Skip to content

Commit 316f961

Browse files
danschmidt5189danschmidt5189
authored
DEV-527: Refactor to more flexible UBI8 base image (#2)
- Switches to the Red Hat UBI8/httpd-24 base image. This image supports flexible configuration via conf.d/*.conf and conf.modules.d/*.conf files, which the "official" httpd24 image does not. It is supported by the standard RHEL UBI policy (i.e. tracks RHEL8). - Bakes in the CAS configuration exactly as before. - Adds our custom index styling. - Adds TrustedProxy configuration so this image works behind NGINX, Traefik, etc.
1 parent f9b50bc commit 316f961

35 files changed

Lines changed: 950 additions & 601 deletions

‎.github/workflows/build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
uses: actions/checkout@v3
4343

4444
- name: Run tests
45-
run: ./test.sh
45+
run: ./test/run_tests.sh
4646

4747
- name: Log in to the Container registry
4848
uses: docker/login-action@v2

‎Dockerfile‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
1-
FROM httpd:2.4
1+
FROM registry.access.redhat.com/ubi8/httpd-24
22

3-
RUN apt -y update && \
4-
apt -y upgrade && \
5-
apt -y install libapache2-mod-auth-cas && \
6-
install -d /var/cache/apache2/mod_auth_cas -o www-data -g www-data
3+
USER root
4+
RUN yum -y update && \
5+
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
6+
yum -y install \
7+
xemacs-nox \
8+
mod_auth_cas \
9+
vim && \
10+
install -d -o apache /var/cache/httpd/mod_auth_cas
711

8-
COPY httpd.conf /usr/local/apache2/conf/httpd.conf
9-
10-
VOLUME [ "/var/cache/apache2/mod_auth_cas" ]
12+
USER root
13+
COPY files/etc/httpd /etc/httpd
14+
COPY files/var/www /var/www

‎data/UCB/sample3.txt‎

Whitespace-only changes.

‎data/UCB/sample4.txt‎

Whitespace-only changes.

‎data/public/sample1.txt‎

Whitespace-only changes.

‎data/public/sample2.txt‎

Whitespace-only changes.

‎docker-compose.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ services:
99
- CAS_PROXY_VALIDATE_URL=https://auth.berkeley.edu/cas/proxyValidate
1010
- CAS_ROOT_PROXIED_AS=http://localhost
1111
ports:
12-
- 80:80
12+
- 80:8080
1313
volumes:
14-
- ./data:/usr/local/apache2/htdocs:ro
14+
- ./test/conf/cas-vhost.conf:/etc/httpd/conf.d/cas-vhost.conf:ro
15+
- ./test/data:/var/www/html:ro

‎files/etc/httpd/conf.d/auth_cas.conf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<IfModule auth_cas_module>
2+
CASVersion 2
3+
CASDebug Off
4+
CASLoginURL ${CAS_LOGIN_URL}
5+
CASValidateURL ${CAS_VALIDATE_URL}
6+
CASProxyValidateURL ${CAS_PROXY_VALIDATE_URL}
7+
CASTimeout 7200
8+
CASIdleTimeout 3600
9+
CASCacheCleanInterval 1800
10+
CASCookiePath /var/cache/httpd/mod_auth_cas/
11+
CASCookieEntropy 32
12+
13+
# You must set CAS_ROOT_PROXIED_AS in the environment
14+
CASRootProxiedAs ${CAS_ROOT_PROXIED_AS}
15+
</IfModule>

