Multiple nodes in Docker-compose about aldica

[AFaust]

Default Alfresco images' handling of CSRF is annoyingly trivial. One of many reasons I typically do not use Alfresco's images for anything other than community projects.

• For your sub-optimal solution you can also choose to include a share-config-custom-dev.xml file in the Docker image which only has to contain a CSRF config override with an effectively disabled state, and thus avoiding the override of all the other config.
• Using an empty value for origin / referer is not the same as effectively disabling CSRF. Without a configured value, there is an internal fallback using localhost / Tomcat server name for validation. In order to effectively disable CSRF guards, it would be best to set a wildcard pattern for the origin / referrer, e.g. https?://[^:/]+(:\d+)?/.*
• The nginx config is extremely simplistic and would cause issues with AOS-based WebDAV connections to the Alfresco Repository.
• The /etc/hosts entries are only relevant for the client access and do not have any impact on the Docker-internal routing.
• Access to load-balanced Share relies on session state. Either nginx must be set to use session-sticky routing or aldica-provided session replication must be enabled for the Share web application.

[andreaskring]

@AFaust Thanks for the feedback. A few comments to your bullets:

1. Good idea - I have implemented this.
2. I tried to do this with the CSRF environment variables discussed earlier, but with no success, so I will go with the solution in 1)
3. Browsing the URLs below /alfresco/aos is working fine, but we can tweek the LB if this is needed for more advanced use cases.
4. Yes, I agree. I find it convenient, however, to perform this configuration on my local host, since it makes is easier to "simulate" an environment with real DNS entries. E.g. I found that in some situations when working with Keycloak and Docker-compose everyone must agree on the names.
5. That makes sense - this was the missing peice. I will go for the low hanging fruits for now and have simply added this to the LB configuration. We can do some more sophisticated aldica/Share configurations later on.

I will make a PR with the changes soon.

[AFaust]

Concerning bullet no. 3: I am referring to the need to support forwarding an OPTIONS request on /, and requests for vti_bin/vti_inf to the Repository container.