Can env vars be referenced in shibboleth2.xml?

[Wessel, Keith]

I tend to agree, Peter, but our organization tends to frown on supervisord being used in Docker images. If you need to start more than one daemon, they prefer it separate. So, as long as shibd is a separate piece, and I don't see that changing any time soon (if ever), I'm stuck with two pieces.

As for your comment about baking it into the container, do you mean scripting some sed magic to do the needed substitutions (or some similar technique) inside the container? That's my current plan. In AWS, the TCP listener address will always be localhost, and the acl list will always be localhost (equivalent IP, of course). In docker-compose, though, it's going to be an IP address other than localhost's. So, doing this somewhat dynamically is the goal, of course.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: Tuesday, September 29, 2020 3:55 PM
To: users at shibboleth.net
Subject: Re: Can env vars be referenced in shibboleth2.xml?

* Wessel, Keith <kwessel at illinois.edu> [2020-09-29 22:02]:
> But, since I have two containers running together to separate out 
> shibd and Apache

"It is generally recommended that you separate areas of concern by using one service per container."[1] A webserver and its modules could be considered to be "one area of concern" or "one service". The fact that the Shib SP also comes with shibd is an implementation detail that may not justify splitting up your web server into multiple containers.
Specifying --init to Docker run isn't sufficient as the default init process (tini) can only spawn a single child. s6-overlay[2] seems to be a popular choice, though.

Other than the above I'd probably use additional tooling to bake all the desired settings for the SP into the container, instead of having them applied at run-time within the container based on environment variables. That'll work with any kind of config or setting, no matter whether it can be set from within Apache httpd or not.

-peter

[1] https://docs.docker.com/config/containers/multi-service_container/
[2] https://github.com/just-containers/s6-overlay
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net