Skip to content

Commit 0ffaad3

Browse files
LordRobinCbzLordRobinCbz
authored
Merge pull request #3 from LordRobinCbz/develop
fix(config.inc.php/docker-entrypoint.sh,dockerfile,helpers.php): Move TLS logic from entrypoint to php configuration files, in all other build
2 parents a284aff + 088137e commit 0ffaad3

File tree

9 files changed

+176
-134
lines changed

9 files changed

+176
-134
lines changed

‎README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,12 +187,12 @@ docker run --name phpmyadmin -d -e PMA_HOSTS='sslhost,nosslhost' -e PMA_SSLS='1,
187187
* ``PMA_SSL`` - when set to 1, defines SSL usage for the MySQL connection
188188
* ``PMA_SSL_VERIFY`` - when set to 1, enables SSL certificate verification for the MySQL connection.
189189
* ``PMA_SSL_VERIFIES`` - comma-separated list of `0` and `1` to enable or disable SSL certificate verification for multiple MySQL connections.
190-
* ``PMA_SSL_CA_BASE64`` - in the context of mTLS security, allows setting your CA file as a base64 string inside the default `config.inc.php`.
191-
* ``PMA_SSL_CAS_BASE64`` - in the context of mTLS security, allows setting multiple CA files as a comma-separated list of base64 strings inside the default `config.inc.php`.
192-
* ``PMA_SSL_CERT_BASE64`` - in the context of mTLS security, allows setting your CERT file as a base64 string inside the default `config.inc.php`.
193-
* ``PMA_SSL_CERTS_BASE64`` - in the context of mTLS security, allows setting multiple CERT files as a comma-separated list of base64 strings inside the default `config.inc.php`.
194-
* ``PMA_SSL_KEY_BASE64`` - in the context of mTLS security, allows setting your KEY file as a base64 string inside the default `config.inc.php`.
195-
* ``PMA_SSL_KEYS_BASE64`` - in the context of mTLS security, allows setting multiple KEY files as a comma-separated list of base64 strings inside the default `config.inc.php`.
190+
* ``PMA_SSL_CA_BASE64`` - in the context of mutual TLS security, allows setting your CA file as a base64 string inside the default `config.inc.php`.
191+
* ``PMA_SSL_CAS_BASE64`` - in the context of mutual TLS security, allows setting multiple CA files as a comma-separated list of base64 strings inside the default `config.inc.php`.
192+
* ``PMA_SSL_CERT_BASE64`` - in the context of mutual TLS security, allows setting your CERT file as a base64 string inside the default `config.inc.php`.
193+
* ``PMA_SSL_CERTS_BASE64`` - in the context of mutual TLS security, allows setting multiple CERT files as a comma-separated list of base64 strings inside the default `config.inc.php`.
194+
* ``PMA_SSL_KEY_BASE64`` - in the context of mutual TLS security, allows setting your KEY file as a base64 string inside the default `config.inc.php`.
195+
* ``PMA_SSL_KEYS_BASE64`` - in the context of mutual TLS security, allows setting multiple KEY files as a comma-separated list of base64 strings inside the default `config.inc.php`.
196196
* ``PMA_USER`` and ``PMA_PASSWORD`` - define username and password to use only with the `config` authentication method
197197
* ``PMA_ABSOLUTE_URI`` - the full URL to phpMyAdmin. Sometimes needed when used in a reverse-proxy configuration. Don't set this unless needed. See [documentation](https://docs.phpmyadmin.net/en/latest/config.html#cfg_PmaAbsoluteUri).
198198
* ``PMA_CONFIG_BASE64`` - if set, this option will override the default `config.inc.php` with the base64 decoded contents of the variable

‎fpm-alpine/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ RUN set -ex; \
120120

121121
# Copy configuration
122122
COPY config.inc.php /etc/phpmyadmin/config.inc.php
123+
COPY helpers.php /etc/phpmyadmin/helpers.php
123124
RUN chown www-data:www-data -R /etc/phpmyadmin/
124125

125126
# Copy main script

‎fpm-alpine/config.inc.php‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,47 @@
6363
$cfg['PmaAbsoluteUri'] = trim($_ENV['PMA_ABSOLUTE_URI']);
6464
}
6565

