From 5fa5354b481dedb79cd816cb96489fdae0e81873 Mon Sep 17 00:00:00 2001 From: Siim Tiilen Date: Thu, 30 Apr 2020 10:59:00 +0300 Subject: [PATCH] update example docker setup to working state --- .dockerignore | 1 + .gitignore | 1 + Dockerfile | 74 +++++++++++++++++++++++++++++++++--------- Makefile | 10 ------ README.md | 37 ++++++++++----------- apache.conf | 81 ++++++++++++++++++++++++++++++++++++++++++++++ docker-compose.yml | 55 +++++++++++++++++++++++++++++++ privacyideaapp.py | 5 +++ test-config-pi.cfg | 16 +++++++++ 9 files changed, 237 insertions(+), 43 deletions(-) create mode 100644 .dockerignore create mode 100644 .gitignore delete mode 100644 Makefile create mode 100644 apache.conf create mode 100644 docker-compose.yml create mode 100644 privacyideaapp.py create mode 100644 test-config-pi.cfg diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..3af0ccb --- /dev/null +++ b/.dockerignore @@ -0,0 +1 @@ +/data diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3af0ccb --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/data diff --git a/Dockerfile b/Dockerfile index 884bdc1..6e775e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,15 +1,59 @@ -FROM ubuntu:trusty -MAINTAINER Cornelius Kölbel -RUN apt-get update -RUN apt-get install -y software-properties-common -RUN add-apt-repository ppa:privacyidea/privacyidea -RUN apt-get update -RUN apt-get install -y privacyidea -RUN apt-get install -y python-mysqldb -RUN privacyidea-create-pwidresolver-user -u admin -p test > /etc/privacyidea/admin-users -EXPOSE 5001 -VOLUME /etc/privacyidea -VOLUME /var/log/privacyidea -VOLUME /var/lib/privacyidea -ENTRYPOINT paster serve /etc/privacyidea/privacyidea.ini -USER privacyidea +FROM ubuntu:18.04 + +ENV PRIVACYIDEA_VERSION=v3.2.2 +ENV PRIVACYIDEA_CONFIGFILE=/etc/privacyidea/pi.cfg + +RUN apt-get update \ + # build deps + && apt-get install -y \ + build-essential \ + default-libmysqlclient-dev \ + libffi-dev \ + libgdbm-dev \ + libjpeg-dev \ + libldap2-dev \ + libncurses5-dev \ + libnss3-dev \ + libpq-dev \ + libreadline-dev \ + libsasl2-dev \ + libssl-dev \ + libxslt1-dev \ + libz-dev \ + zlib1g-dev \ + # python3 + && apt-get install -y \ + python3 \ + python3-pip \ + # apache, mods and wsgi (python support) + && apt-get install -y \ + apache2 \ + apache2-dev \ + libapache2-mod-wsgi-py3 \ + && rm -f /etc/apache2/sites-enabled/*.conf \ + && a2enmod wsgi auth_digest \ + # install stunnel + && apt-get install -y stunnel4 \ + # add user + && adduser --disabled-password --disabled-login --gecos "" privacyidea \ + && mkdir -p /opt/privacyidea \ + ## fix log dir + && mkdir -p /var/log/privacyidea && touch /var/log/privacyidea/privacyidea.log && chmod a+rw /var/log/privacyidea/privacyidea.log \ + # check python + && python3 --version \ + # install privacyIDEA + && pip3 install --no-cache-dir "privacyidea==$PRIVACYIDEA_VERSION" \ + # mysql driver + && pip3 install --no-cache-dir 'pymysql-sa==1.0' 'PyMySQL==0.9.3' \ + # deps + && pip3 install --no-cache-dir -r "https://raw.githubusercontent.com/privacyidea/privacyidea/$PRIVACYIDEA_VERSION/requirements.txt" \ + # cleanup + && rm -rf /var/lib/apt/lists/* + +WORKDIR /opt/privacyidea + +COPY apache.conf /etc/apache2/sites-enabled/privacyidea.conf + +COPY privacyideaapp.py /opt/privacyidea/privacyideaapp.wsgi + +CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"] diff --git a/Makefile b/Makefile deleted file mode 100644 index 