Merge branch 'acs-aims' into acs-aims-enterprise

.env

@@ -1,17 +1,8 @@
-ALFRESCO_DIR=~/alfresco
+EXTERNAL_RESOURCE_DIR=/home/brian
+ALFRESCO_DIR=${EXTERNAL_RESOURCE_DIR}/alfresco
 ALFRESCO_LICENSE_DIR=~/alfresco/license
 
 PROXY_PROTOCOL=http
 PROXY_HOST=localhost
 PROXY_PORT=8080
-IDENTITY_SERVICE_PROTOCOL=http
-IDENTITY_SERVICE_HOST=auth.example.org
-IDENTITY_SERVICE_PORT=8080
-
-ACS_TAG=7.4.1.1
-ATE_AIO_TAG=4.0.0
-AIS_TAG=1.8.0.1
-AAMQ_TAG=latest
-POSTGRES_TAG=13
-ASIE_TAG=2.0.8.2
-ACS_SHARE_TAG=7.4.1.2
+IDENTITY_SERVICE_BASEURL=http://auth.example.org:8080

docker-compose.yml

@@ -1,32 +1,22 @@
-# Originally sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
+# Sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
 #
-version: "3"
+# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
+version: "2"
 
 services:
-
     platform:
-        image: alfresco/alfresco-content-repository-community:${ACS_TAG}
+        image: alfresco/alfresco-content-repository:6.2.2.3
+        mem_limit: 1700m
         environment:
-            JAVA_TOOL_OPTIONS: "
-                -Dencryption.keystore.type=JCEKS
-                -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding
-                -Dencryption.keyAlgorithm=DESede
-                -Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore
-                -Dmetadata-keystore.password=mp6yc0UD9e
-                -Dmetadata-keystore.aliases=metadata
-                -Dmetadata-keystore.metadata.password=oKIWzVdEdA
-                -Dmetadata-keystore.metadata.algorithm=DESede
-                "
             JAVA_OPTS: "
-                -Xms512m -Xmx1g
                 -Ddb.driver=org.postgresql.Driver
                 -Ddb.username=alfresco
                 -Ddb.password=alfresco
                 -Ddb.url=jdbc:postgresql://postgres-acs:5432/alfresco
                 -Dindex.subsystem.name=solr6
                 -Dsolr.host=search
-                -Dsolr.secureComms=secret
-                -Dsolr.sharedSecret=alfresco-secret
+                -Dsolr.port=8983
+                -Dsolr.secureComms=none
                 -Dshare.host=${PROXY_HOST}
                 -Dshare.port=${PROXY_PORT}
                 -Dshare.protocol=${PROXY_PROTOCOL}
@@ -43,30 +33,66 @@ services:
                 -Dtika.url=http://transform-core-aio:8090/
                 -Dtransform.misc.url=http://transform-core-aio:8090/
                 -Dcsrf.filter.enabled=false
-                -Dcors.enabled=true
-                -Dcors.allowed.origins=http://localhost:4200,http://localhost:8080,${PROXY_PROTOCOL}://${PROXY_HOST}
-                -Dtransform.service.enabled=false
-                -Dlocal.transform.service.enabled=true
+                -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
+
+                -Dtransform.service.enabled=true
+                -Dlocal.transform.service.enabled=false
+
+                -Dtransform.service.url=http://transform-router:8095
+                -Dsfs.url=http://shared-file-store:8099
+                -Dalfresco-pdf-renderer.url=http://transform-engine-aio:8090
+                -Djodconverter.url=http://transform-engine-aio:8090
+                -Dimg.url=http://transform-engine-aio:8090
+                -Dtika.url=http://transform-engine-aio:8090
+                -Dtransform.misc.url=http://transform-engine-aio:8090
+
+                -Ddsync.service.uris=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/sync
+
                 -Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
                 -Didentity-service.authentication.defaultAdministratorUserNames=admin.1
-                -Didentity-service.auth-server-url=http://identity:8080/auth
+                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_BASEURL}/auth
+                
                 -Dsystem.content.eagerOrphanCleanup=true
                 -Dsystem.content.orphanProtectDays=0
                 -Djodconverter.enabled=false
                 "
         depends_on:
-            postgres-acs:
-                condition: service_started
-            activemq:
-                condition: service_started
-            identity:
-                condition: service_healthy
+            - postgres-acs
+            - activemq
+            - shared-file-store
+        volumes:
+            - "$ALFRESCO_LICENSE_DIR/acs:/usr/local/tomcat/shared/classes/alfresco/extension/license:ro"
+    
+    transform-router:
+        image: quay.io/alfresco/alfresco-transform-router:1.3.1
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            CORE_AIO_URL : "http://transform-core-aio:8090"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
     
