risk-management/Dockerfile at master · Infopercept/risk-management · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# Dockerfile generated by script

# Using Ubuntu jammy image
FROM ubuntu:jammy

# Maintained by SimpleRisk
LABEL maintainer="Simplerisk <support@simplerisk.com>"

# Make necessary directories
RUN mkdir -p /configurations \
	     /etc/apache2/ssl \
	     /passwords \
	     /var/log/supervisor \
	     /var/lib/mysql \
	     /var/run/supervisor \
	     /var/www/simplerisk

# Installing apt dependencies
RUN dpkg-divert --local --rename /usr/bin/ischroot && \
    ln -sf /bin/true /usr/bin/ischroot && \
    apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get -y install apache2 \
                                                      php \
                                                      php-mysql \
                                                      php-json \
                                                      php-dev \
                                                      php-ldap \
                                                      php-mbstring \
                                                      php-curl \
                                                      php-zip \
                                                      php-gd \
                                                      php-intl \
                                                      mysql-client \
                                                      mysql-server \
                                                      nfs-common \
                                                      chrony \
                                                      cron \
                                                      python-setuptools \
                                                      vim-tiny \
                                                      sendmail \
                                                      openssl \
                                                      ufw \
                                                      git \
                                                      supervisor && \
    rm -rf /var/lib/apt/lists

# Create the OpenSSL password
RUN < /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c21 > /passwords/pass_openssl.txt

# Install and configure supervisor
COPY common/supervisord.conf /etc/supervisor/supervisord.conf

# Configure MySQL
RUN sed -i 's/\[mysqld\]/\[mysqld\]\nsql-mode="NO_ENGINE_SUBSTITUTION"/g' /etc/mysql/mysql.conf.d/mysqld.cnf

# Configure Apache
COPY common/foreground.sh /etc/apache2/foreground.sh
COPY common/envvars /etc/apache2/envvars
COPY common/000-default.conf /etc/apache2/sites-enabled/000-default.conf
COPY common/default-ssl.conf /etc/apache2/sites-enabled/default-ssl.conf
RUN sed -i 's/\(upload_max_filesize =\) .*\(M\)/\1 5\2/g' /etc/php/8.1/apache2/php.ini && \
	sed -i 's/\(memory_limit =\) .*\(M\)/\1 256\2/g' /etc/php/8.1/apache2/php.ini && \
	sed -i 's/;.*\(max_input_vars =\) .*/\1 3000/g' /etc/php/8.1/apache2/php.ini && \
	sed -i 's/;.*\(display_errors =\) .*/\1 Off/g' /etc/php/8.1/apache2/php.ini

# Create SSL Certificates for Apache SSL
RUN mkdir -p /etc/apache2/ssl/ssl.crt /etc/apache2/ssl/ssl.key && \
	openssl genrsa -des3 -passout pass:/passwords/pass_openssl.txt -out /etc/apache2/ssl/ssl.key/simplerisk.pass.key && \
	openssl rsa -passin pass:/passwords/pass_openssl.txt -in /etc/apache2/ssl/ssl.key/simplerisk.pass.key -out /etc/apache2/ssl/ssl.key/simplerisk.key && \
	rm /etc/apache2/ssl/ssl.key/simplerisk.pass.key && \
	openssl req -new -key /etc/apache2/ssl/ssl.key/simplerisk.key -out  /etc/apache2/ssl/ssl.crt/simplerisk.csr -subj "/CN=simplerisk" && \
	openssl x509 -req -days 365 -in /etc/apache2/ssl/ssl.crt/simplerisk.csr -signkey /etc/apache2/ssl/ssl.key/simplerisk.key -out /etc/apache2/ssl/ssl.crt/simplerisk.crt

# Activate Apache modules
RUN phpenmod ldap && \
	a2enmod rewrite && \
	a2enmod ssl && \
	a2enconf security && \
	sed -i 's/\(SSLProtocol\) all -SSLv3/\1 TLSv1.2/g' /etc/apache2/mods-enabled/ssl.conf && \
	sed -i 's/#\(SSLHonorCipherOrder on\)/\1/g' /etc/apache2/mods-enabled/ssl.conf && \
	sed -i 's/\(ServerTokens\) OS/\1 Prod/g' /etc/apache2/conf-enabled/security.conf && \
	sed -i 's/\(ServerSignature\) On/\1 Off/g' /etc/apache2/conf-enabled/security.conf

RUN echo %sudo  ALL=NOPASSWD: ALL >> /etc/sudoers && \
    echo "20231006-001" > /tmp/version

# Download SimpleRisk
RUN rm -rf /var/www/
RUN git clone https://github.com/Infopercept/risk-management.git /var/www/
COPY common/simplerisk.sql /simplerisk.sql

# Permissions
RUN chown -R www-data: /var/www/simplerisk

# Setting up cronjob
RUN echo "* * * * * /usr/bin/php -f /var/www/simplerisk/cron/cron.php > /dev/null 2>&1" >> /etc/cron.d/backup-cron && \
    chmod 0644 /etc/cron.d/backup-cron && \
    crontab /etc/cron.d/backup-cron

EXPOSE 80
EXPOSE 443

# Create the start script and set permissions
COPY common/entrypoint.sh /entrypoint.sh
RUN chmod 755 /entrypoint.sh /etc/apache2/foreground.sh

# Data to save
VOLUME [ "/passwords", "/configurations", "/var/log", "/var/lib/mysql", "/etc/apache2/ssl", "/var/www/simplerisk" ]

# # Setting up entrypoint
ENTRYPOINT [ "/entrypoint.sh" ]

HEALTHCHECK --interval=1m \
	CMD curl --fail http://localhost || exit 1

# Start Apache and MySQL
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]