Merge branch 'LA-3.0.0' into 'master'

# Certificate files (sensitive)

*.pfx

*.p12

*.jks

*.keystore

# Properties files (sensitive configuration)

*.properties

certificate.properties

# Log files

*.log

logs/

*.out

# OS specific files

.DS_Store

Thumbs.db

# IDE specific files

.idea/

.vscode/

*.iml

*.swp

*.swo

*~

# Build directories

build/

target/

dist/

out/

# Docker volumes

docker-volumes/

# Temporary files

*.tmp

*.temp

temp/

tmp/

# DocSigner Application Dockerfile

# Build with: docker build --build-arg JAVA_VERSION=17 -t docsigner:java17 .

# Supported Java versions: 17, 21, or 24

# Declare build argument before FROM statement

ARG JAVA_VERSION=17

FROM eclipse-temurin:${JAVA_VERSION}-jdk

# Metadata labels

LABEL maintainer="Leegality"

LABEL description="Document Signer Application for eSign operations"

LABEL version="1.0.1"

LABEL java.version="${JAVA_VERSION}"

LABEL tomcat.version="11.0.10"

# Set environment variables

ENV TOMCAT_VERSION=11.0.10

ENV TOMCAT_HOME=/opt/tomcat

ENV CATALINA_HOME=/opt/tomcat

ENV PATH=$PATH:$TOMCAT_HOME/bin

ENV PROPERTY_FILE="/opt/tomcat/webapps/docsigner/certificate.properties"

# Install required packages and set up Tomcat with security enhancements

RUN apt-get update && apt-get install -y \

    wget curl \

    && rm -rf /var/lib/apt/lists/* \

    && wget https://archive.apache.org/dist/tomcat/tomcat-11/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz \

    && tar -xzf apache-tomcat-${TOMCAT_VERSION}.tar.gz \

    && mv apache-tomcat-${TOMCAT_VERSION} ${TOMCAT_HOME} \

    && rm apache-tomcat-${TOMCAT_VERSION}.tar.gz \

    && mkdir -p ${TOMCAT_HOME}/webapps \

    && mkdir -p ${TOMCAT_HOME}/certificates \

    && mkdir -p ${TOMCAT_HOME}/logs

# Copy the WAR file (ensure you're using the correct Java version WAR file)

COPY docsigner.war ${TOMCAT_HOME}/webapps/docsigner.war

# Copy certificate files

COPY certificate.pfx ${TOMCAT_HOME}/certificates/certificate.pfx

# To copy multiple certificates, uncomment the following lines

# COPY certificate2.pfx ${TOMCAT_HOME}/certificates/certificate2.pfx

# COPY certificate3.pfx ${TOMCAT_HOME}/certificates/certificate3.pfx

# COPY certificate4.pfx ${TOMCAT_HOME}/certificates/certificate4.pfx

COPY certificate.properties /opt/tomcat/webapps/docsigner/certificate.properties

# Extract WAR, configure permissions, cleanup, and security settings (consolidated to reduce layers)

RUN cd ${TOMCAT_HOME}/webapps && \

    mkdir -p docsigner && \

    cd docsigner && \

    jar -xf ../docsigner.war && \

    echo "WAR file extracted successfully" && \

    ls -la ${TOMCAT_HOME}/webapps/docsigner/ && \

    # Configure WAR file permissions

    chmod 755 ${TOMCAT_HOME}/webapps/docsigner.war && \

    chown -R root:root ${TOMCAT_HOME}/webapps/ && \

    chmod -R 755 ${TOMCAT_HOME}/webapps/ && \

    # Remove unnecessary default Tomcat webapps for security

    rm -rf ${TOMCAT_HOME}/webapps/ROOT ${TOMCAT_HOME}/webapps/docs ${TOMCAT_HOME}/webapps/examples ${TOMCAT_HOME}/webapps/host-manager ${TOMCAT_HOME}/webapps/manager && \

    # Enable auto-deploy and WAR unpacking

    sed -i 's/autoDeploy="false"/autoDeploy="true"/g' ${TOMCAT_HOME}/conf/server.xml && \

    sed -i 's/unpackWARs="false"/unpackWARs="true"/g' ${TOMCAT_HOME}/conf/server.xml && \

    # Security: Disable directory listing

    sed -i 's/<param-value>true<\/param-value>/<param-value>false<\/param-value>/g' ${TOMCAT_HOME}/conf/web.xml && \

    # Security: Set secure file permissions on configuration files

    chmod 600 ${TOMCAT_HOME}/conf/server.xml ${TOMCAT_HOME}/conf/web.xml && \

    chmod 700 ${TOMCAT_HOME}/conf ${TOMCAT_HOME}/logs ${TOMCAT_HOME}/work ${TOMCAT_HOME}/temp && \

    # Security: Create a non-root user for running Tomcat

    groupadd -r tomcat && \

    useradd -r -g tomcat -d ${TOMCAT_HOME} -s /bin/false tomcat && \

    # Set permissions for certificate.properties file

    chown tomcat:tomcat /opt/tomcat/webapps/docsigner/certificate.properties && \

    chmod 644 /opt/tomcat/webapps/docsigner/certificate.properties && \

    # Verify property file exists

    echo "Checking certificate.properties file: ${PROPERTY_FILE}" && \

    if [ ! -f "${PROPERTY_FILE}" ]; then \

        echo "ERROR: property file ${PROPERTY_FILE} not found!"; \

        exit 1; \

    fi && \

    echo "property ${PROPERTY_FILE} verified successfully" && \

    # Set final ownership for all Tomcat files

    chown -R tomcat:tomcat ${TOMCAT_HOME}

# Expose port 8080

EXPOSE 8080

# Health check to monitor application status

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \

    CMD curl -f http://localhost:8080/docsigner/actuator/health || exit 1

# Set the working directory

WORKDIR ${TOMCAT_HOME}

# Switch to non-root user for security

USER tomcat

# Start Tomcat

CMD ["./bin/catalina.sh", "run"]