Merge branch 'aps-base' into aps-persist-base

.env

@@ -1,5 +1,9 @@
-EXTERNAL_RESOURCE_DIR=~
+ALFRESCO_DIR=~/alfresco
+ALFRESCO_LICENSE_DIR=~/alfresco/license
 
 PROXY_PROTOCOL=http
 PROXY_HOST=localhost
 PROXY_PORT=8080
+
+APS_TAG=2.4.1
+POSTGRES_TAG=13

docker-compose.yml

@@ -1,11 +1,55 @@
-# Sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
+# Originally sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
 #
-# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
-version: "2"
+version: "3"
 
 services:
+
+    activiti-app:
+        image: quay.io/alfresco/alfresco-process-services:${APS_TAG}
+        environment:
+            ACTIVITI_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps:5432/activiti?characterEncoding=UTF-8'
+        depends_on:
+            - postgres-aps
+        volumes:
+            - "$ALFRESCO_LICENSE_DIR/aps:/root/.activiti/enterprise-license:ro"
+            - apsbin-volume:/var/lib/postgresql/data:rw
+    
+    activiti-admin:
+        image: quay.io/alfresco/alfresco-process-services-admin:${APS_TAG}
+        environment:
+            ACTIVITI_ADMIN_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps-admin:5432/activiti-admin?characterEncoding=UTF-8'
+            ACTIVITI_ADMIN_REST_APP_HOST: http://activiti-app
+        depends_on:
+            - postgres-aps-admin
+            - activiti-app
+    
+    postgres-aps:
+        image: postgres:${POSTGRES_TAG}
+        environment:
+            POSTGRES_DB: activiti
+        volumes:
+            - apsdb-volume:/var/lib/postgresql/data:rw
+    
+    postgres-aps-admin:
+        image: postgres:${POSTGRES_TAG}
+        environment:
+            POSTGRES_DB: activiti-admin
+        volumes:
+            - apsadmindb-volume:/var/lib/postgresql/data:rw
+
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:base
+        image: local/nginx-ingress:aps
         ports:
             - 8080:8080
+        depends_on:
+            - activiti-app
+            - activiti-admin
+
+volumes:
+    apsbin-volume:
+        driver: local
+    apsdb-volume:
+        driver: local
+    apsadmindb-volume:
+        driver: local

nginx-ingress/entrypoint.sh

@@ -1,5 +1,13 @@
 #!/bin/sh
 
+if [[ $APS_APP_URL ]]; then
+  sed -i s%http:\/\/activiti-app:8080%"$APS_APP_URL"%g /etc/nginx/nginx.conf
+fi
+
+if [[ $APS_ADMIN_URL ]]; then
+  sed -i s%http:\/\/activiti-admin:8080%"$APS_ADMIN_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $ACCESS_LOG ]]; then
   sed -i s%\#ENV_ACCESS_LOG%"access_log $ACCESS_LOG;"%g /etc/nginx/nginx.conf
 fi

nginx-ingress/nginx.conf

@@ -25,5 +25,35 @@ http {
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_pass_header Set-Cookie;
+        
+        # Protect access to SOLR APIs
+        location ~ ^(/.*/service/api/solr/.*)$ {return 403;}
+        location ~ ^(/.*/s/api/solr/.*)$ {return 403;}
+        location ~ ^(/.*/wcservice/api/solr/.*)$ {return 403;}
+        location ~ ^(/.*/wcs/api/solr/.*)$ {return 403;}
+
+        location ~ ^(/.*/proxy/alfresco/api/solr/.*)$ {return 403 ;}
+        location ~ ^(/.*/-default-/proxy/alfresco/api/.*)$ {return 403;}
+        
+        # Protect access to Prometheus endpoint
+        location ~ ^(/.*/s/prometheus)$ {return 403;}
+        
+        location / {
+            return 301 $scheme://$http_host/activiti-app;
+        }
+
+        location /activiti-app/ {
+            proxy_pass http://activiti-app:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+
+        location /activiti-admin/ {
+            proxy_pass http://activiti-admin:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
     }
 }