From dbf1f4b557702499dd00ea40e039aae620cad14f Mon Sep 17 00:00:00 2001
From: Mickael TONNELIER <m.tonnelier@epack-hygiene.fr>
Date: Tue, 19 Nov 2024 10:51:54 +0100
Subject: [PATCH] - add compatibility with tomcat 11 - use modern docker
 configuration with replicat - fixed path on tomcat 7 configuration

---
 cluster/default-3.7.conf |  51 ++++++++++++
 cluster/default.conf     |   9 +-
 cluster/server-3.7.xml   | 175 +++++++++++++++++++++++++++++++++++++++
 cluster/server.xml       |   9 +-
 docker-compose-3-7.yml   |  26 +++---
 docker-compose.yml       |  59 ++++++-------
 6 files changed, 275 insertions(+), 54 deletions(-)
 create mode 100644 cluster/default-3.7.conf
 create mode 100644 cluster/server-3.7.xml

diff --git a/cluster/default-3.7.conf b/cluster/default-3.7.conf
new file mode 100644
index 0000000..b841dce
--- /dev/null
+++ b/cluster/default-3.7.conf
@@ -0,0 +1,51 @@
+upstream backend  {
+  server tomcat1:8080;
+  server tomcat2:8080;
+  server tomcat3:8080;
+}
+
+server {
+    listen       80;
+    server_name  localhost;
+
+    #charset koi8-r;
+    #access_log  /var/log/nginx/log/host.access.log  main;
+
+    location / {
+	    proxy_pass  http://backend;
+    }
+
+
+    #error_page  404              /404.html;
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+
+    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
+    #
+    #location ~ \.php$ {
+    #    proxy_pass   http://127.0.0.1;
+    #}
+
+    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+    #
+    #location ~ \.php$ {
+    #    root           html;
+    #    fastcgi_pass   127.0.0.1:9000;
+    #    fastcgi_index  index.php;
+    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+    #    include        fastcgi_params;
+    #}
+
+    # deny access to .htaccess files, if Apache's document root
+    # concurs with nginx's one
+    #
+    #location ~ /\.ht {
+    #    deny  all;
+    #}
+}
+
diff --git a/cluster/default.conf b/cluster/default.conf
index 2e988dd..851ab41 100644
--- a/cluster/default.conf
+++ b/cluster/default.conf
@@ -1,10 +1,3 @@
-upstream backend  {
-  server tomcat1:8080;
-  server tomcat2:8080;
-  server tomcat3:8080;
-}
-
-
 
 server {
     listen       80;
@@ -14,7 +7,7 @@ server {
     #access_log  /var/log/nginx/log/host.access.log  main;
 
     location / {
-	proxy_pass  http://backend;
+	    proxy_pass  http://backend:8080;
     }
 
