From 894314934f00fde7c49679ed402138d3f8900f2d Mon Sep 17 00:00:00 2001
From: sn0wm1ku <po.ching.yu.alex@oz-design.jp>
Date: Thu, 1 Feb 2024 13:43:22 +0900
Subject: [PATCH 1/2] Setting-from-AWS Detect Host name from AWS also add SSL
 connection to  config

---
 Docker/aws-host-tunnel         |  4 ++--
 Docker/entrypoint.sh           | 19 +++++++++++++++++--
 phpmyadmin/config.user.inc.php | 11 +++++++++++
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 phpmyadmin/config.user.inc.php

diff --git a/Docker/aws-host-tunnel b/Docker/aws-host-tunnel
index 90e2560..a387bf9 100755
--- a/Docker/aws-host-tunnel
+++ b/Docker/aws-host-tunnel
@@ -11,7 +11,7 @@ else
     AWS_CMD=describe-db-clusters
 fi
 
-AWS_MYSQL_ENDPOINT=$(aws rds $AWS_CMD --query "DB${RDS_TYPE}s[*].Endpoint" --output json --profile $AWS_PROFILE)
+export AWS_RDS_ENDPOINT=$(aws rds $AWS_CMD --query "DB${RDS_TYPE}s[*].Endpoint" --output json --profile $AWS_PROFILE)
 BASTION_INSTANCE_ID=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=bastion" --query "Reservations[*].Instances[*].InstanceId" --output text --profile $AWS_PROFILE)
-SSM_PARAM=$(echo $AWS_MYSQL_ENDPOINT | jq '{"portNumber": [(.[] | .Port | tostring)], "localPortNumber": [(.[] | .Port | tostring)], "host": [(.[] | .Address)]}')
+SSM_PARAM=$(echo $AWS_RDS_ENDPOINT | jq '{"portNumber": [(.[] | .Port | tostring)], "localPortNumber": [(.[] | .Port | tostring)], "host": [(.[] | .Address)]}')
 aws ssm start-session --target $BASTION_INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters "$SSM_PARAM" --profile $AWS_PROFILE
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh
index ab57f47..c2523a6 100644
--- a/Docker/entrypoint.sh
+++ b/Docker/entrypoint.sh
@@ -1,5 +1,20 @@
 #!/bin/sh -eu
-/docker-entrypoint.sh php-fpm &
-nginx &
+nginx -g "daemon off;" &
 /workspace/aws-host-tunnel >>/proc/1/fd/2 &
+while [ -z "$AWS_RDS_ENDPOINT" ]; do
+  sleep 1
+done
+RDS_HOST=$(echo $AWS_RDS_ENDPOINT | jq "(.[] | .Address)" | tr -d '"')
+RDS_PORT=$(echo $AWS_RDS_ENDPOINT | jq "(.[] | .Port)")
+RDS_VERBOSE="$(echo $RDS_HOST | cut -d '.' -f 1)(RDS)"
+
+if [ -z "$PMA_HOSTS" ]; then
+  export PMA_HOST=$RDS_HOST
+  export PMA_PORT=$RDS_PORT
+else
+  export PMA_HOSTS=$PMA_HOSTS,$RDS_HOST
+  export PMA_VERBOSES=$PMA_VERBOSES,$RDS_VERBOSE
+  export PMA_PORTS=$PMA_PORT,$RDS_PORT
+fi
+/docker-entrypoint.sh php-fpm &
 wait
diff --git a/phpmyadmin/config.user.inc.php b/phpmyadmin/config.user.inc.php
new file mode 100644
index 0000000..fb65096
--- /dev/null
+++ b/phpmyadmin/config.user.inc.php
@@ -0,0 +1,11 @@
+<?php
+for ($i = 1; isset($hosts[$i - 1]); $i++) {
+  if (str_contains($cfg['Servers'][$i]['verbose'], 'RDS')) {
+    $cfg['Servers'][$i]['host'] = 'databasestack-databaseb269d8bb-dkzvt2k0aooy.cxvccxzmjv3c.ap-northeast-1.rds.amazonaws.com';
+    $cfg['Servers'][$i]['ssl'] = true;
+    // You need to have the region CA file and the authority CA file (2019 edition CA for example) in the PEM bundle for it to work
+    $cfg['Servers'][$i]['ssl_ca'] = '/etc/ssl/ap-northeast-1-bundle.pem';
+    // Enable SSL verification
+    $cfg['Servers'][$i]['ssl_verify'] = true;
+  }
+}