‎files/etc/httpd/conf.d/autoindex.conf‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#
2+
# Directives controlling the display of server-generated directory listings.
3+
#
4+
# Required modules: mod_authz_core, mod_authz_host,
5+
# mod_autoindex, mod_alias
6+
#
7+
# To see the listing of a directory, the Options directive for the
8+
# directory must include "Indexes", and the directory must not contain
9+
# a file matching those listed in the DirectoryIndex directive.
10+
#
11+
12+
# IndexOptions: Controls the appearance of server-generated directory
13+
# listings.
14+
#
15+
# Charset=utf-8 handles rendering of filenames with Asian-language
16+
# characters; see: https://git.lib.berkeley.edu/ops/ansible/issues/304
17+
IndexOptions Charset=utf-8 FancyIndexing HTMLTable IconsAreLinks IgnoreCase NameWidth=* VersionSort
18+
19+
# We include the /icons/ alias for FancyIndexed directory listings. If
20+
# you do not use FancyIndexing, you may comment this out.
21+
Alias /icons/ "/usr/share/httpd/icons/"
22+
Alias /autoindex/ "/var/www/autoindex/"
23+
24+
<Directory "/usr/share/httpd/icons">
25+
Options Indexes MultiViews FollowSymlinks
26+
AllowOverride None
27+
Require all granted
28+
</Directory>
29+
30+
# NOTE(dcschmidt): Custom styles/partials/images
31+
# @see https://git.lib.berkeley.edu/lap/digital-preservation-assets/issues/1
32+
Alias /favicon.ico "/var/www/autoindex/images/favicon.ico"
33+
<Directory /var/www/html>
34+
Options Indexes MultiViews FollowSymlinks
35+
AllowOverride None
36+
Require all granted
37+
</Directory>
38+
39+
#
40+
# AddIcon* directives tell the server which icon to show for different
41+
# files or filename extensions. These are only displayed for
42+
# FancyIndexed directories.
43+
#
44+
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
45+
46+
AddIconByType (TXT,/icons/text.gif) text/*
47+
AddIconByType (IMG,/icons/image2.gif) image/*
48+
AddIconByType (SND,/icons/sound2.gif) audio/*
49+
AddIconByType (VID,/icons/movie.gif) video/*
50+
51+
AddIcon /icons/binary.gif .bin .exe
52+
AddIcon /icons/binhex.gif .hqx
53+
AddIcon /icons/tar.gif .tar
54+
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
55+
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
56+
AddIcon /icons/a.gif .ps .ai .eps
57+
AddIcon /icons/layout.gif .html .shtml .htm .pdf
58+
AddIcon /icons/text.gif .txt
59+
AddIcon /icons/c.gif .c
60+
AddIcon /icons/p.gif .pl .py
61+
AddIcon /icons/f.gif .for
62+
AddIcon /icons/dvi.gif .dvi
63+
AddIcon /icons/uuencoded.gif .uu
64+
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
65+
AddIcon /icons/tex.gif .tex
66+
AddIcon /icons/bomb.gif /core
67+
AddIcon /icons/bomb.gif */core.*
68+
69+
AddIcon /icons/back.gif ..
70+
AddIcon /icons/hand.right.gif README
71+
AddIcon /icons/folder.gif ^^DIRECTORY^^
72+
AddIcon /icons/blank.gif ^^BLANKICON^^
73+
74+
#
75+
# DefaultIcon is which icon to show for files which do not have an icon
76+
# explicitly set.
77+
#
78+
DefaultIcon /icons/unknown.gif
79+
80+
#
81+
# AddDescription allows you to place a short description after a file in
82+
# server-generated indexes. These are only displayed for FancyIndexed
83+
# directories.
84+
# Format: AddDescription "description" filename
85+
#
86+
#AddDescription "GZIP compressed document" .gz
87+
#AddDescription "tar archive" .tar
88+
#AddDescription "GZIP compressed tar archive" .tgz
89+
90+
#
91+
# ReadmeName is the name of the README file the server will look for by
92+
# default, and append to directory listings.
93+
#
94+
# HeaderName is the name of a file which should be prepended to
95+
# directory indexes.
96+
ReadmeName README.html
97+
HeaderName HEADER.html
98+
99+
#
100+
# IndexIgnore is a set of filenames which directory indexing should ignore
101+
# and not include in the listing. Shell-style wildcarding is permitted.
102+
#
103+
# NOTE(dcschmidt): _SYNCAPP directories are created by the Allway Sync program.
104+
# Lynne uses this to copy files from workstations to the NetApp/NFS server.
105+
#
106+
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t _SYNCAPP*
107+
108+
# NOTE(dcschmidt): Implements custom styles. This depends on settings in
109+
# autoindex.conf that alias and allow the .html/ directory.
110+
#
111+
# @see http://digitalassets.lib.berkeley.edu/UCBonly/ldc/2004T04/ Test Case
112+
# @see https://git.lib.berkeley.edu/lap/digital-preservation-assets/issues/1
113+
IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width\">"
114+
IndexHeadInsert "<link rel=\"stylesheet\" href=\"https://use.typekit.net/rxa5jay.css\">"
115+
IndexStyleSheet /autoindex/css/style.css
116+
ReadmeName /autoindex/partials/footer.html
117+
HeaderName /autoindex/partials/header.html

‎files/etc/httpd/conf.d/trusted_proxies.conf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<IfModule remoteip_module>
2+
RemoteIPHeader X-Forwarded-For
3+
# Docker bridge internal network ranges
4+
RemoteIPTrustedProxy 172.17.0.0/16 172.18.0.0/16
5+
# Traefik network ranges
6+
RemoteIPTrustedProxy 10.0.0.0/8
7+
# Standard IP ranges for Library servers in EWH
8+
RemoteIPTrustedProxy 128.32.10.128/25 169.229.32.0/24 169.229.33.128/25
9+
# Temporary Elastic IPs for NGINX in AWS.
10+
# @see https://jira-secure.berkeley.edu/browse/LIT-1935
11+
RemoteIPTrustedProxy 3.101.9.5 13.56.7.239 50.18.47.155
12+
# SDSC NGINX ip
13+
# @see https://ucblib.atlassian.net/browse/DEV-639
14+
RemoteIPTrustedProxy 192.31.161.30
15+
</IfModule>

0 commit comments

Comments
 (0)