wallabag / wallabag/docker

Enable/Support options to use SSL when using external MySQL database.

Open
#278 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Shell
Stars
769
Forks
168
PR merge metrics
No merged PRs in 30d

Description

I am not fully sure if SSL for Database connections is supported or it seems to be broken. This is the log when I run the container in non-detached mode.

```
Starting provisioner...
[WARNING]: Found both group and host with same name: localhost
[WARNING]: Platform linux on host localhost is using the discovered Python
interpreter at /usr/bin/python3, but future installation of another Python
interpreter could change this. See https://docs.ansible.com/ansible/2.9/referen
ce_appendices/interpreter_discovery.html for more information.
PLAY [localhost] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var TASK [Gathering Facts] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost] TASK [needed dirs] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost] => (item=/var/www/wallabag/app) ok: [localhost] => (item=/var/www/wallabag/app/config) ok: [localhost] => (item=/var/www/wallabag/data) changed: [localhost] => (item=/var/www/wallabag/data/assets) ok: [localhost] => (item=/var/www/wallabag/data/db) TASK [write parameters.yml] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var changed: [localhost] TASK [stat] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var skipping: [localhost] TASK [notify install for sqlite] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var skipping: [localhost]
TASK [wait for db container] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost]
TASK [add mariadb db] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var fatal: [localhost]: FAILED! => {"changed": false, "msg": "unable to find /root/.my.cnf. Exception message: (3159, 'Connections using insecure transport are prohibited while --require_secure_transport=ON.')"} RUNNING HANDLER [chown dir] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var PLAY RECAP bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var localhost : ok=4 changed=2 unreachable=0 failed=1 skipped=2 rescued=0 ignored=0
Provisioner finished.
```

These are environment variables passed to the container:

`MYSQL_ROOT_PASSWORD`, `SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql`, `SYMFONY__ENV__DATABASE_HOST`, `SYMFONY__ENV__DATABASE_PORT`, `SYMFONY__ENV__DATABASE_NAME`, `SYMFONY__ENV__DATABASE_USER`, `SYMFONY__ENV__DATABASE_PASSWORD`, `SYMFONY__ENV__DATABASE_CHARSET`, `SYMFONY__ENV__DOMAIN_NAME`.

This line indicates failure to connect due to SSL:
`FAILED! => {"changed": false, "msg": "unable to find /root/.my.cnf. Exception message: (3159, 'Connections using insecure transport are prohibited while --require_secure_transport=ON.')"}`

I verified this my executing `mysql` with and without the option `--ssl` from inside the container to understand the reason for failure. Without the specified option, it fails to connect with same error: `'Connections using insecure transport are prohibited while --require_secure_transport=ON.')`. Adding the option `--ssl` works.

Not sure why it is looking for `/root/.my.cnf`. Adding `ssl=ON` in `/etc/my.cnf` under `[client-server]` defaults the connection to use SSL.

Does the container need a volume mounted that reads `/root/.my.cnf` for overriding the config? I did not find any references to that path in this repo.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.