Skip to content

Commit ce6aaaa

Browse files
dlendlen
committed
Merge branch 'feature/PB-39132_Investigate-implication-of-having-subscription_key-environment-variable-for-Docker' into 'master'
PB-39132 - Add a subscription key environment variable for Docker See merge request passbolt/passbolt_docker!245
2 parents 77bd481 + e31a9c4 commit ce6aaaa

12 files changed

Lines changed: 327 additions & 117 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ conf/*.key
44
.bundle
55

66
# docker compose specific
7-
dev/.env
7+
.env
88
*.vim
99
vendor
1010
*subscription_key.txt

‎.gitlab-ci/Jobs/build_image.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,20 @@
2424
}
2525
EOF
2626
- |
27+
BUILD_TIMESTAMP=$(date +%s)
28+
ARTIFACT_FILE="build_timestamp_${PASSBOLT_FLAVOUR}_${DOCKER_TAG}.env"
29+
30+
echo "BUILD_TIMESTAMP=${BUILD_TIMESTAMP}" > ${ARTIFACT_FILE}
31+
echo "IMAGE_TAG=${PASSBOLT_FLAVOUR:-local}-${DOCKER_TAG}-${BUILD_TIMESTAMP}" >> ${ARTIFACT_FILE}
32+
2733
echo "********************************************"
2834
echo "Build details"
2935
echo "============================================"
3036
echo "Flavour ${PASSBOLT_FLAVOUR:-local}"
37+
echo "Docker Tag ${DOCKER_TAG}"
3138
echo "Commit ${UPSTREAM_COMMIT_SHA:-latest}"
39+
echo "Timestamp ${BUILD_TIMESTAMP}"
40+
echo "Artifact File ${ARTIFACT_FILE}"
3241
echo "********************************************"
3342
- |
3443
/kaniko/executor --context $CI_PROJECT_DIR \
@@ -43,6 +52,12 @@
4352
--custom-platform $PLATFORM \
4453
--destination $CI_REGISTRY_IMAGE:${PASSBOLT_FLAVOUR:-local}-${DOCKER_TAG}-$(date +%s) \
4554
--destination $CI_REGISTRY_IMAGE:${PASSBOLT_FLAVOUR:-local}-${DOCKER_TAG}-latest
55+
artifacts:
56+
reports:
57+
dotenv: build_timestamp_${PASSBOLT_FLAVOUR}_${DOCKER_TAG}.env
58+
paths:
59+
- build_timestamp_*.env
60+
expire_in: 1 hour
4661

4762
.stable-build:
4863
extends: .build
@@ -310,4 +325,4 @@ build-pro-stable-openshift-arm-v7:
310325
DOCKER_TAG: "openshift-arm-v7"
311326
PLATFORM: "linux/arm/v7"
312327
SUPERCRONIC_ARCH: arm
313-
SUPERCRONIC_SHA1SUM: 8c3dbef8175e3f579baefe4e55978f2a27cb76b5
328+
SUPERCRONIC_SHA1SUM: 8c3dbef8175e3f579baefe4e55978f2a27cb76b5

‎.gitlab-ci/Jobs/test_images.yaml‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,28 @@ services:
88
stage: test
99
image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/ruby:slim-bookworm
1010
script:
11+
- bundle install
1112
- |
12-
bundle install
13-
rake spec:$TEST_NAME
13+
# Determine which artifact file to look for
14+
DOCKER_TAG_VARIANT="root"
15+
if [ "$ROOTLESS" = "true" ]; then
16+
DOCKER_TAG_VARIANT="rootless"
17+
fi
18+
19+
ARTIFACT_FILE="build_timestamp_${PASSBOLT_FLAVOUR}_${DOCKER_TAG_VARIANT}.env"
20+
21+
# Source artifact if it exists (optional - won't break if missing)
22+
if [ -f "${ARTIFACT_FILE}" ]; then
23+
echo "✓ Found artifact: ${ARTIFACT_FILE}"
24+
source "${ARTIFACT_FILE}"
25+
echo " BUILD_TIMESTAMP: ${BUILD_TIMESTAMP}"
26+
echo " IMAGE_TAG: ${IMAGE_TAG}"
27+
export USE_TIMESTAMPED_IMAGE=true
28+
else
29+
echo "⚠ No artifact found, using latest images"
30+
export USE_TIMESTAMPED_IMAGE=false
31+
fi
32+
- rake spec:$TEST_NAME
1433
variables:
1534
PASSBOLT_COMPONENT: stable
1635
PASSBOLT_FLAVOUR: ce
@@ -25,6 +44,7 @@ services:
2544
PASSBOLT_FLAVOUR: pro
2645
OPPOSITE_FLAVOUR: ce
2746

