From 2187c2367e0fb94696f97987d81b51f396cfc56d Mon Sep 17 00:00:00 2001 From: Daniel Schmidt Date: Mon, 12 Oct 2026 12:48:52 -0700 Subject: [PATCH] DEV-1291(a): Change to httpd:2.4 base image --- Dockerfile | 53 +++++++++++++++++++++------ README.md | 12 +++++- compose.yml | 2 +- files/docker-entrypoint.sh | 7 ++++ files/etc/httpd/conf.d/autoindex.conf | 4 +- files/etc/httpd/conf/httpd.conf | 16 ++++---- files/pre-init/50-cas-variables.sh | 2 +- test/run_tests.sh | 6 ++- 8 files changed, 74 insertions(+), 28 deletions(-) create mode 100644 files/docker-entrypoint.sh diff --git a/Dockerfile b/Dockerfile index 82ad800..c0181b6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,16 +1,45 @@ -FROM registry.access.redhat.com/ubi8/httpd-24 +FROM httpd:2.4 AS cas-build -USER root -RUN yum -y update && \ - yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \ - yum -y install \ - xemacs-nox \ - mod_auth_cas \ - vim && \ - install -d -o apache /var/cache/httpd/mod_auth_cas +# Build against the official image's Apache, rather than a distro Apache package. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake gcc libtool make pkg-config curl \ + libapr1-dev libaprutil1-dev libcurl4-openssl-dev libpcre2-dev libssl-dev && \ + rm -rf /var/lib/apt/lists/* -USER root +WORKDIR /tmp/mod_auth_cas +RUN curl -fsSL https://codeload.github.com/apereo/mod_auth_cas/tar.gz/refs/tags/v1.3 -o source.tar.gz && \ + echo "7fed6c703ba060f4eb891a9c63a0d8cf0434249bd25d1faa6b8ea9075121c93e source.tar.gz" | sha256sum -c - && \ + tar -xzf source.tar.gz --strip-components=1 && \ + autoreconf -fi && \ + ./configure --with-apxs=/usr/local/apache2/bin/apxs && \ + make -j"$(nproc)" && make install + +FROM httpd:2.4 + +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + ca-certificates \ + libcurl4t64 \ + libpcre2-8-0 \ + python3 && \ + rm -rf /var/lib/apt/lists/* && \ + install -d -o www-data -g www-data /var/cache/httpd/mod_auth_cas && \ + mkdir -p /etc/httpd/conf.modules.d /var/www/html && \ + sed -n '/^LoadModule /p' conf/httpd.conf > /etc/httpd/conf.modules.d/00-base.conf && \ + printf '%s\n' \ + 'LoadModule negotiation_module modules/mod_negotiation.so' \ + 'LoadModule include_module modules/mod_include.so' \ + 'LoadModule remoteip_module modules/mod_remoteip.so' \ + 'LoadModule auth_cas_module modules/mod_auth_cas.so' \ + > /etc/httpd/conf.modules.d/10-cas.conf + +COPY --from=cas-build /usr/local/apache2/modules/mod_auth_cas.so /usr/local/apache2/modules/ COPY files/etc/httpd /etc/httpd -COPY files/pre-init /usr/share/container-scripts/httpd/pre-init +COPY files/pre-init /usr/local/bin/pre-init +COPY --chmod=755 files/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh COPY files/var/www /var/www -RUN rm -rf /etc/httpd/conf.d/welcome.conf +RUN ln -sf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf + +EXPOSE 8080 +ENTRYPOINT ["docker-entrypoint.sh"] +CMD ["httpd-foreground"] diff --git a/README.md b/README.md index ed3fde9..5cbb4c6 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,20 @@ # Apache w/mod-auth-cas docker image -A Red Hat 8 Universal Base Image running Apache with a few helpful extras: +The official `httpd:2.4` image with a few helpful extras: 1. mod_auth_cas, configurable at runtime by setting environment variables. 2. A RemoteIP configuration suitable for running behind NGINX, Traefik, etc. 3. Our branded auto-index pages. +4. Python3 installed for writing RewriteMap programs (and other). -Listens on 8080/tcp. +Listens on 8080/tcp. Existing `/etc/httpd/conf.d/*.conf` configuration mounts +and `/var/www/html` content mounts are supported. + +`mod_auth_cas` 1.3 is built from a checksum-verified upstream release against the +base image's Apache in a separate build stage. The runtime runs Apache workers +as `www-data` and initializes the existing `CAS_*` defaults through its entrypoint. +Apache modules and bundled assets live under `/usr/local/apache2`; the CAS cookie +cache remains at `/var/cache/httpd/mod_auth_cas/`. ## CAS Configuration diff --git a/compose.yml b/compose.yml index 3232b65..c27d10f 100644 --- a/compose.yml +++ b/compose.yml @@ -4,7 +4,7 @@ services: app: build: . ports: - - 80:8080 + - 8080:8080 volumes: - ./test/conf/cas-vhost.conf:/etc/httpd/conf.d/cas-vhost.conf:ro - ./test/data:/var/www/html:ro diff --git a/files/docker-entrypoint.sh b/files/docker-entrypoint.sh new file mode 100644 index 0000000..7ff5680 --- /dev/null +++ b/files/docker-entrypoint.sh @@ -0,0 +1,7 @@ +#!