Enable/Support options to use SSL when using external MySQL database.
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- docker, mysql, shell
- Domain
- databases, infrastructure
Research direction
Inspect entrypoint.sh and the Ansible add mariadb db task that provisions the external database connection. Reproduce the failure with the listed SYMFONY__ENV__ database variables and compare mysql connections with and without --ssl. Done means the container can provision and connect to an external MySQL server that requires secure transport.
Written by the indexing model from the issue text.
Description
I am not fully sure if SSL for Database connections is supported or it seems to be broken. This is the log when I run the container in non-detached mode.
Starting provisioner...
[WARNING]: Found both group and host with same name: localhost
[WARNING]: Platform linux on host localhost is using the discovered Python
interpreter at /usr/bin/python3, but future installation of another Python
interpreter could change this. See https://docs.ansible.com/ansible/2.9/referen
ce_appendices/interpreter_discovery.html for more information.
PLAY [localhost] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var TASK [Gathering Facts] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost] TASK [needed dirs] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost] => (item=/var/www/wallabag/app) ok: [localhost] => (item=/var/www/wallabag/app/config) ok: [localhost] => (item=/var/www/wallabag/data) changed: [localhost] => (item=/var/www/wallabag/data/assets) ok: [localhost] => (item=/var/www/wallabag/data/db) TASK [write parameters.yml] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var changed: [localhost] TASK [stat] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var skipping: [localhost] TASK [notify install for sqlite] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var skipping: [localhost]
TASK [wait for db container] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var ok: [localhost]
TASK [add mariadb db] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var fatal: [localhost]: FAILED! => {"changed": false, "msg": "unable to find /root/.my.cnf. Exception message: (3159, 'Connections using insecure transport are prohibited while --require_secure_transport=ON.')"} RUNNING HANDLER [chown dir] bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var PLAY RECAP bin dev entrypoint.sh etc home lib media mnt opt proc root run sbin srv sys tmp usr var localhost : ok=4 changed=2 unreachable=0 failed=1 skipped=2 rescued=0 ignored=0
Provisioner finished.
These are environment variables passed to the container:
MYSQL_ROOT_PASSWORD, SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql, SYMFONY__ENV__DATABASE_HOST, SYMFONY__ENV__DATABASE_PORT, SYMFONY__ENV__DATABASE_NAME, SYMFONY__ENV__DATABASE_USER, SYMFONY__ENV__DATABASE_PASSWORD, SYMFONY__ENV__DATABASE_CHARSET, SYMFONY__ENV__DOMAIN_NAME.
This line indicates failure to connect due to SSL:
FAILED! => {"changed": false, "msg": "unable to find /root/.my.cnf. Exception message: (3159, 'Connections using insecure transport are prohibited while --require_secure_transport=ON.')"}
I verified this my executing mysql with and without the option --ssl from inside the container to understand the reason for failure. Without the specified option, it fails to connect with same error: 'Connections using insecure transport are prohibited while --require_secure_transport=ON.'). Adding the option --ssl works.
Not sure why it is looking for /root/.my.cnf. Adding ssl=ON in /etc/my.cnf under [client-server] defaults the connection to use SSL.
Does the container need a volume mounted that reads /root/.my.cnf for overriding the config? I did not find any references to that path in this repo.
- Dominant language
- Shell
- Stars
- 771
- Forks
- 168
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from wallabag/docker
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Awaiting response
Difficulty 4/5 3-5 days Newbie friendliness 32/100
-
Difficulty 4/5 3-5 days Newbie friendliness 28/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
Similar issues
-
data only (no code) good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
upstream-release
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
LinkStackOrg/linkstack-docker#170 · 8 reactions ·
-
Negative subscript on a sparse array counts from the number of elements, not from the highest indexOpenarea: compat bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
reubeno/brush#1570 · 1 comment ·
Maintainers usually reply within 1 day