     transform-core-aio:
-        image: alfresco/alfresco-transform-core-aio:${ATE_AIO_TAG}
+        image: alfresco/alfresco-transform-core-aio:2.3.6
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
+
+    shared-file-store:
+        image: alfresco/alfresco-shared-file-store:0.10.0
+        volumes:
+            - shared-file-store-volume:/tmp/Alfresco/sfs
+    
+    transform-core-aio:
+        image: alfresco/alfresco-transform-core-aio:2.3.6
     
     share:
-        image: alfresco/alfresco-share:${ACS_SHARE_TAG}
+        image: alfresco/alfresco-share:6.2.2
+        mem_limit: 512m
         environment:
             REPO_HOST: "platform"
             CSRF_FILTER_REFERER: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?/?.*"
@@ -81,7 +107,7 @@ services:
                 -Daims.enabled=true
                 -Daims.realm=alfresco
                 -Daims.resource=acs-share
-                -Daims.authServerUrl=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+                -Daims.authServerUrl=${IDENTITY_SERVICE_BASEURL}/auth
                 -Daims.sslRequired=none
                 -Daims.publicClient=true
                 -Daims.autodetectBearerOnly=true
@@ -91,61 +117,94 @@ services:
                 "
     
     postgres-acs:
-        image: postgres:${POSTGRES_TAG}
+        image: postgres:11.7
+        mem_limit: 512m
         environment:
-            POSTGRES_PASSWORD: alfresco
-            POSTGRES_USER: alfresco
-            POSTGRES_DB: alfresco
+            - POSTGRES_PASSWORD=alfresco
+            - POSTGRES_USER=alfresco
+            - POSTGRES_DB=alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
     
     search:
-        image: alfresco/alfresco-search-services:${ASIE_TAG}
+        image: alfresco/alfresco-search-services:2.0.1
+        mem_limit: 2g
         environment:
-            SOLR_ALFRESCO_HOST: platform
-            SOLR_SOLR_HOST: search
-            SOLR_CREATE_ALFRESCO_DEFAULTS: alfresco,archive
-            ALFRESCO_SECURE_COMMS: secret
-            JAVA_TOOL_OPTIONS: "
-                -Dalfresco.secureComms.secret=alfresco-secret
-                "
-        healthcheck:
-            test: "curl -fsS http://localhost:8983/solr"
+            - SOLR_ALFRESCO_HOST=platform
+            - SOLR_ALFRESCO_PORT=8080
+            - SOLR_SOLR_HOST=search
+            - SOLR_SOLR_PORT=8983
+            - SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive
+            - ALFRESCO_SECURE_COMMS=none
 
     activemq:
-        image: alfresco/alfresco-activemq:${AAMQ_TAG}
+        image: alfresco/alfresco-activemq:5.15.8
+        mem_limit: 256m
+
+    sync:
+        image: quay.io/alfresco/service-sync:3.3.3.1
+        mem_limit: 512m
         environment:
-            ACTIVEMQ_OPTS_MEMORY: -Xms64m -Xmx256m
-            ACTIVEMQ_ADMIN_LOGIN: alfresco
-            ACTIVEMQ_ADMIN_PASSWORD: alfresco
+            JAVA_OPTS : "
+                -Dsql.db.driver=org.postgresql.Driver
+                -Dsql.db.url=jdbc:postgresql://postgres-acs:5432/alfresco
+                -Dsql.db.username=alfresco
+                -Dsql.db.password=alfresco
+                -Dmessaging.broker.host=activemq
+                -Drepo.hostname=platform
+                -Drepo.port=8080
+                -Ddw.server.applicationConnectors[0].type=http
+                -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
+                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_BASEURL}/auth
+                -Didentity-service.resource=acs-sync
+                "
+        depends_on:
+            - postgres-acs
+            - activemq
+
+    digital-workspace:
+        image: quay.io/alfresco/alfresco-digital-workspace:2.0.0-adw
+        mem_limit: 128m
+        environment:
+            BASE_PATH: ./
+            APP_CONFIG_ECM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
+            APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/#/preview/s"
+            APP_CONFIG_AUTH_TYPE: OAUTH
+            APP_CONFIG_OAUTH2_HOST: "${IDENTITY_SERVICE_BASEURL}/auth/realms/alfresco"
+            APP_CONFIG_OAUTH2_CLIENTID: alfresco
+            APP_CONFIG_OAUTH2_IMPLICIT_FLOW: "true"
+            APP_CONFIG_OAUTH2_REDIRECT_LOGIN: "/workspace/"
+            APP_CONFIG_OAUTH2_REDIRECT_LOGOUT: "/workspace/logout"
 
