Internal activiti-app container with CORS enabled and CSRF disabled

README.md

Running the Activiti Docker container

Docker-compose is used to run the container alongside a MySQL database container. By default it will pull the hosted container from docker-internal.alfresco.com but you can change this to reference the version you have built yourself if you like.

To run the container download the docker-compose.yml file from this project and run docker-compose in the directory where you downloaded it

docker-compose up

Note, you must have a valid Enteprise license installed on your host machine at $HOME/.activiti/enterprise-license/activiti.lic. You can change this location by editing the volume mapping in docker-compose.yml but since version 0.1.5 no license is included in the Activiti container.

When Tomcat has started up you should be able to navigate to http://localhost:9999/activiti-app and see the login screen. You can change the port that is exposed by modifying docker-compose.yml if port 9999 is not your thing. Note that the container itself actually exposes the standard port 8080 but docker-compose re-maps this to 9999 so that you can have Alfresco and Activiti running together.

Log in with the username admin@app.activiti.com and password admin.

If you want to change the default admin account details or change details of the CORS, CSRF or database configuration, the following environment variables can be overridden in docker-compose.yml

- `ACTIVITI_DATASOURCE_URL`
- `ACTIVITI_DATASOURCE_DRIVER`
- `ACTIVITI_DATASOURCE_USERNAME`
- `ACTIVITI_DATASOURCE_PASSWORD`
- `ACTIVITI_HIBERNATE_DIALECT`
- `ACTIVITI_ADMIN_EMAIL`
- `ACTIVITI_ADMIN_PASSWORD_HASH`
- `ACTIVITI_CORS_ENABLED`
- `ACTIVITI_CORS_ALLOWED_ORIGINS`
- `ACTIVITI_CORS_ALLOWED_METHODS`
- `ACTIVITI_CORS_ALLOWED_HEADERS`
- `ACTIVITI_CSRF_DISABLED`

Building the Docker container

The following instructions will build a new container with the Activiti BPM Suite installed inside Tomcat7. It is assumed that you have the activiti-bpm-suite source cloned locally and that you have a license in place in your home directory from a previous install. If this is not the case you may need to modify the steps as required.

Run the build-war.sh WAR file build script

cd build-war && ./build-war.sh && cd -
cp activiti-bpm-suite/activiti-app/src/main/resources/META-INF/activiti-app/activiti-app.properties docker-activiti-app.properties
mvn dependency:get -DgroupId=mysql -DartifactId=mysql-connector-java -Dversion=5.1.39 && cp ~/.m2/repository/mysql/mysql-connector-java/5.1.39/mysql-connector-java-5.1.39.jar .
docker build -t activiti-app-tomcat .

Publishing the container

To publish the container you must first tag it using a hostname and then do the push, e.g.

docker tag activiti-app-tomcat docker-internal.alfresco.com/<username>/activiti-app-tomcat
docker push docker-internal.alfresco.com/<username>/activiti-app-tomcat

docker-activiti-app.properties

server.onpremise=true
server.stencil.custom.allowed=true
server.contextroot=/activiti-app

datasource.username=alfresco
datasource.password=alfresco

datasource.driver=com.mysql.jdbc.Driver
datasource.url=jdbc:mysql://mysql:3306/activiti?characterEncoding=UTF-8

hibernate.dialect=org.hibernate.dialect.MySQLDialect

elastic-search.server.type=embedded
elastic-search.data.path=/usr/local/elasticsearch/data
event.generation.enabled=true
event.processing.enabled=true

admin.email=admin@app.activiti.com
admin.passwordHash=25a463679c56c474f20d8f592e899ef4cb3f79177c19e3782ed827b5c0135c466256f1e7b60e576e
admin.lastname=Administrator
admin.group=Superusers

contentstorage.fs.rootFolder=/usr/local/data/
contentstorage.fs.createRoot=true
contentstorage.fs.depth=4
contentstorage.fs.blockSize=1024

security.csrf.disabled=false
cors.enabled=true
cors.allowed.origins=*
cors.allowed.methods=GET,POST,HEAD,OPTIONS,PUT,DELETE
cors.allowed.headers=Authorization,Content-Type,Cache-Control,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,X-CSRF-Token
cors.exposed.headers=Access-Control-Allow-Origin,Access-Control-Allow-Credentials
cors.support.credentials=true
cors.preflight.maxage=10

