From 64c7be2c20d212acf0c789f058f7eb34fa6cfe2e Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Tue, 7 Jan 2025 11:37:40 +0100 Subject: [PATCH 1/9] Add OpenSSL ini config for PHP with custom cafile path --- docker-compose.yml | 2 ++ docker/php/conf.d/openssl.ini | 2 ++ 2 files changed, 4 insertions(+) create mode 100644 docker/php/conf.d/openssl.ini diff --git a/docker-compose.yml b/docker-compose.yml index 8bfe002..7d55f61 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,6 +7,8 @@ services: container_name: goteo-v4-php volumes: - .:/app + - ./docker/php/ssl/ca-bundle.crt:/etc/ssl/ca-bundle.crt:ro + - ./docker/php/conf.d/openssl.ini:/usr/local/etc/php/conf.d/openssl.ini:ro - ./docker/php/conf.d/opcache.ini:/usr/local/etc/php/conf.d/opcache.ini:ro nginx: diff --git a/docker/php/conf.d/openssl.ini b/docker/php/conf.d/openssl.ini new file mode 100644 index 0000000..ae9008c --- /dev/null +++ b/docker/php/conf.d/openssl.ini @@ -0,0 +1,2 @@ +[openssl] +openssl.cafile=/etc/ssl/ca-bundle.crt From d560aa748c95bdebf1870927ceb60137d11be172 Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Tue, 7 Jan 2025 11:43:05 +0100 Subject: [PATCH 2/9] Ignore ca file, to be downloaded from the internet on docker build --- docker/php/ssl/.gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 docker/php/ssl/.gitignore diff --git a/docker/php/ssl/.gitignore b/docker/php/ssl/.gitignore new file mode 100644 index 0000000..ea26ec0 --- /dev/null +++ b/docker/php/ssl/.gitignore @@ -0,0 +1 @@ +ca-bundle.crt From 1b28422b3307d3b9cbf1706d3d10da9c0a063499 Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Tue, 7 Jan 2025 11:49:56 +0100 Subject: [PATCH 3/9] Update README --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index d7e7f9e..2a1371f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # The v4 API This repository holds the code for the Goteo **v4** API. +> **NOTE**: Review the trusted certificates by OpenSSL. See: https://github.com/GoteoFoundation/v4/issues/43 + ## Installation This application requires [Docker](https://docs.docker.com/get-docker/) and the [Docker Compose](https://docs.docker.com/compose/install/) plugin. @@ -31,7 +33,7 @@ UID=1001 GID=1001 APP_HTTP_PORT=8080 -APP_HTTPS_PORT=8433 +APP_HTTPS_PORT=8443 ``` Then feed your custom env vars to Compose: @@ -41,7 +43,7 @@ docker compose --env-file .env.local up -d --build - Option B. Passing the variables through the shell. ```shell -export APP_HTTP_PORT=8080 && export APP_HTTPS_PORT=8433 +export APP_HTTP_PORT=8080 && export APP_HTTPS_PORT=8443 # Dynamic user and group id export UID=$(id -u) && export GID=$(id -g) @@ -73,7 +75,7 @@ bin/docker php bin/console app:gateways:setup ## Usage -The app should be live at [http://localhost:8091](http://localhost:8091) (or your specified ports). Keep in mind that the API address is [/v4](http://localhost:8091/v4). +The app should be live at [http://localhost:8090](http://localhost:8090) (or your specified ports). Keep in mind that the API address is [/v4](http://localhost:8090/v4). You can access a real-time build of the OpenAPI spec file for v4 at [http://localhost:8090/v4/docs.json](http://localhost:8090/v4/docs.json), to be used, for example, with API development suites such as Hoppscotch. This file will be up to date with most of your latest changes. @@ -83,6 +85,7 @@ For quick Docker access you can use the `bin/docker` shortcut to quickly `exec` - Login to mysql CLI: `bin/docker mariadb mysql -u goteo -pgoteo goteo` - Debug the symfony services: `bin/docker php bin/console debug:container` +- List app custom commands: `bin/docker php bin/console list app` ## Testing From a6e50a49aa9ba25dc688fab5431f29a18cda4996 Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Thu, 9 Jan 2025 10:06:16 +0100 Subject: [PATCH 4/9] Add APCu cache layer on Dockerfile base step --- docker/php/Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docker/php/Dockerfile