66+
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
67+
if (!is_dir(SSL_DIR)) {
68+
mkdir(SSL_DIR, 0755, true);
69+
}
70+
file_put_contents(SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
71+
$_ENV['PMA_SSL_CA'] = SSL_DIR . '/pma-ssl-ca.pem';
72+
}
73+
74+
/* Decode and save the SSL key from base64 */
75+
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
76+
if (!is_dir(SSL_DIR)) {
77+
mkdir(SSL_DIR, 0755, true);
78+
}
79+
file_put_contents(SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
80+
$_ENV['PMA_SSL_KEY'] = SSL_DIR . '/pma-ssl-key.key';
81+
}
82+
83+
/* Decode and save the SSL certificate from base64 */
84+
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
85+
if (!is_dir(SSL_DIR)) {
86+
mkdir(SSL_DIR, 0755, true);
87+
}
88+
file_put_contents(SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
89+
$_ENV['PMA_SSL_CERT'] = SSL_DIR . '/pma-ssl-cert.pem';
90+
}
91+
92+
/* Decode and save multiple SSL CA certificates from base64 */
93+
if (isset($_ENV['PMA_SSL_CAS_BASE64'])) {
94+
$_ENV['PMA_SSL_CAS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CAS_BASE64'], 'CA', 'pem');
95+
}
96+
97+
/* Decode and save multiple SSL keys from base64 */
98+
if (isset($_ENV['PMA_SSL_KEYS_BASE64'])) {
99+
$_ENV['PMA_SSL_KEYS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_KEYS_BASE64'], 'CERT', 'cert');
100+
}
101+
102+
/* Decode and save multiple SSL certificates from base64 */
103+
if (isset($_ENV['PMA_SSL_CERTS_BASE64'])) {
104+
$_ENV['PMA_SSL_CERTS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CERTS_BASE64'], 'KEY', 'key');
105+
}
106+
66107
/* Figure out hosts */
67108

68109
/* Fallback to default linked */

‎fpm-alpine/docker-entrypoint.sh‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -29,45 +29,6 @@ if [ ! -z "${PMA_USER_CONFIG_BASE64}" ]; then
2929
echo "${PMA_USER_CONFIG_BASE64}" | base64 -d > /etc/phpmyadmin/config.user.inc.php
3030
fi
3131

32-
if [ ! -z "${PMA_SSL_CA_BASE64}" ]; then
33-
mkdir -p /etc/phpmyadmin/ssl
34-
echo "Adding the custom pma-ssl-ca from base64."
35-
echo "${PMA_SSL_CA_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-ca.pem
36-
export "PMA_SSL_CA"="/etc/phpmyadmin/ssl/pma-ssl-ca.pem"
37-
fi
38-
39-
if [ ! -z "${PMA_SSL_KEY_BASE64}" ]; then
40-
mkdir -p /etc/phpmyadmin/ssl
41-
echo "Adding the custom pma-ssl-key from base64."
42-
echo "${PMA_SSL_KEY_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-key.key
43-
export "PMA_SSL_KEY"="/etc/phpmyadmin/ssl/pma-ssl-key.key"
44-
fi
45-
46-
if [ ! -z "${PMA_SSL_CERT_BASE64}" ]; then
47-
mkdir -p /etc/phpmyadmin/ssl
48-
echo "Adding the custom pma-ssl-cert from base64."
49-
echo "${PMA_SSL_CERT_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-cert.pem
50-
export "PMA_SSL_CERT"="/etc/phpmyadmin/ssl/pma-ssl-cert.pem"
51-
fi
52-
53-
if [ ! -z "${PMA_SSL_CAS_BASE64}" ]; then
54-
echo "Adding multiples custom pma-ssl-ca from base64."
55-
PMA_SSL_CAS=$(generate_ssl_files "${PMA_SSL_CAS_BASE64}" "CA" "pem")
56-
export "PMA_SSL_CAS"
57-
fi
58-
59-
if [ ! -z "${PMA_SSL_KEYS_BASE64}" ]; then
60-
echo "Adding multiples custom pma-ssl-key from base64."
61-
PMA_SSL_KEYS=$(generate_ssl_files "${PMA_SSL_KEYS_BASE64}" "CERT" "cert")
62-
export "PMA_SSL_KEYS"
63-
fi
64-
65-
if [ ! -z "${PMA_SSL_CERTS_BASE64}" ]; then
66-
echo "Adding multiples custom pma-ssl-cert from base64."
67-
PMA_SSL_CERTS=$(generate_ssl_files "${PMA_SSL_CERTS_BASE64}" "KEY" "key")
68-
export "PMA_SSL_CERTS"
69-
fi
70-
7132
get_docker_secret() {
7233
local env_var="${1}"
7334
local env_var_file="${env_var}_FILE"
@@ -80,31 +41,6 @@ get_docker_secret() {
8041
fi
8142
}
8243

