Merge remote-tracking branch 'origin/ags-frontend-enterprise' into dbp

.env

@@ -4,15 +4,3 @@ ALFRESCO_LICENSE_DIR=~/alfresco/license
 PROXY_PROTOCOL=http
 PROXY_HOST=localhost
 PROXY_PORT=8080
-IDENTITY_SERVICE_PROTOCOL=http
-IDENTITY_SERVICE_HOST=auth.example.org
-IDENTITY_SERVICE_PORT=8080
-
-ACS_TAG=7.4.1.1
-ATE_AIO_TAG=4.0.0
-AAMQ_TAG=latest
-POSTGRES_TAG=13
-ASIE_TAG=2.0.8.2
-APS_TAG=2.4.1
-AIS_TAG=1.8.0.1
-ACS_SHARE_TAG=7.4.1.2

README.md

@@ -3,10 +3,3 @@
 
 This Git Repository intends to represent environments in Docker Compose.  All environments are effectively a derivative of other environments.  The original environment is the environment represented by the `base` branch.  All derivative environments are represented by other branches.  Those branches are named in the format `{core}.{parent}`.
 
-## Licensing
-
-This version of Alfresco requires licensing.
-
-### APS
-
-APS requires a license file for it to work.  For licensing to work, you must place your license file in the following directory relative to the user home directory that runs the Docker Compose command: `alfresco/license/aps`.  The filename must be `activiti.lic`.  You can use symbolic linking if desired.

docker-compose.yml

@@ -1,32 +1,25 @@
-# Originally sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
+# Sourced from https://github.com/Alfresco/acs-deployment/blob/4.0.3/docker-compose/docker-compose.yml
 #
-version: "3"
+# Using version 2 as 3 does not support resource constraint options (cpu_*, mem_* limits) for non swarm mode in Compose
+version: "2"
 
 services:
-
     platform:
-        image: alfresco/alfresco-content-repository-community:${ACS_TAG}
+        image: quay.io/alfresco/alfresco-governance-repository-enterprise:V3.4-latest
+        mem_limit: 1700m
         environment:
-            JAVA_TOOL_OPTIONS: "
-                -Dencryption.keystore.type=JCEKS
-                -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding
-                -Dencryption.keyAlgorithm=DESede
-                -Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore
-                -Dmetadata-keystore.password=mp6yc0UD9e
-                -Dmetadata-keystore.aliases=metadata
-                -Dmetadata-keystore.metadata.password=oKIWzVdEdA
-                -Dmetadata-keystore.metadata.algorithm=DESede
-                "
             JAVA_OPTS: "
-                -Xms512m -Xmx1g
                 -Ddb.driver=org.postgresql.Driver
                 -Ddb.username=alfresco
                 -Ddb.password=alfresco
                 -Ddb.url=jdbc:postgresql://postgres-acs:5432/alfresco
                 -Dindex.subsystem.name=solr6
                 -Dsolr.host=search
-                -Dsolr.secureComms=secret
+                -Dsolr.port=8983
-                -Dsolr.sharedSecret=alfresco-secret
+                -Dsolr.secureComms=none
+                -Dshare.host=${PROXY_HOST}
+                -Dshare.port=${PROXY_PORT}
+                -Dshare.protocol=${PROXY_PROTOCOL}
                 -Dalfresco.host=${PROXY_HOST}
                 -Dalfresco.port=${PROXY_PORT}
                 -Dalfresco.protocol=${PROXY_PROTOCOL}
@@ -40,108 +33,207 @@ services:
                 -Dtika.url=http://transform-core-aio:8090/
                 -Dtransform.misc.url=http://transform-core-aio:8090/
                 -Dcsrf.filter.enabled=false
-                -Dcors.enabled=false
+                -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
-                -Dtransform.service.enabled=false
+
-                -Dlocal.transform.service.enabled=true
+                -Dtransform.service.enabled=true
-                -Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
+                -Dlocal.transform.service.enabled=false
-                -Didentity-service.authentication.defaultAdministratorUserNames=admin.1
+
-                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+                -Dtransform.service.url=http://transform-router:8095
+                -Dsfs.url=http://shared-file-store:8099
+                -Dalfresco-pdf-renderer.url=http://transform-engine-aio:8090
+                -Djodconverter.url=http://transform-engine-aio:8090
+                -Dimg.url=http://transform-engine-aio:8090
+                -Dtika.url=http://transform-engine-aio:8090
+                -Dtransform.misc.url=http://transform-engine-aio:8090
+
+                -Ddsync.service.uris=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/sync
+                
                 -Dsystem.content.eagerOrphanCleanup=true
                 -Dsystem.content.orphanProtectDays=0
                 -Djodconverter.enabled=false
                 "
         depends_on:
-            postgres-acs:
+            - postgres-acs
-                condition: service_started
+            - activemq
-            activemq:
+            - shared-file-store
-                condition: service_started
+        volumes:
-            identity:
+            - "$ALFRESCO_LICENSE_DIR/acs:/usr/local/tomcat/shared/classes/alfresco/extension/license:ro"
-                condition: service_healthy
+    
+    transform-router:
+        image: quay.io/alfresco/alfresco-transform-router:1.3.1
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            CORE_AIO_URL : "http://transform-core-aio:8090"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
     