b/docker/php/Dockerfile index decc4a9..2e44084 100644 --- a/docker/php/Dockerfile +++ b/docker/php/Dockerfile @@ -17,6 +17,10 @@ RUN docker-php-ext-install \ intl \ zip +RUN apk --no-cache add $PHPIZE_DEPS +RUN pecl install apcu \ + && docker-php-ext-enable apcu + COPY --from=composer:lts /usr/bin/composer /usr/local/bin/composer From 41be434bbf7a59ef801c57b81dee3121421d0c3b Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Thu, 9 Jan 2025 10:11:02 +0100 Subject: [PATCH 5/9] Move opcache from dev to base --- docker/php/Dockerfile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docker/php/Dockerfile b/docker/php/Dockerfile index 2e44084..3e15038 100644 --- a/docker/php/Dockerfile +++ b/docker/php/Dockerfile @@ -17,17 +17,16 @@ RUN docker-php-ext-install \ intl \ zip +RUN docker-php-ext-install opcache + RUN apk --no-cache add $PHPIZE_DEPS RUN pecl install apcu \ && docker-php-ext-enable apcu COPY --from=composer:lts /usr/bin/composer /usr/local/bin/composer - FROM base AS dev -RUN docker-php-ext-install opcache - RUN apk --no-cache add $PHPIZE_DEPS RUN pecl install xdebug \ && docker-php-ext-enable xdebug From 16d56294a53b036234d67d1fd15ab15ab8d54fe5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Ig=C3=B3n?= Date: Thu, 9 Jan 2025 15:59:59 +0100 Subject: [PATCH 6/9] add command to download cacert.pem --- docker/php/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker/php/Dockerfile b/docker/php/Dockerfile index decc4a9..9c3adba 100644 --- a/docker/php/Dockerfile +++ b/docker/php/Dockerfile @@ -19,6 +19,8 @@ RUN docker-php-ext-install \ COPY --from=composer:lts /usr/bin/composer /usr/local/bin/composer +RUN curl --remote-name https://curl.se/ca/cacert.pem \ + && mv cacert.pem /etc/ssl/certs/ca-certificates.crt FROM base AS dev From 7faaadeadc78e9a1e303007697a346532e2796f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Ig=C3=B3n?= Date: Thu, 9 Jan 2025 19:02:46 +0100 Subject: [PATCH 7/9] change cafile route in openssl.ini --- docker/php/conf.d/openssl.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/php/conf.d/openssl.ini b/docker/php/conf.d/openssl.ini index ae9008c..e1b00fa 100644 --- a/docker/php/conf.d/openssl.ini +++ b/docker/php/conf.d/openssl.ini @@ -1,2 +1,2 @@ [openssl] -openssl.cafile=/etc/ssl/ca-bundle.crt +openssl.cafile=/etc/ssl/certs/ca-certificates.crt From e413e7c02352a09a2939d475fa8a4f89f9f0c67f Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Fri, 10 Jan 2025 09:21:24 +0100 Subject: [PATCH 8/9] Move test certificates volume to override config --- docker-compose.override.yml | 1 + docker-compose.yml | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.override.yml b/docker-compose.override.yml index 5c29684..a776fbc 100644 --- a/docker-compose.override.yml +++ b/docker-compose.override.yml @@ -1,6 +1,7 @@ services: php: volumes: + # ./docker/php/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro - ./docker/php/conf.d/opcache.dev.ini:/usr/local/etc/php/conf.d/opcache.ini:ro - ./docker/php/conf.d/xdebug.dev.ini:/usr/local/etc/php/conf.d/xdebug.ini:ro extra_hosts: diff --git a/docker-compose.yml b/docker-compose.yml index 7d55f61..c1f6ba8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,7 +7,6 @@ services: container_name: goteo-v4-php volumes: - .:/app - - ./docker/php/ssl/ca-bundle.crt:/etc/ssl/ca-bundle.crt:ro - ./docker/php/conf.d/openssl.ini:/usr/local/etc/php/conf.d/openssl.ini:ro - ./docker/php/conf.d/opcache.ini:/usr/local/etc/php/conf.d/opcache.ini:ro From dad48ca65b80a224c393471b763798e4aa018a91 Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Fri, 10 Jan 2025 09:22:04 +0100 Subject: [PATCH 9/9] Ignore every crt file in docker/php/ssl --- docker/php/ssl/.gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/php/ssl/.gitignore b/docker/php/ssl/.gitignore index ea26ec0..a4e94ec 100644 --- a/docker/php/ssl/.gitignore +++ b/docker/php/ssl/.gitignore @@ -1 +1 @@ -ca-bundle.crt +*.crt