feat(ssl)

Author: redgeoff

Dockerfile

@@ -3,9 +3,21 @@ FROM debian:jessie
 # Update distro
 RUN apt-get update -y && apt-get -y upgrade && apt-get -y dist-upgrade
 
+# Install Erlang 18 from source as the default version of Erlang 17 doesn't support CouchDB's SSL
+# features
+RUN apt-get install -y build-essential autoconf libncurses5-dev \
+                       openssl libssl-dev fop xsltproc unixodbc-dev \
+                       git wget \
+  && cd /usr/src \
+  && wget http://erlang.org/download/otp_src_18.3.tar.gz \
+  && tar zxvf otp_src_18.3.tar.gz \
+  && cd otp_src_18.3 \
+  && ./configure && make && make install
+
 # Install CouchDB from source
 RUN apt-get --no-install-recommends -y install \
-            build-essential pkg-config erlang \
+            # build-essential pkg-config erlang \
+            build-essential pkg-config \
             libicu-dev libmozjs185-dev libcurl4-openssl-dev \
             wget curl ca-certificates \
   && cd /usr/src \
@@ -55,7 +67,7 @@ RUN npm install -g docker-discover-tasks
 
 WORKDIR /home/couchdb/couchdb
 
-EXPOSE 5984 4369 9100-9200
+EXPOSE 5984 6984 4369 9100-9200
 
 VOLUME ["/home/couchdb/couchdb/data"]
 

couchdb-process.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
 
-# /docker-entrypoint.sh /home/couchdb/couchdb/bin/couchdb > /home/couchdb/couchdb/var/log/couch.log
 /docker-entrypoint.sh /home/couchdb/couchdb/bin/couchdb
+# /docker-entrypoint.sh /home/couchdb/couchdb/bin/couchdb > /home/couchdb/couchdb/var/log/couch.log 2>&1

docker-entrypoint.sh

@@ -33,8 +33,14 @@ if [ "$1" = '/home/couchdb/couchdb/bin/couchdb' ]; then
 
 	if [ "$COUCHDB_CERT_FILE" ] && [ "$COUCHDB_KEY_FILE" ] && [ "$COUCHDB_CACERT_FILE" ]; then
 		# Enable SSL
-		# printf "[daemons]\nhttpsd = {couch_httpd, start_link, [https]}\n\n" >> /home/couchdb/couchdb/etc/local.d/ssl.ini
+		printf "[daemons]\nhttpsd = {chttpd, start_link, [https]}\n\n" >> /home/couchdb/couchdb/etc/local.d/ssl.ini
 		printf "[ssl]\ncert_file = %s\nkey_file = %s\ncacert_file = %s\n" "$COUCHDB_CERT_FILE" "$COUCHDB_KEY_FILE" "$COUCHDB_CACERT_FILE" >> /home/couchdb/couchdb/etc/local.d/ssl.ini
+
+		# As per https://groups.google.com/forum/#!topic/couchdb-user-archive/cBrZ25DHHVA, due to bug
+		# https://issues.apache.org/jira/browse/COUCHDB-3162 we need the following lines. TODO: remove
+		# this in a later version of CouchDB 2.
+		printf "ciphers = undefined\ntls_versions = undefined\nsecure_renegotiate = undefined\n" >> /home/couchdb/couchdb/etc/local.d/ssl.ini
+
 		chown couchdb:couchdb /home/couchdb/couchdb/etc/local.d/ssl.ini
 	fi