flywithu/kopano-docker
1
0
Fork 0
mirror of https://github.com/zokradonh/kopano-docker.git synced 2026-08-23 22:32:52 +00:00
Code Issues Releases Wiki Activity

Run all containers read-only (#314)

Browse Source 
* switch containers in compose file to read-only
related to https://github.com/zokradonh/kopano-docker/issues/310
* make scheduler container read-only
* make meet container read-only
* fix konnect for read-only
* make core mostly read-only
* add custom location for ldap.cfg to default config
* sort config option for readability
* update makefile pull workaround
* make kdav read-only
* remove locale generation code from core startup
* fix commander tests
* fix store language tests
* add test for a dutch mailbox
* make it possible to run webapp read-only
* add locale hint to the compose file
* finish read-only mode for z-push
This commit is contained in:
Felix Bartels
2020-01-14 14:31:53 +01:00
committed by GitHub
parent 5a4335998d
commit 70e9940b38
26 changed files with 220 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/start-service.sh
+27 -41
View File
@@ -15,11 +15,17 @@ KCCONF_SEARCH_SERVER_SOCKET=${KCCONF_SEARCH_SERVER_SOCKET:-"file:///var/run/kopa
KCCONF_SPOOLER_SERVER_SOCKET=${KCCONF_SPOOLER_SERVER_SOCKET:-"file:///var/run/kopano/server.sock"}
KOPANO_CON=${KOPANO_CON:-"file:///var/run/kopano/server.sock"}
# copy configuration files to /tmp/kopano to prevent modification of mounted config files
mkdir -p /tmp/kopano
cp /etc/kopano/*.cfg /tmp/kopano
if [ ! -e /kopano/"$SERVICE_TO_START".py ]; then
echo "Invalid service specified: $SERVICE_TO_START" | ts
exit 1
fi
# Hint: this is not compatible with a read-only container.
# The general recommendation is to already build a container that has all required packages installed.
ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
@@ -31,8 +37,9 @@ ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
fi
done
mkdir -p /kopano/data/attachments /kopano/data/kapi-kvs /tmp/"$SERVICE_TO_START" /var/run/kopano /var/lib/kopano-grapi
mkdir -p /tmp/"$SERVICE_TO_START" /var/run/kopano
# TODO is this still required now that we won't modify configuration mounted to /etc/kopano?
if [ "${DISABLE_CONFIG_CHANGES}" == false ]; then
echo "Configure core service '$SERVICE_TO_START'" | ts
/usr/bin/python3 /kopano/"$SERVICE_TO_START".py
@@ -41,10 +48,6 @@ fi
# ensure removed pid-file on unclean shutdowns and mounted volumes
rm -f /var/run/kopano/"$SERVICE_TO_START".pid
echo "Set ownership" | ts
chown kopano:kopano /kopano/data/ /kopano/data/attachments
chown kapi:kopano /var/lib/kopano-grapi
coreversion=$(dpkg-query --showformat='${Version}' --show kopano-server)
echo "Using Kopano Groupware Core: $coreversion"
@@ -89,30 +92,10 @@ fi
# start regular service
case "$SERVICE_TO_START" in
server)
# TODO this could check if the desired locale already exists before calling sed
KCCONF_ADMIN_DEFAULT_STORE_LOCALE=${KCCONF_ADMIN_DEFAULT_STORE_LOCALE:-"en_US.UTF-8"}
# get locales from env
# shellcheck disable=SC1004
sed --regexp-extended --expression='
1 {
i\
# This file lists locales that you wish to have built. You can find a list\
# of valid supported locales at /usr/share/i18n/SUPPORTED, and you can add\
# user defined locales to /usr/local/share/i18n/SUPPORTED. If you change\
# this file, you need to rerun locale-gen.\
\
}
/^('"$KCCONF_ADMIN_DEFAULT_STORE_LOCALE"')(_[[:upper:]]+)?(\.UTF-8)?(@[^[:space:]]+)?[[:space:]]+UTF-8$/! s/^/# /
' /usr/share/i18n/SUPPORTED > /etc/locale.gen
