diff --git a/.github/workflows/build-push-docker-image.yml b/.github/workflows/build-push-docker-image.yml new file mode 100644 index 00000000..5edf8fcf --- /dev/null +++ b/.github/workflows/build-push-docker-image.yml @@ -0,0 +1,48 @@ +name: build-push-docker-image + +#on: workflow_dispatch +on: + push: + branches: feature/docker_configs + workflow_dispatch: + +jobs: + build-push-docker-image: + runs-on: ubuntu-latest + permissions: + packages: write + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: Get the latest release + id: release + uses: robinraju/release-downloader@v1.7 + with: + latest: true + fileName: "*.tar.bz2" + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and push the Production image + uses: docker/build-push-action@v4 + with: + context: . + file: docker/Dockerfile.prod + platforms: linux/amd64,linux/arm64 + push: true + tags: | + ghcr.io/openconext/stepup-tiqr/stepup-tiqr:prod + ghcr.io/openconext/stepup-tiqr/stepup-tiqr:${{ github.sha }} + ghcr.io/openconext/stepup-tiqr/stepup-tiqr:${{ steps.release.outputs.tag_name }} diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml index a8b8d531..fdffb2ac 100644 --- a/.github/workflows/tag-release.yml +++ b/.github/workflows/tag-release.yml @@ -60,4 +60,13 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - release_id: ${{ steps.create_release.outputs.id }} \ No newline at end of file + release_id: ${{ steps.create_release.outputs.id }} + + after_build: + needs: build + runs-on: ubuntu-latest + steps: + - name: Trigger Docker container build + uses: benc-uk/workflow-dispatch@v1 + with: + workflow: build-push-docker-image.yml diff --git a/config/legacy/parameters.yaml.dist b/config/legacy/parameters.yaml.dist index 7cee6227..3fcef45c 100644 --- a/config/legacy/parameters.yaml.dist +++ b/config/legacy/parameters.yaml.dist @@ -12,18 +12,17 @@ parameters: - en_GB # SAML configuration - saml_idp_publickey: '%kernel.root_dir%/../vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_publickey.cer' - saml_idp_privatekey: '%kernel.root_dir%/../vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_privatekey.pem' - saml_metadata_publickey: '%kernel.root_dir%/../vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_publickey.cer' - saml_metadata_privatekey: '%kernel.root_dir%/../vendor/surfnet/stepup-saml-bundle/src/Resources/keys/development_privatekey.pem' - saml_remote_sp_entity_id: 'https://pieter.aai.surfnet.nl/simplesamlphp/module.php/saml/sp/metadata.php/default-sp' - saml_remote_sp_sso_url: '"https://pieter.aai.surfnet.nl/simplesamlphp/module.php/saml/sp/saml2-acs.php/default-sp"' - saml_remote_sp_certificate: '%kernel.root_dir%/../vendor/surfnet/stepup-gssp-bundle/src/Resources/keys/pieter.aai.surfnet.nl.pem' - saml_remote_sp_acs: 'https://pieter.aai.surfnet.nl/simplesamlphp/module.php/saml/sp/saml2-acs.php/default-sp' + saml_idp_publickey: '/config/tiqr/tiqr_idp.crt' + saml_idp_privatekey: '/config/tiqr/tiqr_idp.key' + saml_metadata_publickey: '/config/tiqr/tiqr_idp.crt' + saml_metadata_privatekey: '/config/tiqr/tiqr_idp.key' + saml_remote_sp_entity_id: 'https://gateway.dev.openconext.local/gssp/tiqr/metadata' + saml_remote_sp_certificate: '/config/gateway/gateway_gssp_sp.crt' + saml_remote_sp_acs: 'https://gateway.dev.openconext.local/gssp/tiqr/consume-assertion' # Hosting settings (own URL) - base_url: 'https://tiqr.stepup.example.com' - tiqr_identity: 'tiqr.stepup.example.com' + base_url: 'https://tiqr.dev.openconext.local' + tiqr_identity: 'tiqr.dev.openconext.local' # View parameters, 'en' entry was added as this is the default used by Translator. Was unable to configure it to # use en_GB. TODO: look into configuring this the right way. diff --git a/config/packages/prod/monolog.yaml.docker b/config/packages/prod/monolog.yaml.docker new file mode 100644 index 00000000..f1a1e7e9 --- /dev/null +++ b/config/packages/prod/monolog.yaml.docker @@ -0,0 +1,12 @@ +monolog: + handlers: + prod-signaler: + type: fingers_crossed + action_level: ERROR + passthru_level: NOTICE # this means that all message of level NOTICE or higher are always logged + handler: main_syslog + bubble: false # if we handle it, nothing else should + main_syslog: + type: stream + path: "php://stderr" + formatter: surfnet_stepup.monolog.json_formatter diff --git a/docker/Dockerfile.prod b/docker/Dockerfile.prod new file mode 100644 index 00000000..96da752f --- /dev/null +++ b/docker/Dockerfile.prod @@ -0,0 +1,22 @@ +FROM ghcr.io/openconext/openconext-basecontainers/php72-apache2:latest AS php-build +COPY *.tar.bz2 /tmp/ +RUN tar -xvjf /tmp/*.tar.bz2 -C /var/www/html/ && \ + rm -rf /tmp/*.tar.bz2 + +# Add the application configuration files +COPY config/legacy/parameters.yaml.dist config/legacy/parameters.yaml +COPY config/packages/prod/monolog.yaml.docker config/packages/prod/monolog.yaml + +# TIQR needs some assests to be installed +RUN bin/console assets:install + +# Add the config files for Apache2 +RUN rm -rf /etc/apache2/sites-enabled/* +COPY ./docker/conf/tiqr-apache2.conf /etc/apache2/sites-enabled/tiqr.conf +RUN rm -rf /var/www/html/var/cache/prod && chown -R www-data /var/www/html/var +EXPOSE 80 + +# Set the default workdir +WORKDIR /var/www/html + +ENTRYPOINT ["apache2-foreground"] diff --git a/docker/conf/tiqr-apache2.conf b/docker/conf/tiqr-apache2.conf new file mode 100644 index 00000000..c5e90392 --- /dev/null +++ b/docker/conf/tiqr-apache2.conf @@ -0,0 +1,33 @@ + + ServerName tiqr + ServerAdmin admin@surf.nl + + DocumentRoot /var/www/html/public + + SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 + + + Require all granted + + Options -MultiViews + RewriteEngine On + RewriteCond %{REQUEST_FILENAME} !-f + RewriteRule ^(.*)$ index.php [QSA,L] + + + Require all granted + + + Header always set X-Content-Type-Options "nosniff" + + # Set the php application handler so mod_php interpets the files + + SetHandler application/x-httpd-php + + + ExpiresActive on + ExpiresByType font/* "access plus 1 year" + ExpiresByType image/* "access plus 6 months" + ExpiresByType text/css "access plus 1 year" + ExpiresByType text/js "access plus 1 year" +