Compare commits

..

14 Commits

Author SHA1 Message Date
brian
8b7ec4654e Merge branch 'aps-base' into aps 2021-04-02 09:13:16 -04:00
6e0c055222 Merge branch 'proxy' into aps-base 2021-04-02 09:06:48 -04:00
brian
9dd046ad51 Merge branch 'aps-base' into aps 2021-01-13 16:16:27 -05:00
20b41bbcb1 corrected misspelling 2021-01-13 15:39:02 -05:00
89348916a5 Merge branch 'aps-base' into aps 2021-01-13 15:37:13 -05:00
a2619fac7b fixed license directory var 2021-01-13 15:37:06 -05:00
3a47c43a88 Merge branch 'aps-base' into aps 2021-01-13 15:32:16 -05:00
16aa444b19 removed excess file mapping 2021-01-13 15:32:03 -05:00
deb6bf058c Merge branch 'aps-base' into aps 2021-01-13 15:23:44 -05:00
8a0ccc61a5 backported some stuff from aps to aps-base 2021-01-13 15:22:30 -05:00
695e3b3dc0 fixed after testing 2021-01-13 15:20:03 -05:00
2b7755222b added versions and config to APS 2021-01-13 14:42:41 -05:00
237a8abd62 fixed proxy depends_on 2021-01-13 14:33:11 -05:00
f28c16c4fe initial aps base 2021-01-13 14:32:12 -05:00
6 changed files with 70 additions and 400 deletions

11
.env
View File

@@ -4,14 +4,3 @@ ALFRESCO_LICENSE_DIR=~/alfresco/license
PROXY_PROTOCOL=http
PROXY_HOST=localhost
PROXY_PORT=8080
IDENTITY_SERVICE_PROTOCOL=http
IDENTITY_SERVICE_HOST=auth.example.org
IDENTITY_SERVICE_PORT=8080
ACS_TAG=7.4.1.1
ATE_AIO_TAG=4.0.0
AIS_TAG=1.8.0.1
AAMQ_TAG=latest
POSTGRES_TAG=13
ASIE_TAG=2.0.8.2
ACS_SHARE_TAG=7.4.1.2

