
||||
- 8161:8161 # Web Console
|
||||
- 5672:5672 # AMQP
|
||||
- 61616:61616 # OpenWire
|
||||
- 61613:61613 # STOMP
|
||||
|
||||
digital-workspace:
|
||||
image: quay.io/alfresco/alfresco-digital-workspace:1.1.0
|
||||
mem_limit: 128m
|
||||
environment:
|
||||
BASEPATH: ./
|
||||
|
||||
proxy:
|
||||
image: quay.io/alfresco/alfresco-acs-nginx:3.0.0
|
||||
mem_limit: 128m
|
||||
depends_on:
|
||||
- alfresco
|
||||
- digital-workspace
|
||||
ports:
|
||||
- 8080:8080
|
||||
links:
|
||||
- digital-workspace
|
||||
- alfresco
|
||||
- share
|
||||
|
||||
volumes:
|
||||
shared-file-store-volume:
|
||||
driver_opts:
|
||||
type: tmpfs
|
||||
device: tmpfs
|
||||
@@ -1,10 +0,0 @@
|
||||
FROM quay.io/alfresco/insight-engine:1.1.0.1
|
||||
|
||||
# Configure SOLR cores to run in HTTPs mode from template
|
||||
RUN sed -i '/^bash.*/i sed -i "'"s/alfresco.secureComms=none/alfresco.secureComms=https/g"'" ${DIST_DIR}/solrhome/templates/rerank/conf/solrcore.properties\n' \
|
||||
${DIST_DIR}/solr/bin/search_config_setup.sh
|
||||
|
||||
RUN mkdir ${DIST_DIR}/keystore \
|
||||
&& chown -R solr:solr ${DIST_DIR}/keystore
|
||||
|
||||
VOLUME ["${DIST_DIR}/keystore"]
|
||||
-7
@@ -1,7 +0,0 @@
|
||||
aliases=ssl.alfresco.ca,ssl.repo
|
||||
# The ssl keystore password
|
||||
keystore.password=kT9X6oe68t
|
||||
# The password protecting the ssl repository key
|
||||
ssl.repo.password=kT9X6oe68t
|
||||
# The password protecting the ssl Alfresco CA key
|
||||
ssl.alfresco.ca.password=kT9X6oe68t
|
||||
-5
@@ -1,5 +0,0 @@
|
||||
aliases=alfresco.ca
|
||||
# The ssl truststore password
|
||||
keystore.password=kT9X6oe68t
|
||||
# The password protecting the ssl Alfresco CA strust certificate
|
||||
alfresco.ca.password=kT9X6oe68t
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
@@ -1,4 +0,0 @@
|
||||
FROM quay.io/alfresco/insight-zeppelin:1.1.0.1
|
||||
|
||||
RUN mkdir ${ZEPPELIN_HOME}/keystore \
|
||||
&& chown -R zeppelin:zeppelin ${ZEPPELIN_HOME}/keystore
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
@@ -1,47 +0,0 @@
|
||||
# Generation Tool for custom SSL Certificates
|
||||
|
||||
This `run.sh` script generates certificates for Repository and SOLR SSL Communication:
|
||||
|
||||
* CA Entity to issue all required certificates (alias alfresco.ca)
|
||||
* Server Certificate for Alfresco (alias ssl.repo)
|
||||
* Server Certificate for SOLR (alias ssl.repo.client)
|
||||
|
||||
Sample `openssl.cnf` file is provided for CA Configuration.