/bin/sh +set -e + +# Source defaults so Apache can expand the CAS environment variables. +. /usr/local/bin/pre-init/50-cas-variables.sh + +exec "$@" diff --git a/files/etc/httpd/conf.d/autoindex.conf b/files/etc/httpd/conf.d/autoindex.conf index 89316be..bd48e3b 100644 --- a/files/etc/httpd/conf.d/autoindex.conf +++ b/files/etc/httpd/conf.d/autoindex.conf @@ -18,10 +18,10 @@ IndexOptions Charset=utf-8 FancyIndexing HTMLTable IconsAreLinks IgnoreCase Name # We include the /icons/ alias for FancyIndexed directory listings. If # you do not use FancyIndexing, you may comment this out. -Alias /icons/ "/usr/share/httpd/icons/" +Alias /icons/ "/usr/local/apache2/icons/" Alias /autoindex/ "/var/www/autoindex/" - + Options Indexes MultiViews FollowSymlinks AllowOverride None Require all granted diff --git a/files/etc/httpd/conf/httpd.conf b/files/etc/httpd/conf/httpd.conf index 614b884..9f9e288 100644 --- a/files/etc/httpd/conf/httpd.conf +++ b/files/etc/httpd/conf/httpd.conf @@ -31,7 +31,7 @@ # same ServerRoot for multiple httpd daemons, you will need to change at # least PidFile. # -ServerRoot "/etc/httpd" +ServerRoot "/usr/local/apache2" # # Listen: Allows you to bind Apache to specific IP addresses and/or @@ -56,7 +56,7 @@ Listen 0.0.0.0:8080 # Example: # LoadModule foo_module modules/mod_foo.so # -Include conf.modules.d/*.conf +Include /etc/httpd/conf.modules.d/*.conf # # If you wish httpd to run as a different user or group, you must run @@ -66,8 +66,8 @@ Include conf.modules.d/*.conf # It is usually good practice to create a dedicated user and group for # running httpd, as with most system services. # -User apache -Group apache +User www-data +Group www-data # 'Main' server configuration # @@ -175,7 +175,7 @@ DocumentRoot "/var/www/html" # logged here. If you *do* define an error logfile for a # container, that host's errors will be logged there and not here. # -ErrorLog |/usr/bin/cat +ErrorLog /proc/self/fd/2 # # LogLevel: Control the number of messages logged to the error_log. @@ -210,7 +210,7 @@ LogLevel warn # If you prefer a logfile with access, agent, and referer information # (Combined Logfile Format) you can use the following directive. # - CustomLog |/usr/bin/cat combined + CustomLog /proc/self/fd/1 combined @@ -259,7 +259,7 @@ LogLevel warn # TypesConfig points to the file containing the list of mappings from # filename extension to MIME-type. # - TypesConfig /etc/mime.types + TypesConfig conf/mime.types # # AddType allows you to add to or override the MIME configuration @@ -346,4 +346,4 @@ EnableSendfile on # Supplemental configuration # # Load config files in the "/etc/httpd/conf.d" directory, if any. -IncludeOptional conf.d/*.conf +IncludeOptional /etc/httpd/conf.d/*.conf diff --git a/files/pre-init/50-cas-variables.sh b/files/pre-init/50-cas-variables.sh index 15e7d9f..2770dec 100644 --- a/files/pre-init/50-cas-variables.sh +++ b/files/pre-init/50-cas-variables.sh @@ -11,7 +11,7 @@ export CAS_DEBUG="${CAS_DEBUG:-off}" export CAS_IDLE_TIMEOUT="${CAS_IDLE_TIMEOUT:-3600}" export CAS_LOGIN_URL="${CAS_LOGIN_URL:-https://$CAS_DOMAIN/cas/}" export CAS_PROXY_VALIDATE_URL="${CAS_PROXY_VALIDATE_URL:-https://$CAS_DOMAIN/cas/proxyValidate}" -export CAS_ROOT_PROXIED_AS="${CAS_ROOT_PROXIED_AS:-http://localhost}" +export CAS_ROOT_PROXIED_AS="${CAS_ROOT_PROXIED_AS:-http://localhost:8080}" export CAS_TIMEOUT="${CAS_TIMEOUT:-7200}" export CAS_VALIDATE_URL="${CAS_VALIDATE_URL:-https://$CAS_DOMAIN/cas/serviceValidate}" export CAS_VERSION="${CAS_VERSION:-2}" diff --git a/test/run_tests.sh b/test/run_tests.sh index 180c2f5..441bbb5 100755 --- a/test/run_tests.sh +++ b/test/run_tests.sh @@ -1,7 +1,9 @@ #!/bin/bash +app_url="localhost:8080" + function test_public { - if curl -s localhost/public/ | grep -q 'The Regents of the University of California'; then + if curl -s "${app_url}/public/" | grep -q 'The Regents of the University of California'; then echo "PASS: /public/ serves custom dynamic index page" else echo "FAILED: /public/ serves custom dynamic index page" @@ -10,7 +12,7 @@ function test_public { } function test_ucb { - if curl -sI localhost/UCB/ | grep -q 'Location: https://auth.berkeley.edu/cas/?service=http%3a%2f%2flocalhost%2fUCB%2f'; then + if curl -sI "${app_url}/UCB/" | grep -q "Location: https://auth.berkeley.edu/cas/"; then echo "PASS: /UCB/ redirects to auth.berkeley.edu" else echo "FAILED: /UCB/ redirects to auth.berkeley.edu"