47+
2848
ce-docker-image:
2949
extends: .test-images
3050
variables:
@@ -61,7 +81,7 @@ pro-docker-runtime-no-envs:
6181
TEST_NAME: docker_runtime_no_envs
6282

6383
pro-docker-runtime-with-passbolt-php:
64-
extends: .test-images
84+
extends: .test-pro-images
6585
variables:
6686
TEST_NAME: docker_runtime_with_passbolt_php
6787

‎README.md‎

Lines changed: 70 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ store and share credentials securely.
2222

2323
# Requirements
2424

25-
* mariadb/mysql >= 5.0
25+
- mariadb/mysql >= 5.0
2626

2727
# Usage
2828

@@ -90,80 +90,94 @@ append the line `127.0.0.1 passbolt.local` to your `/etc/hosts` file.
9090

9191
Passbolt docker image provides several environment variables to configure different aspects:
9292

93-
| Variable name | Description | Default value
94-
| ----------------------------------- | -------------------------------- | -------------------
95-
| APP_BASE | In case you want to run Passbolt in a subdirectory (e.g. `https://example.com/passbolt`), set this to the path to the subdirectory (e.g. `/passbolt`). Make sure this does **not** end in a trailing slash! | null
96-
| APP_FULL_BASE_URL | The hostname where your server is reachable, including `https://` (or `http://`). Make sure this does **not** end in a trailing slash! And in case you are running Passbolt from a subdirectory (e.g. `https://example.com/passbolt`), please include the subdirectory in this variable, too. | false
97-
| DATASOURCES_DEFAULT_HOST | Database hostname | localhost
98-
| DATASOURCES_DEFAULT_PORT | Database port | 3306
99-
| DATASOURCES_DEFAULT_USERNAME | Database username | ''
100-
| DATASOURCES_DEFAULT_PASSWORD | Database password | ''
101-
| DATASOURCES_DEFAULT_DATABASE | Database name | ''
102-
| DATASOURCES_DEFAULT_SSL_KEY | Database SSL Key | ''
103-
| DATASOURCES_DEFAULT_SSL_CERT | Database SSL Cert | ''
104-
| DATASOURCES_DEFAULT_SSL_CA | Database SSL CA | ''
105-
| EMAIL_TRANSPORT_DEFAULT_CLASS_NAME | Email classname | Smtp
106-
| EMAIL_DEFAULT_FROM | From email address | you@localhost
107-
| EMAIL_DEFAULT_TRANSPORT | Sets transport method | default
108-
| EMAIL_TRANSPORT_DEFAULT_HOST | Server hostname | localhost
109-
| EMAIL_TRANSPORT_DEFAULT_PORT | Server port | 25
110-
| EMAIL_TRANSPORT_DEFAULT_TIMEOUT | Timeout | 30
111-
| EMAIL_TRANSPORT_DEFAULT_USERNAME | Username for email server auth | null
112-
| EMAIL_TRANSPORT_DEFAULT_PASSWORD | Password for email server auth | null
113-
| EMAIL_TRANSPORT_DEFAULT_CLIENT | Client | null
114-
| EMAIL_TRANSPORT_DEFAULT_TLS | Set tls | null
115-
| EMAIL_TRANSPORT_DEFAULT_URL | Set url | null
116-
| GNUPGHOME | path to gnupghome directory | /var/lib/passbolt/.gnupg
117-
| PASSBOLT_KEY_LENGTH | Gpg desired key length | 3072
118-
| PASSBOLT_SUBKEY_LENGTH | Gpg desired subkey length | 3072
119-
| PASSBOLT_KEY_NAME | Key owner name | Passbolt default user
120-
| PASSBOLT_KEY_EMAIL | Key owner email address | <passbolt@yourdomain.com>
121-
| PASSBOLT_KEY_EXPIRATION | Key expiration date | 0, never expires
122-
| PASSBOLT_GPG_SERVER_KEY_FINGERPRINT | GnuPG fingerprint | null
123-
| PASSBOLT_GPG_SERVER_KEY_FINGERPRINT_FORCE | Force calculation of GnuPG fingerprint for server key | null
124-
| PASSBOLT_GPG_SERVER_KEY_PUBLIC | Path to GnuPG public server key | /etc/passbolt/gpg/serverkey.asc
125-
| PASSBOLT_GPG_SERVER_KEY_PRIVATE | Path to GnuPG private server key | /etc/passbolt/gpg/serverkey_private.asc
126-
| PASSBOLT_PLUGINS_EXPORT_ENABLED | Enable export plugin | true