|
||||
|
||||
## Execution
|
||||
|
||||
```bash
|
||||
$ cd ssl-tool
|
||||
$ ./run.sh
|
||||
```
|
||||
|
||||
## Deployment
|
||||
|
||||
Once this script has been executed successfully, following resources are generated in ${KEYSTORES_DIR} folder:
|
||||
|
||||
```
|
||||
keystores
|
||||
├── alfresco
|
||||
│ ├── keystore
|
||||
│ ├── keystore-passwords.properties
|
||||
│ ├── ssl-keystore-passwords.properties
|
||||
│ ├── ssl-truststore-passwords.properties
|
||||
│ ├── ssl.keystore
|
||||
│ └── ssl.truststore
|
||||
├── client
|
||||
│ └── browser.p12
|
||||
└── solr
|
||||
├── ssl-keystore-passwords.properties
|
||||
├── ssl-truststore-passwords.properties
|
||||
├── ssl.repo.client.keystore
|
||||
└── ssl.repo.client.truststore
|
||||
```
|
||||
|
||||
* `alfresco` files must be copied to "alfresco/keystore" folder in Docker Compose template project (any existing file must be overwritten)
|
||||
* `solr` files must be copied to "solr6/keystore" folder and "zeppelin/keystore" folder (for Enterprise) in Docker Compose template project (any existing file must be overwritten)
|
||||
* `client` files can be used from a browser to access the server using HTTPS in port 8443
|
||||
|
||||
## Dependencies
|
||||
|
||||
* **openssl** version (LibreSSL 2.6.5)
|
||||
* **keytool** from openjdk version "11.0.2"
|
||||
@@ -1,94 +0,0 @@
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
# Directory and file locations: set your current directory
|
||||
dir = ./ca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
new_certs_dir = $dir/newcerts
|
||||
database = $dir/index.txt
|
||||
serial = $dir/serial
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
# The root key and root certificate.
|
||||
certificate = $dir/certs/ca.cert.pem
|
||||
private_key = $dir/private/ca.key.pem
|
||||
|
||||
# For certificate revocation lists.
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl/ca.crl.pem
|
||||
crl_extensions = crl_ext
|
||||
default_crl_days = 30
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 375
|
||||
preserve = no
|
||||
policy = policy_strict
|
||||
|
||||
default_days = 36500
|
||||
|
||||
[ policy_strict ]
|
||||
# The root CA should only sign intermediate certificates that match.
|
||||
# See the POLICY FORMAT section of `man ca`.
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 2048
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = GB
|
||||
stateOrProvinceName_default = England
|
||||
localityName_default =
|
||||
0.organizationName_default = Alice Ltd
|
||||
#organizationalUnitName_default =
|
||||
#emailAddress_default =
|
||||
|
||||
[ v3_ca ]
|
||||
# Extensions for a typical CA (`man x509v3_config`).
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
basicConstraints = CA:true
|
||||
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||
|
||||
[ server_cert ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "OpenSSL Generated Server Certificate"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
[ crl_ext ]
