Dockerfile 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269
  1. FROM ubuntu:disco
  2. LABEL maintainer="wekan"
  3. # Set the environment variables (defaults where required)
  4. # DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
  5. # ENV BUILD_DEPS="paxctl"
  6. ENV BUILD_DEPS="apt-utils bsdtar gnupg gosu wget curl bzip2 build-essential python3 python3-pip git ca-certificates gcc-8" \
  7. DEBUG=false \
  8. NODE_VERSION=v8.16.0 \
  9. METEOR_RELEASE=1.6.0.1 \
  10. USE_EDGE=false \
  11. METEOR_EDGE=1.5-beta.17 \
  12. NPM_VERSION=latest \
  13. FIBERS_VERSION=2.0.0 \
  14. ARCHITECTURE=linux-x64 \
  15. SRC_PATH=./ \
  16. WITH_API=true \
  17. ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 \
  18. ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 \
  19. ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 \
  20. ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 \
  21. ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 \
  22. ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 \
  23. EMAIL_NOTIFICATION_TIMEOUT=30000 \
  24. MATOMO_ADDRESS="" \
  25. MATOMO_SITE_ID="" \
  26. MATOMO_DO_NOT_TRACK=true \
  27. MATOMO_WITH_USERNAME=false \
  28. BROWSER_POLICY_ENABLED=true \
  29. TRUSTED_URL="" \
  30. WEBHOOKS_ATTRIBUTES="" \
  31. OAUTH2_ENABLED=false \
  32. OAUTH2_LOGIN_STYLE=redirect \
  33. OAUTH2_CLIENT_ID="" \
  34. OAUTH2_SECRET="" \
  35. OAUTH2_SERVER_URL="" \
  36. OAUTH2_AUTH_ENDPOINT="" \
  37. OAUTH2_USERINFO_ENDPOINT="" \
  38. OAUTH2_TOKEN_ENDPOINT="" \
  39. OAUTH2_ID_MAP="" \
  40. OAUTH2_USERNAME_MAP="" \
  41. OAUTH2_FULLNAME_MAP="" \
  42. OAUTH2_ID_TOKEN_WHITELIST_FIELDS="" \
  43. OAUTH2_REQUEST_PERMISSIONS='openid profile email' \
  44. OAUTH2_EMAIL_MAP="" \
  45. LDAP_ENABLE=false \
  46. LDAP_PORT=389 \
  47. LDAP_HOST="" \
  48. LDAP_BASEDN="" \
  49. LDAP_LOGIN_FALLBACK=false \
  50. LDAP_RECONNECT=true \
  51. LDAP_TIMEOUT=10000 \
  52. LDAP_IDLE_TIMEOUT=10000 \
  53. LDAP_CONNECT_TIMEOUT=10000 \
  54. LDAP_AUTHENTIFICATION=false \
  55. LDAP_AUTHENTIFICATION_USERDN="" \
  56. LDAP_AUTHENTIFICATION_PASSWORD="" \
  57. LDAP_LOG_ENABLED=false \
  58. LDAP_BACKGROUND_SYNC=false \
  59. LDAP_BACKGROUND_SYNC_INTERVAL=100 \
  60. LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false \
  61. LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false \
  62. LDAP_ENCRYPTION=false \
  63. LDAP_CA_CERT="" \
  64. LDAP_REJECT_UNAUTHORIZED=false \
  65. LDAP_USER_AUTHENTICATION=false \
  66. LDAP_USER_SEARCH_FILTER="" \
  67. LDAP_USER_SEARCH_SCOPE="" \
  68. LDAP_USER_SEARCH_FIELD="" \
  69. LDAP_SEARCH_PAGE_SIZE=0 \
  70. LDAP_SEARCH_SIZE_LIMIT=0 \
  71. LDAP_GROUP_FILTER_ENABLE=false \
  72. LDAP_GROUP_FILTER_OBJECTCLASS="" \
  73. LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE="" \
  74. LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE="" \
  75. LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT="" \
  76. LDAP_GROUP_FILTER_GROUP_NAME="" \
  77. LDAP_UNIQUE_IDENTIFIER_FIELD="" \
  78. LDAP_UTF8_NAMES_SLUGIFY=true \
  79. LDAP_USERNAME_FIELD="" \
  80. LDAP_FULLNAME_FIELD="" \
  81. LDAP_MERGE_EXISTING_USERS=false \
  82. LDAP_EMAIL_FIELD="" \
  83. LDAP_EMAIL_MATCH_ENABLE=false \
