GUACAMOLE-1746: docker enable usage of custom certificate

Dockerfile

@@ -167,6 +167,7 @@ COPY --from=builder ${PREFIX_DIR} ${PREFIX_DIR}
 
 # Bring runtime environment up to date and install runtime dependencies
 RUN apk add --no-cache                \
+        bash                          \
         ca-certificates               \
         ghostscript                   \
         netcat-openbsd                \
@@ -192,10 +193,9 @@ USER guacd
 # Expose the default listener port
 EXPOSE 4822
 
-# Start guacd, listening on port 0.0.0.0:4822
-#
-# Note the path here MUST correspond to the value specified in the 
-# PREFIX_DIR build argument.
-#
-CMD /opt/guacamole/sbin/guacd -b 0.0.0.0 -L $GUACD_LOG_LEVEL -f
+# Add configuration scripts
+COPY src/guacd-docker/sbin /opt/guacamole/sbin/
+
+# Start guacd
+CMD [ "/opt/guacamole/sbin/start.sh" ]
 

README

@@ -173,6 +173,33 @@ guacd currently takes several command-line options:
 Additional information can be found in the guacd man page:
 
     $ man guacd
+
+
+------------------------------------------------------------
+Enabling guacd ssl
+------------------------------------------------------------
+
+This explains how to enable ssl between guacamole and guacd using a self signed certificate.
+
+1. Generate a new certificate
+You need to create the new certificate on the guacd host.
+
+    $ openssl genrsa -out /etc/guacd/server.key 2048
+    $ openssl req -new -key /etc/guacd/server.key -out /etc/guacd/cert.csr
+    $ openssl x509 -in /etc/guacd/cert.csr -out /etc/guacd/server.crt -req -signkey /etc/guacd/server.key -days 3650
+    $ openssl pkcs12 -export -in /etc/guacd/server.crt -inkey /etc/guacd/server.key  -out /etc/guacd/server.p12 -CAfile ca.crt -caname root
+
+2. Configure guacd
+
+On debian, edit /etc/default/guacd and modify the following variables.
+    # listen on all interface
+    LISTEN_ADDRESS=0.0.0.0
+
+    # certificates
+    DAEMON_ARGS=-C /etc/guacd/server.crt -K /etc/guacd/server.key
+
+Restart guacd! 
+You may now enable, within Guacamole, guacd/proxy ssl connexion.
 
 ------------------------------------------------------------
  Reporting problems

src/guacd-docker/README.md

@@ -38,6 +38,29 @@ Connecting to guacd from an application
 
     docker run --name some-app --link some-guacd:guacd -d application-that-uses-guacd
 
+
+Enabling guacd ssl
+------------------
+This explains how to enable ssl between guacamole and guacd using a self signed certificate.
+
+1. Generate a new certificate
+You need to create the new certificate on the guacd host.
+
+    $ openssl genrsa -out /path/guacd/server.key 2048
+    $ openssl req -new -key /path/guacd/server.key -out /path/guacd/cert.csr
+    $ openssl x509 -in /path/guacd/cert.csr -out /path/guacd/server.crt -req -signkey /path/guacd/server.key -days 3650
+    $ openssl pkcs12 -export -in /path/guacd/server.crt -inkey /path/guacd/server.key  -out /path/guacd/server.p12 -CAfile ca.crt -caname root
+
+2. run guacd
+
+    docker run --name some-guacd -d -p 4822:4822 \
+      --env GUACD_CERTIFICATE_CRT=/etc/guacd/server.crt \
+      --env GUACD_CERTIFICATE_KEY=/etc/guacd/server.key \
+      --volume /path/guacd:/etc/guacd \
+      guacamole/guacd
+
+You may now enable, within Guacamole, guacd/proxy ssl connexion.
+
 Reporting issues
 ================
 

src/guacd-docker/sbin/start.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn start.sh
+##
+## Automatically configures and starts GUACD.
+##
+
+
+##
+## Adds SSL command-line options to guacd
+##
+enable_ssl() {
+    if [ -z "$GUACD_CERTIFICATE_CRT" ] || [ -z "$GUACD_CERTIFICATE_KEY" ]; then
+        cat <<END
+FATAL: Missing required environment variables
+-------------------------------------------------------------------------------
+If using a SSL encryption, you must provide both GUACD_CERTIFICATE_CRT
+and GUACD_CERTIFICATE_KEY environment variables.
+
+END
+        exit 1;
+    fi
+
+    args+=( -C "$GUACD_CERTIFICATE_CRT" )
+    args+=( -K "$GUACD_CERTIFICATE_KEY" )
+}
+
+
+# guacd default value if not overridden
+if [ -z "$GUACD_LISTEN_ADDRESS" ]; then
+    export GUACD_LISTEN_ADDRESS=0.0.0.0
+fi
+if [ -z "$GUACD_PORT" ]; then
+    export GUACD_PORT=4822
+fi
+if [ -z "$GUACD_LOG_LEVEL" ]; then
+    export GUACD_LOG_LEVEL=info
+fi
+
+args=( -b "${GUACD_LISTEN_ADDRESS}" -L "${GUACD_LOG_LEVEL}" -l "${GUACD_PORT}" -f )
+
+# guacd certificate files
+if [ -n "$GUACD_CERTIFICATE_CRT" ] || [ -n "$GUACD_CERTIFICATE_KEY" ]; then
+    enable_ssl
+fi
+
+
+/opt/guacamole/sbin/guacd "${args[@]}"
+