mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
d5b6e90a8c
meta/services.yml pinned sso.flavor: oauth2, so an oauth2-proxy fronted the whole role. That gated the storefront too and left /admin behind a proxy the administrator persona could not log out of, while tasks/setup/oidc.yml -- the only OIDC wiring -- installed a literal placeholder plugin name behind an || true and wrote InfxOidc.config.* keys that no plugin reads. tasks/03_setup.yml and tasks/04_cleanup.yml were included by nothing, so none of it ever ran. The flavor moves to oidc, which drops the proxy on its own because sso_proxy.yml keys off is_proxy_gated: the storefront becomes public and /admin authenticates through heptacom/shopware-platform-admin-open-auth against Keycloak. The plugin is baked into files/Dockerfile beside the existing composer require, installed and activated by tasks/setup/oidc.yml, and its Keycloak client row is written idempotently by files/ensure/oidc_client.php over the Admin API -- GET by provider, then PATCH or POST -- because the plugin keeps its configuration in the heptacom_admin_open_auth_client DAL entity, not in system_config. The web service gains container_extra_hosts. With the proxy gone the token exchange runs inside the shopware container, which under swarm resolves clearnet only and could not reach the keycloak onion. The LDAP plugin tasks are deleted rather than wired. No admin-LDAP extension for 6.7 is installable unattended -- the only real one is a paid Store extension needing a licence token -- and arming tasks/03_setup.yml would have fired the INFX_LDAP_PLUGIN placeholder on every deploy that ships OpenLDAP, since meta/services.yml derives ldap.enabled from group membership. Directory identities reach the backend through the Keycloak LDAP federation instead. PERSONA_BIBER_BLOCKED becomes unconditional: biber has an account in no variant. test-admin-native.js keeps the authenticated journey and now drives the AdminOpenAuth provider link when SSO is on. Verified by execution: the provisioning payload and both idempotency branches against a stub; composer resolving 9.1.0 against shopware/core 6.7.13.0 without conflict; the install gate rejecting a no-plugins-found run and accepting both success shapes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
76 lines
2.5 KiB
Docker
76 lines
2.5 KiB
Docker
|
|
ARG SHOPWARE_CONTAINER_IMAGE
|
|
ARG SHOPWARE_CONTAINER_VERSION
|
|
ARG SHOPWARE_PHP_IMAGE
|
|
ARG SHOPWARE_PHP_VERSION
|
|
FROM ${SHOPWARE_CONTAINER_IMAGE}:${SHOPWARE_CONTAINER_VERSION} AS builder
|
|
ENV COMPOSER_ALLOW_SUPERUSER=1 \
|
|
COMPOSER_NO_INTERACTION=1 \
|
|
COMPOSER_PROCESS_TIMEOUT=900
|
|
|
|
WORKDIR /app
|
|
ARG SHOPWARE_PKG_NAME
|
|
ARG SHOPWARE_PKG_VERSION
|
|
ARG SHOPWARE_COMPOSER_PLATFORM_PHP
|
|
|
|
RUN set -eux; \
|
|
composer create-project "${SHOPWARE_PKG_NAME}:${SHOPWARE_PKG_VERSION}" /app --no-install; \
|
|
composer config platform.php "${SHOPWARE_COMPOSER_PLATFORM_PHP}"; \
|
|
composer config policy.advisories.block false
|
|
|
|
RUN set -eux; \
|
|
composer install \
|
|
--no-dev \
|
|
--optimize-autoloader \
|
|
--no-progress \
|
|
--no-scripts \
|
|
--ignore-platform-req=ext-gd \
|
|
--ignore-platform-req=ext-intl \
|
|
--ignore-platform-req=ext-pdo_mysql; \
|
|
composer require symfony/redis-messenger:^7.4 league/flysystem-async-aws-s3:^3.0 \
|
|
heptacom/shopware-platform-admin-open-auth:^9.0 \
|
|
-W \
|
|
--no-scripts \
|
|
--no-progress \
|
|
--update-no-dev \
|
|
--ignore-platform-req=ext-gd \
|
|
--ignore-platform-req=ext-intl \
|
|
--ignore-platform-req=ext-pdo_mysql \
|
|
--ignore-platform-req=ext-redis
|
|
|
|
|
|
FROM ${SHOPWARE_PHP_IMAGE}:${SHOPWARE_PHP_VERSION}
|
|
WORKDIR /var/www/html
|
|
|
|
USER root
|
|
RUN set -eux; \
|
|
apk add --no-cache php83-gd || apk add --no-cache php82-gd || apk add --no-cache php-gd || true; \
|
|
apk add --no-cache php83-intl || apk add --no-cache php82-intl || apk add --no-cache php-intl || true; \
|
|
apk add --no-cache php83-pdo_mysql || apk add --no-cache php82-pdo_mysql || apk add --no-cache php-pdo_mysql || true; \
|
|
apk add --no-cache php83-redis || apk add --no-cache php82-redis || apk add --no-cache php-redis || true
|
|
|
|
RUN set -eux; \
|
|
d="$(php -r 'echo PHP_CONFIG_FILE_SCAN_DIR;')"; \
|
|
{ \
|
|
echo 'session.save_handler = redis'; \
|
|
echo 'session.save_path = ${REDIS_SESSION_TARGET}'; \
|
|
} > "${d}/zz-session-redis.ini"
|
|
|
|
COPY --chown=www-data:www-data --from=builder /app /var/www/html
|
|
|
|
RUN mkdir -p /usr/src/shopware \
|
|
&& cp -a /var/www/html/. /usr/src/shopware/. \
|
|
&& chown -R www-data:www-data /var/www/html /usr/src/shopware
|
|
|
|
RUN set -eux; \
|
|
mkdir -p \
|
|
/var/www/html/files \
|
|
/var/www/html/var \
|
|
/var/www/html/public/media \
|
|
/var/www/html/public/thumbnail \
|
|
/var/www/html/public/sitemap \
|
|
/var/www/html/public/theme; \
|
|
chown -R www-data:www-data /var/www/html
|
|
|
|
USER www-data
|