Docker setup for the repository

[qdm12]

Hi @Bubka

I created this discussion in order to discuss the Docker setup for the repo instead of discussing in multiple issue threads.

First question is below which you can answer in the question thread 😉

Sum up of changes I would like to do:

What	Bubka/2Fauth-Docker	qdm12/2Fauth	Final	Why
Server	Apache2	Nginx+php-fpm	Nginx+php-fpm	Seems faster and understood by more people today
Listening port	80	8000	8000	Must be a non privileged internal port to run without root
User	Run only apache as non root	Run entire container without root	Run entire container without root	To reduce attack surface, especially since this is a security application
Based on	php:7.4-apache	debian:buster-slim	debian:buster-slim	Greater package choice and smaller final image
PHP version	7.4	7.3	7.3	Since that's what documented in the readme
Read env from files	yes	no	no	there is not much of a point since the env is populated with content of secret files. Correct me if I'm wrong though
Wait for database	with script	does not	???	Ideally the PHP code would do it by itself
Env	Use .env	Use env variables injected by Docker	Use env variables injected by Docker	Simpler to use for Docker users. They can always use a .env on their host to populate their env with Docker

References:

• github.com/Bubka/2FAuth-Docker
• github.com/qdm12/2FAuth/tree/docker
• github.com/TrafeX/docker-php-nginx
• PR: Docker #37

[qdm12]

I have a question regarding (from 2fauth-docker's entrypoint):

php artisan migrate
php artisan passport:install
php artisan storage:link
php artisan cache:clear > /dev/null 2>&1
php artisan config:cache > /dev/null 2>&1

On my side, inspiring from your readme and some try-and-fail, there are two cases:

• when the program runs the first time, only run:

  php artisan migrate:refresh
  php artisan passport:install
  php artisan storage:link
  php artisan config:cache

• when the program has already been installed:

  php artisan migrate
  php artisan config:clear
  php artisan storage:link
  php artisan config:cache

I write a file at /2fauth/installed to persist if the program has been installed once or not.

What do you think about this approach?

[qdm12]

Final logic should be this: https://github.com/qdm12/2FAuth/blob/6a6e19f6c0ea16c888757eadeca8e34d6120bbfb/docker/entrypoint.sh#L27-L41

[Bubka]

Hi @qdm12

Thanks for this analysis.
I'm OK with all the changes you suggest, the installed file to handle install/update state included.

I have not much experience with Docker, most of the setup I used in the 2FAuth-docker repo is based on setups I found on GitHub so I'm not married with those choices. I use Apache by habits but I know that nginx has become very popular. Others suggestions are relevant so go ahead 😃

[Bubka]

To @qdm12 and @MohamedElashri coming from #25

Yes Travis has a limit, but it's a not a true limit since it is possible to request for more time freely as long as the repo is public. From what I know this is an action they took to fight against bots that use this free server time to mine cryptos. But this is a cumbersome process I'll be happy to avoid. And I'm interested in discovering GA so no pb to leave Travis.

[Bubka]

Done ✅

[qdm12]

Cool I've already added a GA workflow to sync docker/readme.md with the Docker hub 2fauth/2fauth description. It won't run yet I think since it's not merged in master, but it should once we merge 😉

I'll work on the cross CPU Docker building GA CI later tonight or tomorrow, since I managed to make it build for N architectures almost as fast as for 1 emulated architecture, in 2 to 3 minutes on my computer.
Hopefully GA is not too slow so we can ideally build and push the image on every commit to master.

[MohamedElashri]

That's great. For the cross build, I would suggest something like that (Assuming it is for every push which we can change of course)

name: Multi Platform Build & Push to Dockerhub

on:
  push:
    branches:
      - 'docker'

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      -
        name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: 2fauth/2fauth:latest

Will need to add secrets, or we can replace ${{ secrets.DOCKERHUB_USERNAME }} with 2fauth directly but will need to add a token to secrets. We want to test how fast it build so that we can adjust the trigger.

Hint: This assumes that the build branch is docker and Dockerfile is in the root branch directory.

[qdm12]

Yeah I have something local, I'll finish it and push it tomorrow.

I also managed to speed up builds by quite a lot using the php:7.3-buster image to download/build runtime dependencies, somehow composer install is much faster (although it's the same composer).

[qdm12]

Github Actions added in f0eb186

@MohamedElashri feel free to review it 😉

[qdm12]

@Bubka I have a question, if you start using sqlite and then switch to mysql (for example), is there any migration procedure? Or not? No migration procedure is fine with me, I just want to make sure this doc section is accurate.

[MohamedElashri]

Don't use MySQL for Docker. It will make image RAM usage spike. We face this problem with Bitwarden and that's why the whole Bitwarden_rs/vaultwarden project came into exist.

[qdm12]

@MohamedElashri Well it's not up to me; by default it uses sqlite. But the user can use a mysql (or other) database in another container if they want to, since it's supported by 2fauth. Personally sqlite or even dumb json files are perfect for me 😉

[MohamedElashri]

@qdm12 Yes I know that this is by user choice. I just thought that you plan to add MySQL as a default to the docker setup which is possible as a stack for example but from experience this is overkill for this project. I usually maintain some docker images for some projects I use for myself in sqlite if they use something like mysql or postgresql.

[Bubka]

I agree that sqlite should remain the default. 2FAuth supports other databases mostly because Laravel does.

The question is: Should we provide a docker image that supports other db just because 2FAuth/Laravel support them? I'm not sure. IMO the docker image has to promote the preferred way to use 2FAuth, with a consistent image regarding the dimension of the project.

As @MohamedElashri, people who want to use a db other than sqlite are free to maintain their own image.

[qdm12]

Cool, I'll remove

• the php7.3-mysql driver (save a few bytes 🎉)
• the database migration section in the Docker readme

[qdm12]

@Bubka One last thing, do you think you could hack this sometime soon: #38 ?

It's the last piece before it's all ready (see checklist)

Thanks!