prod

docker/gencerts/Dockerfile

@@ -1,28 +0,0 @@
-FROM openjdk:11-jre-stretch
-
-RUN  apt-get update && apt-get install -y openssl
-
-ENV KEYSTORE_PWD=
-ENV OPENSSL_SUBJ="/C=CH/ST=Zuerich/L=Zuerich"
-ENV OPENSSL_CA="${OPENSSL_SUBJ}/CN=demo-CA"
-
-VOLUME /certs
-WORKDIR /certs
-
-# This works on windows
-CMD openssl genrsa -out ca-key.pem 2048 \
-    && openssl req -new -x509 -key ca-key.pem -nodes -days 3600 -subj "${OPENSSL_CA}" -out ca.pem \
-    && openssl req -newkey rsa:2048 -days 3600 -nodes -config certs.cnf -keyout server-key.pem -out server-req.pem \
-    && openssl rsa -in server-key.pem -out server-key.pem \
-    && openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem \
-    && openssl req -newkey rsa:2048 -days 3600 -nodes -config certs.cnf -keyout client-key.pem -out client-req.pem \
-    && openssl rsa -in client-key.pem -out client-key.pem \
-    && openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem \
-    && openssl verify -CAfile ca.pem server-cert.pem client-cert.pem \
-    && openssl x509 -in ca.pem -inform pem -out ca.der -outform der \
-    && openssl pkcs12 -export -out client-cert.pkcs12 -in client-cert.pem -inkey client-key.pem -passout pass:"${KEYSTORE_PWD}" \
-    && keytool -importkeystore -destkeystore seb-server-keystore.pkcs12 -deststorepass "${KEYSTORE_PWD}" -srckeystore client-cert.pkcs12 -srcstoretype PKCS12 -srcstorepass "${KEYSTORE_PWD}" \
-    && keytool -import -file ca.pem -keystore seb-server-truststore.pkcs12 -storepass "${KEYSTORE_PWD}" -srcstoretype PKCS12 -noprompt
-
-# This doesn't work on windows!?
-#CMD /gencerts.sh

docker/gencerts/certs.cnf

@@ -1,23 +0,0 @@
-[req]
-distinguished_name = req_distinguished_name
-x509_extensions = v3_req
-prompt = no
-
-[req_distinguished_name]
-C = CH
-ST = Zuerich
-L = Zuerich
-O = ETH
-CN = localhost
-
-[v3_req]
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-basicConstraints = CA:TRUE
-subjectAltName = @alt_names
-
-[alt_names]
-DNS.1 = localhost
-DNS.2 = 127.0.0.1
-DNS.3 = seb-server-mariadb
-DNS.4 = seb-server

docker/mariadb/mariadb.cnf

@@ -1,9 +0,0 @@
-[mysqld]
-ssl-ca=/etc/mysql/certs/ca.pem
-ssl-cert=/etc/mysql/certs/server-cert.pem
-ssl-key=/etc/mysql/certs/server-key.pem
-
-[client]
-ssl-ca=/etc/mysql/certs/ca.pem
-ssl-cert=/etc/mysql/certs/client-cert.pem
-ssl-key=/etc/mysql/certs/client-key.pem

docker/prod/standalone/selfsigned/application-prod.properties

@@ -10,10 +10,10 @@ server.servlet.context-path=/
 
 security.require-ssl=true
 server.ssl.key-store-type=PKCS12
-server.ssl.key-store=C:/dev/workspaces/sebserver/seb-server/docker/prod/standalone/selfsigned/certs/seb-server-keystore.pkcs12
+server.ssl.key-store=/certs/seb-server-keystore.pkcs12
 server.ssl.key-store-password=${sebserver.certs.password}
 server.ssl.key-password=${sebserver.certs.password}
-server.ssl.trust-store=C:/dev/workspaces/sebserver/seb-server/docker/prod/standalone/selfsigned/certs/seb-server-truststore.pkcs12
+server.ssl.trust-store=/certs/seb-server-truststore.pkcs12
 server.ssl.trust-store-password=${sebserver.certs.password}
 server.ssl.enabled-protocols=TLSv1,TLSv1.1,TLSv1.2
 
