Update example docker setup

.dockerignore

@@ -0,0 +1 @@
+/data

.gitignore

@@ -0,0 +1 @@
+/data

Dockerfile

@@ -1,15 +1,59 @@
-FROM ubuntu:trusty
-MAINTAINER Cornelius Kölbel <cornelius@privacyidea.org>
-RUN apt-get update
-RUN apt-get install -y software-properties-common
-RUN add-apt-repository ppa:privacyidea/privacyidea
-RUN apt-get update
-RUN apt-get install -y privacyidea
-RUN apt-get install -y python-mysqldb
-RUN privacyidea-create-pwidresolver-user -u admin -p test > /etc/privacyidea/admin-users 
-EXPOSE 5001
-VOLUME /etc/privacyidea
-VOLUME /var/log/privacyidea
-VOLUME /var/lib/privacyidea
-ENTRYPOINT paster serve /etc/privacyidea/privacyidea.ini 
-USER privacyidea
+FROM ubuntu:18.04
+
+ENV PRIVACYIDEA_VERSION=v3.2.2
+ENV PRIVACYIDEA_CONFIGFILE=/etc/privacyidea/pi.cfg
+
+RUN apt-get update \
+  # build deps
+  && apt-get install -y \
+    build-essential \
+    default-libmysqlclient-dev \
+    libffi-dev \
+    libgdbm-dev \
+    libjpeg-dev \
+    libldap2-dev \
+    libncurses5-dev \
+    libnss3-dev \
+    libpq-dev \
+    libreadline-dev \
+    libsasl2-dev \
+    libssl-dev \
+    libxslt1-dev \
+    libz-dev \
+    zlib1g-dev \
+  # python3
+  && apt-get install -y \
+    python3 \
+    python3-pip \
+  # apache, mods and wsgi (python support)
+  && apt-get install -y \
+    apache2 \
+    apache2-dev \
+    libapache2-mod-wsgi-py3 \
+  && rm -f /etc/apache2/sites-enabled/*.conf \
+  && a2enmod wsgi auth_digest \
+  # install stunnel
+  && apt-get install -y stunnel4 \
+  # add user
+  && adduser --disabled-password --disabled-login --gecos "" privacyidea \
+  && mkdir -p /opt/privacyidea \
+  ## fix log dir
+  && mkdir -p /var/log/privacyidea && touch /var/log/privacyidea/privacyidea.log && chmod a+rw /var/log/privacyidea/privacyidea.log \
+  # check python
+  && python3 --version \
+  # install privacyIDEA
+  && pip3 install --no-cache-dir "privacyidea==$PRIVACYIDEA_VERSION" \
+  # mysql driver
+  && pip3 install --no-cache-dir 'pymysql-sa==1.0' 'PyMySQL==0.9.3' \
+  # deps
+  && pip3 install --no-cache-dir -r "https://raw.githubusercontent.com/privacyidea/privacyidea/$PRIVACYIDEA_VERSION/requirements.txt" \
+  # cleanup
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/privacyidea
+
+COPY apache.conf /etc/apache2/sites-enabled/privacyidea.conf
+
+COPY privacyideaapp.py /opt/privacyidea/privacyideaapp.wsgi
+
+CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"]

README.md

@@ -1,28 +1,29 @@
 This is a small draft build environment to build a docker image for privacyIDEA.
 
-The image
-=========
+## Getting running example
 
-The docker image is a self contained Ubuntu 14.04 with privacyIDEA installed, which will
-run on every distribution.
+ * Start services
 
-Run it with 
+```bash
+docker-compose up
+```
 
-  docker run -d -p 5001:5001 privacyidea/otpserver
+ * Minimal setup steps
 
-This will download the existing privacyIDEA container from the docker hub
-https://registry.hub.docker.com/u/privacyidea/otpserver/
-and run it.
+```bash
+docker exec -it privacyidea bash               # connect to privacyIDEA docker container
+pi-manage createdb                             # create db
+pi-manage create_enckey                        # create encryption keys
+pi-manage create_audit_keys                    # create signing keys
+pi-manage admin add admin -e admin@localhost   # add admin user
+```
 
-Login to http://localhost:5001 with "admin@admin"/"test".
+Check more from [offical docs](https://privacyidea.readthedocs.io/en/latest/) about setup/config.
 
-You must not use this in productive environment, since it contains fixed encryption keys
-and SSL certificate!
-
-Building
-========
-
-To build the docker image, you must be root, since the result is written to
-/var/lib/docker...
+ * Access privacyIDEA -> [http://localhost:80/](http://localhost:80/)
 