# make sure that en_US and de_DE are always there
sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
sed -i -e 's/# de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen
dpkg-reconfigure --frontend=noninteractive locales
echo "Set ownership" | ts
mkdir -p /kopano/data/attachments
chown kopano:kopano /kopano/data/ /kopano/data/attachments
if [[ "$DISABLE_CHECKS" == false ]]; then
# determine db connection mode (unix vs. network socket)
if [ -n "$KCCONF_SERVER_MYSQL_SOCKET" ]; then
@@ -129,11 +112,11 @@ server)
fi
# pre populate database
if dpkg --compare-versions "$coreversion" "gt" "8.7.84"; then
kopano-dbadm populate
kopano-dbadm -c /tmp/kopano/server.cfg populate
fi
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-server -F
exec /usr/sbin/kopano-server --config /tmp/kopano/server.cfg -F
;;
dagent)
dockerize \
@@ -141,7 +124,7 @@ dagent)
-timeout 360s
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-dagent -l
exec /usr/sbin/kopano-dagent --config /tmp/kopano/dagent.cfg -l
;;
gateway)
dockerize \
@@ -149,7 +132,7 @@ gateway)
-timeout 360s
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-gateway -F
exec /usr/sbin/kopano-gateway --config /tmp/kopano/gateway.cfg -F
;;
ical)
dockerize \
@@ -157,13 +140,15 @@ ical)
-timeout 360s
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-ical -F
exec /usr/sbin/kopano-ical --config /tmp/kopano/ical.cfg -F
;;
grapi)
LC_CTYPE=en_US.UTF-8
export socket_path=/var/run/kopano/grapi
mkdir -p "$socket_path"
export pid_file="$socket_path/grapi.pid"
mkdir -p "$socket_path" /var/lib/kopano-grapi
chown -R kapi:kopano "$socket_path"
chown kapi:kopano /var/lib/kopano-grapi
# TODO there could be a case where multiple backends are desired
case $GRAPI_BACKEND in
ldap)
@@ -176,7 +161,7 @@ grapi)
fi
;;
esac
sed s/\ *=\ */=/g /etc/kopano/grapi.cfg > /tmp/grapi-env
sed s/\ *=\ */=/g /tmp/kopano/grapi.cfg > /tmp/grapi-env
# shellcheck disable=SC2046
export $(grep -v '^#' /tmp/grapi-env | xargs -d '\n')
# cleaning up env variables
@@ -191,6 +176,7 @@ grapi)
fi
;;
kapi)
mkdir -p /kopano/data/kapi-kvs
if [ "$KCCONF_KAPID_INSECURE" = "yes" ]; then
dockerize \
-skip-tls-verify \
@@ -206,7 +192,7 @@ kapi)
kapiversion=$(dpkg-query --showformat='${Version}' --show kopano-kapid)
echo "Using Kopano Kapi: $kapiversion"
LC_CTYPE=en_US.UTF-8
sed s/\ *=\ */=/g /etc/kopano/kapid.cfg > /tmp/kapid-env
sed s/\ *=\ */=/g /tmp/kopano/kapid.cfg > /tmp/kapid-env
# shellcheck disable=SC2046
export $(grep -v '^#' /tmp/kapid-env | xargs -d '\n')
kopano-kapid setup
@@ -220,7 +206,7 @@ monitor)
-timeout 360s
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-monitor -F
exec /usr/sbin/kopano-monitor --config /tmp/kopano/monitor.cfg -F
;;
search)
dockerize \
@@ -233,9 +219,9 @@ search)
# with commit 702bb3fccb3 search does not need -F any longer
searchversion=$(dpkg-query --showformat='${Version}' --show kopano-search)
if dpkg --compare-versions "$searchversion" "gt" "8.7.82.165"; then
exec /usr/sbin/kopano-search
exec /usr/sbin/kopano-search --config /tmp/kopano/search.cfg
else
exec /usr/bin/python3 /usr/sbin/kopano-search -F
exec /usr/bin/python3 /usr/sbin/kopano-search --config /tmp/kopano/search.cfg -F
fi
;;
spooler)
@@ -245,7 +231,7 @@ spooler)
-timeout 1080s
# cleaning up env variables
unset "${!KCCONF_@}"
exec /usr/sbin/kopano-spooler -F
exec /usr/sbin/kopano-spooler --config /tmp/kopano/spooler.cfg -F
;;
*)
echo "Failed to start: Unknown service name: '$SERVICE_TO_START'" | ts