Merge branch 'dbp-aims' into dbp-persist-aims

.env

@@ -9,10 +9,14 @@ IDENTITY_SERVICE_HOST=auth.example.org
 IDENTITY_SERVICE_PORT=8080
 
 ACS_TAG=7.4.1.1
+ATR_TAG=3.0.0
 ATE_AIO_TAG=4.0.0
+ASFS_TAG=3.0.0
+APS_TAG=2.4.1
+AIS_TAG=1.8.0.1
 AAMQ_TAG=latest
 POSTGRES_TAG=13
 ASIE_TAG=2.0.8.2
-APS_TAG=2.4.1
-AIS_TAG=1.8.0.1
 ACS_SHARE_TAG=7.4.1.2
+ALF_SYNC_SERV_TAG=3.9.0
+ADW_TAG=4.1.0

README.md

@@ -7,6 +7,10 @@ This Git Repository intends to represent environments in Docker Compose.  All en
 
 This version of Alfresco requires licensing.
 
+### ACS Enterprise
+
+The enterprise version of ACS requires a license file for it to work for more than 2 days.  This means it isn't really required, but it is becomes important when you utilize any `persist` branch.  For licensing to work, you must place your license file in the following directory relative to the user home directory that runs the Docker Compose command: `alfresco/license/acs`.  There must be just one file in there that ends in `.lic`.
+
 ### APS
 
 APS requires a license file for it to work.  For licensing to work, you must place your license file in the following directory relative to the user home directory that runs the Docker Compose command: `alfresco/license/aps`.  The filename must be `activiti.lic`.  You can use symbolic linking if desired.

docker-compose.yml

@@ -5,7 +5,7 @@ version: "3"
 services:
 
     platform:
-        image: alfresco/alfresco-content-repository-community:${ACS_TAG}
+        image: quay.io/alfresco/alfresco-governance-repository-enterprise:${ACS_TAG}
         environment:
             JAVA_TOOL_OPTIONS: "
                 -Dencryption.keystore.type=JCEKS
@@ -27,26 +27,30 @@ services:
                 -Dsolr.host=search
                 -Dsolr.secureComms=secret
                 -Dsolr.sharedSecret=alfresco-secret
+                -Dshare.host=${PROXY_HOST}
+                -Dshare.port=${PROXY_PORT}
+                -Dshare.protocol=${PROXY_PROTOCOL}
                 -Dalfresco.host=${PROXY_HOST}
                 -Dalfresco.port=${PROXY_PORT}
                 -Dalfresco.protocol=${PROXY_PROTOCOL}
                 -Daos.baseUrlOverwrite=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/alfresco/aos
                 -Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\"
                 -Ddeployment.method=DOCKER_COMPOSE
-                -DlocalTransform.core-aio.url=http://transform-core-aio:8090/
-                -Dalfresco-pdf-renderer.url=http://transform-core-aio:8090/
-                -Djodconverter.url=http://transform-core-aio:8090/
-                -Dimg.url=http://transform-core-aio:8090/
-                -Dtika.url=http://transform-core-aio:8090/
-                -Dtransform.misc.url=http://transform-core-aio:8090/
                 -Dcsrf.filter.enabled=false
-                -Dcors.enabled=true
-                -Dcors.allowed.origins=http://localhost:4200,http://localhost:8080,${PROXY_PROTOCOL}://${PROXY_HOST}
-                -Dtransform.service.enabled=false
+                -Dcors.enabled=false
+                -Dtransform.service.enabled=true
+                -Dtransform.service.url=http://transform-router:8095
+                -Dsfs.url=http://shared-file-store:8099
                 -Dlocal.transform.service.enabled=true
+                -Dalfresco-pdf-renderer.url=http://transform-engine-aio:8090
+                -Djodconverter.url=http://transform-engine-aio:8090
+                -Dimg.url=http://transform-engine-aio:8090
+                -Dtika.url=http://transform-engine-aio:8090
+                -Dtransform.misc.url=http://transform-engine-aio:8090
+                -Ddsync.service.uris=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/sync
                 -Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
                 -Didentity-service.authentication.defaultAdministratorUserNames=admin.1
-                -Didentity-service.auth-server-url=http://identity:8080/auth
+                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
                 -Dsystem.content.eagerOrphanCleanup=true
                 -Dsystem.content.orphanProtectDays=0
                 -Djodconverter.enabled=false
@@ -56,11 +60,62 @@ services:
                 condition: service_started
             activemq:
                 condition: service_started
+            shared-file-store:
+                condition: service_started
             identity:
                 condition: service_healthy
+        volumes:
+            - "$ALFRESCO_LICENSE_DIR/acs:/usr/local/tomcat/shared/classes/alfresco/extension/license:ro"
+            - acsbin-volume:/usr/local/tomcat/alf_data:rw
+    
+    transform-router:
+        image: quay.io/alfresco/alfresco-transform-router:${ATR_TAG}
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            CORE_AIO_URL : "http://transform-core-aio:8090"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
     