     identity:
-        image: alfresco/alfresco-identity-service:${AIS_TAG}
+        image: alfresco/alfresco-identity-service:1.3
         user: jboss
         environment:
             KEYCLOAK_USER: admin
             KEYCLOAK_PASSWORD: admin
-            KEYCLOAK_FRONTEND_URL: ${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+            KEYCLOAK_HOSTNAME: auth.example.org
             KEYCLOAK_IMPORT: /tmp/keycloak-alfresco-realm.json
             KEYCLOAK_STATISTICS: enabled
         networks:
             default:
                 aliases:
-                    - "${IDENTITY_SERVICE_HOST}"
-        healthcheck:
-            test: ["CMD", "curl", "-f", "http://localhost:8080/auth/realms/alfresco"]
-            interval: 10s
-            timeout: 10s
-            # Really long startup times on Windows
-            retries: 18
+                    - "auth.example.org"
         volumes:
             - ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
 
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:acs-share-aims
+        image: local/nginx-ingress:acs-sync-share-adw-aims
         ports:
             - 8080:8080
         depends_on:
             - platform
+            - sync
             - share
+            - digital-workspace
             - identity
+
+volumes:
+    shared-file-store-volume:
+        driver_opts:
+            type: tmpfs
+            device: tmpfs

keycloak-alfresco-realm.json

@@ -42,6 +42,24 @@
       "attributes": {
         "login_theme": "alfresco"
       }
+    },
+    {
+      "clientId": "acs-sync",
+      "name": "Alfresco Sync Service Clients",
+      "enabled": true,
+      "alwaysDisplayInConsole": false,
+      "redirectUris": [
+        "http://127.0.0.1*",
+        "http://localhost*"
+      ],
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "publicClient": true,
+      "protocol": "openid-connect",
+      "attributes": {
+        "login_theme": "alfresco"
+      }
     }
   ],
   "requiredCredentials": [ "password" ],

nginx-ingress/entrypoint.sh

@@ -4,10 +4,18 @@ if [[ $ACS_PLATFORM_URL ]]; then
   sed -i s%http:\/\/platform:8080%"$ACS_PLATFORM_URL"%g /etc/nginx/nginx.conf
 fi
 
+if [[ $ACS_SYNC_URL ]]; then
+  sed -i s%http:\/\/sync:9090%"$ACS_SYNC_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $ACS_SHARE_URL ]]; then
   sed -i s%http:\/\/share:8080%"$ACS_SHARE_URL"%g /etc/nginx/nginx.conf
 fi
 
+if [[ $ADW_URL ]]; then
+  sed -i s%http:\/\/digital-workspace:8080%"$ADW_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $AIMS_URL ]]; then
   sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
 fi

nginx-ingress/nginx.conf

@@ -51,10 +51,21 @@ http {
             # If using external proxy / load balancer (for initial redirect if no trailing slash)
             absolute_redirect off;
         }
+        
+        location /sync/ {
+            proxy_pass http://sync:9090/alfresco/;
+        }
 
         location /share/ {
             proxy_pass http://share:8080;
         }
+        
+        location /workspace/ {
+            proxy_pass http://digital-workspace:8080/;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
 
         location /auth/ {
             proxy_pass http://identity:8080;

