Comments (3)
@jryberg I'm 90% sure you're looking to configure your archiva container to support serving content over HTTPS. Providing I'm right, there's only one way to do that without a proxy and it's briefly covered in the second example in the readme.
You just need to setup a java keystore with the key pairs you want archiva to use, then use the KEYSTORE_*
environment variables to get the image to use it.
If you're new to java keystores, there are ton of good "quick start" style guides out there. Digital Ocean has a pretty good one. And, if nothing else, you can checkout our parameterized commands for setting up a JKS with a self-signed certificate in the run.bash.
Once you have java keystore setup, see the second example for how to use it to serve content over HTTPS.
from docker-archiva.
Hi,
Yes, I want https without self signed certificates but for that you need to be able to import intermediate certificate, the actual certificate and the key for the certificate.
It's not really possible to do this without creating a custom keystore and import it.
I managed to use nginx as a reverse proxy for https with my certificates and that works perfectly fine.
The only tweak I had to do was disable csr protection until I figure out what wrong I'm doing with rest.baseUrl (https://archiva.apache.org/docs/2.2.3/adminguide/customising-security.html)
If anyone are interested this is how I did it using docker-compose
docker-compose.yml
version: "3"
services:
reverseproxy:
image: nginx
restart: unless-stopped
ports:
- "8443:8443"
volumes:
- /data/archiva-compose/proxy_ssl.conf:/etc/nginx/conf.d/proxy_ssl.conf:ro
- /data/archiva-compose/ssl.crt:/etc/nginx/ssl.crt:ro
- /data/archiva-compose/ssl.key:/etc/nginx/ssl.key:ro
archiva:
image: xetusoss/archiva
restart: unless-stopped
depends_on:
- "reverseproxy"
ports:
# It's not nessary to export this port, but I wanted another service on the same host to be able to access Archiva unencrypted.
- "127.0.0.1:8080:8080"
volumes:
- /data/archiva:/archiva-data
proxy_ssl.conf
server {
listen 8443;
server_name <replace with FQDN>;
ssl_certificate /etc/nginx/ssl.crt;
ssl_certificate_key /etc/nginx/ssl.key;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port "8443";
proxy_pass http://archiva:8080;
proxy_redirect off;
}
}
from docker-archiva.
I think there's just a misunderstanding here.
... for that you need to be able to import intermediate certificate, the actual certificate and the key for the certificate.
It's not really possible to do this without creating a custom keystore and import it...
That's right, but that's not a problem! That's how it's supposed to work. Some servers want their SSL keys as PEM files, some as P12, some in JKS's (or maybe some combination). Jetty, which is what Archiva uses in this image, is a standard servlet container and supports a standard a JKS.
What you're talking about is a quite common thing to do, which is why it's our second example.
It seems like a lot of effort to setup, configure, and test an nginx proxy for the sole reason of avoiding creating a JKS. Is there some reason you can't use a java keystore? A proxy is a fine solution, but you usually do that when you have some other motivation (e.g. network path restrictions, request logging, a KMS, etc) and I haven't heard any mention of things like that.
from docker-archiva.
Related Issues (20)
- Running from example seems to hang on "Loading" HOT 2
- Support custom context path with environment variable HOT 7
- Artifacts are no longer stored under /archiva-data HOT 3
- What is the root password for Archiva Docker image? HOT 1
- while trying to push the artifact from jenkins(CI Job) to nexus.Error:"HTTP method PUT is not supported by this URL". HOT 1
- Latest openjdk:8 image breaks builds due to cacerts being moved.
- Error creating bean with name 'authenticationInterceptor#rest' HOT 2
- Hello, I'm new to docker. How easy would it be to add the $PORT env variable as a configuration parameter ? Thanks HOT 1
- validation_mail: user and password set via env variable HOT 2
- Container does not start as expected (HTTP ERROR 404) HOT 2
- How to set rest.baseUrl if behind proxy. HOT 2
- can't create directory '/archiva-data/data': Permission denied HOT 6
- Increase upload size HOT 9
- Add support for ARM 64 HOT 2
- Critical Log4j RCE bug (CVE-2021-44228) HOT 2
- Dockerhub tag `latest` does not seem to get updated HOT 1
- SSL Connection issue while connecting to mysql database HOT 1
- Write migration guide to reposilite
- Archiva 2.2.10 HOT 1
- Adding port 8443 to port list HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-archiva.