83-
# This function generates SSL files from a base64 encoded string.
84-
# Arguments:
85-
# 1. base64_string: A comma-separated string of base64 encoded SSL files.
86-
# 2. prefix: A prefix to be used in the output file names.
87-
# 3. extension: The file extension to be used for the output files.
88-
# The function creates a directory for the SSL files, decodes each base64 string,
89-
# writes the decoded content to a file, and returns a comma-separated list of the generated file paths.
90-
#
91-
generate_ssl_files() {
92-
local base64_string="${1}"
93-
local output_dir="/etc/phpmyadmin/ssl"
94-
mkdir -p "${output_dir}"
95-
IFS=',' read -ra FILES <<< "${base64_string}"
96-
local counter=1
97-
local ssl_files=""
98-
for file in "${FILES[@]}"; do
99-
local output_file="${output_dir}/pma-ssl-${2}-${counter}.${3}"
100-
echo "${file}" | base64 -d > "${output_file}"
101-
ssl_files="${ssl_files}${output_file},"
102-
counter=$((counter + 1))
103-
done
104-
ssl_files="${ssl_files%,}"
105-
echo "${ssl_files}"
106-
}
107-
10844
get_docker_secret PMA_USER
10945
get_docker_secret PMA_PASSWORD
11046
get_docker_secret MYSQL_ROOT_PASSWORD

‎fpm-alpine/helpers.php‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?php
2+
3+
class SslFileGenerationException extends Exception {}
4+
5+
define('OUTPUT_DIR', '/etc/phpmyadmin/ssl');
6+
7+
/**
8+
* Helper function to decode and save multiple SSL files from base64.
9+
*
10+
* @param string $base64_string The base64 encoded string containing multiple SSL files separated by commas.
11+
* If no commas are present, the entire string is treated as a single file.
12+
* @param string $prefix The prefix to use for the generated SSL file names.
13+
* @param string $extension The file extension to use for the generated SSL files.
14+
* @return string A comma-separated list of paths to the generated SSL files.
15+
*/
16+
function decodeAndSaveSslFiles($base64_string, $prefix, $extension) {
17+
// Ensure the output directory exists
18+
if (!is_dir(OUTPUT_DIR)) {
19+
mkdir(OUTPUT_DIR, 0755, true);
20+
}
21+
22+
// Split the base64 string into an array of files
23+
$files = strpos($base64_string, ',') !== false ? explode(',', $base64_string) : [$base64_string];
24+
$counter = 1;
25+
$ssl_files = [];
26+
27+
// Process each file
28+
foreach ($files as $file) {
29+
$output_file = OUTPUT_DIR . "/pma-ssl-$prefix-$counter.$extension";
30+
31+
// Write the decoded file to the output directory
32+
if (file_put_contents($output_file, base64_decode($file)) === false) {
33+
throw new SslFileGenerationException("Failed to write to $output_file");
34+
}
35+
36+
// Add the output file path to the list
37+
$ssl_files[] = $output_file;
38+
$counter++;
39+
}
40+
41+
// Return a comma-separated list of the generated file paths
42+
return implode(',', $ssl_files);
43+
}

‎fpm/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ RUN set -ex; \
137137

138138
# Copy configuration
139139
COPY config.inc.php /etc/phpmyadmin/config.inc.php
140+
COPY helpers.php /etc/phpmyadmin/helpers.php
140141
RUN chown www-data:www-data -R /etc/phpmyadmin/
141142

142143
# Copy main script

‎fpm/config.inc.php‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,47 @@
6363
$cfg['PmaAbsoluteUri'] = trim($_ENV['PMA_ABSOLUTE_URI']);
6464
}
6565

