Skip to content

Commit baf96c9

Browse files
thespadthespad
committed
Sync default config with upstream to support mTLS
1 parent b525490 commit baf96c9

4 files changed

Lines changed: 173 additions & 22 deletions

File tree

‎readme-vars.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ init_diagram: |
9595
"phpmyadmin:latest" <- Base Images
9696
# changelog
9797
changelogs:
98+
- {date: "23.08.25:", desc: "Add support for mTLS. Existing users will need to delete their config.inc.php and restart the container."}
9899
- {date: "05.07.25:", desc: "Rebase to Alpine 3.22."}
99100
- {date: "19.12.24:", desc: "Rebase to Alpine 3.21."}
100101
- {date: "27.05.24:", desc: "Existing users should update their nginx confs to avoid http2 deprecation warnings."}

‎root/defaults/config.inc.php‎

Lines changed: 115 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22

33
// Sourced from https://github.com/phpmyadmin/docker/blob/master/config.inc.php
44

5-
require('/config/phpmyadmin/config.secret.inc.php');
5+
require_once '/config/phpmyadmin/config.secret.inc.php';
6+
require_once '/config/phpmyadmin/helpers.php';
67

78
/* Ensure we got the environment */
8-
$vars = array(
9+
$vars = [
910
'PMA_ARBITRARY',
1011
'PMA_HOST',
1112
'PMA_HOSTS',
@@ -26,20 +27,45 @@
2627
'PMA_QUERYHISTORYDB',
2728
'PMA_QUERYHISTORYMAX',
2829
'MAX_EXECUTION_TIME',
29-
'MEMORY_LIMIT'
30-
);
30+
'MEMORY_LIMIT',
31+
'PMA_UPLOADDIR',
32+
'PMA_SAVEDIR',
33+
'PMA_SSL',
34+
'PMA_SSLS',
35+
'PMA_SSL_DIR',
36+
'PMA_SSL_VERIFY',
37+
'PMA_SSL_VERIFIES',
38+
'PMA_SSL_CA',
39+
'PMA_SSL_CAS',
40+
'PMA_SSL_CA_BASE64',
41+
'PMA_SSL_CAS_BASE64',
42+
'PMA_SSL_KEY',
43+
'PMA_SSL_KEYS',
44+
'PMA_SSL_KEY_BASE64',
45+
'PMA_SSL_KEYS_BASE64',
46+
'PMA_SSL_CERT',
47+
'PMA_SSL_CERTS',
48+
'PMA_SSL_CERT_BASE64',
49+
'PMA_SSL_CERTS_BASE64',
50+
];
51+
3152
foreach ($vars as $var) {
3253
$env = getenv($var);
3354
if (!isset($_ENV[$var]) && $env !== false) {
3455
$_ENV[$var] = $env;
3556
}
3657
}
58+
59+
if (! defined('PMA_SSL_DIR')) {
60+
define('PMA_SSL_DIR', $_ENV['PMA_SSL_DIR'] ?? '/config/phpmyadmin/ssl');
61+
}
62+
3763
if (isset($_ENV['PMA_QUERYHISTORYDB'])) {
38-
$cfg['QueryHistoryDB'] = boolval($_ENV['PMA_QUERYHISTORYDB']);
64+
$cfg['QueryHistoryDB'] = (bool) $_ENV['PMA_QUERYHISTORYDB'];
3965
}
4066

4167
if (isset($_ENV['PMA_QUERYHISTORYMAX'])) {
42-
$cfg['QueryHistoryMax'] = intval($_ENV['PMA_QUERYHISTORYMAX']);
68+
$cfg['QueryHistoryMax'] = (int) $_ENV['PMA_QUERYHISTORYMAX'];
4369
}
4470

4571
/* Arbitrary server connection */
@@ -52,29 +78,84 @@
5278
$cfg['PmaAbsoluteUri'] = trim($_ENV['PMA_ABSOLUTE_URI']);
5379
}
5480

81+
if (isset($_ENV['PMA_SSL_CA_BASE64'])) {
82+
$_ENV['PMA_SSL_CA'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_CA_BASE64'], 'phpmyadmin-ssl-CA', 'pem', PMA_SSL_DIR);
83+
}
84+
85+
/* Decode and save the SSL key from base64 */
86+
if (isset($_ENV['PMA_SSL_KEY_BASE64'])) {
87+
$_ENV['PMA_SSL_KEY'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_KEY_BASE64'], 'phpmyadmin-ssl-CERT', 'cert', PMA_SSL_DIR);
88+
}
89+
90+
/* Decode and save the SSL certificate from base64 */
91+
if (isset($_ENV['PMA_SSL_CERT_BASE64'])) {
92+
$_ENV['PMA_SSL_CERT'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_CERT_BASE64'], 'phpmyadmin-ssl-CERT', 'cert', PMA_SSL_DIR);
93+
}
94+
95+
/* Decode and save multiple SSL CA certificates from base64 */
96+
if (isset($_ENV['PMA_SSL_CAS_BASE64'])) {
97+
$_ENV['PMA_SSL_CAS'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_CAS_BASE64'], 'phpmyadmin-ssl-CA', 'pem', PMA_SSL_DIR);
98+
}
99+
100+
/* Decode and save multiple SSL keys from base64 */
101+
if (isset($_ENV['PMA_SSL_KEYS_BASE64'])) {
102+
$_ENV['PMA_SSL_KEYS'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_KEYS_BASE64'], 'phpmyadmin-ssl-CERT', 'cert', PMA_SSL_DIR);
103+
}
104+
105+
/* Decode and save multiple SSL certificates from base64 */
106+
if (isset($_ENV['PMA_SSL_CERTS_BASE64'])) {
107+
$_ENV['PMA_SSL_CERTS'] = decodeBase64AndSaveFiles($_ENV['PMA_SSL_CERTS_BASE64'], 'phpmyadmin-ssl-KEY', 'key', PMA_SSL_DIR);
108+
}
109+
55110
/* Figure out hosts */
56111

