Skip to content

Commit ba8c4c2

Browse files
Marc-André Moreauawakecoding
Marc-André Moreau
authored and
awakecoding
committed
improve container image for Azure Web App usage
1 parent c4af593 commit ba8c4c2

File tree

3 files changed

+410
-4
lines changed

3 files changed

+410
-4
lines changed

‎package/Linux/Dockerfile

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,16 @@ RUN apt-get update \
88
&& rm packages-microsoft-prod.deb \
99
&& apt-get update \
1010
&& apt-get install -y --no-install-recommends \
11-
powershell \
11+
powershell openssl \
1212
&& rm -rf /var/lib/apt/lists/*
1313

14+
ENV XDG_CACHE_HOME="/tmp/.cache"
15+
ENV XDG_DATA_HOME="/tmp/.local/share"
16+
ENV POWERSHELL_TELEMETRY_OPTOUT="1"
17+
18+
ENV DGATEWAY_CONFIG_PATH="/tmp/devolutions-gateway"
19+
RUN mkdir -p "$DGATEWAY_CONFIG_PATH"
20+
1421
WORKDIR /opt/devolutions/gateway
1522

1623
ENV DGATEWAY_EXECUTABLE_PATH="/opt/devolutions/gateway/devolutions-gateway"
@@ -26,7 +33,9 @@ RUN apt-get update
2633
RUN apt-get install -y --no-install-recommends ca-certificates curl
2734
RUN rm -rf /var/lib/apt/lists/*
2835

29-
EXPOSE 8080
30-
EXPOSE 10256
36+
EXPOSE 7171
37+
EXPOSE 8181
3138

32-
ENTRYPOINT [ "./devolutions-gateway" ]
39+
COPY entrypoint.ps1 /usr/local/bin/entrypoint.ps1
40+
RUN chmod +x /usr/local/bin/entrypoint.ps1
41+
ENTRYPOINT ["pwsh", "-File", "/usr/local/bin/entrypoint.ps1"]