66+
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
67+
if (!is_dir(SSL_DIR)) {
68+
mkdir(SSL_DIR, 0755, true);
69+
}
70+
file_put_contents(SSL_DIR . '/pma-ssl-ca.pem', base64_decode($_ENV['PMA_SSL_CA_BASE64']));
71+
$_ENV['PMA_SSL_CA'] = SSL_DIR . '/pma-ssl-ca.pem';
72+
}
73+
74+
/* Decode and save the SSL key from base64 */
75+
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
76+
if (!is_dir(SSL_DIR)) {
77+
mkdir(SSL_DIR, 0755, true);
78+
}
79+
file_put_contents(SSL_DIR . '/pma-ssl-key.key', base64_decode($_ENV['PMA_SSL_KEY_BASE64']));
80+
$_ENV['PMA_SSL_KEY'] = SSL_DIR . '/pma-ssl-key.key';
81+
}
82+
83+
/* Decode and save the SSL certificate from base64 */
84+
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
85+
if (!is_dir(SSL_DIR)) {
86+
mkdir(SSL_DIR, 0755, true);
87+
}
88+
file_put_contents(SSL_DIR . '/pma-ssl-cert.pem', base64_decode($_ENV['PMA_SSL_CERT_BASE64']));
89+
$_ENV['PMA_SSL_CERT'] = SSL_DIR . '/pma-ssl-cert.pem';
90+
}
91+
92+
/* Decode and save multiple SSL CA certificates from base64 */
93+
if (isset($_ENV['PMA_SSL_CAS_BASE64'])) {
94+
$_ENV['PMA_SSL_CAS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CAS_BASE64'], 'CA', 'pem');
95+
}
96+
97+
/* Decode and save multiple SSL keys from base64 */
98+
if (isset($_ENV['PMA_SSL_KEYS_BASE64'])) {
99+
$_ENV['PMA_SSL_KEYS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_KEYS_BASE64'], 'CERT', 'cert');
100+
}
101+
102+
/* Decode and save multiple SSL certificates from base64 */
103+
if (isset($_ENV['PMA_SSL_CERTS_BASE64'])) {
104+
$_ENV['PMA_SSL_CERTS'] = decodeAndSaveSslFiles($_ENV['PMA_SSL_CERTS_BASE64'], 'KEY', 'key');
105+
}
106+
66107
/* Figure out hosts */
67108

68109
/* Fallback to default linked */

‎fpm/docker-entrypoint.sh‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -29,45 +29,6 @@ if [ ! -z "${PMA_USER_CONFIG_BASE64}" ]; then
2929
echo "${PMA_USER_CONFIG_BASE64}" | base64 -d > /etc/phpmyadmin/config.user.inc.php
3030
fi
3131

32-
if [ ! -z "${PMA_SSL_CA_BASE64}" ]; then
33-
mkdir -p /etc/phpmyadmin/ssl
34-
echo "Adding the custom pma-ssl-ca from base64."
35-
echo "${PMA_SSL_CA_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-ca.pem
36-
export "PMA_SSL_CA"="/etc/phpmyadmin/ssl/pma-ssl-ca.pem"
37-
fi
38-
39-
if [ ! -z "${PMA_SSL_KEY_BASE64}" ]; then
40-
mkdir -p /etc/phpmyadmin/ssl
41-
echo "Adding the custom pma-ssl-key from base64."
42-
echo "${PMA_SSL_KEY_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-key.key
43-
export "PMA_SSL_KEY"="/etc/phpmyadmin/ssl/pma-ssl-key.key"
44-
fi
45-
46-
if [ ! -z "${PMA_SSL_CERT_BASE64}" ]; then
47-
mkdir -p /etc/phpmyadmin/ssl
48-
echo "Adding the custom pma-ssl-cert from base64."
49-
echo "${PMA_SSL_CERT_BASE64}" | base64 -d > /etc/phpmyadmin/ssl/pma-ssl-cert.pem
50-
export "PMA_SSL_CERT"="/etc/phpmyadmin/ssl/pma-ssl-cert.pem"
51-
fi
52-
53-
if [ ! -z "${PMA_SSL_CAS_BASE64}" ]; then
54-
echo "Adding multiples custom pma-ssl-ca from base64."
55-
PMA_SSL_CAS=$(generate_ssl_files "${PMA_SSL_CAS_BASE64}" "CA" "pem")
56-
export "PMA_SSL_CAS"
57-
fi
58-
59-
if [ ! -z "${PMA_SSL_KEYS_BASE64}" ]; then
60-
echo "Adding multiples custom pma-ssl-key from base64."
61-
PMA_SSL_KEYS=$(generate_ssl_files "${PMA_SSL_KEYS_BASE64}" "CERT" "cert")
62-
export "PMA_SSL_KEYS"
63-
fi
64-
65-
if [ ! -z "${PMA_SSL_CERTS_BASE64}" ]; then
66-
echo "Adding multiples custom pma-ssl-cert from base64."
67-
PMA_SSL_CERTS=$(generate_ssl_files "${PMA_SSL_CERTS_BASE64}" "KEY" "key")
68-
export "PMA_SSL_CERTS"
69-
fi
70-
7132
get_docker_secret() {
7233
local env_var="${1}"
7334
local env_var_file="${env_var}_FILE"
@@ -80,31 +41,6 @@ get_docker_secret() {
8041
fi
8142
}
8243