     transform-core-aio:
-        image: alfresco/alfresco-transform-core-aio:${ATE_AIO_TAG}
+        image: alfresco/alfresco-transform-core-aio:2.3.6
+        environment:
+            ACTIVEMQ_URL: "nio://activemq:61616"
+            FILE_STORE_URL: "http://shared-file-store:8099/alfresco/api/-default-/private/sfs/versions/1/file"
+        depends_on:
+            - activemq
+            - shared-file-store
+
+    shared-file-store:
+        image: alfresco/alfresco-shared-file-store:0.10.0
+        volumes:
+            - shared-file-store-volume:/tmp/Alfresco/sfs
+    
+    transform-core-aio:
+        image: alfresco/alfresco-transform-core-aio:2.3.6
+    
+    share:
+        image: quay.io/alfresco/alfresco-governance-share-enterprise:V3.4-latest
+        mem_limit: 512m
+        environment:
+            REPO_HOST: "platform"
+            CSRF_FILTER_REFERER: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?/?.*"
+            CSRF_FILTER_ORIGIN: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?"
+            JAVA_OPTS: "
+                -Dshare.host=${PROXY_HOST}
+                -Dshare.port=${PROXY_PORT}
+                -Dshare.protocol=${PROXY_PROTOCOL}
+                -Dalfresco.host=${PROXY_HOST}
+                -Dalfresco.port=${PROXY_PORT}
+                -Dalfresco.protocol=${PROXY_PROTOCOL}
+                "
     
     postgres-acs:
-        image: postgres:${POSTGRES_TAG}
+        image: postgres:11.7
+        mem_limit: 512m
         environment:
-            POSTGRES_PASSWORD: alfresco
+            - POSTGRES_PASSWORD=alfresco
-            POSTGRES_USER: alfresco
+            - POSTGRES_USER=alfresco
-            POSTGRES_DB: alfresco
+            - POSTGRES_DB=alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
     
     search:
-        image: alfresco/alfresco-search-services:${ASIE_TAG}
+        image: alfresco/alfresco-search-services:2.0.1
+        mem_limit: 2g
         environment:
-            SOLR_ALFRESCO_HOST: platform
+            - SOLR_ALFRESCO_HOST=platform
-            SOLR_SOLR_HOST: search
+            - SOLR_ALFRESCO_PORT=8080
-            SOLR_CREATE_ALFRESCO_DEFAULTS: alfresco,archive
+            - SOLR_SOLR_HOST=search
-            ALFRESCO_SECURE_COMMS: secret
+            - SOLR_SOLR_PORT=8983
-            JAVA_TOOL_OPTIONS: "
+            - SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive
-                -Dalfresco.secureComms.secret=alfresco-secret
+            - ALFRESCO_SECURE_COMMS=none
-                "
-        healthcheck:
-            test: "curl -fsS http://localhost:8983/solr"
 
     activemq:
-        image: alfresco/alfresco-activemq:${AAMQ_TAG}
+        image: alfresco/alfresco-activemq:5.15.8
+        mem_limit: 256m
+
+    sync:
+        image: quay.io/alfresco/service-sync:3.3.3.1
+        mem_limit: 512m
         environment:
-            ACTIVEMQ_OPTS_MEMORY: -Xms64m -Xmx256m
+            JAVA_OPTS : "
-            ACTIVEMQ_ADMIN_LOGIN: alfresco
+                -Dsql.db.driver=org.postgresql.Driver
-            ACTIVEMQ_ADMIN_PASSWORD: alfresco
+                -Dsql.db.url=jdbc:postgresql://postgres-acs:5432/alfresco
+                -Dsql.db.username=alfresco
+                -Dsql.db.password=alfresco
+                -Dmessaging.broker.host=activemq
+                -Drepo.hostname=platform
+                -Drepo.port=8080
+                -Ddw.server.applicationConnectors[0].type=http
+                -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
+                "
+        depends_on:
+            - postgres-acs
+            - activemq
+
+    digital-workspace:
+        image: quay.io/alfresco/alfresco-digital-workspace:2.0.0-adw
+        mem_limit: 128m
+        environment:
+            BASE_PATH: ./
+            APP_CONFIG_ECM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
+            APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/#/preview/s"
 
