Merged in forked-contributions-target (pull request #60)

Contributions from Karolis Eigelis

Approved-by: Karolis Eigelis
Approved-by: Dave Chevell

CONTRIBUTING.md

@@ -0,0 +1,7 @@
+# Contributing
+
+If you are contributing from outside Atlassian, make sure you have signed the [Atlassian CLA](https://developer.atlassian.com/platform/open-source/contributor-license-agreement/)
+
+If you are contributing from an external fork, please target your pull request at the `forked-contributions-target` branch. We will perform a preliminary code review
+in this pull request, then merge to this branch. Once the code has been merged into `forked-contributions-target` our pipeline will run our tests against it. Once
+the tests pass, your contribution will be merged into `master`.

README.md

@@ -110,6 +110,15 @@ of the setup. They can be controlled via the below environment variables.
    The context path the application is served over. `CATALINA_CONTEXT_PATH` is
    also supported for backwards compatability.
 
+* `ATL_TOMCAT_ACCESS_LOG` (default: false)
+
+   Whether to enable Tomcat access logging; set to `true` to enable. *NOTE*:
+   These logs are written to the Container internal volume by default (under
+   `/opt/atlassian/confluence/logs/`); these are rotated but not removed, and
+   will grow indefinitely. If you enable this functionality it is recommended
+   that you map the directory to a volume and perform log ingestion/cleanup with
+   external tools.
+
 The following Tomcat/Catalina options are also supported. For more information,
 see https://tomcat.apache.org/tomcat-7.0-doc/config/index.html.
 
@@ -419,6 +428,10 @@ Note that these images are built on the [AdoptOpenJDK](https://adoptopenjdk.net/
 Confluence 6.13 OpenJDK was not a supported platform. See [the 6.13
 release-notes][12] for more information.
 
+# Contribution
+
+See the [contributing guideline](CONTRIBUTING.md) if you are contributing from outside Atlassian.
+
 # License
 
 Copyright © 2020 Atlassian Corporation Pty Ltd.

config/server.xml.j2

@@ -50,6 +50,22 @@
           <Manager pathname=""/>
           <Valve className="org.apache.catalina.valves.StuckThreadDetectionValve"
                  threshold="60"/>
+        {% if atl_tomcat_access_log == 'true' %}  
+          <Valve className="org.apache.catalina.valves.AccessLogValve"
+                 requestAttributesEnabled="true"
+                 directory="logs"
+                 prefix="confluence_access"
+                 suffix=".log"
+                 rotatable="true"
+                 pattern="%h %{X-AUSERNAME}o %t &quot;%r&quot; %s %b %D %U %I &quot;%{User-Agent}i&quot;" />
+          <Valve className="org.apache.catalina.valves.RemoteIpValve"
+                 proxiesHeader="x-forwarded-by"
+                 internalProxies="{{ atl_tomcat_proxy_internal_ips | default('') }}"
+                 remoteIpHeader="x-forwarded-for"
+                 protocolHeader="x-forwarded-proto"
+                 requestAttributesEnabled="true"
+                 resolveHosts="false" />
+        {% endif %}
         </Context>
 
         <Context path="${confluence.context.path}/synchrony-proxy"

tests/test_image.py

@@ -14,10 +14,10 @@ def test_jvm_args(docker_cli, image, run_user):
     }
     container = run_image(docker_cli, image, user=run_user, environment=environment)
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-    
+
     procs_list = get_procs(container)
     jvm = [proc for proc in procs_list if get_bootstrap_proc(container) in proc][0]
-    
+
     assert f'-Xms{environment.get("JVM_MINIMUM_MEMORY")}' in jvm
     assert f'-Xmx{environment.get("JVM_MAXIMUM_MEMORY")}' in jvm
     assert f'-XX:ReservedCodeCacheSize={environment.get("JVM_RESERVED_CODE_CACHE_SIZE")}' in jvm
@@ -37,9 +37,9 @@ def test_install_permissions(docker_cli, image):
 def test_first_run_state(docker_cli, image, run_user):
     PORT = 8090
     URL = f'http://localhost:{PORT}/status'
-    
+
     container = run_image(docker_cli, image, user=run_user, ports={PORT: PORT})
-    
+
     wait_for_http_response(URL, expected_status=200, expected_state=('STARTING', 'FIRST_RUN'))
 