|
||||
# Extension for CRLs (`man x509v3_config`).
|
||||
authorityKeyIdentifier=keyid:always
|
||||
@@ -1,189 +0,0 @@
|
||||
#! /bin/sh
|
||||
|
||||
# This script generates certificates for Repository and SOLR SSL Communication:
|
||||
#
|
||||
# * CA Entity to issue all required certificates (alias alfresco.ca)
|
||||
# * Server Certificate for Alfresco (alias ssl.repo)
|
||||
# * Server Certificate for SOLR (alias ssl.repo.client)
|
||||
#
|
||||
# Sample "openssl.cnf" file is provided for CA Configuration.
|
||||
#
|
||||
# Once this script has been executed successfully, following resources are generated in ${KEYSTORES_DIR} folder:
|
||||
#
|
||||
# .
|
||||
# ├── alfresco
|
||||
# │ ├── ssl-keystore-passwords.properties
|
||||
# │ ├── ssl-truststore-passwords.properties
|
||||
# │ ├── ssl.keystore
|
||||
# │ └── ssl.truststore
|
||||
# ├── client
|
||||
# │ └── browser.p12
|
||||
# └── solr
|
||||
# ├── ssl-keystore-passwords.properties
|
||||
# ├── ssl-truststore-passwords.properties
|
||||
# ├── ssl.repo.client.keystore
|
||||
# └── ssl.repo.client.truststore
|
||||
#
|
||||
# "alfresco" files must be copied to "alfresco/keystore" folder
|
||||
# "solr" files must be copied to "keystore"
|
||||
# "client" files can be used from a browser to access the server using HTTPS in port 8443
|
||||
|
||||
# Dependencies:
|
||||
# * openssl version (LibreSSL 2.6.5)
|
||||
# * keytool from openjdk version "11.0.2"
|
||||
|
||||
# PARAMETERS
|
||||
|
||||
# Distinguished name of the CA
|
||||
CA_DNAME="/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA"
|
||||
# Distinguished name of the Server Certificate for Alfresco
|
||||
REPO_CERT_DNAME="/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco Repository"
|
||||
# Distinguished name of the Server Certificate for SOLR
|
||||
SOLR_CLIENT_CERT_DNAME="/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco Repository Client"
|
||||
|
||||
# RSA key length
|
||||
KEY_SIZE=1024
|
||||
|
||||
# Default password for every store and key
|
||||
PASS=kT9X6oe68t
|
||||
|
||||
# Encryption secret key passwords
|
||||
ENC_STORE_PASS=password
|
||||
ENC_METADATA_PASS=password
|
||||
|
||||
# Folder where keystores, truststores and cerfiticates are generated
|
||||
KEYSTORES_DIR=keystores
|
||||
ALFRESCO_KEYSTORES_DIR=keystores/alfresco
|
||||
SOLR_KEYSTORES_DIR=keystores/solr
|
||||
CLIENT_KEYSTORES_DIR=keystores/client
|
||||
|
||||
# SCRIPT
|
||||
|
||||
# Remove previous working directories and certificates
|
||||
rm -rf ca
|
||||
rm -rf ${KEYSTORES_DIR}
|
||||
rm repository.*
|
||||
rm solr.*
|
||||
rm ssl.*
|
||||
|
||||
# Generate a new CA Entity
|
||||
mkdir ca
|
||||
|
||||
mkdir ca/certs ca/crl ca/newcerts ca/private
|
||||
chmod 700 ca/private
|
||||
touch ca/index.txt
|
||||
echo 1000 > ca/serial
|
||||
|
||||
openssl genrsa -aes256 -passout pass:$PASS -out ca/private/ca.key.pem $KEY_SIZE
|
||||
chmod 400 ca/private/ca.key.pem
|
||||
|
||||
openssl req -config openssl.cnf \
|
||||
-key ca/private/ca.key.pem \
|
||||
-new -x509 -days 7300 -sha256 -extensions v3_ca \
|
||||
-out ca/certs/ca.cert.pem \
|
||||
-subj "$CA_DNAME" \
|
||||
-passin pass:$PASS
|
||||
chmod 444 ca/certs/ca.cert.pem
|
||||
|
||||
# Generate Server Certificate for Alfresco (issued by just generated CA)
|
||||
openssl req -newkey rsa:$KEY_SIZE -nodes -out repository.csr -keyout repository.key -subj "$REPO_CERT_DNAME"
|
||||
openssl ca -config openssl.cnf -extensions server_cert -passin pass:$PASS -batch -notext -in repository.csr -out repository.cer
