Skip to content

Revert 126 fix/tls fastcgi https param - #128

Open
thekevinm wants to merge 20 commits into
masterfrom
revert-126-fix/tls-fastcgi-https-param
Open

thekevinm wants to merge 20 commits into
masterfrom
revert-126-fix/tls-fastcgi-https-param

Conversation

@thekevinm

Copy link
Copy Markdown
Contributor

No description provided.

tomonorman and others added 20 commits July 26, 2022 16:20
Support for PHP 8.3
Add support for PHP 8.3
…no ODBC drivers into docker container (#117)

* DreamFactory 7 Release (#116)

* DP-513 Add web.config deny setting to nginx server configuration

* use ubuntu20 image

* update readme

* Update dreamfactory.conf

Support for PHP 8.3

* Update docker-entrypoint.sh

Add support for PHP 8.3

* Testing Laravel 11

* Laravel 11 OSS rebuild

* Update Dockerfile

* Update Dockerfile

* Update Dockerfile

* Update docker-entrypoint.sh

* Update docker-entrypoint.sh

---------

Co-authored-by: Tomo Norman <tomo.l.norman@gmail.com>
Co-authored-by: Kevin McGahey <36458555+thekevinm@users.noreply.github.com>
Co-authored-by: Kevin McGahey <kevinmcgahey1114@gmail.com>

* DreamFactory 7 Release

* DreamFactory 7 Release

Updated Dockerfile to reflect changes needed for running commercial license

* DreamFactory 7 Release

Update README to reflect commercial license requirements

* Update README.md

* Adding instructions on how to properly install Simba Trino ODBC drivers into docker container

* Simplying the installation process for docker deployments

* Correcting typo

---------

Co-authored-by: oleksandrkits <42465412+oleksandrkits@users.noreply.github.com>
Co-authored-by: Tomo Norman <tomo.l.norman@gmail.com>
Co-authored-by: Kevin McGahey <36458555+thekevinm@users.noreply.github.com>
Co-authored-by: Kevin McGahey <kevinmcgahey1114@gmail.com>
…MIN_PASSWORD

The 7.7 .env-dist no longer carries a #DF_LICENSE_KEY= placeholder, so the
sed that set the key matched nothing and the key was silently dropped.
php-fpm clears the process environment, so the container env var was not
visible to the app either. Licensed installs reported license_key: false.

Add set_env_var(): replace an existing or commented line, else append.

df:setup enforces a 16-character minimum admin password. With a shorter
ADMIN_PASSWORD it falls into an interactive prompt with no TTY and spins at
100% CPU. Check the length before calling df:setup and exit with a clear
error instead.

tests/entrypoint-test.sh covers both helpers.

Fixes #124
…-env

fix(entrypoint): write DF_LICENSE_KEY to .env on 7.7; refuse short ADMIN_PASSWORD
… proxies (#126)

The shipped nginx config has a single :80 server block and passes
'fastcgi_param HTTPS %HTTPS_HEADER%;' to PHP-FPM, with HTTPS_HEADER
defaulting to "off". When TLS is terminated in front of the container
(reverse proxy, load balancer, CDN) and HTTPS_HEADER is left unset,
Laravel's Request::isSecure() returns false and every absolute URL the
app generates comes out as http:// — including the issuer and endpoint
URLs in /.well-known/oauth-authorization-server. RFC 8414 s3.3 requires
clients to validate that metadata against the https:// issuer they
queried, so MCP/OAuth clients discard it and discovery breaks.

Nothing in the plumbing needed to change (the env var already exists
and works); what was missing was any signal that it must be set. This
documents the behavior at every place an operator would look:

- dreamfactory.conf: comment above the fastcgi_param explaining the
  substitution and the consequence of leaving it off behind TLS
- docker-compose.yml: comment on the HTTPS_HEADER example explaining
  when to enable it, and why the quotes are required (bare `on` is a
  YAML 1.1 boolean)
- docker-entrypoint.sh: clearer comment on the substitution line
- README.md: two sentences under the docker-compose edit step

Verified: rendered dreamfactory.conf with HTTPS_HEADER=on and =off
(plus SERVERNAME) and ran nginx -t (nginx/1.24.0) against both renders
in a running df-docker container — "syntax is ok" for both. bash -n on
the entrypoint and a YAML parse of docker-compose.yml also pass. The
comment text deliberately avoids the literal %HTTPS_HEADER% token so
the entrypoint's global sed cannot rewrite it.

Co-authored-by: Kevin McGahey <kevin.mcgahey@dreamfactory.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants