Merge branch 'master' into shib-auth

.gitlab-ci.yml

@@ -37,7 +37,8 @@ build-master:
     - IMAGE_6="$CI_REGISTRY_IMAGE/pvs_ingestor"
     - docker pull "$IMAGE_6":latest || true
     - docker build --cache-from "$IMAGE_6":latest -t "$IMAGE_6":latest -t "$IMAGE_6":$VERSION_6 ingestor/
-    - cd ./testing && ./gitlab_test.sh && cd -
+    - cd ./testing && ./gitlab_test.sh
+    - if [ $? -ne 0 ]; then exit 1; fi  # actually fail build
     - docker push "$IMAGE_1":$VERSION_1
     - docker push "$IMAGE_1":latest
     - docker push "$IMAGE_2":$VERSION_2
@@ -82,7 +83,7 @@ build:
     - docker build --cache-from "$IMAGE":latest -t "$IMAGE":$CI_COMMIT_REF_SLUG -t "$IMAGE":$CI_COMMIT_REF_NAME fluentd/
     - docker tag "$IMAGE:$CI_COMMIT_REF_NAME" "$IMAGE:latest"
     - IMAGE="$CI_REGISTRY_IMAGE/pvs_ingestor"
-    - docker pull "$IMAGE":$CI_COMMIT_REF_NAME || true
+    - docker pull "$IMAGE":latest || true
     - docker build --cache-from "$IMAGE":latest -t "$IMAGE":$CI_COMMIT_REF_SLUG -t "$IMAGE":$CI_COMMIT_REF_NAME ingestor/
     - cd ./testing && ./gitlab_test.sh && cd -
   except:

README.md

@@ -190,6 +190,16 @@ docker network create -d overlay emg-extnet
 ```
 Add following .env files with credentials to the cloned copy of the repository /env folder: `vhr18_db.env`, `vhr18_obs.env`, `vhr18_django.env`.
 
+create docker secrets:
+
+Sensitive environment variables are not included in the .env files, and must be generated as docker secrets. To create docker secrets run :
+```bash
+# replace the "<variable>" with the value of the secret
+printf "<OS_PASSWORD_DOWNLOAD>" | docker secret create OS_PASSWORD_DOWNLOAD -
+printf "<DJANGO_PASSWORD>" | docker secret create DJANGO_PASSWORD -
+printf "<OS_PASSWORD>" | docker secret create OS_PASSWORD -
+```
+
 Deploy the stack:
 ```
 docker stack deploy -c docker-compose.vhr18.yml -c docker-compose.vhr18.dev.yml -c docker-compose.logging.yml -c docker-compose.logging.dev.yml vhr18-pvs  # start VHR_IMAGE_2018 stack in dev mode, for example to use local sources
@@ -226,7 +236,7 @@ Select `@timestamp` as time field
 
 The `SFTP` image allow remote access into 2 logging folders, you can define (edit/add) users, passwords and (UID/GID) in the respictive configuration file ( e.g  *config/vhr_sftp_users.conf* ). 
 
-The default username is `eox`, once the stack is deployed you can sftp into the logging folders through port 2222 on -if you rn the dev stack- localhost :
+The default username is `eox`, once the stack is deployed you can sftp into the logging folders through port 2222 on -if you are running the dev stack- localhost :
 
 ```bash
 sftp -P 2222 eox@127.0.0.1

cache/entrypoint.sh

@@ -8,5 +8,32 @@ if [[ ! -z $SERVICES ]] ; then
         wait-for-it -t $TIMEOUT $service
     done
 fi
+# usage: file_env VAR [DEFAULT]
+#    ie: file_env 'XYZ_DB_PASSWORD' 'example'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+#  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+file_env() {
 
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		echo "Both $var and $fileVar are set (but are exclusive)" >&2
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	cat >> /etc/bash.bashrc <<EOF
+export "${var}"="${val}"
+EOF
+	echo "the value of variable ${var} is set" >&2
+  # make them also available in preparatory steps until container starts
+  export "${var}"="${val}"
+	unset "$fileVar"
+}
+
+file_env "OS_PASSWORD"
 eval "$@"

client/Dockerfile

@@ -25,7 +25,7 @@
 # IN THE SOFTWARE.
 #-----------------------------------------------------------------------------
 
-FROM nginx
+FROM nginx:1.19
 
 LABEL name="prism view server client" \
       vendor="EOX IT Services GmbH <https://eox.at>" \