View File

@@ -1,151 +1,80 @@
# Originally sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
# Sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
#
version: "3"
# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
version: "2"
services:
platform:
image: alfresco/alfresco-content-repository-community:${ACS_TAG}
activiti-app:
image: alfresco/process-services:1.11.1.1
mem_limit: 512m
environment:
JAVA_TOOL_OPTIONS: "
-Dencryption.keystore.type=JCEKS
-Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding
-Dencryption.keyAlgorithm=DESede
-Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore
-Dmetadata-keystore.password=mp6yc0UD9e
-Dmetadata-keystore.aliases=metadata
-Dmetadata-keystore.metadata.password=oKIWzVdEdA
-Dmetadata-keystore.metadata.algorithm=DESede
"
JAVA_OPTS: "
-Xms512m -Xmx1g
-Ddb.driver=org.postgresql.Driver
-Ddb.username=alfresco
-Ddb.password=alfresco
-Ddb.url=jdbc:postgresql://postgres-acs:5432/alfresco
-Dindex.subsystem.name=solr6
-Dsolr.host=search
-Dsolr.secureComms=secret
-Dsolr.sharedSecret=alfresco-secret
-Dshare.host=${PROXY_HOST}
-Dshare.port=${PROXY_PORT}
-Dshare.protocol=${PROXY_PROTOCOL}
-Dalfresco.host=${PROXY_HOST}
-Dalfresco.port=${PROXY_PORT}
-Dalfresco.protocol=${PROXY_PROTOCOL}
-Daos.baseUrlOverwrite=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/alfresco/aos
-Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\"
-Ddeployment.method=DOCKER_COMPOSE
-DlocalTransform.core-aio.url=http://transform-core-aio:8090/
-Dalfresco-pdf-renderer.url=http://transform-core-aio:8090/
-Djodconverter.url=http://transform-core-aio:8090/
-Dimg.url=http://transform-core-aio:8090/
-Dtika.url=http://transform-core-aio:8090/
-Dtransform.misc.url=http://transform-core-aio:8090/
-Dcsrf.filter.enabled=false
-Dcors.enabled=true
-Dcors.allowed.origins=http://localhost:4200,http://localhost:8080,${PROXY_PROTOCOL}://${PROXY_HOST}
-Dtransform.service.enabled=false
-Dlocal.transform.service.enabled=true
-Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
-Didentity-service.authentication.defaultAdministratorUserNames=admin.1
-Didentity-service.auth-server-url=http://identity:8080/auth
-Dsystem.content.eagerOrphanCleanup=true
-Dsystem.content.orphanProtectDays=0
-Djodconverter.enabled=false
"
ACTIVITI_DATASOURCE_USERNAME: alfresco
ACTIVITI_DATASOURCE_PASSWORD: alfresco
ACTIVITI_DATASOURCE_DRIVER: org.postgresql.Driver
ACTIVITI_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
ACTIVITI_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps:5432/activiti?characterEncoding=UTF-8'
ACTIVITI_ES_SERVER_TYPE: rest
ACTIVITI_ES_REST_CLIENT_ADDRESS: search-aps
ACTIVITI_ES_REST_CLIENT_PORT: 9200
ACTIVITI_ES_REST_CLIENT_SCHEMA: http
JAVA_OPTS: "-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
depends_on:
postgres-acs:
condition: service_started
activemq:
condition: service_started
identity:
condition: service_healthy
- postgres-aps
volumes:
- "$ALFRESCO_LICENSE_DIR/aps:/root/.activiti/enterprise-license:ro"
transform-core-aio:
image: alfresco/alfresco-transform-core-aio:${ATE_AIO_TAG}
share:
image: alfresco/alfresco-share:${ACS_SHARE_TAG}
activiti-admin:
image: alfresco/process-services-admin:1.11.1.1
mem_limit: 256m
environment:
REPO_HOST: "platform"
CSRF_FILTER_REFERER: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?/?.*"
CSRF_FILTER_ORIGIN: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?"
JAVA_OPTS: "
-Dshare.host=${PROXY_HOST}
-Dshare.port=${PROXY_PORT}
-Dshare.protocol=${PROXY_PROTOCOL}
-Dalfresco.host=${PROXY_HOST}
-Dalfresco.port=${PROXY_PORT}
-Dalfresco.protocol=${PROXY_PROTOCOL}
-Daims.enabled=true
-Daims.realm=alfresco
-Daims.resource=acs-share
-Daims.authServerUrl=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-Daims.sslRequired=none
-Daims.publicClient=true
-Daims.autodetectBearerOnly=true
-Daims.alwaysRefreshToken=true
-Daims.principalAttribute=preferred_username
-Daims.enableBasicAuth=true
"
ACTIVITI_ADMIN_DATASOURCE_USERNAME: alfresco
ACTIVITI_ADMIN_DATASOURCE_PASSWORD: alfresco
ACTIVITI_ADMIN_DATASOURCE_DRIVER: org.postgresql.Driver
ACTIVITI_ADMIN_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
ACTIVITI_ADMIN_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps-admin:5432/activiti-admin?characterEncoding=UTF-8'
ACTIVITI_ADMIN_REST_APP_HOST: http://activiti-app
ACTIVITI_ADMIN_REST_APP_PORT: 8080
JAVA_OPTS: "-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
depends_on:
- postgres-aps-admin
- activiti-app
postgres-acs:
image: postgres:${POSTGRES_TAG}
postgres-aps:
image: postgres:11.6
mem_limit: 256m
environment:
POSTGRES_PASSWORD: alfresco
POSTGRES_DB: activiti
POSTGRES_USER: alfresco
POSTGRES_DB: alfresco
POSTGRES_PASSWORD: alfresco
command: postgres -c max_connections=300 -c log_min_messages=LOG
search:
image: alfresco/alfresco-search-services:${ASIE_TAG}
postgres-aps-admin:
image: postgres:11.6
mem_limit: 128m
environment:
SOLR_ALFRESCO_HOST: platform
SOLR_SOLR_HOST: search
SOLR_CREATE_ALFRESCO_DEFAULTS: alfresco,archive
ALFRESCO_SECURE_COMMS: secret
JAVA_TOOL_OPTIONS: "
-Dalfresco.secureComms.secret=alfresco-secret
"
healthcheck:
test: "curl -fsS http://localhost:8983/solr"
activemq:
image: alfresco/alfresco-activemq:${AAMQ_TAG}
POSTGRES_DB: activiti-admin
POSTGRES_USER: alfresco
POSTGRES_PASSWORD: alfresco
command: postgres -c max_connections=50 -c log_min_messages=LOG
search-aps:
image: elasticsearch:7.6.0
mem_limit: 512m
environment:
ACTIVEMQ_OPTS_MEMORY: -Xms64m -Xmx256m
ACTIVEMQ_ADMIN_LOGIN: alfresco
ACTIVEMQ_ADMIN_PASSWORD: alfresco
identity:
image: alfresco/alfresco-identity-service:${AIS_TAG}
user: jboss
environment:
KEYCLOAK_USER: admin
KEYCLOAK_PASSWORD: admin
KEYCLOAK_FRONTEND_URL: ${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
KEYCLOAK_IMPORT: /tmp/keycloak-alfresco-realm.json
KEYCLOAK_STATISTICS: enabled
networks:
default:
aliases:
- "${IDENTITY_SERVICE_HOST}"
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080/auth/realms/alfresco"]
interval: 10s
timeout: 10s
# Really long startup times on Windows
retries: 18
volumes:
- ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
discovery.type: single-node
ES_JAVA_OPTS: "-Xms128m -Xmx256m"
ulimits:
memlock:
soft: -1
hard: -1
depends_on:
- activiti-app
proxy:
build: ./nginx-ingress
image: local/nginx-ingress:acs-share-aims
image: local/nginx-ingress:acs
ports:
- 8080:8080
depends_on:
- platform
- share
- identity
- activiti-app
- activiti-admin

View File

@@ -1,62 +0,0 @@
{
"realm": "alfresco",
"enabled": true,
"sslRequired": "external",
"registrationAllowed": false,
"roles": {
"realm": [ {
"name": "user",
"description": "User privileges"
}, {
"name": "admin",
"description": "Administrator privileges"
} ]
},
"clients": [
{
"clientId": "alfresco",
"name": "Alfresco Products",
"enabled": true,
"alwaysDisplayInConsole": false,
"redirectUris": [ "*" ],
"standardFlowEnabled": true,
"implicitFlowEnabled": true,
"directAccessGrantsEnabled": false,
"publicClient": true,
"protocol": "openid-connect",
"attributes": {
"login_theme": "alfresco"
}
},
{
"clientId": "acs-share",
"name": "ACS Share",
"enabled": true,
"alwaysDisplayInConsole": false,
"redirectUris": [ "*" ],
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"publicClient": true,
"protocol": "openid-connect",
"attributes": {
"login_theme": "alfresco"
}
}
],
"requiredCredentials": [ "password" ],
"users": [
{
"username": "admin",
"email": "admin@app.activiti.com",
"enabled": true,
"credentials" : [
{
"type" : "password",
"value" : "admin"
}
],
"realmRoles": [ "user", "admin" ]
}
]
}

View File

@@ -1,15 +1,11 @@
#!/bin/sh
if [[ $ACS_PLATFORM_URL ]]; then
sed -i s%http:\/\/platform:8080%"$ACS_PLATFORM_URL"%g /etc/nginx/nginx.conf
if [[ $APS_APP_URL ]]; then
sed -i s%http:\/\/activiti-app:8080%"$APS_APP_URL"%g /etc/nginx/nginx.conf
fi
if [[ $ACS_SHARE_URL ]]; then
sed -i s%http:\/\/share:8080%"$ACS_SHARE_URL"%g /etc/nginx/nginx.conf
fi
if [[ $AIMS_URL ]]; then
sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
if [[ $APS_ADMIN_URL ]]; then
sed -i s%http:\/\/activiti-admin:8080%"$APS_ADMIN_URL"%g /etc/nginx/nginx.conf
fi
if [[ $ACCESS_LOG ]]; then

View File

@@ -19,10 +19,7 @@ http {
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_redirect off;
# proxy_buffering off;
proxy_buffer_size 64k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -42,22 +39,18 @@ http {
location ~ ^(/.*/s/prometheus)$ {return 403;}
location / {
proxy_pass http://platform:8080;
return 301 $scheme://$http_host/activiti-app;
}
location /alfresco/ {
proxy_pass http://platform:8080;
location /activiti-app/ {
proxy_pass http://activiti-app:8080;
# If using external proxy / load balancer (for initial redirect if no trailing slash)
absolute_redirect off;
}
location /share/ {
proxy_pass http://share:8080;
}
location /auth/ {
proxy_pass http://identity:8080;
location /activiti-admin/ {
proxy_pass http://activiti-admin:8080;
# If using external proxy / load balancer (for initial redirect if no trailing slash)
absolute_redirect off;

View File

@@ -1,175 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
-->
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener" logArgs="false" />
<!-- Security listener. Documentation at /docs/config/listeners.html
<Listener className="org.apache.catalina.security.SecurityListener" />
-->
<!-- APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-->
<Connector port="8080" protocol="HTTP/1.1"
Server=" "
connectionTimeout="20000"
redirectPort="8443"
proxyName="alfresco.inteligr8.com" proxyPort="443" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443"
proxyHost="alfresco.inteligr8.com" proxyPort="443" />
-->
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
This connector uses the NIO implementation. The default
SSLImplementation will depend on the presence of the APR/native
library and the useOpenSSL attribute of the AprLifecycleListener.
Either JSSE or OpenSSL style configuration may be used regardless of
the SSLImplementation selected. JSSE style configuration is used below.
-->
<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
type="RSA" />
</SSLHostConfig>
</Connector>
-->
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
This connector uses the APR/native implementation which always uses
OpenSSL for TLS.
Either JSSE or OpenSSL style configuration may be used. OpenSSL style
configuration is used below.
-->
<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
maxThreads="150" SSLEnabled="true" >
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
<SSLHostConfig>
<Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
certificateFile="conf/localhost-rsa-cert.pem"
certificateChainFile="conf/localhost-rsa-chain.pem"
type="RSA" />
</SSLHostConfig>
</Connector>
-->
<!-- Define an AJP 1.3 Connector on port 8009 -->
<!--
<Connector protocol="AJP/1.3"
address="::1"
port="8009"
redirectPort="8443" />
-->
<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %u %t &quot;%r&quot; %s %b" />
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
</Host>
</Engine>
</Service>
</Server>