Skip to content

Commit 5703b2d

Browse files
JedMeisterJedMeister
committed
Update tomcat config for trixie - perhaps v10 & v11 should be separate?
1 parent 84dca41 commit 5703b2d

6 files changed

Lines changed: 442 additions & 21 deletions

File tree

‎conf/tomcat‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,30 @@
1-
#!/bin/sh -ex
1+
#!/bin/bash -ex
22

3-
fatal() { echo "FATAL [$(basename $0)]: $@" 1>&2; exit 1; }
3+
fatal() { echo "FATAL [$(basename "$0")]: $*" 1>&2; exit 1; }
44

5-
TOMCAT=tomcat10
5+
if [[ -e /var/lib/tomcat10 ]]; then
6+
TOMCAT=tomcat10
7+
elif [[ -e /var/lib/tomcat11 ]]; then
8+
TOMCAT=tomcat11
9+
else
10+
fatal "Tomcat version could not be determined"
11+
fi
612

713
CATALINA_HOME="/usr/share/$TOMCAT"
814
CATALINA_BASE="/var/lib/$TOMCAT"
915
CATALINA_TMPDIR="$CATALINA_BASE/temp"
1016

11-
# identify JVM to use
12-
## We check for openjdk 17
13-
[ -e /usr/lib/jvm/java-17-openjdk-amd64 ] && JVM=java-17-openjdk-amd64
14-
[ -z "$JVM" ] && fatal "JVM to use could not be identified"
17+
# identify JVM to use - Trixie provides openjdk 21 & 25
18+
if [[ -e /usr/lib/jvm/java-21-openjdk-amd64 ]]; then
19+
JVM=java-21-openjdk-amd64
20+
JINFO=$(ls /usr/lib/jvm/.*java*21*jinfo)
21+
elif [[ -e /usr/lib/jvm/java-25-openjdk-amd64 ]]; then
22+
JVM=java-25-openjdk-amd64
23+
JINFO=$(ls /usr/lib/jvm/.*java*25*jinfo)
24+
else
25+
fatal "JVM to use could not be identified"
26+
fi
27+
1528

1629
# configure java/tomcat environment
1730
cat >> /etc/environment<<EOF
@@ -22,15 +35,14 @@ JAVA_HOME="/usr/lib/jvm/${JVM}"
2235
EOF
2336

2437
# this may not be 100% safe
25-
JINFO=$(ls /usr/lib/jvm/.*java*17*jinfo)
2638
JINFO=${JINFO%.jinfo}
2739
JINFO=${JINFO#*.}
2840
# not sure if this is actually needed
29-
update-java-alternatives --jre-headless -s $JINFO
41+
update-java-alternatives --jre-headless -s "$JINFO"
3042
sed -i "s/^#JAVA_HOME.*/JAVA_HOME=\/usr\/lib\/jvm\/${JVM}/" /etc/default/$TOMCAT
3143

3244
# configure Apache if needed (Jk connector to Tomcat)
33-
if [ -e /etc/apache2/sites-available/jktomcat.conf ]; then
45+
if [[ -e /etc/apache2/sites-available/jktomcat.conf ]]; then
3446
a2dissite 000-default
3547
a2ensite jktomcat
3648

@@ -46,12 +58,12 @@ fi
4658
# create convenience links to original conf that we overwrite
4759
conf_files="tomcat-users.xml server.xml"
4860
for conf in $conf_files; do
49-
ln -s /usr/share/$TOMCAT/etc/$conf /etc/$TOMCAT/$conf.orig
61+
ln -s "/usr/share/$TOMCAT/etc/$conf" "/etc/$TOMCAT/$conf.orig"
5062
done
5163

5264
# from https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1232258
5365
create_link() {
54-
ln -s $CATALINA_BASE/$1 $CATALINA_HOME/$1
66+
ln -s "$CATALINA_BASE/$1" "$CATALINA_HOME/$1"
5567
}
5668
create_link common
5769
create_link server

‎overlays/tomcat-apache/etc/tomcat11/mod_jk.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
RedirectMatch ^/manager[/]$ /manager/html
2+
JkMount /manager ajp13_worker
3+
JkMount /manager/* ajp13_worker
4+
5+
RedirectMatch ^/host-manager[/]$ /host-manager/html
6+
JkMount /host-manager ajp13_worker
7+
JkMount /host-manager/* ajp13_worker