‎package/Linux/README.md

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# 🚪 Devolutions Gateway – Container Entry Point
2+
3+
This container entry script configures and runs the **Devolutions Gateway** using environment variables. It is compatible with both Docker and Azure Web App (Linux) deployments.
4+
5+
## 🚀 Simple Example
6+
7+
Run this:
8+
9+
```powershell
10+
docker run -it --rm `
11+
-e PORT=7171 `
12+
-p 7171:7171 `
13+
-e WEB_APP_ENABLED=true `
14+
devolutions-gateway:latest
15+
```
16+
17+
Then open http://localhost:7171
18+
19+
---
20+
21+
## 🌐 Web Listener Configuration
22+
23+
| Variable | Description | Default |
24+
|---------------------------|--------------------------------------------------------------------|------------|
25+
| `WEB_SCHEME` | Internal web scheme: `http` or `https` | `http` |
26+
| `WEB_PORT` or `PORT` | Internal port for the web listener | `7171` |
27+
| `EXTERNAL_WEB_SCHEME` | Scheme used externally (e.g. `https` behind a proxy) | `WEB_SCHEME` |
28+
| `EXTERNAL_WEB_PORT` | Port exposed externally to clients | `WEB_PORT` |
29+
| `HOSTNAME` | Hostname for certificate and configuration | `localhost` |
30+
| `WEBSITE_HOSTNAME` | Azure App hostname (auto-detected) | *(Azure)* |
31+
| `WEBSITE_INSTANCE_ID` | Azure instance ID (forces external scheme to `https`, port 443) | *(Azure)* |
32+
33+
---
34+
35+
## 🔌 TCP Listener Configuration
36+
37+
| Variable | Description | Default |
38+
|----------------------|----------------------------------------------------------------|----------|
39+
| `TCP_ENABLED` | Enables the TCP listener | `true` |
40+
| `TCP_PORT` | Internal TCP listener port | `8181` |
41+
| `EXTERNAL_TCP_PORT` | External TCP port | `TCP_PORT` |
42+
| `TCP_HOSTNAME` | External hostname for TCP listener | `*` |
43+
44+
> When `WEB_APP_ENABLED=true`, `TCP_ENABLED` is disabled by default because it is not used in standalone web access.
45+
46+
---
47+
48+
## 🔐 Web App Configuration
49+
50+
| Variable | Description | Default |
51+
|--------------------------|--------------------------------------------------------|---------|
52+
| `WEB_APP_ENABLED` | Enables the embedded admin Web UI | `false` |
53+
| `WEB_APP_AUTHENTICATION` | Auth mode: `None` or `Custom` | `None` |
54+
| `WEB_APP_USERNAME` | Username for custom auth | unset |
55+
| `WEB_APP_PASSWORD` | Password for custom auth | unset |
56+
57+
---
58+
59+
## 🎥 Session Recording & Logging
60+
61+
| Variable | Description | Default |
62+
|---------------------|----------------------------------------------------|---------|
63+
| `RECORDING_PATH` | Directory path to store session recordings | unset |
64+
| `VERBOSITY_PROFILE` | Logging verbosity level (`Default`, `Debug`, `Tls`, `All`, `Quiet`) | unset |
65+
66+
---
67+
68+
## 🔑 Provisioner Key Injection
69+
70+
Use these to inject a pre-generated key pair into the container:
71+
72+
| Variable | Description |
73+
|------------------------------|----------------------------------------|
74+
| `PROVISIONER_PUBLIC_KEY_B64`| Base64-encoded `.pem` public key |
75+
| `PROVISIONER_PRIVATE_KEY_B64`| Base64-encoded `.key` private key |
76+
77+
- If neither is provided, a new key pair will be generated.
78+
79+
---
80+
81+
## 🔐 TLS Certificate Injection
82+
83+
Use these to inject a TLS certificate and private key into the container:
84+
85+
| Variable | Description |
86+
|---------------------------|--------------------------------------------|
87+
| `TLS_CERTIFICATE_B64` | Base64-encoded TLS certificate `.pem` |
88+
| `TLS_PRIVATE_KEY_B64` | Base64-encoded private key `.key` |
89+
| `TLS_CERTIFICATE_PASSWORD`| Optional password for encrypted certificate |
90+
91+
- If not set and `WEB_SCHEME=https`, a self-signed cert will be generated using OpenSSL.
92+
93+
---
94+
95+
## 🧪 Health Check
96+
97+
The Devolutions Gateway HTTP health check endpoint is `/jet/health`
98+
99+
---
100+
101+
## 🧪 Sample Usage
102+
103+
Launching Devolutions Gateway with a provisioner public key, an HTTP listener, a TCP listener, using a reverse proxy for HTTPS and external access:
104+
105+
```powershell
106+
$Env:PROVISIONER_PUBLIC_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("provisioner.pem"))
107+
108+
docker run -it --rm `
109+
--name gateway-test `
110+
-p 7171:7171 `
111+
-p 8181:8181 `
112+
-e WEB_PORT=7171 `
113+
-e TCP_PORT=8181 `
114+
-e WEB_SCHEME=http `
115+
-e EXTERNAL_WEB_SCHEME=https `
116+
-e HOSTNAME=gateway.contoso.local `
117+
-e VERBOSITY_PROFILE=all `
118+
-e PROVISIONER_PUBLIC_KEY_B64=$Env:PROVISIONER_PUBLIC_KEY_B64 `
119+
devolutions-gateway:latest
120+
```
121+
122+
Launching Devolutions Gateway with a provisioner public key, an HTTPS listener with a certificate, external hostname, and TCP listener:
123+
124+
```powershell
125+
$Env:PROVISIONER_PUBLIC_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("provisioner.pem"))
126+
$Env:TLS_CERTIFICATE_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("server.crt"))
127+
$Env:TLS_PRIVATE_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("server.key"))
128+
129+
docker run -it --rm `
130+
--name gateway-test `
131+
-p 7171:7171 `
132+
-p 8181:8181 `
133+
-e WEB_PORT=7171 `
134+
-e TCP_PORT=8181 `
135+
-e WEB_SCHEME=https `
136+
-e HOSTNAME=gateway.contoso.local `
137+
-e VERBOSITY_PROFILE=all `
138+
-e PROVISIONER_PUBLIC_KEY_B64=$Env:PROVISIONER_PUBLIC_KEY_B64 `
139+
-e TLS_CERTIFICATE_B64=$Env:TLS_CERTIFICATE_B64 `
140+
-e TLS_PRIVATE_KEY_B64=$Env:TLS_PRIVATE_KEY_B64 `
141+
devolutions-gateway:latest
142+
```
143+
144+
Launching Devolutions Gateway with a provisioner public key, with a custom TCP hostname and port used for external access:
145+
146+
```powershell
147+
$Env:PROVISIONER_PUBLIC_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("provisioner.pem"))
148+
149+
docker run -it --rm `
150+
--name gateway-test `
151+
-p 7171:7171 `
152+
-p 8181:8181 `
153+
-e WEB_PORT=7171 `
154+
-e TCP_PORT=8181 `
155+
-e WEB_SCHEME=http `
156+
-e EXTERNAL_WEB_SCHEME=https `
157+
-e HOSTNAME=gateway.contoso.local `
158+
-e TCP_HOSTNAME=tcp.contoso.local `
159+
-e EXTERNAL_TCP_PORT=9191 `
160+
-e VERBOSITY_PROFILE=all `
161+
-e PROVISIONER_PUBLIC_KEY_B64=$Env:PROVISIONER_PUBLIC_KEY_B64 `
162+
devolutions-gateway:latest
163+
```
164+
165+
Launching Devolutions Gateway with an injected provisioner key pair and certificate:
166+
167+
```powershell
168+
$Env:PROVISIONER_PUBLIC_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("provisioner.pem"))
169+
$Env:PROVISIONER_PRIVATE_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("provisioner.key"))
170+
$Env:TLS_CERTIFICATE_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("server.crt"))
171+
$Env:TLS_PRIVATE_KEY_B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("server.key"))
172+
173+
docker run -it --rm `
174+
--name gateway-test `
175+
-p 7171:7171 `
176+
-e PORT=7171 `
177+
-e WEB_SCHEME=https `
178+
-e WEB_APP_ENABLED=true `
179+
-e RECORDING_PATH=/tmp/recording `
180+
-e VERBOSITY_PROFILE=all `
181+
-e PROVISIONER_PUBLIC_KEY_B64=$Env:PROVISIONER_PUBLIC_KEY_B64 `
182+
-e PROVISIONER_PRIVATE_KEY_B64=$Env:PROVISIONER_PRIVATE_KEY_B64 `
183+
-e TLS_CERTIFICATE_B64=$Env:TLS_CERTIFICATE_B64 `
184+
-e TLS_PRIVATE_KEY_B64=$Env:TLS_PRIVATE_KEY_B64 `
185+
devolutions-gateway:latest
186+
```

0 commit comments

Comments
 (0)