DEV-1291(a): Change to httpd:2.4 base image

Dockerfile

@@ -1,16 +1,45 @@
-FROM registry.access.redhat.com/ubi8/httpd-24
+FROM httpd:2.4 AS cas-build
 
-USER root
-RUN yum -y update && \
-    yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
-    yum -y install \
-        xemacs-nox \
-        mod_auth_cas \
-        vim && \
-    install -d -o apache /var/cache/httpd/mod_auth_cas
+# Build against the official image's Apache, rather than a distro Apache package.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        autoconf automake gcc libtool make pkg-config curl \
+        libapr1-dev libaprutil1-dev libcurl4-openssl-dev libpcre2-dev libssl-dev && \
+    rm -rf /var/lib/apt/lists/*
 
-USER root
+WORKDIR /tmp/mod_auth_cas
+RUN curl -fsSL https://codeload.github.com/apereo/mod_auth_cas/tar.gz/refs/tags/v1.3 -o source.tar.gz && \
+    echo "7fed6c703ba060f4eb891a9c63a0d8cf0434249bd25d1faa6b8ea9075121c93e  source.tar.gz" | sha256sum -c - && \
+    tar -xzf source.tar.gz --strip-components=1 && \
+    autoreconf -fi && \
+    ./configure --with-apxs=/usr/local/apache2/bin/apxs && \
+    make -j"$(nproc)" && make install
+
+FROM httpd:2.4
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libcurl4t64 \
+        libpcre2-8-0 \
+        python3 && \
+    rm -rf /var/lib/apt/lists/* && \
+    install -d -o www-data -g www-data /var/cache/httpd/mod_auth_cas && \
+    mkdir -p /etc/httpd/conf.modules.d /var/www/html && \
+    sed -n '/^LoadModule /p' conf/httpd.conf > /etc/httpd/conf.modules.d/00-base.conf && \
+    printf '%s\n' \
+        'LoadModule negotiation_module modules/mod_negotiation.so' \
+        'LoadModule include_module modules/mod_include.so' \
+        'LoadModule remoteip_module modules/mod_remoteip.so' \
+        'LoadModule auth_cas_module modules/mod_auth_cas.so' \
+        > /etc/httpd/conf.modules.d/10-cas.conf
+
+COPY --from=cas-build /usr/local/apache2/modules/mod_auth_cas.so /usr/local/apache2/modules/
 COPY files/etc/httpd /etc/httpd
-COPY files/pre-init /usr/share/container-scripts/httpd/pre-init
+COPY files/pre-init /usr/local/bin/pre-init
+COPY --chmod=755 files/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 COPY files/var/www /var/www
-RUN rm -rf /etc/httpd/conf.d/welcome.conf
+RUN ln -sf /etc/httpd/conf/httpd.conf /usr/local/apache2/conf/httpd.conf
+
+EXPOSE 8080
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["httpd-foreground"]

README.md

@@ -1,12 +1,20 @@
 # Apache w/mod-auth-cas docker image
 
-A Red Hat 8 Universal Base Image running Apache with a few helpful extras:
+The official `httpd:2.4` image with a few helpful extras:
 
 1. mod_auth_cas, configurable at runtime by setting environment variables.
 2. A RemoteIP configuration suitable for running behind NGINX, Traefik, etc.
 3. Our branded auto-index pages.
+4. Python3 installed for writing RewriteMap programs (and other).
 
-Listens on 8080/tcp.
+Listens on 8080/tcp. Existing `/etc/httpd/conf.d/*.conf` configuration mounts
+and `/var/www/html` content mounts are supported.
+
+`mod_auth_cas` 1.3 is built from a checksum-verified upstream release against the
+base image's Apache in a separate build stage. The runtime runs Apache workers
+as `www-data` and initializes the existing `CAS_*` defaults through its entrypoint.
+Apache modules and bundled assets live under `/usr/local/apache2`; the CAS cookie
+cache remains at `/var/cache/httpd/mod_auth_cas/`.
 
 ## CAS Configuration
 

compose.yml

@@ -4,7 +4,7 @@ services:
   app:
     build: .
     ports:
-      - 80:8080
+      - 8080:8080
     volumes:
       - ./test/conf/cas-vhost.conf:/etc/httpd/conf.d/cas-vhost.conf:ro
       - ./test/data:/var/www/html:ro

files/docker-entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+# Source defaults so Apache can expand the CAS environment variables.
+. /usr/local/bin/pre-init/50-cas-variables.sh
+
+exec "$@"

files/etc/httpd/conf.d/autoindex.conf

@@ -18,10 +18,10 @@ IndexOptions Charset=utf-8 FancyIndexing HTMLTable IconsAreLinks IgnoreCase Name
 