  84. LDAP_EMAIL_MATCH_REQUIRE=false \
  85. LDAP_EMAIL_MATCH_VERIFIED=false \
  86. LDAP_SYNC_USER_DATA=false \
  87. LDAP_SYNC_USER_DATA_FIELDMAP="" \
  88. LDAP_SYNC_GROUP_ROLES="" \
  89. LDAP_DEFAULT_DOMAIN="" \
  90. LDAP_SYNC_ADMIN_STATUS="" \
  91. LDAP_SYNC_ADMIN_GROUPS="" \
  92. HEADER_LOGIN_ID="" \
  93. HEADER_LOGIN_FIRSTNAME="" \
  94. HEADER_LOGIN_LASTNAME="" \
  95. HEADER_LOGIN_EMAIL="" \
  96. LOGOUT_WITH_TIMER=false \
  97. LOGOUT_IN="" \
  98. LOGOUT_ON_HOURS="" \
  99. LOGOUT_ON_MINUTES="" \
  100. CORS="" \
  101. CORS_ALLOW_HEADERS="" \
  102. CORS_EXPOSE_HEADERS="" \
  103. DEFAULT_AUTHENTICATION_METHOD=""
  104. # Copy the app to the image
  105. COPY ${SRC_PATH} /home/wekan/app
  106. RUN \
  107. set -o xtrace && \
  108. # Add non-root user wekan
  109. useradd --user-group --system --home-dir /home/wekan wekan && \
  110. \
  111. # OS dependencies
  112. apt-get update -y && apt-get install -y --no-install-recommends ${BUILD_DEPS} && \
  113. pip3 install -U pip setuptools wheel && \
  114. \
  115. # Meteor installer doesn't work with the default tar binary, so using bsdtar while installing.
  116. # https://github.com/coreos/bugs/issues/1095#issuecomment-350574389
  117. cp $(which tar) $(which tar)~ && \
  118. ln -sf $(which bsdtar) $(which tar) && \
  119. \
  120. # Download nodejs
  121. wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
  122. wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
  123. #---------------------------------------------------------------------------------------------
  124. # Node Fibers 100% CPU usage issue:
  125. # https://github.com/wekan/wekan-mongodb/issues/2#issuecomment-381453161
  126. # https://github.com/meteor/meteor/issues/9796#issuecomment-381676326
  127. # https://github.com/sandstorm-io/sandstorm/blob/0f1fec013fe7208ed0fd97eb88b31b77e3c61f42/shell/server/00-startup.js#L99-L129
  128. # Also see beginning of wekan/server/authentication.js
  129. # import Fiber from "fibers";
  130. # Fiber.poolSize = 1e9;
  131. # OLD: Download node version 8.12.0 prerelease that has fix included, => Official 8.12.0 has been released
  132. # Description at https://releases.wekan.team/node.txt
  133. #wget https://releases.wekan.team/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
  134. #echo "1ed54adb8497ad8967075a0b5d03dd5d0a502be43d4a4d84e5af489c613d7795 node-v8.12.0-linux-x64.tar.gz" >> SHASUMS256.txt.asc && \
  135. \
  136. # Verify nodejs authenticity
  137. grep ${NODE_VERSION}-${ARCHITECTURE}.tar.gz SHASUMS256.txt.asc | shasum -a 256 -c - && \
  138. #export GNUPGHOME="$(mktemp -d)" && \
  139. #\
  140. # Try other key servers if ha.pool.sks-keyservers.net is unreachable
  141. # Code from https://github.com/chorrell/docker-node/commit/2b673e17547c34f17f24553db02beefbac98d23c
  142. # gpg keys listed at https://github.com/nodejs/node#release-team
  143. # and keys listed here from previous version of this Dockerfile
  144. #for key in \
  145. #9554F04D7259F04124DE6B476D5A82AC7E37093B \
  146. #94AE36675C464D64BAFA68DD7434390BDBE9B9C5 \
  147. #FD3A5288F042B6850C66B31F09FE44734EB7990E \
  148. #71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 \
  149. #DD8F2338BAE7501E3DD5AC78C273792F7D83545D \