     transform-core-aio:
         image: alfresco/alfresco-transform-core-aio:${ATE_AIO_TAG}
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
+
+    shared-file-store:
+        image: quay.io/alfresco/alfresco-shared-file-store:${ASFS_TAG}
+        volumes:
+            - shared-file-store-volume:/tmp/Alfresco/sfs
+    
+    share:
+        image: quay.io/alfresco/alfresco-governance-share-enterprise:${ACS_SHARE_TAG}
+        environment:
+            REPO_HOST: "platform"
+            CSRF_FILTER_REFERER: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?/?.*"
+            CSRF_FILTER_ORIGIN: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?"
+            JAVA_OPTS: "
+                -Dshare.host=${PROXY_HOST}
+                -Dshare.port=${PROXY_PORT}
+                -Dshare.protocol=${PROXY_PROTOCOL}
+                -Dalfresco.host=${PROXY_HOST}
+                -Dalfresco.port=${PROXY_PORT}
+                -Dalfresco.protocol=${PROXY_PROTOCOL}
+                -Daims.enabled=true
+                -Daims.realm=alfresco
+                -Daims.resource=acs-share
+                -Daims.authServerUrl=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+                -Daims.sslRequired=none
+                -Daims.publicClient=true
+                -Daims.autodetectBearerOnly=true
+                -Daims.alwaysRefreshToken=true
+                -Daims.principalAttribute=preferred_username
+                -Daims.enableBasicAuth=true
+                "
     
     postgres-acs:
         image: postgres:${POSTGRES_TAG}
@@ -69,6 +124,8 @@ services:
             POSTGRES_USER: alfresco
             POSTGRES_DB: alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
+        volumes:
+            - acsdb-volume:/var/lib/postgresql/data:rw
     
     search:
         image: alfresco/alfresco-search-services:${ASIE_TAG}
@@ -82,6 +139,8 @@ services:
                 "
         healthcheck:
             test: "curl -fsS http://localhost:8983/solr"
+        volumes:
+            - solrindex-volume:/opt/alfresco-search-services/data:rw
 
     activemq:
         image: alfresco/alfresco-activemq:${AAMQ_TAG}
@@ -89,6 +148,45 @@ services:
             ACTIVEMQ_OPTS_MEMORY: -Xms64m -Xmx256m
             ACTIVEMQ_ADMIN_LOGIN: alfresco
             ACTIVEMQ_ADMIN_PASSWORD: alfresco
+        volumes:
+            - activemq-volume:/opt/activemq/data:rw
+
+    sync:
+        image: quay.io/alfresco/service-sync:${ALF_SYNC_SERV_TAG}
+        environment:
+            JAVA_OPTS : "
+                -Xms64m -Xmx256m
+                -Dsql.db.driver=org.postgresql.Driver
+                -Dsql.db.url=jdbc:postgresql://postgres-acs:5432/alfresco
+                -Dsql.db.username=alfresco
+                -Dsql.db.password=alfresco
+                -Dmessaging.broker.host=activemq
+                -Drepo.hostname=platform
+                -Drepo.port=8080
+                -Ddw.server.applicationConnectors[0].type=http
+                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+                -Didentity-service.resource=acs-sync
+                "
+        depends_on:
+            - postgres-acs
+            - activemq
+
+    digital-workspace:
+        image: quay.io/alfresco/alfresco-digital-workspace:${ADW_TAG}
+        environment:
+            BASE_PATH: ./
+            APP_CONFIG_ECM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
+            APP_CONFIG_BPM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
+            APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/workspace/#/preview/s"
+            APP_CONFIG_PROVIDER: "ALL"
+            APP_CONFIG_PLUGIN_PROCESS_SERVICE: "true"
+            #APP_CONFIG_PLUGIN_PROCESS_AUTOMATION: "true"
+            APP_CONFIG_AUTH_TYPE: OAUTH
+            APP_CONFIG_OAUTH2_HOST: "${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth/realms/alfresco"
+            APP_CONFIG_OAUTH2_CLIENTID: alfresco
+            APP_CONFIG_OAUTH2_IMPLICIT_FLOW: "true"
+            APP_CONFIG_OAUTH2_REDIRECT_LOGIN: "/workspace/"
+            APP_CONFIG_OAUTH2_REDIRECT_LOGOUT: "/workspace/logout"
 
