This makes it much easier and more secure to use it "rootless",
e.g. with https://podman.io's podman-compose instead (Moby) Docker.
Also includes minor README improvements useful for beginners.
Note that it is NOT enabled by default, which should be OK for the ASF.
The main point here is just to clearly document it for end-users.
I've obviously tried out what's documented, and can confirm it works.
These are the default values, from jdbc.properties, only added for
clarity and to make it obvious that they need to be changed e.g. for
FINERACT-762.
The different formats and naming conventions are a little bit of a mess,
but changing them now leads to backwards incompatibility, so for now
let's leave as is; possible clean up later in FINERACT-889.
We can use environment variables instead of system properties.
We originally had to use system properties and could not use environment
variables, because these used to read by Tomcat, but since the switch
to Hikari in FINERACT-796 these are read by Spring Boot instead of
Tomcat, so we can now use system properties.
This both "looks nicer" and is useful e.g. for FINERACT-881.
* Allow customizing Tenants DB JDBC uid/pwd/driver (FINERACT-806)
Added Java system properties for username and password to docker-compose
Modified sever.xml to get username and password
* Fixes for customizing Tenants DB JDBC uid/pwd/driver (FINERACT-806)
* Use random MYSQL_ROOT_PASSWORD in docker-compose.yml (FINERACT-806)
This provides future non-regression testing that the the customized
MySQL password is actually really used, and it doesn't just work because
"mysql" is still hard-coded anywhere.
Co-authored-by: Yemdjih Kaze Nasser <kaze.nasser@outlook.com>
In Docker, set JAVA_OPTS instead of FINERACT_TENANTS_URL.
Because ARG/ENV in the Dockerfile can't (easily) be changed at run-time.
At first I tried to override the ENTRYPOINT with a script which sets
JAVA_OPTS based on FINERACT_TENANTS_URL and then delegates to the original
/app-entrypoint.sh; that didn't immediately work, so this seems simpler.
Including make default tenant JDBC hostname & port configurable at Docker container run instead of build time.
This is required on secure Linux distributions such as
Fedora/CentOS/RHEL where SELinux is enabled, where without this
the mysql container fails to start due to:
ls: cannot open directory '/docker-entrypoint-initdb.d/': Permission denied
These Z,ro volume mount flags are (should be..) harmless and ignored
by Docker on other platforms, such as insecure ;) Linux distributions
without SELinux, or Windows and Mac.
PS: I personally don't actually use real Docker, but instead I use Podman
(see https://github.com/containers/libpod; install via `dnf install podman-docker`)
and https://github.com/containers/podman-compose/) via `pip3 install podman-compose`;
it's more secure (because it doesn't need a daemon and root to run containers).
