Merge branch 'stable/12' into dev

compose/.env.example

@@ -1 +1,19 @@
-PORT=8080
+##
+# All environment variables defined here will only apply if you pass them
+# to the OpenProject container in docker-compose.yml under x-op-app -> environment.
+# For the examples here this is already the case.
+#
+# Please refer to our documentation to see all possible variables:
+#   https://www.openproject.org/docs/installation-and-operations/configuration/environment/
+#
+TAG=12
+OPENPROJECT_HTTPS=false
+OPENPROJECT_HOST__NAME=localhost
+PORT=127.0.0.1:8080
+OPENPROJECT_RAILS__RELATIVE__URL__ROOT=
+IMAP_ENABLED=false
+DATABASE_URL=postgres://postgres:p4ssw0rd@db/openproject?pool=20&encoding=unicode&reconnect=true
+RAILS_MIN_THREADS=4
+RAILS_MAX_THREADS=16
+PGDATA="/var/lib/postgresql/data"
+OPDATA="/var/openproject/assets"

compose/.gitignore

@@ -0,0 +1 @@
+.env

compose/README.md

@@ -14,25 +14,74 @@ Make sure you are using the latest version of the Docker images:
 
     docker-compose pull
 
+Copy the example `.env` file and edit any values you want to change:
+
+    cp .env.example .env
+    vim .env
+
 Launch the containers:
 
     docker-compose up -d
 
 After a while, OpenProject should be up and running on <http://localhost:8080>.
 
+**HTTPS/SSL**
+
+By default OpenProject starts with the HTTPS option **enabled**, but it **does not** handle SSL termination itself.
+This is usually done separately via a [reverse proxy setup](https://www.openproject.org/docs/installation-and-operations/installation/docker/#apache-reverse-proxy-setup).
+Without this you will run into an `ERR_SSL_PROTOCOL_ERROR` when accessing OpenProject.
+
+See below how to disable HTTPS.
+
+**PORT**
+
+By default the port is bound to `0.0.0.0` means access to OpenProject will be public.
+See below how to change that.
+
 ## Configuration
 
+Environment variables can be added to `docker-compose.yml` under `x-op-app -> environment` to change
+OpenProject's configuration. Some are already defined and can be changed via the environment.
+
+You can pass those variables directly when starting the stack as follows.
+
+```
+VARIABLE=value docker-compose up -d
+```
+
+You can also put those variables into an `.env` file in your current working
+directory, and Docker Compose will pick it up automatically. See `.env.example`
+for details.
+
+## HTTPS
+
+You can disable OpenProject's HTTPS option via:
+
+```
+OPENPROJECT_HTTPS=false
+```
+
+## PORT
+
 If you want to specify a different port, you can do so with:
 
-    PORT=4000 docker-compose up -d
+```
+PORT=4000
+```
+
+If you don't want OpenProject to bind to `0.0.0.0` you can bind it to localhost only like this:
+
+```
+PORT=127.0.0.1:8080
+```
+
+## TAG
 
 If you want to specify a custom tag for the OpenProject docker image, you can do so with:
 
-    TAG=my-docker-tag docker-compose up -d
-
-You can also set those variables into an `.env` file in your current working
-directory, and Docker Compose will pick it up automatically. See `.env.example`
-for details.
+```
+TAG=my-docker-tag
+```
 
 ## Upgrade
 
@@ -65,3 +114,18 @@ You can look at the logs with:
     docker-compose logs -n 1000
 
 For the complete documentation, please refer to https://docs.openproject.org/installation-and-operations/.
+
+### Network issues
+
+If you're running into weird network issues and timeouts such as the one described in [OP#42802](https://community.openproject.org/work_packages/42802), you might have success in remove the two separate frontend and backend networks. This might be connected to using podman for orchestration, although we haven't been able to confirm this.
+
+
+### SMTP setup fails: Network is unreachable.
+
+Make sure your container has DNS resolution to access external SMTP server when set up as described in [OP#44515](https://community.openproject.org/work_packages/44515).
+
+```yml
+worker:
+   dns:    
+     - "Your DNS IP" # OR add a public DNS resolver like 8.8.8.8
+ ```

compose/docker-compose.yml

@@ -13,15 +13,17 @@ x-op-restart-policy: &restart_policy
 x-op-image: &image
   image: openproject/community:${TAG:-12}
 x-op-app: &app
-  <<: *image
-  <<: *restart_policy
+  <<: [*image, *restart_policy]
   environment:
+    OPENPROJECT_HTTPS: "${OPENPROJECT_HTTPS:-true}"
+    OPENPROJECT_HOST__NAME: "${OPENPROJECT_HOST__NAME:-localhost:8080}"
+    OPENPROJECT_HSTS: "${OPENPROJECT_HSTS:-true}"
     RAILS_CACHE_STORE: "memcache"
     OPENPROJECT_CACHE__MEMCACHE__SERVER: "cache:11211"
     OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "${OPENPROJECT_RAILS__RELATIVE__URL__ROOT:-}"
     DATABASE_URL: "${DATABASE_URL:-postgres://postgres:p4ssw0rd@db/openproject?pool=20&encoding=unicode&reconnect=true}"
-    RAILS_MIN_THREADS: 4
-    RAILS_MAX_THREADS: 16
+    RAILS_MIN_THREADS: ${RAILS_MIN_THREADS:-4}
+    RAILS_MAX_THREADS: ${RAILS_MAX_THREADS:-16}
     # set to true to enable the email receiving feature. See ./docker/cron for more options
     IMAP_ENABLED: "${IMAP_ENABLED:-false}"
   volumes:
@@ -47,8 +49,7 @@ services:
       - backend
 
   proxy:
-    <<: *image
-    <<: *restart_policy
+    <<: [*image, *restart_policy]
     command: "./docker/prod/proxy"
     ports:
       - "${PORT:-8080}:80"
@@ -85,6 +86,8 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock"
     environment:
       AUTOHEAL_CONTAINER_LABEL: autoheal
+      AUTOHEAL_START_PERIOD: 600
+      AUTOHEAL_INTERVAL: 30
 
   worker:
     <<: *app