docker-compose.yml

alfresco:
  image: "docker-internal.alfresco.com/platform-distribution:5.2.N-latest"
  ports:
  - "8080:8080"
mysql:
  image: mysql:5.6
  environment:
    MYSQL_ROOT_PASSWORD: my-secret-pass
    MYSQL_DATABASE: activiti
    MYSQL_USER: alfresco
    MYSQL_PASSWORD: alfresco
  ports:
  - "33061:3306"
activiti:
  image: docker-internal.alfresco.com/wabson/activiti-app-tomcat:v0.1.6
  environment:
    ACTIVITI_DATASOURCE_USERNAME: alfresco
    ACTIVITI_DATASOURCE_PASSWORD: alfresco
    ACTIVITI_CSRF_DISABLED: 'true'
    ACTIVITI_CORS_ENABLED: 'true'
  volumes:
  - "~/.activiti/enterprise-license:/root/.activiti/enterprise-license/:ro"
  ports:
  - "9999:8080"
  links:
    - mysql
    - alfresco

Dockerfile

FROM tomcat:7.0

ENV ACTIVITI_APP_PROPS ${CATALINA_HOME}/lib/activiti-app.properties

COPY build-war/activiti-app.war /usr/local/tomcat/webapps/
COPY docker-activiti-app.properties ${ACTIVITI_APP_PROPS}
COPY mysql-connector-java-5.1.39.jar ${CATALINA_HOME}/lib

COPY set-activiti-config.sh entrypoint.sh /root/

RUN mkdir -p /root/.activiti/enterprise-license
VOLUME /root/.activiti/enterprise-license

EXPOSE 8080

CMD ["/root/entrypoint.sh"]

entrypoint.sh

#!/bin/bash

$HOME/set-activiti-config.sh
$CATALINA_HOME/bin/catalina.sh run

set-activiti-config.sh

#!/bin/bash

properties="${ACTIVITI_APP_PROPS}"

test -n "$ACTIVITI_DATASOURCE_URL" && sed -i "s/^\(hibernate\.datasource\.url\s*=\s*\).*\$/\1$ACTIVITI_DATASOURCE_URL/" $properties
test -n "$ACTIVITI_DATASOURCE_DRIVER" && sed -i "s/^\(hibernate\.datasource\.driver\s*=\s*\).*\$/\1$ACTIVITI_DATASOURCE_DRIVER/" $properties
test -n "$ACTIVITI_DATASOURCE_USERNAME" && sed -i "s/^\(hibernate\.datasource\.username\s*=\s*\).*\$/\1$ACTIVITI_DATASOURCE_USERNAME/" $properties
test -n "$ACTIVITI_DATASOURCE_PASSWORD" && sed -i "s/^\(hibernate\.datasource\.password\s*=\s*\).*\$/\1$ACTIVITI_DATASOURCE_PASSWORD/" $properties
test -n "$ACTIVITI_HIBERNATE_DIALECT" && sed -i "s/^\(hibernate\.dialect\s*=\s*\).*\$/\1$ACTIVITI_HIBERNATE_DIALECT/" $properties
test -n "$ACTIVITI_ADMIN_EMAIL" && sed -i "s/^\(admin\.email\s*=\s*\).*\$/\1$ACTIVITI_ADMIN_EMAIL/" $properties
test -n "$ACTIVITI_ADMIN_PASSWORD_HASH" && sed -i "s/^\(admin\.passwordHash\s*=\s*\).*\$/\1$ACTIVITI_ADMIN_PASSWORD_HASH/" $properties
test -n "$ACTIVITI_CORS_ENABLED" && sed -i "s/^\(cors\.enabled\s*=\s*\).*\$/\1$ACTIVITI_CORS_ENABLED/" $properties
test -n "$ACTIVITI_CORS_ALLOWED_ORIGINS" && sed -i "s/^\(cors\.allowed\.origins\s*=\s*\).*\$/\1$ACTIVITI_CORS_ALLOWED_ORIGINS/" $properties
test -n "$ACTIVITI_CORS_ALLOWED_METHODS" && sed -i "s/^\(cors\.allowed\.methods\s*=\s*\).*\$/\1$ACTIVITI_CORS_ALLOWED_METHODS/" $properties
test -n "$ACTIVITI_CORS_ALLOWED_HEADERS" && sed -i "s/^\(cors\.allowed\.headers\s*=\s*\).*\$/\1$ACTIVITI_CORS_ALLOWED_HEADERS/" $properties
test -n "$ACTIVITI_CSRF_DISABLED" && sed -i "s/^\(security\.csrf\.disabled\s*=\s*\).*\$/\1$ACTIVITI_CSRF_DISABLED/" $properties