     activiti-app:
         image: quay.io/alfresco/alfresco-process-services:${APS_TAG}
@@ -106,6 +204,22 @@ services:
             - postgres-aps
         volumes:
             - "$ALFRESCO_LICENSE_DIR/aps:/home/alfresco/.activiti/enterprise-license:ro"
+            - apsbin-volume:/var/lib/postgresql/data:rw
+    
+    activiti-admin:
+        image: quay.io/alfresco/alfresco-process-services-admin:${APS_TAG}
+        environment:
+            ACTIVITI_ADMIN_DATASOURCE_USERNAME: alfresco
+            ACTIVITI_ADMIN_DATASOURCE_PASSWORD: alfresco
+            ACTIVITI_ADMIN_DATASOURCE_DRIVER: org.postgresql.Driver
+            ACTIVITI_ADMIN_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
+            ACTIVITI_ADMIN_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps-admin:5432/activiti-admin?characterEncoding=UTF-8'
+            ACTIVITI_ADMIN_REST_APP_HOST: http://activiti-app
+            ACTIVITI_ADMIN_REST_APP_PORT: 8080
+            JAVA_OPTS: "-Xms64m -Xmx128m"
+        depends_on:
+            - postgres-aps-admin
+            - activiti-app
     
     postgres-aps:
         image: postgres:${POSTGRES_TAG}
@@ -114,7 +228,19 @@ services:
             POSTGRES_USER: alfresco
             POSTGRES_PASSWORD: alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
+        volumes:
+            - apsdb-volume:/var/lib/postgresql/data:rw
     
+    postgres-aps-admin:
+        image: postgres:${POSTGRES_TAG}
+        environment:
+            POSTGRES_DB: activiti-admin
+            POSTGRES_USER: alfresco
+            POSTGRES_PASSWORD: alfresco
+        command: postgres -c max_connections=50 -c log_min_messages=LOG
+        volumes:
+            - apsadmindb-volume:/var/lib/postgresql/data:rw
+
     identity:
         image: alfresco/alfresco-identity-service:${AIS_TAG}
         user: jboss
@@ -136,13 +262,40 @@ services:
             retries: 18
         volumes:
             - ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
+            - keycloak-volume:/opt/jboss/keycloak/standalone/data:rw
     
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:acs-aps-aims
+        image: local/nginx-ingress:acs-sync-share-adw-aps-aims
         ports:
             - 8080:8080
         depends_on:
             - platform
+            - sync
+            - share
+            - digital-workspace
             - activiti-app
+            - activiti-admin
             - identity
+
+volumes:
+    shared-file-store-volume:
+        driver_opts:
+            type: tmpfs
+            device: tmpfs
+    acsbin-volume:
+        driver: local
+    acsdb-volume:
+        driver: local
+    activemq-volume:
+        driver: local
+    solrindex-volume:
+        driver: local
+    apsbin-volume:
+        driver: local
+    apsdb-volume:
+        driver: local
+    apsadmindb-volume:
+        driver: local
+    keycloak-volume:
+        driver: local

keycloak-alfresco-realm.json

@@ -42,6 +42,24 @@
       "attributes": {
         "login_theme": "alfresco"
       }
+    },
+    {
+      "clientId": "acs-sync",
+      "name": "Alfresco Sync Service Clients",
+      "enabled": true,
+      "alwaysDisplayInConsole": false,
+      "redirectUris": [
+        "http://127.0.0.1*",
+        "http://localhost*"
+      ],
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "publicClient": true,
+      "protocol": "openid-connect",
+      "attributes": {
+        "login_theme": "alfresco"
+      }
     }
   ],
   "requiredCredentials": [ "password" ],

nginx-ingress/entrypoint.sh

@@ -4,10 +4,26 @@ if [[ $ACS_PLATFORM_URL ]]; then
   sed -i s%http:\/\/platform:8080%"$ACS_PLATFORM_URL"%g /etc/nginx/nginx.conf
 fi
 
+if [[ $ACS_SYNC_URL ]]; then
+  sed -i s%http:\/\/sync:9090%"$ACS_SYNC_URL"%g /etc/nginx/nginx.conf
+fi
+
+if [[ $ACS_SHARE_URL ]]; then
+  sed -i s%http:\/\/share:8080%"$ACS_SHARE_URL"%g /etc/nginx/nginx.conf
+fi
+
+if [[ $ADW_URL ]]; then
+  sed -i s%http:\/\/digital-workspace:8080%"$ADW_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $APS_APP_URL ]]; then
   sed -i s%http:\/\/activiti-app:8080%"$APS_APP_URL"%g /etc/nginx/nginx.conf
 fi
 
+if [[ $APS_ADMIN_URL ]]; then
+  sed -i s%http:\/\/activiti-admin:8080%"$APS_ADMIN_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $AIMS_URL ]]; then
   sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
 fi

nginx-ingress/nginx.conf

@@ -47,6 +47,13 @@ http {
 
         location /alfresco/ {
             proxy_pass http://platform:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+        
+        location /sync/ {
+            proxy_pass http://sync:9090/alfresco/;
         }
 
         location /activiti-app/ {
@@ -56,6 +63,24 @@ http {
             absolute_redirect off;
         }
 
+        location /activiti-admin/ {
+            proxy_pass http://activiti-admin:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+
+        location /share/ {
+            proxy_pass http://share:8080;
+        }
+        
+        location /workspace/ {
+            proxy_pass http://digital-workspace:8080/;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+
         location /auth/ {
             proxy_pass http://identity:8080;