 # We include the /icons/ alias for FancyIndexed directory listings.  If
 # you do not use FancyIndexing, you may comment this out.
-Alias /icons/ "/usr/share/httpd/icons/"
+Alias /icons/ "/usr/local/apache2/icons/"
 Alias /autoindex/ "/var/www/autoindex/"
 
-<Directory "/usr/share/httpd/icons">
+<Directory "/usr/local/apache2/icons">
   Options Indexes MultiViews FollowSymlinks
   AllowOverride None
   Require all granted

files/etc/httpd/conf/httpd.conf

@@ -31,7 +31,7 @@
 # same ServerRoot for multiple httpd daemons, you will need to change at
 # least PidFile.
 #
-ServerRoot "/etc/httpd"
+ServerRoot "/usr/local/apache2"
 
 #
 # Listen: Allows you to bind Apache to specific IP addresses and/or
@@ -56,7 +56,7 @@ Listen 0.0.0.0:8080
 # Example:
 # LoadModule foo_module modules/mod_foo.so
 #
-Include conf.modules.d/*.conf
+Include /etc/httpd/conf.modules.d/*.conf
 
 #
 # If you wish httpd to run as a different user or group, you must run
@@ -66,8 +66,8 @@ Include conf.modules.d/*.conf
 # It is usually good practice to create a dedicated user and group for
 # running httpd, as with most system services.
 #
-User apache
-Group apache
+User www-data
+Group www-data
 
 # 'Main' server configuration
 #
@@ -175,7 +175,7 @@ DocumentRoot "/var/www/html"
 # logged here.  If you *do* define an error logfile for a <VirtualHost>
 # container, that host's errors will be logged there and not here.
 #
-ErrorLog |/usr/bin/cat
+ErrorLog /proc/self/fd/2
 
 #
 # LogLevel: Control the number of messages logged to the error_log.
@@ -210,7 +210,7 @@ LogLevel warn
     # If you prefer a logfile with access, agent, and referer information
     # (Combined Logfile Format) you can use the following directive.
     #
-    CustomLog |/usr/bin/cat combined
+    CustomLog /proc/self/fd/1 combined
 </IfModule>
 
 <IfModule alias_module>
@@ -259,7 +259,7 @@ LogLevel warn
     # TypesConfig points to the file containing the list of mappings from
     # filename extension to MIME-type.
     #
-    TypesConfig /etc/mime.types
+    TypesConfig conf/mime.types
 
     #
     # AddType allows you to add to or override the MIME configuration
@@ -346,4 +346,4 @@ EnableSendfile on
 # Supplemental configuration
 #
 # Load config files in the "/etc/httpd/conf.d" directory, if any.
-IncludeOptional conf.d/*.conf
+IncludeOptional /etc/httpd/conf.d/*.conf

files/pre-init/50-cas-variables.sh

@@ -11,7 +11,7 @@ export CAS_DEBUG="${CAS_DEBUG:-off}"
 export CAS_IDLE_TIMEOUT="${CAS_IDLE_TIMEOUT:-3600}"
 export CAS_LOGIN_URL="${CAS_LOGIN_URL:-https://$CAS_DOMAIN/cas/}"
 export CAS_PROXY_VALIDATE_URL="${CAS_PROXY_VALIDATE_URL:-https://$CAS_DOMAIN/cas/proxyValidate}"
-export CAS_ROOT_PROXIED_AS="${CAS_ROOT_PROXIED_AS:-http://localhost}"
+export CAS_ROOT_PROXIED_AS="${CAS_ROOT_PROXIED_AS:-http://localhost:8080}"
 export CAS_TIMEOUT="${CAS_TIMEOUT:-7200}"
 export CAS_VALIDATE_URL="${CAS_VALIDATE_URL:-https://$CAS_DOMAIN/cas/serviceValidate}"
 export CAS_VERSION="${CAS_VERSION:-2}"

test/run_tests.sh

@@ -1,7 +1,9 @@
 #!/bin/bash
 
+app_url="localhost:8080"
+
 function test_public {
-  if curl -s localhost/public/ | grep -q 'The Regents of the University of California'; then
+  if curl -s "${app_url}/public/" | grep -q 'The Regents of the University of California'; then
     echo "PASS: /public/ serves custom dynamic index page"
   else
     echo "FAILED: /public/ serves custom dynamic index page"
@@ -10,7 +12,7 @@ function test_public {
 }
 
 function test_ucb {
-  if curl -sI localhost/UCB/ | grep -q 'Location: https://auth.berkeley.edu/cas/?service=http%3a%2f%2flocalhost%2fUCB%2f'; then
+  if curl -sI "${app_url}/UCB/" | grep -q "Location: https://auth.berkeley.edu/cas/"; then
     echo "PASS: /UCB/ redirects to auth.berkeley.edu"
   else
     echo "FAILED: /UCB/ redirects to auth.berkeley.edu"