Steven Foerster
5 years ago
5 changed files with 220 additions and 0 deletions
@ -0,0 +1,56 @@ |
|||||||
|
FROM alpine:3.10 |
||||||
|
|
||||||
|
# Some ENV variables |
||||||
|
ENV PATH="/mattermost/bin:${PATH}" |
||||||
|
ENV MM_VERSION=5.27.0 |
||||||
|
|
||||||
|
# Build argument to set Mattermost edition |
||||||
|
ARG edition=enterprise |
||||||
|
ARG PUID=2000 |
||||||
|
ARG PGID=2000 |
||||||
|
ARG MM_BINARY= |
||||||
|
|
||||||
|
|
||||||
|
# Install some needed packages |
||||||
|
RUN apk add --no-cache \ |
||||||
|
ca-certificates \ |
||||||
|
curl \ |
||||||
|
jq \ |
||||||
|
libc6-compat \ |
||||||
|
libffi-dev \ |
||||||
|
libcap \ |
||||||
|
linux-headers \ |
||||||
|
mailcap \ |
||||||
|
netcat-openbsd \ |
||||||
|
xmlsec-dev \ |
||||||
|
tzdata \ |
||||||
|
&& rm -rf /tmp/* |
||||||
|
|
||||||
|
# Get Mattermost |
||||||
|
RUN mkdir -p /mattermost/data /mattermost/plugins /mattermost/client/plugins \ |
||||||
|
&& if [ ! -z "$MM_BINARY" ]; then curl $MM_BINARY | tar -xvz ; \ |
||||||
|
elif [ "$edition" = "team" ] ; then curl https://releases.mattermost.com/$MM_VERSION/mattermost-team-$MM_VERSION-linux-amd64.tar.gz?src=docker-app | tar -xvz ; \ |
||||||
|
else curl https://releases.mattermost.com/$MM_VERSION/mattermost-$MM_VERSION-linux-amd64.tar.gz?src=docker-app | tar -xvz ; fi \ |
||||||
|
&& cp /mattermost/config/config.json /config.json.save \ |
||||||
|
&& rm -rf /mattermost/config/config.json \ |
||||||
|
&& addgroup -g ${PGID} mattermost \ |
||||||
|
&& adduser -D -u ${PUID} -G mattermost -h /mattermost -D mattermost \ |
||||||
|
&& chown -R mattermost:mattermost /mattermost /config.json.save /mattermost/plugins /mattermost/client/plugins \ |
||||||
|
&& setcap cap_net_bind_service=+ep /mattermost/bin/mattermost |
||||||
|
|
||||||
|
USER mattermost |
||||||
|
|
||||||
|
#Healthcheck to make sure container is ready |
||||||
|
HEALTHCHECK CMD curl --fail http://localhost:8000 || exit 1 |
||||||
|
|
||||||
|
# Configure entrypoint and command |
||||||
|
COPY entrypoint.sh / |
||||||
|
ENTRYPOINT ["/entrypoint.sh"] |
||||||
|
WORKDIR /mattermost |
||||||
|
CMD ["mattermost"] |
||||||
|
|
||||||
|
# Expose port 8000 of the container |
||||||
|
EXPOSE 8000 |
||||||
|
|
||||||
|
# Declare volumes for mount point directories |
||||||
|
VOLUME ["/mattermost/data", "/mattermost/logs", "/mattermost/config", "/mattermost/plugins", "/mattermost/client/plugins"] |
||||||
@ -0,0 +1,74 @@ |
|||||||
|
#!/bin/sh |
||||||
|
|
||||||
|
# Function to generate a random salt |
||||||
|
generate_salt() { |
||||||
|
tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 48 | head -n 1 |
||||||
|
} |
||||||
|
|
||||||
|
# Read environment variables or set default values |
||||||
|
DB_HOST=${DB_HOST:-db} |
||||||
|
DB_PORT_NUMBER=${DB_PORT_NUMBER:-5432} |
||||||
|
MM_DBNAME=${MM_DBNAME:-mattermost} |
||||||
|
MM_CONFIG=${MM_CONFIG:-/mattermost/config/config.json} |
||||||
|
|
||||||
|
if [ "${1:0:1}" = '-' ]; then |
||||||
|
set -- mattermost "$@" |
||||||
|
fi |
||||||
|
|
||||||
|
if [ "$1" = 'mattermost' ]; then |
||||||
|
# Check CLI args for a -config option |
||||||
|
for ARG in $@; |
||||||
|
do |
||||||
|
case "$ARG" in |
||||||
|
-config=*) |
||||||
|
MM_CONFIG=${ARG#*=};; |
||||||
|
esac |
||||||
|
done |
||||||
|
|
||||||
|
if [ ! -f "$MM_CONFIG" ]; then |
||||||
|