83-
# This function generates SSL files from a base64 encoded string.
84-
# Arguments:
85-
# 1. base64_string: A comma-separated string of base64 encoded SSL files.
86-
# 2. prefix: A prefix to be used in the output file names.
87-
# 3. extension: The file extension to be used for the output files.
88-
# The function creates a directory for the SSL files, decodes each base64 string,
89-
# writes the decoded content to a file, and returns a comma-separated list of the generated file paths.
90-
#
91-
generate_ssl_files() {
92-
local base64_string="${1}"
93-
local output_dir="/etc/phpmyadmin/ssl"
94-
mkdir -p "${output_dir}"
95-
IFS=',' read -ra FILES <<< "${base64_string}"
96-
local counter=1
97-
local ssl_files=""
98-
for file in "${FILES[@]}"; do
99-
local output_file="${output_dir}/pma-ssl-${2}-${counter}.${3}"
100-
echo "${file}" | base64 -d > "${output_file}"
101-
ssl_files="${ssl_files}${output_file},"
102-
counter=$((counter + 1))
103-
done
104-
ssl_files="${ssl_files%,}"
105-
echo "${ssl_files}"
106-
}
107-
10844
get_docker_secret PMA_USER
10945
get_docker_secret PMA_PASSWORD
11046
get_docker_secret MYSQL_ROOT_PASSWORD

‎fpm/helpers.php‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?php
2+
3+
class SslFileGenerationException extends Exception {}
4+
5+
define('OUTPUT_DIR', '/etc/phpmyadmin/ssl');
6+
7+
/**
8+
* Helper function to decode and save multiple SSL files from base64.
9+
*
10+
* @param string $base64_string The base64 encoded string containing multiple SSL files separated by commas.
11+
* If no commas are present, the entire string is treated as a single file.
12+
* @param string $prefix The prefix to use for the generated SSL file names.
13+
* @param string $extension The file extension to use for the generated SSL files.
14+
* @return string A comma-separated list of paths to the generated SSL files.
15+
*/
16+
function decodeAndSaveSslFiles($base64_string, $prefix, $extension) {
17+
// Ensure the output directory exists
18+
if (!is_dir(OUTPUT_DIR)) {
19+
mkdir(OUTPUT_DIR, 0755, true);
20+
}
21+
22+
// Split the base64 string into an array of files
23+
$files = strpos($base64_string, ',') !== false ? explode(',', $base64_string) : [$base64_string];
24+
$counter = 1;
25+
$ssl_files = [];
26+
27+
// Process each file
28+
foreach ($files as $file) {
29+
$output_file = OUTPUT_DIR . "/pma-ssl-$prefix-$counter.$extension";
30+
31+
// Write the decoded file to the output directory
32+
if (file_put_contents($output_file, base64_decode($file)) === false) {
33+
throw new SslFileGenerationException("Failed to write to $output_file");
34+
}
35+
36+
// Add the output file path to the list
37+
$ssl_files[] = $output_file;
38+
$counter++;
39+
}
40+
41+
// Return a comma-separated list of the generated file paths
42+
return implode(',', $ssl_files);
43+
}

0 commit comments

Comments
 (0)