|
||||
openssl pkcs12 -export -out repository.p12 -inkey repository.key -in repository.cer -password pass:$PASS -certfile ca/certs/ca.cert.pem
|
||||
|
||||
# Server Certificate for SOLR (issued by just generated CA)
|
||||
openssl req -newkey rsa:$KEY_SIZE -nodes -out solr.csr -keyout solr.key -subj "$SOLR_CLIENT_CERT_DNAME"
|
||||
openssl ca -config openssl.cnf -extensions server_cert -passin pass:$PASS -batch -notext -in solr.csr -out solr.cer
|
||||
openssl pkcs12 -export -out solr.p12 -inkey solr.key -in solr.cer -certfile ca.cer -password pass:$PASS -certfile ca/certs/ca.cert.pem
|
||||
|
||||
# Create folders for truststores, keystores and certificates
|
||||
mkdir ${KEYSTORES_DIR}
|
||||
mkdir ${ALFRESCO_KEYSTORES_DIR}
|
||||
mkdir ${SOLR_KEYSTORES_DIR}
|
||||
mkdir ${CLIENT_KEYSTORES_DIR}
|
||||
|
||||
#
|
||||
# ALFRESCO
|
||||
#
|
||||
|
||||
# Include CA and SOLR certificates in Alfresco Truststore
|
||||
keytool -import -trustcacerts -noprompt -alias alfresco.ca -file ca/certs/ca.cert.pem \
|
||||
-keystore ${ALFRESCO_KEYSTORES_DIR}/ssl.truststore -storetype JCEKS -storepass $PASS
|
||||
|
||||
keytool -importcert -noprompt -alias ssl.repo.client -file solr.cer \
|
||||
-keystore ${ALFRESCO_KEYSTORES_DIR}/ssl.truststore -storetype JCEKS -storepass $PASS
|
||||
|
||||
# Include Alfresco Certificate in Alfresco Keystore
|
||||
# Also adding CA Certificate for historical reasons
|
||||
keytool -importkeystore \
|
||||
-srckeystore repository.p12 -destkeystore ${ALFRESCO_KEYSTORES_DIR}/ssl.keystore \
|
||||
-srcstoretype PKCS12 -deststoretype JCEKS \
|
||||
-srcstorepass $PASS -deststorepass $PASS \
|
||||
-srcalias 1 -destalias ssl.repo \
|
||||
-srckeypass $PASS -destkeypass $PASS \
|
||||
-noprompt
|
||||
|
||||
keytool -importcert -noprompt -alias ssl.alfresco.ca -file ca/certs/ca.cert.pem \
|
||||
-keystore ${ALFRESCO_KEYSTORES_DIR}/ssl.keystore -storetype JCEKS -storepass $PASS
|
||||
|
||||
# Generate Encryption Secret Key
|
||||
keytool -genseckey -alias metadata -keypass $ENC_METADATA_PASS -storepass $ENC_STORE_PASS -keystore ${ALFRESCO_KEYSTORES_DIR}/keystore \
|
||||
-storetype JCEKS -keyalg DESede
|
||||
|
||||
# Create Alfresco stores password files
|
||||
ECHO "aliases=alfresco.ca
|
||||
keystore.password=$PASS
|
||||
alfresco.ca.password=$PASS" > ${ALFRESCO_KEYSTORES_DIR}/ssl-truststore-passwords.properties
|
||||
|
||||
ECHO "aliases=ssl.alfresco.ca,ssl.repo
|
||||
keystore.password=$PASS
|
||||
ssl.repo.password=$PASS
|
||||
ssl.alfresco.ca.password=$PASS" > ${ALFRESCO_KEYSTORES_DIR}/ssl-keystore-passwords.properties
|
||||
|
||||
ECHO "aliases=metadata
|
||||
keystore.password=$ENC_METADATA_PASS
|
||||
metadata.keyData=
|
||||
metadata.algorithm=DESede
|
||||
metadata.password=$ENC_STORE_PASS" > ${ALFRESCO_KEYSTORES_DIR}/keystore-passwords.properties
|
||||
|
||||
#
|
||||
# SOLR
|
||||
#
|
||||
|
||||
# Include CA and Alfresco certificates in SOLR Truststore
|
||||
keytool -import -trustcacerts -noprompt -alias ssl.alfresco.ca -file ca/certs/ca.cert.pem \
|
||||
-keystore ${SOLR_KEYSTORES_DIR}/ssl.repo.client.truststore -storetype JCEKS -storepass $PASS
|
||||
|
||||
keytool -importcert -noprompt -alias ssl.repo -file repository.cer \
|
||||
-keystore ${SOLR_KEYSTORES_DIR}/ssl.repo.client.truststore -storetype JCEKS -storepass $PASS
|
||||
|
||||
# Include SOLR Certificate in SOLR Keystore
|
||||
# Also adding CA Certificate for historical reasons
|
||||
keytool -importkeystore \
|
||||