127-
| PASSBOLT_PLUGINS_IMPORT_ENABLED | Enable import plugin | true
128-
| PASSBOLT_REGISTRATION_PUBLIC | Defines if users can register | false
129-
| PASSBOLT_SSL_FORCE | Redirects http to https | false
130-
| PASSBOLT_SECURITY_SET_HEADERS | Send CSP Headers | true
131-
| SECURITY_SALT | CakePHP security salt | **SALT**
93+
| Variable name | Description | Default value
94+
|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -------------------
95+
| APP_BASE | In case you want to run Passbolt in a subdirectory (e.g. `https://example.com/passbolt`), set this to the path to the subdirectory (e.g. `/passbolt`). Make sure this does **not** end in a trailing slash! | null
96+
| APP_FULL_BASE_URL | The hostname where your server is reachable, including `https://` (or `http://`). Make sure this does **not** end in a trailing slash! And in case you are running Passbolt from a subdirectory (e.g. `https://example.com/passbolt`), please include the subdirectory in this variable, too. | false
97+
| DATASOURCES_DEFAULT_HOST | Database hostname | localhost
98+
| DATASOURCES_DEFAULT_PORT | Database port | 3306
99+
| DATASOURCES_DEFAULT_USERNAME | Database username | ''
100+
| DATASOURCES_DEFAULT_PASSWORD | Database password | ''
101+
| DATASOURCES_DEFAULT_DATABASE | Database name | ''
102+
| DATASOURCES_DEFAULT_SSL_KEY | Database SSL Key | ''
103+
| DATASOURCES_DEFAULT_SSL_CERT | Database SSL Cert | ''
104+
| DATASOURCES_DEFAULT_SSL_CA | Database SSL CA | ''
105+
| EMAIL_TRANSPORT_DEFAULT_CLASS_NAME | Email classname | Smtp
106+
| EMAIL_DEFAULT_FROM | From email address | you@localhost
107+
| EMAIL_DEFAULT_TRANSPORT | Sets transport method | default
108+
| EMAIL_TRANSPORT_DEFAULT_HOST | Server hostname | localhost
109+
| EMAIL_TRANSPORT_DEFAULT_PORT | Server port | 25
110+
| EMAIL_TRANSPORT_DEFAULT_TIMEOUT | Timeout | 30
111+
| EMAIL_TRANSPORT_DEFAULT_USERNAME | Username for email server auth | null
112+
| EMAIL_TRANSPORT_DEFAULT_PASSWORD | Password for email server auth | null
113+
| EMAIL_TRANSPORT_DEFAULT_CLIENT | Client | null
114+
| EMAIL_TRANSPORT_DEFAULT_TLS | Set tls | null
115+
| EMAIL_TRANSPORT_DEFAULT_URL | Set url | null
116+
| GNUPGHOME | path to gnupghome directory | /var/lib/passbolt/.gnupg
117+
| PASSBOLT_KEY_LENGTH | Gpg desired key length | 3072
118+
| PASSBOLT_SUBKEY_LENGTH | Gpg desired subkey length | 3072
119+
| PASSBOLT_KEY_NAME | Key owner name | Passbolt default user
120+
| PASSBOLT_KEY_EMAIL | Key owner email address | <passbolt@yourdomain.com>
121+
| PASSBOLT_KEY_EXPIRATION | Key expiration date | 0, never expires
122+
| PASSBOLT_GPG_SERVER_KEY_FINGERPRINT | GnuPG fingerprint | null
123+
| PASSBOLT_GPG_SERVER_KEY_FINGERPRINT_FORCE | Force calculation of GnuPG fingerprint for server key | null
124+
| PASSBOLT_GPG_SERVER_KEY_PUBLIC | Path to GnuPG public server key | /etc/passbolt/gpg/serverkey.asc
125+
| PASSBOLT_GPG_SERVER_KEY_PRIVATE | Path to GnuPG private server key | /etc/passbolt/gpg/serverkey_private.asc
126+
| PASSBOLT_PLUGINS_EXPORT_ENABLED | Enable export plugin | true
127+
| PASSBOLT_PLUGINS_IMPORT_ENABLED | Enable import plugin | true
128+
| PASSBOLT_REGISTRATION_PUBLIC | Defines if users can register | false
129+
| PASSBOLT_SSL_FORCE | Redirects http to https | false
130+
| PASSBOLT_SECURITY_SET_HEADERS | Send CSP Headers | true
131+
| SECURITY_SALT | CakePHP security salt | **SALT**
132+
| SUBSCRIPTION_KEY | The base64-encoded subscription key for Passbolt PRO | null
132133

