Run all containers read-only (#314)

* switch containers in compose file to read-only
related to https://github.com/zokradonh/kopano-docker/issues/310
* make scheduler container read-only
* make meet container read-only
* fix konnect for read-only
* make core mostly read-only
* add custom location for ldap.cfg to default config
* sort config option for readability
* update makefile pull workaround
* make kdav read-only
* remove locale generation code from core startup
* fix commander tests
* fix store language tests
* add test for a dutch mailbox
* make it possible to run webapp read-only
* add locale hint to the compose file
* finish read-only mode for z-push

meet/Dockerfile

@@ -49,8 +49,10 @@ RUN \
         kopano-meet kopano-meet-webapp \
         ${ADDITIONAL_KOPANO_PACKAGES} \
         && \
-    cp /usr/share/doc/kopano-meet-webapp/config.json.in /usr/share/kopano-kweb/www/config/kopano/meet.json && \
-    rm -rf /var/cache/apt /var/lib/apt/lists
+    rm -rf /var/cache/apt /var/lib/apt/lists && \
+    # make configuration a symlink to prevent overwriting it
+    # TODO better would be to override its configuration in kweb.cfg
+    ln -s /tmp/meet.json /usr/share/kopano-kweb/www/config/kopano/meet.json
 
 COPY defaultconfigs/ start-service.sh /kopano/
 COPY goss.yaml /goss/

meet/defaultconfigs/meet.py

@@ -2,4 +2,4 @@ import os
 import kcconf
 
 # Override configs from environment variables
-kcconf.configkopano(kcconf.parseenvironmentvariables(r"/etc/kopano/"))
+kcconf.configkopano(kcconf.parseenvironmentvariables(r"/tmp/kopano/"))

meet/start-service.sh

@@ -5,11 +5,16 @@ ADDITIONAL_KOPANO_PACKAGES=${ADDITIONAL_KOPANO_PACKAGES:-""}
 set -eu # unset variables are errors & non-zero return values exit the whole script
 [ "$DEBUG" ] && set -x
 
+# copy configuration files to /tmp/kopano to prevent modification of mounted config files
+mkdir -p /tmp/kopano
+cp /etc/kopano/*.cfg /tmp/kopano
+
 if [ ! -e /kopano/"$SERVICE_TO_START".py ]; then
 	echo "Invalid service specified: $SERVICE_TO_START" | ts
 	exit 1
 fi
 
+# TODO how to best move this to /tmp? 
 echo "Configure service '$SERVICE_TO_START'" | ts
 /usr/bin/python3 /kopano/"$SERVICE_TO_START".py
 
@@ -22,7 +27,8 @@ if [ $# -gt 0 ]; then
 	exit
 fi
 
-CONFIG_JSON="/usr/share/kopano-kweb/www/config/kopano/meet.json"
+cp /usr/share/doc/kopano-meet-webapp/config.json.in /tmp/meet.json
+CONFIG_JSON="/tmp/meet.json"
 echo "Updating $CONFIG_JSON"
 for setting in $(compgen -A variable KCCONF_MEET); do
 	setting2=${setting#KCCONF_MEET_}
@@ -54,11 +60,12 @@ if [ "${GRID_WEBAPP:-yes}" = "yes" ]; then
 	jq '.apps.enabled += ["kopano-webapp"]' $CONFIG_JSON | sponge $CONFIG_JSON
 fi
 
-sed -i s/\ *=\ */=/g /etc/kopano/kwebd.cfg
+# todo do not replace here, but in a temp location
+sed s/\ *=\ */=/g /tmp/kopano/kwebd.cfg > /tmp/kweb-env
 # always disable tls
 export tls=no
 # shellcheck disable=SC2046
-export $(grep -v '^#' /etc/kopano/kwebd.cfg | xargs -d '\n')
+export $(grep -v '^#' /tmp/kweb-env | xargs -d '\n')
 
 # services need to be aware of the machine-id
 dockerize \