# If there is no configuration file, create it with some default values |
||||||
|
echo "No configuration file" $MM_CONFIG |
||||||
|
echo "Creating a new one" |
||||||
|
# Copy default configuration file |
||||||
|
cp /config.json.save "$MM_CONFIG" |
||||||
|
# Substitute some parameters with jq |
||||||
|
jq '.ServiceSettings.ListenAddress = ":8000"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.LogSettings.EnableConsole = true' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.LogSettings.ConsoleLevel = "ERROR"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.FileSettings.Directory = "/mattermost/data/"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.FileSettings.EnablePublicLink = true' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.FileSettings.PublicLinkSalt = "'$(generate_salt)'"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.SendEmailNotifications = false' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.FeedbackEmail = ""' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.SMTPServer = ""' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.SMTPPort = ""' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.InviteSalt = "'$(generate_salt)'"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.EmailSettings.PasswordResetSalt = "'$(generate_salt)'"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.RateLimitSettings.Enable = true' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.SqlSettings.DriverName = "postgres"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.SqlSettings.AtRestEncryptKey = "'$(generate_salt)'"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
jq '.PluginSettings.Directory = "/mattermost/plugins/"' $MM_CONFIG > $MM_CONFIG.tmp && mv $MM_CONFIG.tmp $MM_CONFIG |
||||||
|
else |
||||||
|
echo "Using existing config file $MM_CONFIG" |
||||||
|
fi |
||||||
|
|
||||||
|
# Configure database access |
||||||
|
if [[ -z "$MM_SQLSETTINGS_DATASOURCE" && ! -z "$MM_USERNAME" && ! -z "$MM_PASSWORD" ]] |
||||||
|
then |
||||||
|
echo -ne "Configure database connection..." |
||||||
|
# URLEncode the password, allowing for special characters |
||||||
|
ENCODED_PASSWORD=$(printf %s $MM_PASSWORD | jq -s -R -r @uri) |
||||||
|
export MM_SQLSETTINGS_DATASOURCE="postgres://$MM_USERNAME:$ENCODED_PASSWORD@$DB_HOST:$DB_PORT_NUMBER/$MM_DBNAME?sslmode=disable&connect_timeout=10" |
||||||
|
echo "OK" |
||||||
|
else |
||||||
|
echo "Using existing database connection" |
||||||
|
fi |
||||||
|
|
||||||
|
# Wait another second for the database to be properly started. |
||||||
|
# Necessary to avoid "panic: Failed to open sql connection pq: the database system is starting up" |
||||||
|
sleep 1 |
||||||
|
|
||||||
|
echo "Starting mattermost" |
||||||
|
fi |
||||||
|
|
||||||
|
exec "$@" |
||||||
@ -0,0 +1,79 @@ |
|||||||
|
version: "3" |
||||||
|
|
||||||
|
services: |
||||||
|
|
||||||
|
db: |
||||||
|
build: db |
||||||
|
read_only: true |
||||||
|
restart: unless-stopped |
||||||
|
volumes: |
||||||
|
- ../../mistborn_volumes/extra/mattermost/db/var/lib/postgresql/data:/var/lib/postgresql/data |
||||||
|
- /etc/localtime:/etc/localtime:ro |
||||||
|
env_file: |
||||||
|
- ../.envs/.production/.mattermost |
||||||
|
#environment: |
||||||
|
# - POSTGRES_USER=mmuser |
||||||
|
# - POSTGRES_PASSWORD=mmuser_password |
||||||
|
# - POSTGRES_DB=mattermost |
||||||