133134
For more env variables supported please check [default.php](https://github.com/passbolt/passbolt_api/blob/master/config/default.php)
134135
and [app.default.php](https://github.com/passbolt/passbolt_api/blob/master/config/app.default.php)
135136

137+
### Subscription key precedence
138+
139+
On the PRO version, the subscription key can be provided as a file, using a
140+
[Docker bind mount](https://docs.docker.com/engine/storage/bind-mounts/),
141+
or using an environment variable named `SUBSCRIPTION_KEY`.
142+
143+
If both are provided at the same time, only the file will be read and the
144+
environment variable will be ignored.
145+
146+
> ⚠️ As this behavior may change in the future, we **strongly** advise to only
147+
use one method for providing the subscription key, either using the environment
148+
variable or the bind mount method, but not both at the same time.
149+
136150
### Configuration files
137151

138152
What if you already have a set of gpg keys and custom configuration files for passbolt?
139153
It it possible to mount the desired configuration files as volumes.
140154

141-
* /etc/passbolt/app.php
142-
* /etc/passbolt/passbolt.php
143-
* /etc/passbolt/gpg/serverkey.asc
144-
* /etc/passbolt/gpg/serverkey_private.asc
145-
* /usr/share/php/passbolt/webroot/img/public/images
155+
- /etc/passbolt/app.php
156+
- /etc/passbolt/passbolt.php
157+
- /etc/passbolt/gpg/serverkey.asc
158+
- /etc/passbolt/gpg/serverkey_private.asc
159+
- /usr/share/php/passbolt/webroot/img/public/images
146160

147161
### SSL certificate files
148162

149163
It is also possible to mount a ssl certificate on the following paths:
150164

151165
For **image: passbolt/passbolt:latest-ce-non-root**
152166

153-
* /etc/passbolt/certs/certificate.crt
154-
* /etc/passbolt/certs/certificate.key
167+
- /etc/passbolt/certs/certificate.crt
168+
- /etc/passbolt/certs/certificate.key
155169

156170
For **image: passbolt/passbolt:latest-ce**
157171

158-
* /etc/ssl/certs/certificate.crt
159-
* /etc/ssl/certs/certificate.key
172+
- /etc/ssl/certs/certificate.crt
173+
- /etc/ssl/certs/certificate.key
160174

161175
### Database SSL certificate files
162176

163177
If Database SSL certs provided, you must mount mysql/mariadb specific conf on the following paths:
164178

165-
* /etc/mysql/conf.d # if using mysql
166-
* /etc/mysql/mariadb.conf.d/ #if using mariadb
179+
- /etc/mysql/conf.d # if using mysql
180+
- /etc/mysql/mariadb.conf.d/ #if using mariadb
167181

168182
Example:
169183

@@ -195,7 +209,7 @@ bin/cake passbolt healthcheck
195209

196210
## Docker secrets support
197211

198-
As an alternative to passing sensitive information via environment variables, _FILE may be appended to the previously listed environment variables, causing the initialization script to load the values for those variables from files present in the container. In particular, this can be used to load passwords from Docker secrets stored in /run/secrets/<secret_name> files. For example:
212+
As an alternative to passing sensitive information via environment variables, \_FILE may be appended to the previously listed environment variables, causing the initialization script to load the values for those variables from files present in the container. In particular, this can be used to load passwords from Docker secrets stored in /run/secrets/\<secret_name> files. For example:
199213