@@ -21,12 +21,13 @@ server.ssl.enabled-protocols=TLSv1,TLSv1.1,TLSv1.2
 ### SEB Server Overall
 
 # Default logging level in the form  "logging.level" + namespace=LEVEL 
-logging.level.ch=DEBUG
+logging.level.ch=INFO
 logging.file=log/sebserver.log
 
 # If webservice or gui runs on ssl and this flag is true, an integrated redirect from http to https is activated
 # Disable this if a redirect is done by a pre-processing proxy
 sebserver.ssl.redirect.enabled=true
+sebserver.ssl.redirect.html.port=8080
 
 ##########################################################
 ### SEB Server Webservice configuration

docker/prod/standalone/selfsigned/certs.Dockerfile

@@ -2,26 +2,27 @@ FROM openjdk:11-jre-stretch
 
 RUN  apt-get update && apt-get install -y openssl
 
-ENV OPENSSL_SUBJ="/C=CH/ST=Zuerich/L=Zuerich"
+ENV OPENSSL_SUBJ="/C=CH/ST=Zurich/L=Zurich"
-ENV OPENSSL_CA="${OPENSSL_SUBJ}/CN=SEB_SEVER_CN"
+ENV OPENSSL_CA="${OPENSSL_SUBJ}/CN=demo-CA"
+ENV OPENSSL_SERVER="${OPENSSL_SUBJ}/CN=localhost"
+ENV OPENSSL_CLIENT="${OPENSSL_SUBJ}/CN=localhost"
+ENV ADDITIONAL_DNS="dns:localhost,dns:127.0.0.1,dns:seb-server"
+ENV KEYSTORE_PWD=
 
 VOLUME /certs
 WORKDIR /certs
 
-RUN export $(grep -v '^#' secrets | xargs)
-
 CMD openssl genrsa -out ca-key.pem 2048 \
     && openssl req -new -x509 -key ca-key.pem -nodes -days 3600 -subj "${OPENSSL_CA}" -out ca.pem \
-    && openssl req -newkey rsa:2048 -days 3600 -nodes -config certs.cnf -keyout server-key.pem -out server-req.pem \
+    && openssl req -newkey rsa:2048 -days 3600 -nodes -subj "${OPENSSL_SERVER}" -keyout server-key.pem -out server-req.pem \
     && openssl rsa -in server-key.pem -out server-key.pem \
     && openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem \
-    && openssl req -newkey rsa:2048 -days 3600 -nodes -config certs.cnf -keyout client-key.pem -out client-req.pem \
+    && openssl req -newkey rsa:2048 -days 3600 -nodes -subj "${OPENSSL_CLIENT}" -keyout client-key.pem -out client-req.pem \
     && openssl rsa -in client-key.pem -out client-key.pem \
     && openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem \
     && openssl verify -CAfile ca.pem server-cert.pem client-cert.pem \
-    && openssl x509 -in ca.pem -inform pem -out ca.der -outform der \
     && openssl pkcs12 -export -out client-cert.pkcs12 -in client-cert.pem -inkey client-key.pem -passout pass:"${KEYSTORE_PWD}" \
-    && keytool -genkeypair -alias sebserver -dname "CN=localhost, OU=ETHZ, O=ETHZ, L=Zuerich, S=Zuerich, C=CH" -keyalg RSA -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore seb-server-keystore.pkcs12 -storepass "${KEYSTORE_PWD}" -validity 3650 \
+    && keytool -genkeypair -alias sebserver -dname "CN=localhost, OU=ETHZ, O=ETHZ, L=Zurich, S=Zurich, C=CH" -ext san="${ADDITIONAL_DNS}" -keyalg RSA -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore seb-server-keystore.pkcs12 -storepass "${KEYSTORE_PWD}" -validity 3650 \
     && keytool -export -alias sebserver -keystore seb-server-keystore.pkcs12 -rfc -file sebserver.cert -storetype PKCS12 -storepass "${KEYSTORE_PWD}" -noprompt \
     && keytool -importcert -trustcacerts -alias sebserver -file sebserver.cert -keystore seb-server-truststore.pkcs12 -storetype PKCS12 -storepass "${KEYSTORE_PWD}" -noprompt \
     && keytool -import -alias mariadb-ca -file ca.pem -keystore seb-server-truststore.pkcs12 -storepass "${KEYSTORE_PWD}" -srcstoretype PKCS12 -noprompt \