+## Build docker image
 
+```bash
+docker build -t $NAME .
+```

apache.conf

@@ -0,0 +1,81 @@
+<VirtualHost 0.0.0.0:80>
+	ServerAdmin webmaster@localhost
+	# You might want to change this
+	ServerName localhost
+
+	DocumentRoot /var/www/html
+	<Directory />
+		# For Apache 2.4 you need to set this:
+		Require all granted
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+
+        # Yubico servers use /wsapi/2.0/verify as the path in the
+        # validation URL. Some tools (e.g. Kolab 2fa) let the
+        # user/admin change the api host, but not the rest of
+        # the URL. Uncomment the following two lines to reroute
+        # the api URL internally to privacyideas /ttype/yubikey.
+        #RewriteEngine  on
+        #RewriteRule    "^/wsapi/2.0/verify"  "/ttype/yubikey" [PT]
+
+	# We can run several instances on different paths with different configurations
+	WSGIScriptAlias /      /opt/privacyidea/privacyideaapp.wsgi
+	#WSGIScriptAlias /instance1      /home/cornelius/src/privacyidea/deploy/privacyideaapp1.wsgi
+	#WSGIScriptAlias /instance2      /home/cornelius/src/privacyidea/deploy/privacyideaapp2.wsgi
+	#WSGIScriptAlias /instance3      /home/cornelius/src/privacyidea/deploy/privacyideaapp3.wsgi
+	#
+	# The daemon is running as user 'privacyidea'
+	# This user should have access to the encKey database encryption file
+	WSGIDaemonProcess privacyidea processes=1 threads=15 display-name=%{GROUP} user=privacyidea
+	WSGIProcessGroup privacyidea
+	WSGIPassAuthorization On
+
+	ErrorLog /dev/stderr
+
+	LogLevel warn
+	# Do not use %q! This will reveal all parameters, including setting PINs and Keys!
+	# Using SSL_CLINET_S_DN_CN will show you, which administrator did what task
+	LogFormat "%h %l %u %t %>s \"%m %U %H\"  %b \"%{Referer}i\" \"%{User-agent}i\"" privacyIDEA
+	CustomLog /dev/stdout privacyIDEA
+
+	TransferLog /dev/stdout
+
+	# #   SSL Engine Switch:
+	# #   Enable/Disable SSL for this virtual host.
+	# SSLEngine on
+        # SSLProtocol ALL -SSLv2 -SSLv3
+	# SSLHonorCipherOrder On
+	# SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
+
+
+	# #   If both key and certificate are stored in the same file, only the
+	# #   SSLCertificateFile directive is needed.
+	# SSLCertificateFile    /etc/ssl/certs/privacyideaserver.pem
+	# SSLCertificateKeyFile /etc/ssl/private/privacyideaserver.key
+
+	# <FilesMatch "\.(cgi|shtml|phtml|php)$">
+	# 	SSLOptions +StdEnvVars
+	# </FilesMatch>
+	# <Directory /usr/lib/cgi-bin>
+	# 	SSLOptions +StdEnvVars
+	# </Directory>
+	# BrowserMatch ".*MSIE.*" \
+	# 	nokeepalive ssl-unclean-shutdown \
+	# 	downgrade-1.0 force-response-1.0
+
+
+</VirtualHost>
+
+# If you want to forward http request to https enable the
+# following virtual host.
+#<VirtualHost _default_:80>
+#	# This will enable the Rewrite capabilities
+#	RewriteEngine On
+#
+#	# This checks to make sure the connection is not already HTTPS
+#	RewriteCond %{HTTPS} !=on
+#	RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
+#</VirtualHost>
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

docker-compose.yml

@@ -0,0 +1,55 @@
+version: "3.4"
+
+services:
+
+  privacyidea:
+    # docker exec -it privacyidea bash
+    container_name: privacyidea
+    build: .
+    depends_on:
+      - mysql
+    volumes:
+      # test config
+      - ./test-config-pi.cfg:/etc/privacyidea/pi.cfg
+      # keys
+      - ./data/keys:/etc/privacyidea/keys
+
+    ports:
+      # http://localhost:80/
+      - "80:80"
+
+  mysql:
+    container_name: privacyidea-mysql
+    image: mysql:8.0.16
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      MYSQL_ROOT_PASSWORD: test1
+      MYSQL_PASSWORD: test1
+      MYSQL_USER: test1
+      MYSQL_DATABASE: test1
+    security_opt:
+      - seccomp:unconfined
+    #
+    # commented the volume if you do not want to have database persisted!
+    #
+    volumes:
+      - ./data/mysql:/var/lib/mysql
+    #
+    # # uncommend ports to access db locally
+    #
+    # ports:
+    #   - "3306:3306"
+
+  # phpmyadmin:
+  #   container_name: privacyidea-phpmyadmin
+  #   image: phpmyadmin/phpmyadmin
+  #   environment:
+  #     PMA_HOST: mysql
+  #     PMA_PASSWORD: test1
+  #     PMA_USER: test1
+  #     PMA_PORT: "3306"
+  #   depends_on:
+  #     - mysql
+  #   ports:
+  #     # http://localhost:8017/
+  #     - "8017:80"

privacyideaapp.py

@@ -0,0 +1,5 @@
+import sys
+sys.stdout = sys.stderr
+from privacyidea.app import create_app
+# Now we can select the config file:
+application = create_app(config_name="production", config_file="/etc/privacyidea/pi.cfg")

test-config-pi.cfg

@@ -0,0 +1,16 @@
+# The realm, where users are allowed to login as administrators
+SUPERUSER_REALM = ['super', 'administrators']
+# Your database
+SQLALCHEMY_DATABASE_URI = 'pymysql://test1:test1@mysql/test1'
+# This is used to encrypt the auth_token
+SECRET_KEY = 't0p s3cr3t'
+# This is used to encrypt the admin passwords
+PI_PEPPER = "Never know..."
+# This is used to encrypt the token data and token passwords
+PI_ENCFILE = '/etc/privacyidea/keys/enckey'
+# This is used to sign the audit log
+PI_AUDIT_KEY_PRIVATE = '/etc/privacyidea/keys/private.pem'
+PI_AUDIT_KEY_PUBLIC = '/etc/privacyidea/keys/public.pem'
+# log
+PI_LOGFILE = "/var/log/privacyidea/privacyidea.log"
+PI_LOGLEVEL = 20