From bd09bc47b9bf663e7e038113c2fb970cbaaf9cd0 Mon Sep 17 00:00:00 2001
From: sn0wm1ku <po.ching.yu.alex@oz-design.jp>
Date: Mon, 4 Mar 2024 09:51:55 +0900
Subject: [PATCH 2/2] Enable SSL connection to RDS

Edit host files to add remote host name to 127.0.0.1
Add Php Config for localhost and Cert
---
 .env                           | 1 +
 Docker/aws-host-tunnel         | 2 +-
 Docker/entrypoint.sh           | 4 ++++
 phpmyadmin/config.user.inc.php | 4 ++--
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.env b/.env
index bf81fbf..0eddd87 100644
--- a/.env
+++ b/.env
@@ -3,6 +3,7 @@
 # RDS_TYPE    : RDS Type (Instance or Cluster)
 ############################################
 AWS_PROFILE=
+AWS_REGION=
 RDS_TYPE=
 PMA_HOSTS=
 PMA_VERBOSES=
diff --git a/Docker/aws-host-tunnel b/Docker/aws-host-tunnel
index a387bf9..85391c5 100755
--- a/Docker/aws-host-tunnel
+++ b/Docker/aws-host-tunnel
@@ -11,7 +11,7 @@ else
     AWS_CMD=describe-db-clusters
 fi
 
-export AWS_RDS_ENDPOINT=$(aws rds $AWS_CMD --query "DB${RDS_TYPE}s[*].Endpoint" --output json --profile $AWS_PROFILE)
+export AWS_RDS_ENDPOINT=$(aws rds $AWS_CMD --query "DB${RDS_TYPE}s[?DBInstanceStatus=='available'].Endpoint" --output json --profile $AWS_PROFILE)
 BASTION_INSTANCE_ID=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=bastion" --query "Reservations[*].Instances[*].InstanceId" --output text --profile $AWS_PROFILE)
 SSM_PARAM=$(echo $AWS_RDS_ENDPOINT | jq '{"portNumber": [(.[] | .Port | tostring)], "localPortNumber": [(.[] | .Port | tostring)], "host": [(.[] | .Address)]}')
 aws ssm start-session --target $BASTION_INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters "$SSM_PARAM" --profile $AWS_PROFILE
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh
index c2523a6..3379da1 100644
--- a/Docker/entrypoint.sh
+++ b/Docker/entrypoint.sh
@@ -17,4 +17,8 @@ else
   export PMA_PORTS=$PMA_PORT,$RDS_PORT
 fi
 /docker-entrypoint.sh php-fpm &
+echo -e "127.0.0.1\t$RDS_HOST" >>/etc/hosts
+if [ ! -f "/etc/ssl/$AWS_REGION-bundle.pem" ]; then
+  curl "https://truststore.pki.rds.amazonaws.com/$AWS_REGION/$AWS_REGION-bundle.pem" -o "/etc/ssl/$AWS_REGION-bundle.pem"
+fi
 wait
diff --git a/phpmyadmin/config.user.inc.php b/phpmyadmin/config.user.inc.php
index fb65096..456e2e2 100644
--- a/phpmyadmin/config.user.inc.php
+++ b/phpmyadmin/config.user.inc.php
@@ -1,10 +1,10 @@
 <?php
 for ($i = 1; isset($hosts[$i - 1]); $i++) {
+  $aws_region = getenv('AWS_REGION');
   if (str_contains($cfg['Servers'][$i]['verbose'], 'RDS')) {
-    $cfg['Servers'][$i]['host'] = 'databasestack-databaseb269d8bb-dkzvt2k0aooy.cxvccxzmjv3c.ap-northeast-1.rds.amazonaws.com';
     $cfg['Servers'][$i]['ssl'] = true;
     // You need to have the region CA file and the authority CA file (2019 edition CA for example) in the PEM bundle for it to work
-    $cfg['Servers'][$i]['ssl_ca'] = '/etc/ssl/ap-northeast-1-bundle.pem';
+    $cfg['Servers'][$i]['ssl_ca'] = "/etc/ssl/{$aws_region}-bundle.pem";
     // Enable SSL verification
     $cfg['Servers'][$i]['ssl_verify'] = true;
   }