docker/prod/standalone/selfsigned/certs.cnf

@@ -1,23 +0,0 @@
-[req]
-distinguished_name = req_distinguished_name
-x509_extensions = v3_req
-prompt = no
-
-[req_distinguished_name]
-C = CH
-ST = Zuerich
-L = Zuerich
-O = ETHZ
-CN = localhost
-
-[v3_req]
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid,issuer
-basicConstraints = CA:TRUE
-subjectAltName = @alt_names
-
-[alt_names]
-DNS.1 = localhost
-DNS.2 = 127.0.0.1
-DNS.3 = seb-server-mariadb
-DNS.4 = seb-server

docker/prod/standalone/selfsigned/docker-compose.yml

@@ -7,11 +7,8 @@ services:
     container_name: gencerts
     volumes:
         - ./certs:/certs
-        - ./certs.cnf:/certs/certs.cnf
+    env_file:
-        - ./secrets:/certs/secrets
+        - secrets
-    environment:
-        - SERVER_CN=seb-server-mariadb
-        - CLIENT_CN=seb-server-mariadb
   
   mariadb: 
     image: "mariadb/server:10.3"
@@ -37,11 +34,22 @@ services:
               - GIT_TAG=
               - SEBSERVER_VERSION=0.4.1-beta-SNAPSHOT
       container_name: seb-server
+      env_file:
+        - secrets
+      environment:
+        - ADDITIONAL_DNS=dns:127.0.0.1,dns:seb-server
       volumes:
-        - .:/config
+        - ./application-prod.properties:/sebserver/application-prod.properties
         - ./certs:/certs
+        - ./secrets:/sebserver/secrets
       ports:
           - 443:443
+          - 8080:80
+      logging:
+        driver: "json-file"
+        options:
+            max-size: "200k"
+            max-file: "10"
       networks:
           - seb-server-network
       depends_on:

docker/prod/standalone/selfsigned/sebserver.Dockerfile

@@ -21,19 +21,21 @@ FROM openjdk:11-jre-stretch
 
 ARG SEBSERVER_VERSION
 ENV SEBSERVER_VERSION=${SEBSERVER_VERSION}
+ENV KEYSTORE_PWD=
+ENV MYSQL_ROOT_PASSWORD=
+ENV SEBSERVER_PWD=
+ENV JAVA_NET_DEBUG="ssl:handshake"
 
 WORKDIR /sebserver
 COPY --from=1 /sebserver/target/seb-server-"$SEBSERVER_VERSION".jar /sebserver
 
-RUN export $(grep -v '^#' secrets | xargs)
-
 ENTRYPOINT exec java \
-        -Djavax.net.debug=SSL \
+        -Djavax.net.debug="${JAVA_NET_DEBUG}" \
         -jar seb-server-"${SEBSERVER_VERSION}".jar \
         --spring.profiles.active=prod \
-        --spring.config.location=file:/config/,classpath:/config/ \
+        --spring.config.location=file:/sebserver/,classpath:/config/ \
         --sebserver.certs.password="${KEYSTORE_PWD}" \ 
         --sebserver.mariadb.password="${MYSQL_ROOT_PASSWORD}" \
-        --sebserver.password="${SEBSERVER_PWD}" \
+        --sebserver.password="${SEBSERVER_PWD}"
 
-EXPOSE 443
+EXPOSE 443 8080

src/main/java/ch/ethz/seb/sebserver/SEBServer.java

@@ -92,9 +92,10 @@ public class SEBServer {
 
     private Connector redirectConnector(final Environment env) {
         final String sslPort = env.getRequiredProperty("server.port");
+        final String httpPort = env.getProperty("sebserver.ssl.redirect.html.port", "80");
         final Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
         connector.setScheme("http");
-        connector.setPort(80);
+        connector.setPort(Integer.valueOf(httpPort));
         connector.setSecure(false);
         connector.setRedirectPort(Integer.valueOf(sslPort));
         return connector;