200214
```
201215
docker run --name passsbolt -e DATASOURCES_DEFAULT_PASSWORD_FILE=/run/secrets/db-password -d passbolt/passbolt
@@ -211,10 +225,10 @@ docker run --name passsbolt -e PASSBOLT_SSL_SERVER_CERT_FILE=/run/secrets/ssl-ce
211225

212226
This feature is only supported for:
213227

214-
* PASSBOLT_SSL_SERVER_CERT_FILE that points to /etc/ssl/certs/certificate.crt
215-
* PASSBOLT_SSL_SERVER_KEY_FILE that points to /etc/ssl/certs/certificate.key
216-
* PASSBOLT_GPG_SERVER_KEY_PRIVATE_FILE that points to /etc/passbolt/gpg/serverkey_private.asc
217-
* PASSBOLT_GPG_SERVER_KEY_PUBLIC_FILE that points to /etc/passbolt/gpg/serverkey.asc
228+
- PASSBOLT_SSL_SERVER_CERT_FILE that points to /etc/ssl/certs/certificate.crt
229+
- PASSBOLT_SSL_SERVER_KEY_FILE that points to /etc/ssl/certs/certificate.key
230+
- PASSBOLT_GPG_SERVER_KEY_PRIVATE_FILE that points to /etc/passbolt/gpg/serverkey_private.asc
231+
- PASSBOLT_GPG_SERVER_KEY_PUBLIC_FILE that points to /etc/passbolt/gpg/serverkey.asc
218232

219233
## Develop on Passbolt
220234

‎docker-compose/docker-compose-pro.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ services:
1919
- db
2020
environment:
2121
APP_FULL_BASE_URL: https://passbolt.local
22+
#If you don't want to mount the subscription key, you can use the environment variable below instead
23+
#SUBSCRIPTION_KEY: ""
2224
DATASOURCES_DEFAULT_HOST: "db"
2325
DATASOURCES_DEFAULT_USERNAME: "passbolt"
2426
DATASOURCES_DEFAULT_PASSWORD: "P4ssb0lt"

‎scripts/entrypoint/passbolt/entrypoint-openshift.sh‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,6 @@ function gen_ssl_cert() {
3636
}
3737

3838
function get_subscription_file() {
39-
if [ "${PASSBOLT_FLAVOUR}" == 'ce' ]; then
40-
return 1
41-
fi
42-
4339
# Look for subscription key on possible paths
4440
for path in "${subscription_key_file_paths[@]}"; do
4541
if [ -f "${path}" ]; then
@@ -52,9 +48,19 @@ function get_subscription_file() {
5248
}
5349

5450
function import_subscription() {
51+
if [ "${PASSBOLT_FLAVOUR}" == 'ce' ]; then
52+
return
53+
fi
54+
5555
if get_subscription_file; then
56-
echo "Subscription file found: $SUBSCRIPTION_FILE"
57-
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "$SUBSCRIPTION_FILE"
56+
echo "Subscription file found: ${SUBSCRIPTION_FILE}"
57+
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "${SUBSCRIPTION_FILE}"
58+
elif [ -n "${SUBSCRIPTION_KEY}" ]; then
59+
echo "Using SUBSCRIPTION_KEY environment variable"
60+
echo "${SUBSCRIPTION_KEY}" > "${subscription_key_file_paths[0]}"
61+
chmod 640 ${subscription_key_file_paths[0]}
62+
echo "Subscription key file created at ${subscription_key_file_paths[0]}"
63+
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "${subscription_key_file_paths[0]}"
5864
fi
5965
}
6066

‎scripts/entrypoint/passbolt/entrypoint-rootless.sh‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,6 @@ function gen_ssl_cert() {
3636
}
3737

3838
function get_subscription_file() {
39-
if [ "${PASSBOLT_FLAVOUR}" == 'ce' ]; then
40-
return 1
41-
fi
42-
4339
# Look for subscription key on possible paths
4440
for path in "${subscription_key_file_paths[@]}"; do
4541
if [ -f "${path}" ]; then
@@ -52,9 +48,19 @@ function get_subscription_file() {
5248
}
5349

5450
function import_subscription() {
51+
if [ "${PASSBOLT_FLAVOUR}" == 'ce' ]; then
52+
return
53+
fi
54+
5555
if get_subscription_file; then
56-
echo "Subscription file found: $SUBSCRIPTION_FILE"
57-
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "$SUBSCRIPTION_FILE"
56+
echo "Subscription file found: ${SUBSCRIPTION_FILE}"
57+
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "${SUBSCRIPTION_FILE}"
58+
elif [ -n "${SUBSCRIPTION_KEY}" ]; then
59+
echo "Using SUBSCRIPTION_KEY environment variable"
60+
echo "${SUBSCRIPTION_KEY}" > "${subscription_key_file_paths[0]}"
61+
chmod 640 ${subscription_key_file_paths[0]}
62+
echo "Subscription key file created at ${subscription_key_file_paths[0]}"
63+
/usr/share/php/passbolt/bin/cake passbolt subscription_import --file "${subscription_key_file_paths[0]}"
5864
fi
5965
}
6066

@@ -96,7 +102,6 @@ function install() {
96102
fi
97103

98104
import_subscription || true
99-
100105
jwt_keys_creation
101106
install_command || migrate_command && echo "Enjoy! ☮"
102107
check_fullbase_url

0 commit comments

Comments
 (0)