‎overlays/tomcat-apache/etc/tomcat11/server.xml‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<!-- Note: A "Server" is not itself a "Container", so you may not
19+
define subcomponents such as "Valves" at this level.
20+
Documentation at /docs/config/server.html
21+
-->
22+
<Server port="-1" shutdown="SHUTDOWN">
23+
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
24+
<!-- Security listener. Documentation at /docs/config/listeners.html
25+
<Listener className="org.apache.catalina.security.SecurityListener" />
26+
-->
27+
<!--APR library loader. Documentation at /docs/apr.html -->
28+
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
29+
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
30+
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
31+
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
32+
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
33+
34+
<!-- Global JNDI resources
35+
Documentation at /docs/jndi-resources-howto.html
36+
-->
37+
<GlobalNamingResources>
38+
<!-- Editable user database that can also be used by
39+
UserDatabaseRealm to authenticate users
40+
-->
41+
<Resource name="UserDatabase" auth="Container"
42+
type="org.apache.catalina.UserDatabase"
43+
description="User database that can be updated and saved"
44+
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
45+
pathname="conf/tomcat-users.xml" />
46+
</GlobalNamingResources>
47+
48+
<!-- A "Service" is a collection of one or more "Connectors" that share
49+
a single "Container" Note: A "Service" is not itself a "Container",
50+
so you may not define subcomponents such as "Valves" at this level.
51+
Documentation at /docs/config/service.html
52+
-->
53+
<Service name="Catalina">
54+
55+
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
56+
<!--
57+
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
58+
maxThreads="150" minSpareThreads="4"/>
59+
-->
60+
61+
62+
<!-- A "Connector" represents an endpoint by which requests are received
63+
and responses are returned. Documentation at :
64+
Java HTTP Connector: /docs/config/http.html
65+
Java AJP Connector: /docs/config/ajp.html
66+
APR (HTTP/AJP) Connector: /docs/apr.html
67+
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
68+
-->
69+
<!--
70+
<Connector port="8080" protocol="HTTP/1.1"
71+
connectionTimeout="20000"
72+
redirectPort="8443" />
73+
-->
74+
<!-- A "Connector" using the shared thread pool-->
75+
<!--
76+
<Connector executor="tomcatThreadPool"
77+
port="8080" protocol="HTTP/1.1"
78+
connectionTimeout="20000"
79+
redirectPort="8443" />
80+
-->
81+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
82+
This connector uses the NIO implementation. The default
83+
SSLImplementation will depend on the presence of the APR/native
84+
library and the useOpenSSL attribute of the
85+
AprLifecycleListener.
86+
Either JSSE or OpenSSL style configuration may be used regardless of
87+
the SSLImplementation selected. JSSE style configuration is used below.
88+
-->
89+
<!--
90+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
91+
maxThreads="150" SSLEnabled="true">
92+
<SSLHostConfig>
93+
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
94+
type="RSA" />
95+
</SSLHostConfig>
96+
</Connector>
97+
-->
98+
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
99+
This connector uses the APR/native implementation which always uses
100+
OpenSSL for TLS.
101+
Either JSSE or OpenSSL style configuration may be used. OpenSSL style
102+
configuration is used below.
103+
-->
104+
<!--
105+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
106+
maxThreads="150" SSLEnabled="true" >
107+
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
108+
<SSLHostConfig>
109+
<Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
110+
certificateFile="conf/localhost-rsa-cert.pem"
111+
certificateChainFile="conf/localhost-rsa-chain.pem"
112+
type="RSA" />
113+
</SSLHostConfig>
114+
</Connector>
115+
-->
116+
117+
<!-- Define an AJP 1.3 Connector on port 8009 -->
118+
<!-- Important: if you allow Tomcat to listen on all interfaces, to maximise
119+
security, a secret should be set & required. -->
120+
<Connector protocol="AJP/1.3"
121+
address="127.0.0.1"
122+
port="8009"
123+
redirectPort="8443"
124+
secretRequired="false" />
125+
126+
<!-- An Engine represents the entry point (within Catalina) that processes
127+
every request. The Engine implementation for Tomcat stand alone
128+
analyzes the HTTP headers included with the request, and passes them
129+
on to the appropriate Host (virtual host).
130+
Documentation at /docs/config/engine.html -->
131+
132+
<!-- You should set jvmRoute to support load-balancing via AJP ie :
133+
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
134+
-->
135+
<Engine name="Catalina" defaultHost="localhost">
136+
137+
<!--For clustering, please take a look at documentation at:
138+
/docs/cluster-howto.html (simple how to)
139+
/docs/config/cluster.html (reference documentation) -->
140+
<!--
141+
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
142+
-->
143+
144+
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
145+
via a brute-force attack -->
146+
<Realm className="org.apache.catalina.realm.LockOutRealm">
147+
<!-- This Realm uses the UserDatabase configured in the global JNDI
148+
resources under the key "UserDatabase". Any edits
149+
that are performed against this UserDatabase are immediately
150+
available for use by the Realm. -->
151+
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
152+
resourceName="UserDatabase"/>
153+
</Realm>
154+
155+
<Host name="localhost" appBase="webapps"
156+
unpackWARs="true" autoDeploy="true">
157+
158+
<!-- SingleSignOn valve, share authentication between web applications
159+
Documentation at: /docs/config/valve.html -->
160+
<!--
161+
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
162+
-->
163+
164+
<!-- Access log processes all example.
165+
Documentation at: /docs/config/valve.html
166+
Note: The pattern used is equivalent to using pattern="common" -->
167+
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
168+
prefix="localhost_access_log" suffix=".txt"
169+
pattern="%h %l %u %t &quot;%r&quot; %s %b" />
170+
171+
</Host>
172+
</Engine>
173+
</Service>
174+
</Server>

‎overlays/tomcat/etc/tomcat10/server.xml‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -105,15 +105,27 @@
105105
-->
106106

107107
<!-- TurnKey Linux default HTTPS connector on port 443 -->
108-
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
109-
maxThreads="150" scheme="https" secure="true" URIEncoding="UTF-8"
110-
clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2"
111-
server="Secret">
112-
<SSLHostConfig>
113-
<Certificate
114-
certificateKeystoreFile="/etc/tomcat10/cert.p12"
115-
certificateKeystorePassword="turnkey" />
116-
</SSLHostConfig>
108+
<Connector
109+
port="443"
110+
protocol="org.apache.coyote.http11.Http11NioProtocol"
111+
SSLEnabled="true"
112+
maxThreads="150"
113+
scheme="https"
114+
secure="true"
115+
URIEncoding="UTF-8"
116+
clientAuth="false"
117+
server="Secret">
118+
119+
<SSLHostConfig
120+
protocols="TLSv1.2,TLSv1.3"
121+
ciphers="ZZ_SSL_CIPHERS"
122+
disableSessionTickets="true"
123+
honorCipherOrder="false">
124+
125+
<Certificate
126+
certificateKeystoreFile="/etc/tomcat10/cert.p12"
127+
certificateKeystorePassword="turnkey" />
128+
</SSLHostConfig>
117129
</Connector>
118130

119131
<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2

0 commit comments

Comments
 (0)