How to make trame docker serve https/wss directly?

[tayran-mila]

Hello everyone!

I am currently working on enabling the HTTPS service in my application, but I'm encountering some issues.

My application is essentially running based on the trame cookie cutter example and it is hosted remotely. I've created two certificate files and placed them inside my trame environment using a Dockerfile, with the file paths '/etc/ssl/certs/trame.crt' and '/etc/ssl/private/trame.key'.

Following Sebastien's suggestion in another thread, I have made the necessary configurations in the apps.yml file:

trame: # Default app under /index.html
  cmd:
    - /opt/paraview/bin/pvpython
    - -m
    - paraview.apps.trame
    - --trame-app
    - dashboard
    - --data
    - /data
    - --host
    - ${host}
    - --port
    - ${port}
    - --authKey
    - ${secret}
    - --ssl
    - '/etc/ssl/certs/trame.crt,/etc/ssl/private/trame.key'
    - --server
dashboard: # /dashboard.html
  cmd:
    - /opt/paraview/bin/pvpython
    - -m
    - paraview.apps.trame
    - --trame-app
    - dashboard
    - --data
    - ${data} # <-- come from url(data=...)
    - --host
    - ${host}
    - --port
    - ${port}
    - --authKey
    - ${secret}
    - --ssl
    - '/etc/ssl/certs/trame.crt,/etc/ssl/private/trame.key'
    - --server

Then I updated the Apache configuration file '/etc/apache2/sites-available/default-ssl.conf' within docker to contain the path to the files (though I am not sure if this is the file I should have modified):

<IfModule mod_ssl.c>
        <VirtualHost *:443>
                ServerAdmin webmaster@localhost

                DocumentRoot /var/www/html

                # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                # error, crit, alert, emerg.
                # It is also possible to configure the loglevel for particular
                # modules, e.g.
                #LogLevel info ssl:warn

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                # For most configuration files from conf-available/, which are
                # enabled or disabled at a global level, it is possible to
                # include a line for only one particular virtual host. For example the
                # following line enables the CGI configuration for this host only
                # after it has been globally disabled with "a2disconf".
                #Include conf-available/serve-cgi-bin.conf

                #   SSL Engine Switch:
                #   Enable/Disable SSL for this virtual host.
                SSLEngine on

                #   A self-signed (snakeoil) certificate can be created by installing
                #   the ssl-cert package. See
                #   /usr/share/doc/apache2/README.Debian.gz for more info.
                #   If both key and certificate are stored in the same file, only the
                #   SSLCertificateFile directive is needed.
                SSLCertificateFile /etc/ssl/certs/trame.crt
                SSLCertificateKeyFile /etc/ssl/private/trame.key

                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

        </VirtualHost>
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Finally, I built the image and ran the run_image.sh as:

#!/usr/bin/env bash


echo "$HOME/dashboard/data"

docker run -it --rm \
    -p 8081:443 \
    --network=postgres-network \
    -v "$HOME:/work" \
    dashboard_dev

It is still not working and the docker logs are not helping. Would you happen to have any idea what I am doing wrong?

[jourdain]

So if you go the Apache route, you should not do SSL at the trame layer (apps.yml).

Then you need to expose the following config with the SSL part.

Also you can see how we were doing that years ago here

[tayran-mila]

Thank you for your help, @jourdain !

Now it is working. I am going to show here what I did in case someone needs to do the same in the future:

The first thing I did was to create the certificates (trame.crt and trame.key) and a copy of the apache configuration file 001-trame.conf as Sebastien showed in his answer.

The 001-trame.conf configuration file is like this:

<VirtualHost *:80>

    ServerAdmin webmaster@localhost
    DocumentRoot /deploy/server/www
    ErrorLog /deploy/server/logs/apache/error.log
    CustomLog /deploy/server/logs/apache/access.log combined


    ## The following commented lines could be useful when running
    ## over https and wss:
    SSLEngine On
    SSLCertificateFile    /etc/ssl/certs/trame.crt
    SSLCertificateKeyFile /etc/ssl/private/trame.key
    # SSLCertificateChainFile /etc/apache2/ssl/DigiCertCA.crt

    <Location /deploy/server/www>
        SSLRequireSSL On
        SSLVerifyClient optional
        SSLVerifyDepth 1
        SSLOptions +StdEnvVars +StrictRequire
    </Location>

    <Directory /deploy/server/www>
      Options Indexes FollowSymLinks
      Order allow,deny
      Allow from all
      AllowOverride None
      Require all granted
    </Directory>

    Header set Access-Control-Allow-Origin "*"

    # Handle launcher forwarding
    ProxyPass /launcher http://localhost:9000/paraview
    ProxyPass /paraview http://localhost:9000/paraview

    # Handle WebSocket forwarding
    RewriteEngine On
    RewriteMap session-to-port txt:/opt/trame/proxy-mapping.txt
    RewriteCond %{QUERY_STRING} ^sessionId=(.*)&path=(.*)$ [NC]
    RewriteRule ^/proxy.*$  ws://${session-to-port:%1}/%2  [P]
</VirtualHost>

My Dockerfile is like this:

FROM kitware/trame:glvnd_2022-02

COPY /ssl/trame.crt /etc/ssl/certs/trame.crt
COPY /ssl/trame.key /etc/ssl/private/trame.key
COPY /ssl/001-trame.conf /etc/apache2/sites-available/001-trame.conf

RUN /bin/sh -c a2enmod vhost_alias &&     a2enmod proxy &&     a2enmod proxy_http &&     a2enmod proxy_wstunnel &&     a2enmod rewrite &&     a2enmod headers &&    a2enmod ssl &&     a2dissite 000-default.conf &&     a2ensite 001-trame &&     a2dismod autoindex -f # buildkit

# Create the /deploy directory with trame-user as the owner
RUN install -d -o trame-user -g trame-user /deploy

# Install ParaView-EGL
ARG PV_FILE=ParaView-master-5.11.0-347-g72d21070df-osmesa-MPI-Linux-Python3.9-x86_64.tar.gz
RUN mkdir -p /opt/paraview
COPY paraview/$PV_FILE /opt/paraview
RUN tar -xzvf /opt/paraview/$PV_FILE --strip-components=1 -C /opt/paraview/
ENV TRAME_PARAVIEW=/opt/paraview

# Copy the server directory
COPY --chown=trame-user:trame-user ./server /deploy/server

The important part of the docker file related to the SSL protocol is:

COPY /ssl/trame.crt /etc/ssl/certs/trame.crt
COPY /ssl/trame.key /etc/ssl/private/trame.key
COPY /ssl/001-trame.conf /etc/apache2/sites-available/001-trame.conf

RUN /bin/sh -c a2enmod vhost_alias &&     a2enmod proxy &&     a2enmod proxy_http &&     a2enmod proxy_wstunnel &&     a2enmod rewrite &&     a2enmod headers &&    a2enmod ssl &&     a2dissite 000-default.conf &&     a2ensite 001-trame &&     a2dismod autoindex -f # buildkit

Where first I copy the certificates and the configuration file to my docker image and then I run the command that I saw in kitware/trame:glvnd_2022-02.

It is important to add a2enmod ssl to this RUN. Without it the SSLEngine On command inside the configuration file will not be recognized.

Then I built and ran my image and Voilà, it worked!

Thanks again @jourdain, for all your help!

[jourdain]

I'm glad you figured it out, and thanks for sharing the complete solution.