 
@@ -63,7 +63,6 @@ def test_server_xml_defaults(docker_cli, image):
     assert connector.get('proxyName') == ''
     assert connector.get('proxyPort') == ''
 
-
 def test_server_xml_catalina_fallback(docker_cli, image):
     environment = {
         'CATALINA_CONNECTOR_PROXYNAME': 'PROXYNAME',
@@ -125,6 +124,18 @@ def test_server_xml_params(docker_cli, image):
 
     assert context.get('path') == environment.get('ATL_TOMCAT_CONTEXTPATH')
 
+def test_server_xml_access_log(docker_cli, image):
+    environment = {
+        'ATL_TOMCAT_ACCESS_LOG': 'true',
+        'ATL_TOMCAT_PROXY_INTERNAL_IPS': '192.168.1.1',
+    }
+
+    container = run_image(docker_cli, image, environment=environment)
+    _jvm = wait_for_proc(container, get_bootstrap_proc(container))
+
+    xml = parse_xml(container, f'{get_app_install_dir(container)}/conf/server.xml')
+    valve = xml.find('.//Context/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]')
+    assert valve.get('internalProxies') == environment.get('ATL_TOMCAT_PROXY_INTERNAL_IPS')
 
 def test_seraph_defaults(docker_cli, image):
     container = run_image(docker_cli, image)
@@ -169,7 +180,7 @@ def test_confluence_xml_postgres(docker_cli, image, run_user):
     }
     container = run_image(docker_cli, image, user=run_user, environment=environment)
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-    
+
     xml = parse_xml(container, f'{get_app_home(container)}/confluence.cfg.xml')
     assert xml.findall('.//property[@name="hibernate.connection.url"]')[0].text == "atl_jdbc_url"
     assert xml.findall('.//property[@name="hibernate.connection.username"]')[0].text == "atl_jdbc_user"
@@ -232,7 +243,7 @@ def test_confluence_xml_cluster_aws(docker_cli, image, run_user):
     }
     container = run_image(docker_cli, image, user=run_user, environment=environment)
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-    
+
     xml = parse_xml(container, f'{get_app_home(container)}/confluence.cfg.xml')
 
     assert xml.findall('.//property[@name="confluence.cluster"]')[0].text == "true"
@@ -256,7 +267,7 @@ def test_confluence_xml_cluster_multicast(docker_cli, image, run_user):
     }
     container = run_image(docker_cli, image, user=run_user, environment=environment)
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-    
+
     xml = parse_xml(container, f'{get_app_home(container)}/confluence.cfg.xml')
 
     assert xml.findall('.//property[@name="confluence.cluster"]')[0].text == "true"
@@ -274,7 +285,7 @@ def test_confluence_xml_cluster_tcp(docker_cli, image, run_user):
     }
     container = run_image(docker_cli, image, user=run_user, environment=environment)
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-    
+
     xml = parse_xml(container, f'{get_app_home(container)}/confluence.cfg.xml')
 
     assert xml.findall('.//property[@name="confluence.cluster"]')[0].text == "true"
@@ -282,7 +293,6 @@ def test_confluence_xml_cluster_tcp(docker_cli, image, run_user):
     assert xml.findall('.//property[@name="confluence.cluster.name"]')[0].text == "atl_cluster_name"
     assert xml.findall('.//property[@name="confluence.cluster.peers"]')[0].text == "1.1.1.1,99.99.99.99"
 
-
 def test_java_in_run_user_path(docker_cli, image):
     RUN_USER = 'confluence'
     container = run_image(docker_cli, image)
@@ -294,4 +304,4 @@ def test_non_root_user(docker_cli, image):
     RUN_UID = 2002
     RUN_GID = 2002
     container = run_image(docker_cli, image, user=f'{RUN_UID}:{RUN_GID}')
-    jvm = wait_for_proc(container, "org.apache.catalina.startup.Bootstrap")
+    _jvm = wait_for_proc(container, get_bootstrap_proc(container))