57112
/* Fallback to default linked */
58-
$hosts = array('db');
113+
$hosts = ['db'];
59114

60115
/* Set by environment */
61-
if (!empty($_ENV['PMA_HOST'])) {
62-
$hosts = array($_ENV['PMA_HOST']);
63-
$verbose = array($_ENV['PMA_VERBOSE']);
64-
$ports = array($_ENV['PMA_PORT']);
65-
} elseif (!empty($_ENV['PMA_HOSTS'])) {
116+
if (! empty($_ENV['PMA_HOST'])) {
117+
$hosts = [$_ENV['PMA_HOST']];
118+
$verbose = [$_ENV['PMA_VERBOSE']];
119+
$ports = [$_ENV['PMA_PORT']];
120+
$ssls = [$_ENV['PMA_SSL']];
121+
$ssl_verifies = [$_ENV['PMA_SSL_VERIFY']];
122+
$ssl_cas = [$_ENV['PMA_SSL_CA']];
123+
$ssl_keys = [$_ENV['PMA_SSL_KEY']];
124+
$ssl_certs = [$_ENV['PMA_SSL_CERT']];
125+
} elseif (! empty($_ENV['PMA_HOSTS'])) {
66126
$hosts = array_map('trim', explode(',', $_ENV['PMA_HOSTS']));
67127
$verbose = array_map('trim', explode(',', $_ENV['PMA_VERBOSES']));
68128
$ports = array_map('trim', explode(',', $_ENV['PMA_PORTS']));
129+
$ssls = array_map('trim', explode(',', $_ENV['PMA_SSLS']));
130+
$ssl_verifies = array_map('trim', explode(',', $_ENV['PMA_SSL_VERIFIES']));
131+
$ssl_cas = array_map('trim', explode(',', $_ENV['PMA_SSL_CAS']));
132+
$ssl_keys = array_map('trim', explode(',', $_ENV['PMA_SSL_KEYS']));
133+
$ssl_certs = array_map('trim', explode(',', $_ENV['PMA_SSL_CERTS']));
69134
}
70-
if (!empty($_ENV['PMA_SOCKET'])) {
71-
$sockets = array($_ENV['PMA_SOCKET']);
72-
} elseif (!empty($_ENV['PMA_SOCKETS'])) {
135+
136+
if (! empty($_ENV['PMA_SOCKET'])) {
137+
$sockets = [$_ENV['PMA_SOCKET']];
138+
} elseif (! empty($_ENV['PMA_SOCKETS'])) {
73139
$sockets = explode(',', $_ENV['PMA_SOCKETS']);
74140
}
75141

76142
/* Server settings */
77143
for ($i = 1; isset($hosts[$i - 1]); $i++) {
144+
if (isset($ssls[$i - 1]) && $ssls[$i - 1] === '1') {
145+
$cfg['Servers'][$i]['ssl'] = $ssls[$i - 1];
146+
}
147+
if (isset($ssl_verifies[$i - 1]) && $ssl_verifies[$i - 1] === '1') {
148+
$cfg['Servers'][$i]['ssl_verify'] = $ssl_verifies[$i - 1];
149+
}
150+
if (isset($ssl_cas[$i - 1])) {
151+
$cfg['Servers'][$i]['ssl_ca'] = $ssl_cas[$i - 1];
152+
}
153+
if (isset($ssl_keys[$i - 1])) {
154+
$cfg['Servers'][$i]['ssl_key'] = $ssl_keys[$i - 1];
155+
}
156+
if (isset($ssl_certs[$i - 1])) {
157+
$cfg['Servers'][$i]['ssl_cert'] = $ssl_certs[$i - 1];
158+
}
78159
$cfg['Servers'][$i]['host'] = $hosts[$i - 1];
79160
if (isset($verbose[$i - 1])) {
80161
$cfg['Servers'][$i]['verbose'] = $verbose[$i - 1];
@@ -126,9 +207,10 @@
126207
$cfg['Servers'][$i]['compress'] = false;
127208
$cfg['Servers'][$i]['AllowNoPassword'] = true;
128209
}
129-
for ($i = 1; isset($sockets[$i - 1]); $i++) {
130-
$cfg['Servers'][$i]['socket'] = $sockets[$i - 1];
131-
$cfg['Servers'][$i]['host'] = 'localhost';
210+
// Avoid overwriting the last server id $i, use another variable name
211+
for ($socketHostId = 1; isset($sockets[$socketHostId - 1]); $socketHostId++) {
212+
$cfg['Servers'][$socketHostId]['socket'] = $sockets[$socketHostId - 1];
213+
$cfg['Servers'][$socketHostId]['host'] = 'localhost';
132214
}
133215
/*
134216
* Revert back to last configured server to make
@@ -137,9 +219,13 @@
137219
$i--;
138220