|
# uncomment the following to enable backup |
||||||
|
# - AWS_ACCESS_KEY_ID=XXXX |
||||||
|
# - AWS_SECRET_ACCESS_KEY=XXXX |
||||||
|
# - WALE_S3_PREFIX=s3://BUCKET_NAME/PATH |
||||||
|
# - AWS_REGION=us-east-1 |
||||||
|
|
||||||
|
app: |
||||||
|
build: |
||||||
|
context: compose/production/mattermost #app |
||||||
|
# uncomment following lines for team edition or change UID/GID |
||||||
|
args: |
||||||
|
- edition=team |
||||||
|
- PUID=1000 |
||||||
|
- PGID=1000 |
||||||
|
restart: unless-stopped |
||||||
|
volumes: |
||||||
|
- ../../mistborn_volumes/extra/mattermost/app/mattermost/config:/mattermost/config:rw |
||||||
|
- ../../mistborn_volumes/extra/mattermost/app/mattermost/data:/mattermost/data:rw |
||||||
|
- ../../mistborn_volumes/extra/mattermost/app/mattermost/logs:/mattermost/logs:rw |
||||||
|
- ../../mistborn_volumes/extra/mattermost/app/mattermost/plugins:/mattermost/plugins:rw |
||||||
|
- ../../mistborn_volumes/extra/mattermost/app/mattermost/client-plugins:/mattermost/client/plugins:rw |
||||||
|
- /etc/localtime:/etc/localtime:ro |
||||||
|
# When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine |
||||||
|
# to avoid Token request failed: certificate signed by unknown authority (link: https://github.com/mattermost/mattermost-server/issues/13059) |
||||||
|
# - <path_to_your_gitlab_pki>/pki_chain.pem:/etc/ssl/certs/pki_chain.pem:ro |
||||||
|
env_file: |
||||||
|
- ../.envs/.production/.mattermost |
||||||
|
environment: |
||||||
|
# set same as db credentials and dbname |
||||||
|
#- MM_USERNAME=mmuser |
||||||
|
#- MM_PASSWORD=mmuser_password |
||||||
|
#- MM_DBNAME=mattermost |
||||||
|
|
||||||
|
# use the credentials you've set above, in the format: |
||||||
|
# MM_SQLSETTINGS_DATASOURCE=postgres://${MM_USERNAME}:${MM_PASSWORD}@db:5432/${MM_DBNAME}?sslmode=disable&connect_timeout=10 |
||||||
|
#- MM_SQLSETTINGS_DATASOURCE=postgres://mmuser:mmuser_password@db:5432/mattermost?sslmode=disable&connect_timeout=10 |
||||||
|
- MM_SQLSETTINGS_DATASOURCE=postgres://${MM_USERNAME}:${MM_PASSWORD}@db:5432/${MM_DBNAME}?sslmode=disable&connect_timeout=10 |
||||||
|
|
||||||
|
# in case your config is not in default location |
||||||
|
#- MM_CONFIG=/mattermost/config/config.json |
||||||
|
|
||||||
|
web: |
||||||
|
build: web |
||||||
|
#ports: |
||||||
|
# - "80:80" |
||||||
|
# - "443:443" |
||||||
|
labels: |
||||||
|
- "traefik.enable=true" |
||||||
|
- "traefik.http.routers.mattermost-http.rule=Host(`mattermost.mistborn`)" |
||||||
|
- "traefik.http.routers.mattermost-http.entrypoints=web" |
||||||
|
- "traefik.http.routers.mattermost-http.middlewares=mistborn_auth@file" |
||||||
|
- "traefik.http.routers.mattermost-https.rule=Host(`mattermost.mistborn`)" |
||||||
|
- "traefik.http.routers.mattermost-https.entrypoints=websecure" |
||||||
|
- "traefik.http.routers.mattermost-https.middlewares=mistborn_auth@file" |
||||||
|
- "traefik.http.routers.mattermost-https.tls.certresolver=basic" |
||||||
|
- "traefik.http.services.mattermost-service.loadbalancer.server.port=80" |
||||||
|
read_only: true |
||||||
|
restart: unless-stopped |
||||||
|
volumes: |
||||||
|
# This directory must have cert files if you want to enable SSL |
||||||
|
#- ./volumes/web/cert:/cert:ro |
||||||
|
- /etc/localtime:/etc/localtime:ro |
||||||
Loading…
Reference in new issue