server.xml

@@ -1,175 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<!-- Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" at this level.
-     Documentation at /docs/config/server.html
- -->
-<Server port="8005" shutdown="SHUTDOWN">
-  <Listener className="org.apache.catalina.startup.VersionLoggerListener" logArgs="false" />
-  <!-- Security listener. Documentation at /docs/config/listeners.html
-  <Listener className="org.apache.catalina.security.SecurityListener" />
-  -->
-  <!-- APR library loader. Documentation at /docs/apr.html -->
-  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
-  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
-  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
-
-  <!-- Global JNDI resources
-       Documentation at /docs/jndi-resources-howto.html
-  -->
-  <GlobalNamingResources>
-    <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users
-    -->
-    <Resource name="UserDatabase" auth="Container"
-              type="org.apache.catalina.UserDatabase"
-              description="User database that can be updated and saved"
-              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-              pathname="conf/tomcat-users.xml" />
-  </GlobalNamingResources>
-
-  <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" Note:  A "Service" is not itself a "Container",
-       so you may not define subcomponents such as "Valves" at this level.
-       Documentation at /docs/config/service.html
-   -->
-  <Service name="Catalina">
-
-    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
-    <!--
-    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
-        maxThreads="150" minSpareThreads="4"/>
-    -->
-
-
-    <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned. Documentation at :
-         Java HTTP Connector: /docs/config/http.html
-         Java AJP  Connector: /docs/config/ajp.html
-         APR (HTTP/AJP) Connector: /docs/apr.html
-         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-    -->
-    <Connector port="8080" protocol="HTTP/1.1"
-               Server=" "
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyName="alfresco.inteligr8.com" proxyPort="443" />
-    <!-- A "Connector" using the shared thread pool-->
-    <!--
-    <Connector executor="tomcatThreadPool"
-               port="8080" protocol="HTTP/1.1"
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyHost="alfresco.inteligr8.com" proxyPort="443" />
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
-         This connector uses the NIO implementation. The default
-         SSLImplementation will depend on the presence of the APR/native
-         library and the useOpenSSL attribute of the AprLifecycleListener.
-         Either JSSE or OpenSSL style configuration may be used regardless of
-         the SSLImplementation selected. JSSE style configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
-               maxThreads="150" SSLEnabled="true">
-        <SSLHostConfig>
-            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
-         This connector uses the APR/native implementation which always uses
-         OpenSSL for TLS.
-         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
-         configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
-               maxThreads="150" SSLEnabled="true" >
-        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
-        <SSLHostConfig>
-            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
-                         certificateFile="conf/localhost-rsa-cert.pem"
-                         certificateChainFile="conf/localhost-rsa-chain.pem"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <!--
-    <Connector protocol="AJP/1.3"
-               address="::1"
-               port="8009"
-               redirectPort="8443" />
-    -->
-
-    <!-- An Engine represents the entry point (within Catalina) that processes
-         every request.  The Engine implementation for Tomcat stand alone
-         analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host).
-         Documentation at /docs/config/engine.html -->
-
-    <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-    -->
-    <Engine name="Catalina" defaultHost="localhost">
-
-      <!--For clustering, please take a look at documentation at:
-          /docs/cluster-howto.html  (simple how to)
-          /docs/config/cluster.html (reference documentation) -->
-      <!--
-      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-      -->
-
-      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
-           via a brute-force attack -->
-      <Realm className="org.apache.catalina.realm.LockOutRealm">
-        <!-- This Realm uses the UserDatabase configured in the global JNDI
-             resources under the key "UserDatabase".  Any edits
-             that are performed against this UserDatabase are immediately
-             available for use by the Realm.  -->
-        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
-               resourceName="UserDatabase"/>
-      </Realm>
-
-      <Host name="localhost"  appBase="webapps"
-            unpackWARs="true" autoDeploy="true">
-
-        <!-- SingleSignOn valve, share authentication between web applications
-             Documentation at: /docs/config/valve.html -->
-        <!--
-        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-        -->
-
-        <!-- Access log processes all example.
-             Documentation at: /docs/config/valve.html
-             Note: The pattern used is equivalent to using pattern="common" -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
-               prefix="localhost_access_log" suffix=".txt"
-               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
-
-	<Valve className="org.apache.catalina.valves.RemoteIpValve" />
-
-      </Host>
-    </Engine>
-  </Service>
-</Server>