bostonuniversity/apache-php-fpm repository overview

⁠Apache PHP FPM

Apache containers created with this image serve as the front-end for the application containers. The functions of the Apache:

1. Serve static content

2. Apply .htaccess rules

3. Play Shibboleth Service Provider role

4. Implement basic security measures (such as bouncing off requests with unknown Host headers) or enforce HTTPS.

5. Provide session mechanism that can be controlled from PHP code.

Normally, containers based off of this image are not adding the content (such as pictures or .htaccess files), instead it's expected that the volume will be attached to the container somewhere in /var/www/html.

In other word, this image shouldn't be built in CodePipeline, it can be used directly it the TaskDefinition.

⁠Linked container

This container expects another one with the name phpbin to exist in the same network. This container should run PHP FPM on port 9000.

Otherwise, *.php files won't be working.

In production, we achieve it by using the Links parameter of the ContainerDefinitions section of AWS::ECS::TaskDefinition⁠.

In local environment, the easiest way to achieve it is to use docker-compose.

⁠Environment Variables

sp_skip_update (when set to any non-empty value) allows to avoid downloading the IdP metadata when running the container. It's generally useful only for local development.

SP_HOME_URL must start and end with /.

PROXY_INTERNAL is corresponding to Apache's RemoteIPInternalProxy Directive⁠. PROXY_EXTERNAL is corresponding to Apache's RemoteIPTrustedProxy Directive⁠. The default value of PROXY_INTERNAL is overly permissive and intended only for development environments. For production, you need to figure out the proper combination of values passed as PROXY_INTERNAL and PROXY_EXTERNAL. If not sure if you need this, set both to empty strings.

⁠Sandbox

The local sandbox is available for you to experiment with the Apache container. The sandbox consists of an IdP connected to an LDAP that this container can communicate with and an SSL terminating proxy in front of it.

Also, there's a basic PHP application⁠ that hides behind the Apache and the container is called phpbin. This setup is simulating how real app containers are configured.

To start the sandbox, run:

docker-compose up --build --force-recreate

While it's running, you can open a bash session with the container:

docker-compose exec sp bash

When done, don't forget to clean up:

docker-compose down

⁠Local credentials

The LDAP has several pre-defined accounts that you can use to login. Try using superadmin, student1, or staff for the username and password for the password.

Feel free to edit the LDAP config⁠ to add more.

⁠Useful links

• https://localhost/phpbin/hello-world⁠
• https://localhost/phpbin/hello-world/csp-error.html⁠
• https://localhost/phpbin/hello-world/phpinfo.php⁠
• https://localhost/phpbin/hello-world/admin/⁠
• https://localhost/phpbin/hello-world/admin/non-index.php⁠
• https://localhost/phpbin/hello-world/admin/?set_session⁠
• https://localhost/phpbin/hello-world/admin/?clear_session⁠
• https://localhost/Shibboleth.sso/Login?target=https://localhost/phpbin/hello-world/⁠
• https://localhost/Shibboleth.sso/Login⁠
• https://localhost/Shibboleth.sso/Logout⁠
• https://localhost/Shibboleth.sso/Session⁠
• https://localhost/idp/profile/Logout⁠
• https://localhost/errors/404.html⁠

⁠Testing

cd tests/
scripts/all_cases.sh