8478b98..0000000 --- a/Makefile +++ /dev/null @@ -1,10 +0,0 @@ -info: - @echo "build build the otpserver image" - @echo "push push the image to the docker hub" - -build: - docker.io build -rm -t privacyidea/otpserver . - -push: - docker.io push privacyidea/otpserver - diff --git a/README.md b/README.md index 69ded36..a340462 100644 --- a/README.md +++ b/README.md @@ -1,28 +1,29 @@ This is a small draft build environment to build a docker image for privacyIDEA. -The image -========= +## Getting running example -The docker image is a self contained Ubuntu 14.04 with privacyIDEA installed, which will -run on every distribution. + * Start services -Run it with +```bash +docker-compose up +``` - docker run -d -p 5001:5001 privacyidea/otpserver + * Minimal setup steps -This will download the existing privacyIDEA container from the docker hub -https://registry.hub.docker.com/u/privacyidea/otpserver/ -and run it. +```bash +docker exec -it privacyidea bash # connect to privacyIDEA docker container +pi-manage createdb # create db +pi-manage create_enckey # create encryption keys +pi-manage create_audit_keys # create signing keys +pi-manage admin add admin -e admin@localhost # add admin user +``` -Login to http://localhost:5001 with "admin@admin"/"test". +Check more from [offical docs](https://privacyidea.readthedocs.io/en/latest/) about setup/config. -You must not use this in productive environment, since it contains fixed encryption keys -and SSL certificate! - -Building -======== - -To build the docker image, you must be root, since the result is written to -/var/lib/docker... + * Access privacyIDEA -> [http://localhost:80/](http://localhost:80/) +## Build docker image +```bash +docker build -t $NAME . +``` diff --git a/apache.conf b/apache.conf new file mode 100644 index 0000000..8b6cda2 --- /dev/null +++ b/apache.conf @@ -0,0 +1,81 @@ + + ServerAdmin webmaster@localhost + # You might want to change this + ServerName localhost + + DocumentRoot /var/www/html + + # For Apache 2.4 you need to set this: + Require all granted + Options FollowSymLinks + AllowOverride None + + + # Yubico servers use /wsapi/2.0/verify as the path in the + # validation URL. Some tools (e.g. Kolab 2fa) let the + # user/admin change the api host, but not the rest of + # the URL. Uncomment the following two lines to reroute + # the api URL internally to privacyideas /ttype/yubikey. + #RewriteEngine on + #RewriteRule "^/wsapi/2.0/verify" "/ttype/yubikey" [PT] + + # We can run several instances on different paths with different configurations + WSGIScriptAlias / /opt/privacyidea/privacyideaapp.wsgi + #WSGIScriptAlias /instance1 /home/cornelius/src/privacyidea/deploy/privacyideaapp1.wsgi + #WSGIScriptAlias /instance2 /home/cornelius/src/privacyidea/deploy/privacyideaapp2.wsgi + #WSGIScriptAlias /instance3 /home/cornelius/src/privacyidea/deploy/privacyideaapp3.wsgi + # + # The daemon is running as user 'privacyidea' + # This user should have access to the encKey database encryption file + WSGIDaemonProcess privacyidea processes=1 threads=15 display-name=%{GROUP} user=privacyidea + WSGIProcessGroup privacyidea + WSGIPassAuthorization On + + ErrorLog /dev/stderr + + LogLevel warn + # Do not use %q! This will reveal all parameters, including setting PINs and Keys! + # Using SSL_CLINET_S_DN_CN will show you, which administrator did what task + LogFormat "%h %l %u %t %>s \"%m %U %H\" %b \"%{Referer}i\" \"%{User-agent}i\"" privacyIDEA + CustomLog /dev/stdout privacyIDEA + + TransferLog /dev/stdout + + # # SSL Engine Switch: + # # Enable/Disable SSL for this virtual host. + # SSLEngine on + # SSLProtocol ALL -SSLv2 -SSLv3 + # SSLHonorCipherOrder On + # SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS + + + # # If both key and certificate are stored in the same file, only the + # # SSLCertificateFile directive is needed. + # SSLCertificateFile /etc/ssl/certs/privacyideaserver.pem + # SSLCertificateKeyFile /etc/ssl/private/privacyideaserver.key + + # + # SSLOptions +StdEnvVars + # + # + # SSLOptions +StdEnvVars + # + # BrowserMatch ".*MSIE.*" \ + # nokeepalive ssl-unclean-shutdown \ + # downgrade-1.0 force-response-1.0 + + + + +# If you want to forward http request to https enable the +# following virtual host. +# +# # This will enable the Rewrite capabilities +# RewriteEngine On +# +# # This checks to make sure the connection is not already HTTPS +# RewriteCond %{HTTPS} !=on +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] +# + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..6cb005f --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,55 @@ +version: "3.4" + +services: + + privacyidea: + # docker exec -it privacyidea bash + container_name: privacyidea + build: . + depends_on: + - mysql + volumes: + # test config + - ./test-config-pi.cfg:/etc/privacyidea/pi.cfg + # keys + - ./data/keys:/etc/privacyidea/keys + + ports: + # http://localhost:80/ + - "80:80" + + mysql: + container_name: privacyidea-mysql + image: mysql:8.0.16 + command: --default-authentication-plugin=mysql_native_password + environment: + MYSQL_ROOT_PASSWORD: test1 + MYSQL_PASSWORD: test1 + MYSQL_USER: test1 + MYSQL_DATABASE: test1 + security_opt: + - seccomp:unconfined + # + # commented the volume if you do not want to have database persisted! + # + volumes: + - ./data/mysql:/var/lib/mysql + # + # # uncommend ports to access db locally + # + # ports: + # - "3306:3306" + + # phpmyadmin: + # container_name: privacyidea-phpmyadmin + # image: phpmyadmin/phpmyadmin + # environment: + # PMA_HOST: mysql + # PMA_PASSWORD: test1 + # PMA_USER: test1 + # PMA_PORT: "3306" + # depends_on: + # - mysql + # ports: + # # http://localhost:8017/ + # - "8017:80" diff --git a/privacyideaapp.py b/privacyideaapp.py new file mode 100644 index 0000000..16e813b --- /dev/null +++ b/privacyideaapp.py @@ -0,0 +1,5 @@ +import sys +sys.stdout = sys.stderr +from privacyidea.app import create_app +# Now we can select the config file: +application = create_app(config_name="production", config_file="/etc/privacyidea/pi.cfg") diff --git a/test-config-pi.cfg b/test-config-pi.cfg new file mode 100644 index 0000000..3beb7af --- /dev/null +++ b/test-config-pi.cfg @@ -0,0 +1,16 @@ +# The realm, where users are allowed to login as administrators +SUPERUSER_REALM = ['super', 'administrators'] +# Your database +SQLALCHEMY_DATABASE_URI = 'pymysql://test1:test1@mysql/test1' +# This is used to encrypt the auth_token +SECRET_KEY = 't0p s3cr3t' +# This is used to encrypt the admin passwords +PI_PEPPER = "Never know..." +# This is used to encrypt the token data and token passwords +PI_ENCFILE = '/etc/privacyidea/keys/enckey' +# This is used to sign the audit log +PI_AUDIT_KEY_PRIVATE = '/etc/privacyidea/keys/private.pem' +PI_AUDIT_KEY_PUBLIC = '/etc/privacyidea/keys/public.pem' +# log +PI_LOGFILE = "/var/log/privacyidea/privacyidea.log" +PI_LOGLEVEL = 20