     activiti-app:
-        image: quay.io/alfresco/alfresco-process-services:${APS_TAG}
+        image: alfresco/process-services:1.11.1.1
+        mem_limit: 512m
         environment:
             ACTIVITI_DATASOURCE_USERNAME: alfresco
             ACTIVITI_DATASOURCE_PASSWORD: alfresco
             ACTIVITI_DATASOURCE_DRIVER: org.postgresql.Driver
             ACTIVITI_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
             ACTIVITI_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps:5432/activiti?characterEncoding=UTF-8'
-            IDENTITY_SERVICE_ENABLED: "true"
+            ACTIVITI_ES_SERVER_TYPE: rest
-            IDENTITY_SERVICE_AUTH: ${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
+            ACTIVITI_ES_REST_CLIENT_ADDRESS: search-aps
-            IDENTITY_SERVICE_CONTENT_SSO_REDIRECT_URI: ${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/activiti-app/app/rest/integration/sso/confirm-auth-request
+            ACTIVITI_ES_REST_CLIENT_PORT: 9200
-            JAVA_OPTS: "-Xms128m -Xmx256m"
+            ACTIVITI_ES_REST_CLIENT_SCHEMA: http
+            JAVA_OPTS: "-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
         depends_on:
             - postgres-aps
         volumes:
-            - "$ALFRESCO_LICENSE_DIR/aps:/home/alfresco/.activiti/enterprise-license:ro"
+            - "$ALFRESCO_LICENSE_DIR/aps:/root/.activiti/enterprise-license:ro"
+    
+    activiti-admin:
+        image: alfresco/process-services-admin:1.11.1.1
+        mem_limit: 256m
+        environment:
+            ACTIVITI_ADMIN_DATASOURCE_USERNAME: alfresco
+            ACTIVITI_ADMIN_DATASOURCE_PASSWORD: alfresco
+            ACTIVITI_ADMIN_DATASOURCE_DRIVER: org.postgresql.Driver
+            ACTIVITI_ADMIN_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
+            ACTIVITI_ADMIN_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps-admin:5432/activiti-admin?characterEncoding=UTF-8'
+            ACTIVITI_ADMIN_REST_APP_HOST: http://activiti-app
+            ACTIVITI_ADMIN_REST_APP_PORT: 8080
+            JAVA_OPTS: "-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
+        depends_on:
+            - postgres-aps-admin
+            - activiti-app
     
     postgres-aps:
-        image: postgres:${POSTGRES_TAG}
+        image: postgres:11.6
+        mem_limit: 256m
         environment:
             POSTGRES_DB: activiti
             POSTGRES_USER: alfresco
             POSTGRES_PASSWORD: alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
     
-    identity:
+    postgres-aps-admin:
-        image: alfresco/alfresco-identity-service:${AIS_TAG}
+        image: postgres:11.6
-        user: jboss
+        mem_limit: 128m
         environment:
-            KEYCLOAK_USER: admin
+            POSTGRES_DB: activiti-admin
-            KEYCLOAK_PASSWORD: admin
+            POSTGRES_USER: alfresco
-            KEYCLOAK_HOSTNAME: ${IDENTITY_SERVICE_HOST}
+            POSTGRES_PASSWORD: alfresco
-            KEYCLOAK_IMPORT: /tmp/keycloak-alfresco-realm.json
+        command: postgres -c max_connections=50 -c log_min_messages=LOG
-            KEYCLOAK_STATISTICS: enabled
+    
-        networks:
+    search-aps:
-            default:
+        image: elasticsearch:7.6.0
-                aliases:
+        mem_limit: 512m
-                    - "${IDENTITY_SERVICE_HOST}"
+        environment:
-        healthcheck:
+            discovery.type: single-node
-            test: ["CMD", "curl", "-f", "http://localhost:8080/auth/realms/alfresco"]
+            ES_JAVA_OPTS: "-Xms128m -Xmx256m"
-            interval: 10s
+        ulimits:
-            timeout: 10s
+            memlock:
-            # Really long startup times on Windows
+                soft: -1
-            retries: 18
+                hard: -1
-        volumes:
+        depends_on:
-            - ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
+            - activiti-app
     
