matomo-org / matomo-org/docker
Allow configuration setting to run Apache HTTPD on different ports
- Dominant language
- Shell
- Stars
- 1k
- Forks
- 384
- PR merge metrics
- No merged PRs in 30d
Description
# Configurable Ports
It would be great to be able to run Matomo on unprivileged ports, like 8080 and 8443 for HTTP and HTTPS respectively.
## Why?
The default OpenShift security settings does not allow privilege escalation. That would require creating a SecurityContextConstraint to run containers that binds to ports below 1024. Cluster Edge is already listening on 80/443 so the container port should be functionally irrelevant to Matomo and in regards to the client expecting standard ports.
## Suggestion
Implement a way to set env-vars in the container to overwrite the Apache ports.
### Env-variables
- MATOMO_HTTP_PORT - defaults to 80 but is configurable
- MATOMO_HTTPS_PORT - defaults to 443 but is configurable.
### Alternative solution
Document the below solution and its cons in detail in the README and on Docker Hub.
## WorkAround
I have started to create a workaround that overwrites the following files:
- `/etc/apache2/ports.conf`
- `/etc/apache2/sites-available/000-default.conf`
- `/etc/apache2/sites-available/default-ssl.conf`
That is replacing 80 with 8080 and 443 with 8443, mounting them with configMaps in OpenShift.
### Cons of the workAround
If the Matomo project decides to make configuration changes to the apache sites down the line, these will be overwritten by the configuration mounts used in the workAround.
## Disclaimer
I don't know if it would be functionally possible to make Apache read env variables from the OS environment or replace the ports using `sed` in the `entrypoint` script. Using `sed` would probably fail due to permissions when starting the container (the file system is read only on OpenShift).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting the Apache configuration files /etc/apache2/ports.conf, /etc/apache2/sites-available/000-default.conf, and /etc/apache2/sites-available/default-ssl.conf, along with the container entrypoint script. Check how MATOMO_HTTP_PORT and MATOMO_HTTPS_PORT could override the defaults without modifying a read-only filesystem. Done means both variables default to 80 and 443 and allow alternate ports such as 8080 and 8443; document the configuration in the README and on Docker Hub if that is the chosen solution.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, docker, shell
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 56/100