Docker compose environment definition for forwardHeadersEnabled about scm-manager

[zT-1337]

I tested it with the SCM-Manager 3.1.0. Configuration provided as environment variables override the configuration provided by the config.yml. But they do not change the values inside the config.yml.

The values inside the config.yml is not supposed to be changed, by environment variables. But you can override the behavior, configured by the config.yml, by using the environment variables.

[pfeuffer]

This sounds like a reasonable request. We will check this. Thanks for the suggestion!

[zT-1337]

Hello @mfide,

this is already possible by using this snippet inside your docker-compose.yaml File

environment:
  - SCM_FORWARD_HEADERS_ENABLED=true

[mfide]

Hello @mfide,

this is already possible by using this snippet inside your docker-compose.yaml File

environment:
  - SCM_FORWARD_HEADERS_ENABLED=true

Did you test that?
For me it is always ignored and config.yml produced in /etc/scm looks like following:

..
## Evaluates headers set by a reverse proxy like X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host
forwardHeadersEnabled: false
..

[zT-1337]

I tested it with the SCM-Manager 3.1.0.
Configuration provided as environment variables override the configuration provided by the config.yml.
But they do not change the values inside the config.yml.

Here is the complete docker-compose.yaml.

version: '3'

services:
  scm:
    image: scmmanager/scm-manager:3.1.0
    ports:
      - 8080:8080
    volumes:
      - scm-volume:/var/lib/scm
    environment:
      - SCM_FORWARD_HEADERS_ENABLED=true
  proxy:
    image: nginx
    #nginx config files and certificates
    volumes:
      - type: bind
        source: ./nginx.conf
        target: /etc/nginx/conf.d/default.conf
        read_only: true
      - type: bind
        source: ./nginx.crt
        target: /etc/nginx/ssl/nginx.crt
        read_only: true
      - type: bind
        source: ./nginx.key
        target: /etc/nginx/ssl/nginx.key
        read_only: true
    ports:
      - 443:443
    depends_on:
      - scm

volumes:
  scm-volume:
    name: scm-home

And here is the used nginx.conf:

server {
  listen 443 ssl default_server;
  listen [::]:443 ssl default_server;

  ssl_certificate /etc/nginx/ssl/nginx.crt;
  ssl_certificate_key /etc/nginx/ssl/nginx.key;

  location / {
	  proxy_pass http://scm:8080;
          proxy_set_header X-Real-IP         $remote_addr;
	  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
	  proxy_set_header X-Forwarded-Proto $scheme;
	  proxy_set_header Host $http_host;
  }
}

[mfide]

Hi @zT-1337,

I have created a new instance using following docker-compose.yml in my test folder:

Docker version:

docker --version
Docker version 26.1.0, build 9714adc

docker-compose.yml:

version: '3'

services:
  scm:
    image: scmmanager/scm-manager:3.1.0
    environment:
      - SCM_FORWARD_HEADERS_ENABLED=true

Running the container:

mf@myserver:~/test$ docker compose up -d
WARN[0000] /home/mf/test/docker-compose.yml: `version` is obsolete
[+] Running 1/1
 ✔ scm Pulled                                                                                                                                                                                                                       0.6s
[+] Running 2/2
 ✔ Network test_default  Created                                                                                                                                                                                                    0.1s
 ✔ Container test-scm-1  Started  

Check status:

mf@myserver:~/test$ docker compose ps
WARN[0000] /home/mf/test/docker-compose.yml: `version` is obsolete
NAME         IMAGE                          COMMAND                  SERVICE   CREATED          STATUS                    PORTS
test-scm-1   scmmanager/scm-manager:3.1.0   "/opt/scm-server/bin…"   scm       38 seconds ago   Up 37 seconds (healthy)   8080/tcp

Attach to container's bash:

mf@myserver:~/test$ docker exec -it test-scm-1 /bin/sh
/opt/scm-server $
/opt/scm-server $ cd /etc/scm/
/etc/scm $
/etc/scm $

Print config.yml produced:

etc/scm $ cat config.yml
# base server config
##  Address to listen 0.0.0.0 means on every interface
addressBinding: 0.0.0.0
port: 8080
contextPath: /scm

## Evaluates headers set by a reverse proxy like X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host
forwardHeadersEnabled: false         <----------------------------- here it is still false

## increase http header size for mercurial
httpHeaderSize: 16384

## set http idle timeout (set to 0 for default)
idleTimeout: 0

# ssl config - ssl is only evaluated if key store path is set
## path to your cert file
https:
  keyStorePath: ""
  keyStorePassword: secret
  keyStoreType: PKCS12
  sslPort: 8443
  redirectHttpToHttps: false

tempDir: /var/cache/scm/work

# logging
log:
  rootLevel: WARN
  enableFileAppender: false
  enableConsoleAppender: true
  logger:
    sonia.scm: INFO
    com.cloudogu.scm: INFO

# webapp config
webapp:
  ## Sets explicit working directory for internal processes, empty means default java temp dir
  workDir:
  ## Home directory "scm-home" which is also set for classpath
  homeDir: /var/lib/scm
  cache:
    dataFile:
      enabled: true
    store:
      enabled: true
  ## Warning: Enabling this option can lead to security issue.
  endlessJwt: false
  ## Number of async threads
  asyncThreads: 4
  ## Max seconds to abort async execution
  maxAsyncAbortSeconds: 60
  ## Amount of central work queue workers
  centralWorkQueue:
    workers: 4
  ## Strategy for the working copy pool implementation [sonia.scm.repository.work.NoneCachingWorkingCopyPool, sonia.scm.repository.work.SimpleCachingWorkingCopyPool]
  workingCopyPoolStrategy: sonia.scm.repository.work.SimpleCachingWorkingCopyPool
  ## Amount of "cached" working copies
  workingCopyPoolSize: 5
/etc/scm $

[mfide]

I tested it with the SCM-Manager 3.1.0. Configuration provided as environment variables override the configuration provided by the config.yml. But they do not change the values inside the config.yml.

The values inside the config.yml is not supposed to be changed, by environment variables. But you can override the behavior, configured by the config.yml, by using the environment variables.

Yes you are right.

I confirmed that config.yml in the container still has "forwardHeadersEnabled: false" item but "SCM_FORWARD_HEADERS_ENABLED=true" in the environment section overrides the behaviour of the container and it behaves as expected.

Thank you for your help.