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:acs-aps-aims
+        image: local/nginx-ingress:acs-sync-share-adw-aps
         ports:
             - 8080:8080
         depends_on:
             - platform
+            - sync
+            - share
+            - digital-workspace
             - activiti-app
-            - identity
+            - activiti-admin
+
+volumes:
+    shared-file-store-volume:
+        driver_opts:
+            type: tmpfs
+            device: tmpfs

keycloak-alfresco-realm.json

@@ -1,62 +0,0 @@
-{
-  "realm": "alfresco",
-  "enabled": true,
-  "sslRequired": "external",
-  "registrationAllowed": false,
-  "roles": {
-    "realm": [ {
-      "name": "user",
-      "description": "User privileges"
-    }, {
-      "name": "admin",
-      "description": "Administrator privileges"
-    } ]
-  },
-  "clients": [
-    {
-      "clientId": "alfresco",
-      "name": "Alfresco Products",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": true,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    },
-    {
-      "clientId": "acs-share",
-      "name": "ACS Share",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    }
-  ],
-  "requiredCredentials": [ "password" ],
-  "users": [
-    {
-      "username": "admin",
-      "email": "admin@app.activiti.com",
-      "enabled": true,
-      "credentials" : [
-        {
-          "type" : "password",
-          "value" : "admin"
-        }
-      ],
-      "realmRoles": [ "user", "admin" ]
-    }
-  ]
-}

nginx-ingress/entrypoint.sh

@@ -4,12 +4,24 @@ if [[ $ACS_PLATFORM_URL ]]; then
   sed -i s%http:\/\/platform:8080%"$ACS_PLATFORM_URL"%g /etc/nginx/nginx.conf
 fi
 
+if [[ $ACS_SYNC_URL ]]; then
+  sed -i s%http:\/\/sync:9090%"$ACS_SYNC_URL"%g /etc/nginx/nginx.conf
+fi
+
+if [[ $ACS_SHARE_URL ]]; then
+  sed -i s%http:\/\/share:8080%"$ACS_SHARE_URL"%g /etc/nginx/nginx.conf
+fi
+
+if [[ $ADW_URL ]]; then
+  sed -i s%http:\/\/digital-workspace:8080%"$ADW_URL"%g /etc/nginx/nginx.conf
+fi
+
 if [[ $APS_APP_URL ]]; then
   sed -i s%http:\/\/activiti-app:8080%"$APS_APP_URL"%g /etc/nginx/nginx.conf
 fi
 
-if [[ $AIMS_URL ]]; then
+if [[ $APS_ADMIN_URL ]]; then
-  sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
+  sed -i s%http:\/\/activiti-admin:8080%"$APS_ADMIN_URL"%g /etc/nginx/nginx.conf
 fi
 
 if [[ $ACCESS_LOG ]]; then

nginx-ingress/nginx.conf

@@ -19,10 +19,7 @@ http {
 
         proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
         proxy_redirect off;
-#        proxy_buffering off;
+        proxy_buffering off;
-        proxy_buffer_size	64k;
-        proxy_buffers		4 256k;
-        proxy_busy_buffers_size	256k;
         proxy_set_header Host              $http_host;
         proxy_set_header X-Real-IP         $remote_addr;
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
@@ -47,6 +44,13 @@ http {
 
         location /alfresco/ {
             proxy_pass http://platform:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+        
+        location /sync/ {
+            proxy_pass http://sync:9090/alfresco/;
         }
 
         location /activiti-app/ {
@@ -56,8 +60,22 @@ http {
             absolute_redirect off;
         }
 
-        location /auth/ {
+        location /activiti-admin/ {
-            proxy_pass http://identity:8080;
+            proxy_pass http://activiti-admin:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+
+        location /share/ {
+            proxy_pass http://share:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
+        }
+        
+        location /workspace/ {
+            proxy_pass http://digital-workspace:8080/;
 
             # If using external proxy / load balancer (for initial redirect if no trailing slash)
             absolute_redirect off;