feat: use new nginx-unpriviledged base image

document HTTP basic auth usage

Author: KieranKaelin

.gitignore

@@ -9,3 +9,4 @@ volumes/core/config/oracle/wallet/*.lck
 volumes/core/config/oracle/wallet/*.p12
 volumes/core/config/oracle/wallet/*.sso
 volumes/web_gui/nginx/certs/nginx.*
+volumes/web_gui/nginx/htpasswd/.htpasswd

docker-compose.yml

@@ -10,13 +10,15 @@ services:
     depends_on:
       core:
         condition: service_started
+    environment:
+      - FRONTEND_BASE_URL=${FRONTEND_BASE_URL:-}
     volumes:
-      - ./volumes/web_gui/nginx/templates:/etc/nginx/templates
+      - ./volumes/web_gui/nginx/htpasswd:/etc/nginx/htpasswd
       - ./volumes/web_gui/nginx/certs:/etc/nginx/certs
     networks:
       - common
     ports:
-      - ${EXTERNAL_HTTP_PORT}:443
+      - ${EXTERNAL_HTTP_PORT}:8443
 
   # Migrator core exposed as REST service API
   core:

migrator

@@ -254,11 +254,17 @@ installed_from_archive() {
 
 generate_self_signed_certificate() {
     info "Generating self-signed TLS/SSL certificate"
-    docker compose run --no-deps web_gui \
-        openssl req -x509 -nodes -newkey rsa:2048 \
-        -keyout "${NGINX_SSL_CERTIFICATE_KEY}" -out "${NGINX_SSL_CERTIFICATE}"
-    docker compose run --no-deps web_gui \
-        chown $UID:$(id -g) "${NGINX_SSL_CERTIFICATE_KEY}" "${NGINX_SSL_CERTIFICATE}"
+    edition=$(print_env 'EDITION')
+    version=$(print_env 'VERSION')
+    docker run -it \
+        cybertecpostgresql/cybertec_migrator-${edition}-web_gui:${version} \
+        bash -c "openssl genrsa -out /tmp/nginx.key 4096 && cat /tmp/nginx.key" \
+        > ./volumes/web_gui/nginx/certs/nginx.key
+    docker run -it \
+        --mount "type=bind,source=$(pwd)/volumes/web_gui/nginx/certs/nginx.key,target=/tmp/nginx.key" \
+        cybertecpostgresql/cybertec_migrator-${edition}-web_gui:${version} \
+        bash -c "openssl req -new -key /tmp/nginx.key -x509 -out /tmp/nginx.crt -days 3650 -subj \"/C=AT/ST=Lower Austria/L=Wöllersdorf/O=CYBERTEC PostgreSQL International GmbH/OU=Development/CN=cybertec.at\" && cat /tmp/nginx.crt" \
+        > ./volumes/web_gui/nginx/certs/nginx.crt
     ok "Generated self-signed TLS/SSL certificate"
     next_step_upgrade
 }

volumes/web_gui/nginx/htpasswd/README.md

@@ -0,0 +1,23 @@
+# Basic Authentication
+
+To enable HTTP Basic Auth, create a new file `.htpasswd`:
+
+```shell
+touch .htpasswd
+```
+
+To add a new user, start by adding a username (replace the example with your own username):
+```shell
+sh -c "echo -n 'john-doe:' >> ./.htpasswd"
+```
+
+Finish the process by generating a password:
+```shell
+sh -c "openssl passwd -apr1 >> ./.htpasswd"
+```
+
+Restart the migrator for the new users to come into effect:
+```shell
+# Within the repository root
+./migrator up
+```