  150. #C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 \
  151. #B9AE9905FFD7803F25714661B63B535A4C206CA9 \
  152. #; do \
  153. #gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
  154. #gpg --keyserver pgp.mit.edu --recv-keys "$key" || \
  155. #gpg --keyserver keyserver.pgp.com --recv-keys "$key" ; \
  156. #done && \
  157. #gpg --verify SHASUMS256.txt.asc && \
  158. # Ignore socket files then delete files then delete directories
  159. #find "$GNUPGHOME" -type f | xargs rm -f && \
  160. #find "$GNUPGHOME" -type d | xargs rm -fR && \
  161. rm -f SHASUMS256.txt.asc && \
  162. \
  163. # Install Node
  164. tar xvzf node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
  165. rm node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
  166. mv node-${NODE_VERSION}-${ARCHITECTURE} /opt/nodejs && \
  167. ln -s /opt/nodejs/bin/node /usr/bin/node && \
  168. ln -s /opt/nodejs/bin/npm /usr/bin/npm && \
  169. \
  170. #DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
  171. #paxctl -mC `which node` && \
  172. \
  173. # Install Node dependencies
  174. npm install -g [email protected]${NPM_VERSION} && \
  175. npm install -g node-gyp && \
  176. npm install -g [email protected]${FIBERS_VERSION} && \
  177. \
  178. # Change user to wekan and install meteor
  179. cd /home/wekan/ && \
  180. chown wekan:wekan --recursive /home/wekan && \
  181. curl "https://install.meteor.com" -o /home/wekan/install_meteor.sh && \
  182. #curl "https://install.meteor.com/?release=${METEOR_RELEASE}" -o /home/wekan/install_meteor.sh && \
  183. # OLD: sed -i "s|RELEASE=.*|RELEASE=${METEOR_RELEASE}\"\"|g" ./install_meteor.sh && \
  184. # Install Meteor forcing its progress
  185. sed -i 's/VERBOSITY="--silent"/VERBOSITY="--progress-bar"/' ./install_meteor.sh && \
  186. echo "Starting meteor ${METEOR_RELEASE} installation... \n" && \
  187. chown wekan:wekan /home/wekan/install_meteor.sh && \
  188. \
  189. # Check if opting for a release candidate instead of major release
  190. if [ "$USE_EDGE" = false ]; then \
  191. gosu wekan:wekan sh /home/wekan/install_meteor.sh; \
  192. else \
  193. gosu wekan:wekan git clone --recursive --depth 1 -b release/[email protected]${METEOR_EDGE} git://github.com/meteor/meteor.git /home/wekan/.meteor; \
  194. fi; \
  195. \
  196. # Get additional packages
  197. #mkdir -p /home/wekan/app/packages && \
  198. #chown wekan:wekan --recursive /home/wekan && \
  199. # REPOS BELOW ARE INCLUDED TO WEKAN REPO
  200. #cd /home/wekan/app/packages && \
  201. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/flow-router.git kadira-flow-router && \
  202. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/meteor-useraccounts/core.git meteor-useraccounts-core && \
  203. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/meteor-accounts-cas.git && \
  204. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/wekan-ldap.git && \
  205. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/wekan-scrollbar.git && \
  206. #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/meteor-accounts-oidc.git && \
  207. #gosu wekan:wekan git clone --depth 1 -b master --recurse-submodules https://github.com/wekan/markdown.git && \
  208. #gosu wekan:wekan mv meteor-accounts-oidc/packages/switch_accounts-oidc wekan-accounts-oidc && \
  209. #gosu wekan:wekan mv meteor-accounts-oidc/packages/switch_oidc wekan-oidc && \
  210. #gosu wekan:wekan rm -rf meteor-accounts-oidc && \
  211. sed -i 's/api\.versionsFrom/\/\/api.versionsFrom/' /home/wekan/app/packages/meteor-useraccounts-core/package.js && \
  212. cd /home/wekan/.meteor && \
  213. gosu wekan:wekan /home/wekan/.meteor/meteor -- help; \
  214. \
  215. # extract the OpenAPI specification
  216. npm install -g [email protected] && \
  217. mkdir -p /home/wekan/python && \
  218. chown wekan:wekan --recursive /home/wekan/python && \
  219. cd /home/wekan/python && \
  220. gosu wekan:wekan git clone --depth 1 -b master https://github.com/Kronuz/esprima-python && \
  221. cd /home/wekan/python/esprima-python && \
  222. python3 setup.py install --record files.txt && \
  223. cd /home/wekan/app &&\
  224. gosu wekan:wekan mkdir -p ./public/api && \
  225. gosu wekan:wekan python3 ./openapi/generate_openapi.py --release $(git describe --tags --abbrev=0) > ./public/api/wekan.yml && \
  226. gosu wekan:wekan /opt/nodejs/bin/api2html -c ./public/logo-header.png -o ./public/api/wekan.html ./public/api/wekan.yml; \
  227. # Build app
  228. cd /home/wekan/app && \
  229. gosu wekan:wekan /home/wekan/.meteor/meteor add standard-minifier-js && \
  230. gosu wekan:wekan /home/wekan/.meteor/meteor npm install && \
  231. gosu wekan:wekan /home/wekan/.meteor/meteor build --directory /home/wekan/app_build && \
  232. cp /home/wekan/app/fix-download-unicode/cfs_access-point.txt /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
  233. rm /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/rajit_bootstrap3-datepicker/lib/bootstrap-datepicker/node_modules/phantomjs-prebuilt/lib/phantom/bin/phantomjs && \
  234. chown wekan:wekan /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
  235. #Removed binary version of bcrypt because of security vulnerability that is not fixed yet.
  236. #https://github.com/wekan/wekan/commit/4b2010213907c61b0e0482ab55abb06f6a668eac
  237. #https://github.com/wekan/wekan/commit/7eeabf14be3c63fae2226e561ef8a0c1390c8d3c
  238. #cd /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/npm-bcrypt && \
  239. #gosu wekan:wekan rm -rf node_modules/bcrypt && \
  240. #gosu wekan:wekan npm install bcrypt && \
  241. cd /home/wekan/app_build/bundle/programs/server/ && \
  242. gosu wekan:wekan npm install && \
  243. #gosu wekan:wekan npm install bcrypt && \
  244. mv /home/wekan/app_build/bundle /build && \
  245. \
  246. # Put back the original tar
  247. mv $(which tar)~ $(which tar) && \
  248. \
  249. # Cleanup
  250. apt-get remove --purge -y ${BUILD_DEPS} && \
  251. apt-get autoremove -y && \
  252. npm uninstall -g api2html &&\
  253. rm -R /var/lib/apt/lists/* && \
  254. rm -R /home/wekan/.meteor && \
  255. rm -R /home/wekan/app && \
  256. rm -R /home/wekan/app_build && \
  257. cat /home/wekan/python/esprima-python/files.txt | xargs rm -R && \
  258. rm -R /home/wekan/python && \
  259. rm /home/wekan/install_meteor.sh
  260. ENV PORT=8080
  261. EXPOSE $PORT
  262. USER wekan
  263. CMD ["node", "/build/main.js"]