mirror of
https://github.com/Infisical/infisical.git
synced 2026-01-09 15:38:03 -05:00
118 lines
3.7 KiB
Docker
118 lines
3.7 KiB
Docker
FROM node:20.19.5-trixie-slim
|
|
|
|
# ? Setup a test SoftHSM module. In production a real HSM is used.
|
|
|
|
ARG SOFTHSM2_VERSION=2.5.0
|
|
|
|
ENV SOFTHSM2_VERSION=${SOFTHSM2_VERSION} \
|
|
SOFTHSM2_SOURCES=/tmp/softhsm2
|
|
|
|
# Install build dependencies including python3 (required for pkcs11js and partially TDS driver)
|
|
RUN apt-get update && apt-get install -y \
|
|
build-essential \
|
|
autoconf \
|
|
automake \
|
|
git \
|
|
libtool \
|
|
libssl-dev \
|
|
python3 \
|
|
make \
|
|
g++ \
|
|
openssh-client \
|
|
curl \
|
|
pkg-config \
|
|
perl \
|
|
wget \
|
|
unzip
|
|
|
|
# Install libaio (required for Oracle Instant Client) - architecture-specific for Debian Trixie
|
|
RUN ARCH=$(dpkg --print-architecture) && \
|
|
if [ "$ARCH" = "arm64" ]; then \
|
|
apt-get install -y libaio1t64 && \
|
|
ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
|
|
else \
|
|
apt-get install -y libaio1t64; \
|
|
fi
|
|
|
|
# Install dependencies for TDS driver (required for SAP ASE dynamic secrets)
|
|
RUN apt-get install -y \
|
|
unixodbc \
|
|
unixodbc-dev \
|
|
freetds-dev \
|
|
freetds-bin \
|
|
tdsodbc
|
|
|
|
RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nFileUsage = 1\n" > /etc/odbcinst.ini
|
|
|
|
# Build and install SoftHSM2
|
|
RUN git clone https://github.com/opendnssec/SoftHSMv2.git ${SOFTHSM2_SOURCES}
|
|
WORKDIR ${SOFTHSM2_SOURCES}
|
|
|
|
RUN git checkout ${SOFTHSM2_VERSION} -b ${SOFTHSM2_VERSION} \
|
|
&& sh autogen.sh \
|
|
&& ./configure --prefix=/usr/local --disable-gost \
|
|
&& make \
|
|
&& make install
|
|
|
|
WORKDIR /root
|
|
RUN rm -fr ${SOFTHSM2_SOURCES}
|
|
|
|
# Install pkcs11-tool
|
|
RUN apt-get install -y opensc
|
|
|
|
# Install Oracle Instant Client for OracleDB mTLS (Wallet) support
|
|
RUN mkdir -p /opt/oracle && \
|
|
ARCH=$(dpkg --print-architecture) && \
|
|
if [ "$ARCH" = "arm64" ]; then \
|
|
EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32" && \
|
|
curl -o /tmp/instantclient.zip https://download.oracle.com/otn_software/linux/instantclient/2326000/instantclient-basic-linux.arm64-23.26.0.0.0.zip; \
|
|
else \
|
|
EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5" && \
|
|
curl -o /tmp/instantclient.zip https://download.oracle.com/otn_software/linux/instantclient/2326000/instantclient-basic-linux.x64-23.26.0.0.0.zip; \
|
|
fi && \
|
|
echo "$EXPECTED_SHA /tmp/instantclient.zip" | sha256sum -c - && \
|
|
unzip -oq /tmp/instantclient.zip -d /opt/oracle && \
|
|
rm /tmp/instantclient.zip && \
|
|
echo /opt/oracle/instantclient_23_26 > /etc/ld.so.conf.d/oracle-instantclient.conf && \
|
|
ldconfig
|
|
|
|
WORKDIR /openssl-build
|
|
RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
|
|
&& tar -xf openssl-3.1.2.tar.gz \
|
|
&& cd openssl-3.1.2 \
|
|
&& ./Configure enable-fips \
|
|
&& make \
|
|
&& make install_fips \
|
|
&& cd / \
|
|
&& rm -rf /openssl-build \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
|
|
|
# ? App setup
|
|
|
|
# Install Infisical CLI
|
|
RUN curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash && \
|
|
apt-get update && \
|
|
apt-get install -y infisical=0.43.14
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json package.json
|
|
COPY package-lock.json package-lock.json
|
|
|
|
COPY dev-entrypoint.sh dev-entrypoint.sh
|
|
RUN chmod +x dev-entrypoint.sh
|
|
|
|
RUN npm install
|
|
|
|
COPY . .
|
|
|
|
ENV HOST=0.0.0.0
|
|
ENV OPENSSL_CONF=/app/nodejs.fips.cnf
|
|
ENV OPENSSL_MODULES=/usr/local/lib/ossl-modules
|
|
# ENV NODE_OPTIONS=--force-fips # Note(Daniel): We can't set this on the node options because it may break for existing folks using the infisical/infisical-fips image. Instead we call crypto.setFips(true) at runtime.
|
|
ENV FIPS_ENABLED=true
|
|
|
|
ENTRYPOINT ["/app/dev-entrypoint.sh"]
|
|
CMD ["npm", "run", "dev:docker"]
|