diff --git a/Dockerfile b/Dockerfile index 7409fe6..0925fa8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM php:7-fpm-alpine3.7 +FROM php:7-fpm LABEL maintainer="diego@passbolt.com" @@ -10,47 +10,51 @@ ARG PHP_EXTENSIONS="gd \ pdo_mysql \ xsl" -ARG PHP_GNUPG_BUILD_DEPS="php7-dev \ - make \ - gcc \ - g++ \ - libc-dev \ - pkgconfig \ - re2c \ - gpgme-dev \ - autoconf \ - zlib-dev \ - file" - ARG PECL_PASSBOLT_EXTENSIONS="gnupg \ - redis" + redis \ + mcrypt" -RUN apk add --no-cache $PHP_GNUPG_BUILD_DEPS \ +ENV PECL_BASE_URL="https://pecl.php.net/get" +ENV PHP_EXT_DIR="/usr/src/php/ext" + +WORKDIR /var/www/passbolt +RUN apt-get update && apt-get -y install \ + --no-install-recommends \ nginx \ - gpgme \ + libgpgme11-dev \ gnupg1 \ mysql-client \ libpng-dev \ - icu-dev \ - libxslt-dev \ + libicu-dev \ + libxslt1-dev \ libmcrypt-dev \ supervisor \ git \ - && pecl install $PECL_PASSBOLT_EXTENSIONS mcrypt-snapshot \ - && docker-php-ext-install -j4 $PHP_EXTENSIONS \ - && docker-php-ext-enable $PHP_EXTENSIONS $PECL_PASSBOLT_EXTENSIONS mcrypt \ - && apk del $PHP_GNUPG_BUILD_DEPS \ + netcat \ + procps \ + cron \ + && mv /usr/bin/gpg /usr/bin/gpg2 \ + && update-alternatives --verbose --install /usr/bin/gpg gnupg /usr/bin/gpg1 50 \ + && mkdir /home/www-data \ + && chown -R www-data:www-data /home/www-data \ + && usermod -d /home/www-data www-data \ + && docker-php-source extract \ + && for i in $PECL_PASSBOLT_EXTENSIONS; do \ + mkdir $PHP_EXT_DIR/$i; \ + curl -sSL $PECL_BASE_URL/$i | tar zxf - -C $PHP_EXT_DIR/$i --strip-components 1; \ + done \ + && docker-php-ext-install -j4 $PHP_EXTENSIONS $PECL_PASSBOLT_EXTENSIONS \ + && docker-php-ext-enable $PHP_EXTENSIONS $PECL_PASSBOLT_EXTENSIONS \ && curl -sS https://getcomposer.org/installer | php \ - && mv composer.phar /usr/local/bin/composer - -WORKDIR /var/www/passbolt -RUN curl -sSL $PASSBOLT_URL | tar zxf - -C . --strip-components 1 \ + && mv composer.phar /usr/local/bin/composer \ + && curl -sSL $PASSBOLT_URL | tar zxf - -C . --strip-components 1 \ && composer install --no-dev --optimize-autoloader \ && chown -R www-data:www-data . \ && chmod 775 $(find /var/www/passbolt/tmp -type d) \ && chmod 664 $(find /var/www/passbolt/tmp -type f) \ && chmod 775 $(find /var/www/passbolt/webroot/img/public -type d) \ - && chmod 664 $(find /var/www/passbolt/webroot/img/public -type f) + && chmod 664 $(find /var/www/passbolt/webroot/img/public -type f) \ + && rm /etc/nginx/sites-enabled/default COPY conf/passbolt.conf /etc/nginx/conf.d/default.conf COPY conf/supervisord.conf /etc/supervisord.conf diff --git a/bin/docker-entrypoint.sh b/bin/docker-entrypoint.sh index a13ec1b..bc93558 100755 --- a/bin/docker-entrypoint.sh +++ b/bin/docker-entrypoint.sh @@ -1,6 +1,6 @@ -#!/usr/bin/env sh +#!/usr/bin/env bash -set -eo pipefail +set -eu gpg_private_key="${PASSBOLT_GPG_SERVER_KEY_PRIVATE:-/var/www/passbolt/config/gpg/serverkey_private.asc}" gpg_public_key="${PASSBOLT_GPG_SERVER_KEY_PUBLIC:-/var/www/passbolt/config/gpg/serverkey.asc}" @@ -8,6 +8,8 @@ gpg_public_key="${PASSBOLT_GPG_SERVER_KEY_PUBLIC:-/var/www/passbolt/config/gpg/s ssl_key='/etc/ssl/certs/certificate.key' ssl_cert='/etc/ssl/certs/certificate.crt' +export GNUPGHOME="/home/www-data/.gnupg" + gpg_gen_key() { key_email="${PASSBOLT_KEY_EMAIL:-passbolt@yourdomain.com}" key_name="${PASSBOLT_KEY_NAME:-Passbolt default user}" @@ -15,7 +17,7 @@ gpg_gen_key() { subkey_length="${PASSBOLT_SUBKEY_LENGTH:-2048}" expiration="${PASSBOLT_KEY_EXPIRATION:-0}" - su -m -c "gpg --batch --gen-key <> $cron_task - mkdir -p $cron_task_dir - echo "* * * * * run-parts $cron_task_dir" >> $root_crontab - echo "#!/bin/sh" > $cron_task - chmod +x $cron_task - echo "su -c \"$process_email\" -s /bin/sh www-data" >> $cron_task + crontab /etc/cron.d/passbolt_email } if [ ! -f "$gpg_private_key" ] && [ ! -L "$gpg_private_key" ] || \ diff --git a/conf/supervisord.conf b/conf/supervisord.conf index 9cd1f5a..3ba74ba 100644 --- a/conf/supervisord.conf +++ b/conf/supervisord.conf @@ -26,11 +26,11 @@ autostart=true priority=5 [program:nginx] -command=nginx -g "pid /tmp/nginx.pid; daemon off;" +command=nginx -g "daemon off;" autostart=true priority=10 -[program:crond] -command=crond -f -c /etc/crontabs +[program:cron] +command=cron autostart=true priority=20 diff --git a/docker-compose.yml b/docker-compose.yml index a147a8c..75361c9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,15 +10,15 @@ services: - 3306 passbolt: - image: passbolt/passbolt:2.0.0-rc2-alpine + image: gcr.io/passbolt-production/passbolt-api:2.0.0-rc2-debian depends_on: - db env_file: - env/passbolt.env volumes: - - gpg_volume:/var/www/passbolt/config/gpg - - images_volume:/var/www/passbolt/webroot/img/public/images - ./scripts/wait-for.sh:/usr/bin/wait-for.sh + tmpfs: + - /run command: ["/usr/bin/wait-for.sh", "db:3306", "--", "/docker-entrypoint.sh"] ports: - 80:80 diff --git a/env/passbolt.env b/env/passbolt.env index 01ff892..c5cffef 100644 --- a/env/passbolt.env +++ b/env/passbolt.env @@ -6,6 +6,7 @@ DATASOURCES_DEFAULT_HOST=db DATASOURCES_DEFAULT_USERNAME=passbolt DATASOURCES_DEFAULT_PASSWORD=P4ssb0lt DATASOURCES_DEFAULT_DATABASE=passbolt +DATASOURCES_DEFAULT_PORT=3306 # Misc PASSBOLT_REGISTRATION_PUBLIC=true