139221
/* Uploads setup */
140-
$cfg['UploadDir'] = '';
141-
$cfg['SaveDir'] = '';
142-
$cfg['TempDir'] = '/tmp';
222+
if (isset($_ENV['PMA_UPLOADDIR'])) {
223+
$cfg['UploadDir'] = $_ENV['PMA_UPLOADDIR'];
224+
}
225+
226+
if (isset($_ENV['PMA_SAVEDIR'])) {
227+
$cfg['SaveDir'] = $_ENV['PMA_SAVEDIR'];
228+
}
143229

144230
if (isset($_ENV['MAX_EXECUTION_TIME'])) {
145231
$cfg['ExecTimeLimit'] = $_ENV['MAX_EXECUTION_TIME'];
@@ -151,5 +237,12 @@
151237

152238
/* Include User Defined Settings Hook */
153239
if (file_exists('/config/phpmyadmin/config.user.inc.php')) {
154-
include('/config/phpmyadmin/config.user.inc.php');
240+
include '/config/phpmyadmin/config.user.inc.php';
241+
}
242+
243+
/* Support additional configurations */
244+
if (is_dir('/config/phpmyadmin/conf.d/')) {
245+
foreach (glob('/config/phpmyadmin/conf.d/*.php') as $filename) {
246+
include $filename;
247+
}
155248
}

‎root/defaults/helpers.php‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?php
2+
3+
// Sourced from https://github.com/phpmyadmin/docker/blob/master/helpers.php
4+
5+
declare(strict_types=1);
6+
7+
/**
8+
* Helper function to decode and save multiple SSL files from base64.
9+
*
10+
* @param string $base64FilesContents The base64 encoded string containing multiple files separated by commas.
11+
* If no commas are present, the entire string is treated as a single file.
12+
* @param string $prefix The prefix to use for the generated file names.
13+
* @param string $extension The file extension to use for the generated files.
14+
* @param string $storageFolder The folder where to store the generated files.
15+
*
16+
* @return string A comma-separated list of paths to the generated files.
17+
*/
18+
function decodeBase64AndSaveFiles(string $base64FilesContents, string $prefix, string $extension, string $storageFolder): string
19+
{
20+
// Ensure the output directory exists
21+
if (! is_dir($storageFolder)) {
22+
mkdir($storageFolder, 0755, true);
23+
}
24+
25+
// Split the base64 string into an array of files
26+
$base64FilesContents = explode(',', trim($base64FilesContents));
27+
$counter = 1;
28+
$outputFiles = [];
29+
30+
// Process each file
31+
foreach ($base64FilesContents as $base64FileContent) {
32+
$outputFile = $storageFolder . '/' . $prefix . '-' . $counter . '.' . $extension;
33+
34+
$fileContent = base64_decode($base64FileContent, true);
35+
if ($fileContent === false) {
36+
echo 'Failed to decode: ' . $base64FileContent;
37+
exit(1);
38+
}
39+
40+
// Write the decoded file to the output directory
41+
if (file_put_contents($outputFile, $fileContent) === false) {
42+
echo 'Failed to write to ' . $outputFile;
43+
exit(1);
44+
}
45+
46+
// Add the output file path to the list
47+
$outputFiles[] = $outputFile;
48+
$counter++;
49+
}
50+
51+
// Return a comma-separated list of the generated file paths
52+
return implode(',', $outputFiles);
53+
}

‎root/etc/s6-overlay/s6-rc.d/init-phpmyadmin-config/run‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ if [[ ! -f /config/phpmyadmin/config.inc.php ]]; then
2727
cp /defaults/config.inc.php /config/phpmyadmin/config.inc.php
2828
fi
2929

30+
if [[ ! -f /config/phpmyadmin/helpers.php ]]; then
31+
cp /defaults/helpers.php /config/phpmyadmin/helpers.php
32+
fi
33+
3034
if [[ -z ${LSIO_READ_ONLY_FS} ]] && [[ -z ${LSIO_NON_ROOT_USER} ]]; then
3135
# Set up themes
3236
if [[ -d "/config/themes" && ! -L "/app/www/public/themes" ]]; then

0 commit comments

Comments
 (0)