-srckeystore solr.p12 -destkeystore ${SOLR_KEYSTORES_DIR}/ssl.repo.client.keystore \
|
||||
-srcstoretype PKCS12 -deststoretype JCEKS \
|
||||
-srcstorepass $PASS -deststorepass $PASS \
|
||||
-srcalias 1 -destalias ssl.repo.client \
|
||||
-srckeypass $PASS -destkeypass $PASS \
|
||||
-noprompt
|
||||
|
||||
keytool -importcert -noprompt -alias alfresco.ca -file ca/certs/ca.cert.pem \
|
||||
-keystore ${SOLR_KEYSTORES_DIR}/ssl.repo.client.keystore -storetype JCEKS -storepass $PASS
|
||||
|
||||
# Create SOLR stores password files
|
||||
ECHO "aliases=alfresco.ca
|
||||
keystore.password=$PASS
|
||||
alfresco.ca.password=$PASS" > ${SOLR_KEYSTORES_DIR}/ssl-truststore-passwords.properties
|
||||
|
||||
ECHO "aliases=ssl.alfresco.ca,ssl.repo
|
||||
keystore.password=$PASS
|
||||
ssl.repo.password=$PASS
|
||||
ssl.alfresco.ca.password=$PASS" > ${SOLR_KEYSTORES_DIR}/ssl-keystore-passwords.properties
|
||||
|
||||
#
|
||||
# CLIENT
|
||||
#
|
||||
|
||||
# Create client certificate
|
||||
keytool -importkeystore -srckeystore ${ALFRESCO_KEYSTORES_DIR}/ssl.keystore -srcstorepass $PASS -srcstoretype JCEKS -srcalias ssl.repo \
|
||||
-srckeypass $PASS -destkeystore ${CLIENT_KEYSTORES_DIR}/browser.p12 -deststoretype pkcs12 -deststorepass $PASS \
|
||||
-destalias ssl.repo -destkeypass $PASS
|
||||
@@ -0,0 +1,5 @@
|
||||
ALFRESCO_TAG=6.1.2-ga
|
||||
SHARE_TAG=6.1.0
|
||||
POSTGRES_TAG=10.1
|
||||
SEARCH_TAG=1.3.0.1
|
||||
ACTIVE_MQ_TAG=5.15.8
|
||||
+4
-34
@@ -1,12 +1,6 @@
|
||||
# Docker Templates for Community Edition
|
||||
|
||||
This project includes default configuration for ACS Community 6.1 and Search Services 1.3.
|
||||
|
||||
Different Docker Compose templates are provided:
|
||||
|
||||
* `docker-compose.yml` to use Plain HTTP communication between Repository and SOLR
|
||||
|
||||
* `docker-compose-ssl.yml` to use Mutual TLS communication between Repository and SOLR
|
||||
This project includes default configuration to use Mutual TLS communication between ACS Community 6.1 and Search Services 1.3.
|
||||
|
||||
Every *truststores*, *keystores* and *certificates* are copied from sources.
|
||||
|
||||
@@ -14,9 +8,7 @@ Every *truststores*, *keystores* and *certificates* are copied from sources.
|
||||
|
||||
* **alfresco** includes a `Dockerfile` with *Tomcat Connector* configuration and *Keystore* folder mapping as it's required for Connector. Default stores and certificates from source code (`alfresco-repository`) have been copied in keystore folder.
|
||||
|
||||
* **docker-compose-ssl.yml** includes a Docker Composition for ACS 6.1 and Search Services 1.3 using Mutual TLS
|
||||
|
||||
* **docker-compose.yml** includes a Docker Composition for ACS 6.1 and Search Services 1.3 using Plain HTTP
|
||||
* **docker-compose.yml** includes a Docker Composition for ACS 6.1 and Search Services 1.3 using Mutual TLS
|
||||
|
||||
* **solr6** includes a `Dockerfile` to set *https* communications and to provide a volume for the keystore. The keystore folder includes default certificates for SOLR server copied from source code (`alfresco-search`)
|
||||
|
||||
@@ -30,7 +22,6 @@ Every *truststores*, *keystores* and *certificates* are copied from sources.
|
||||
│ ├── ssl-truststore-passwords.properties
|
||||
│ ├── ssl.keystore
|
||||
│ └── ssl.truststore
|
||||
├── docker-compose-ssl.yml
|
||||
├── docker-compose.yml
|
||||
└── solr6
|
||||
├── Dockerfile
|
||||
@@ -44,33 +35,12 @@ Every *truststores*, *keystores* and *certificates* are copied from sources.
|
||||
|
||||
## Running Docker Compose
|
||||
|
||||
This project includes resources to start the platform in Plain HTTP or Mutual TLS (SSL).
|
||||
|
||||
**Plain HTTP**
|
||||
|
||||
Docker can be started using default command.
|
||||
|
||||
```bash
|
||||
$ docker-compose up --build
|
||||
```
|
||||
|
||||
Alfresco will be available at:
|
||||
|
||||
http://localhost:8082/alfresco
|
||||
|
||||
http://localhost:8080/share
|
||||
|
||||
http://localhost:8083/solr
|
||||
|
||||
Plain HTTP Communication from SOLR is targeted inside Docker Network to http://alfresco:8080/alfresco
|
||||
|
||||
|
||||
**Mutual TLS (SSL)**
|
||||
This project includes resources to start the platform in Mutual TLS (SSL).
|
||||
|
||||
Docker can be started selecting SSL Docker Compose file.
|
||||
|
||||
```bash
|
||||
$ docker-compose -f docker-compose-ssl.yml up --build
|
||||
$ docker-compose up --build
|
||||
```
|
||||
|
||||
Alfresco will be available at:
|
||||
+2
-1
@@ -1,4 +1,5 @@
|
||||
FROM alfresco/alfresco-content-repository-community:6.1.2-ga
|
||||
ARG ALFRESCO_TAG
|
||||
FROM alfresco/alfresco-content-repository-community:${ALFRESCO_TAG}
|
||||
|
||||
USER root
|
||||
|
||||
+11
-5
@@ -10,7 +10,10 @@ version: "2"
|
||||
|
||||
services:
|
||||
alfresco:
|
||||
build: ./alfresco
|
||||
build:
|
||||
context: ./alfresco
|
||||
args:
|
||||
ALFRESCO_TAG: ${ALFRESCO_TAG}
|
||||
mem_limit: 1500m
|
||||
environment:
|
||||
JAVA_OPTS : "
|
||||
@@ -36,7 +39,7 @@ services:
|
||||
- 8443:8443
|
||||
|
||||
share:
|
||||
image: alfresco/alfresco-share:6.1.0
|
||||
image: alfresco/alfresco-share:${SHARE_TAG}
|
||||
mem_limit: 1g
|
||||
environment:
|
||||
- REPO_HOST=alfresco
|
||||
@@ -46,7 +49,7 @@ services:
|
||||
- 8080:8080
|
||||
|
||||
postgres:
|
||||
image: postgres:10.1
|
||||
image: postgres:${POSTGRES_TAG}
|
||||
mem_limit: 1500m
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=alfresco
|
||||
@@ -57,7 +60,10 @@ services:
|
||||
- 5432:5432
|
||||
|
||||
solr6:
|
||||
build: ./solr6
|
||||
build:
|
||||
context: ./solr6
|
||||
args:
|
||||
- SEARCH_TAG=${SEARCH_TAG}
|
||||
mem_limit: 2500m
|
||||
environment:
|
||||
#Solr needs to know how to register itself with Alfresco
|
||||
@@ -94,7 +100,7 @@ services:
|
||||
- ./solr6/keystore:/opt/alfresco-search-services/keystore
|
||||
|
||||
activemq:
|
||||
image: alfresco/alfresco-activemq:5.15.8
|
||||
image: alfresco/alfresco-activemq:${ACTIVE_MQ_TAG}
|
||||
mem_limit: 2048m
|
||||
ports:
|
||||
- 8161:8161 # Web Console
|
||||
+2
-1
@@ -1,4 +1,5 @@
|
||||
FROM alfresco/alfresco-search-services:1.3.0.1
|
||||
ARG SEARCH_TAG
|
||||
FROM alfresco/alfresco-search-services:${SEARCH_TAG}
|
||||
|
||||
# Configure SOLR cores to run in HTTPs mode from template
|
||||
RUN sed -i '/^bash.*/i sed -i "'"s/alfresco.secureComms=none/alfresco.secureComms=https/g"'" ${DIST_DIR}/solrhome/templates/rerank/conf/solrcore.properties\n' \
|
||||
Reference in New Issue
Block a user