 
diff --git a/cluster/server-3.7.xml b/cluster/server-3.7.xml
new file mode 100644
index 0000000..9c42664
--- /dev/null
+++ b/cluster/server-3.7.xml
@@ -0,0 +1,175 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ -->
+<Server port="8005" shutdown="SHUTDOWN">
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+  <!-- Security listener. Documentation at /docs/config/listeners.html
+  <Listener className="org.apache.catalina.security.SecurityListener" />
+  -->
+  <!--APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
+  <GlobalNamingResources>
+    <!-- Editable user database that can also be used by
+         UserDatabaseRealm to authenticate users
+    -->
+    <Resource name="UserDatabase" auth="Container"
+              type="org.apache.catalina.UserDatabase"
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
+  </GlobalNamingResources>
+
+  <!-- A "Service" is a collection of one or more "Connectors" that share
+       a single "Container" Note:  A "Service" is not itself a "Container",
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
+   -->
+  <Service name="Catalina">
+
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+
+
+    <!-- A "Connector" represents an endpoint by which requests are received
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+    -->
+    <Connector port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443" />
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443" />
+    -->
+    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation that requires the JSSE
+         style configuration. When using the APR/native implementation, the
+         OpenSSL style configuration is required as described in the APR/native
+         documentation -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
+               clientAuth="false" sslProtocol="TLS" />
+    -->
+
+    <!-- Define an AJP 1.3 Connector on port 8009 -->
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
+
+    <!-- An Engine represents the entry point (within Catalina) that processes
+         every request.  The Engine implementation for Tomcat stand alone
+         analyzes the HTTP headers included with the request, and passes them
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
+
+    <!-- You should set jvmRoute to support load-balancing via AJP ie :
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+    -->
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+
+
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
+                 channelSendOptions="8">
+
+          <Manager className="org.apache.catalina.ha.session.DeltaManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"/>
+
+          <Channel className="org.apache.catalina.tribes.group.GroupChannel">
+            <Membership className="org.apache.catalina.tribes.membership.McastService"
+                        address="228.0.0.4"
+                        port="45564"
+                        frequency="500"
+                        dropTime="3000"/>
+            <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
+                      address="auto"
+                      port="4000"
+                      autoBind="100"
+                      selectorTimeout="5000"
+                      maxThreads="6"/>
+
+            <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
+              <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
+            </Sender>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatch15Interceptor"/>
+          </Channel>
+
+          <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
+                 filter=""/>
+          <Valve className="org.apache.catalina.ha.session.JvmRouteBinderValve"/>
+
+
+          <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
+        </Cluster>
+
+
+	 <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+               resourceName="UserDatabase"/>
+      </Realm>
+
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="true">
+
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
+        <!--
+        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+        -->
+
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html
+             Note: The pattern used is equivalent to using pattern="common" -->
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+               prefix="localhost_access_log" suffix=".txt"
+               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+
+      </Host>
+    </Engine>
+  </Service>
+</Server>
diff --git a/cluster/server.xml b/cluster/server.xml
index c9d3b16..303e79e 100644
--- a/cluster/server.xml
+++ b/cluster/server.xml
@@ -88,8 +88,7 @@
     -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
-
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" secretRequired="false" />
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
@@ -105,8 +104,8 @@
       <!--For clustering, please take a look at documentation at:
           /docs/cluster-howto.html  (simple how to)
           /docs/config/cluster.html (reference documentation) -->
-      
-     
+
+
       <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
                  channelSendOptions="8">
 
@@ -131,7 +130,7 @@
               <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
             </Sender>
             <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
-            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatch15Interceptor"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor"/>
           </Channel>
 
           <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
diff --git a/docker-compose-3-7.yml b/docker-compose-3-7.yml
index 347bdd5..b0c0d19 100644
--- a/docker-compose-3-7.yml
+++ b/docker-compose-3-7.yml
@@ -2,29 +2,29 @@ version: '3.7'
 services:
   portal:
     container_name: portal
-    image: nginx  
+    image: nginx
     ports:
-      - 8080:80
-    volumes: 
-      - /home/ramki/cluster/default.conf:/etc/nginx/conf.d/default.conf
+      - "8080:80"
+    volumes:
+      - ./cluster/default-3.7.conf:/etc/nginx/conf.d/default.conf
   tomcat1:
     image: tomcat:7.0.94-jre7-alpine
     container_name: tomcat1
     volumes:
-      - /home/ramki/cluster/server.xml:/usr/local/tomcat/conf/server.xml
-      - /home/ramki/cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-      - /home/ramki/cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
+      - ./cluster/server-3.7.xml:/usr/local/tomcat/conf/server.xml
+      - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
+      - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
   tomcat2:
     image: tomcat:7.0.94-jre7-alpine
     container_name: tomcat2
     volumes:
-      - /home/ramki/cluster/server.xml:/usr/local/tomcat/conf/server.xml
-      - /home/ramki/cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-      - /home/ramki/cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
+      - ./cluster/server-3.7.xml:/usr/local/tomcat/conf/server.xml
+      - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
+      - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
   tomcat3:
     image: tomcat:7.0.94-jre7-alpine
     container_name: tomcat3
     volumes:
-      - /home/ramki/cluster/server.xml:/usr/local/tomcat/conf/server.xml
-      - /home/ramki/cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-      - /home/ramki/cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml 
+      - ./cluster/server-3.7.xml:/usr/local/tomcat/conf/server.xml
+      - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
+      - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
diff --git a/docker-compose.yml b/docker-compose.yml
index e454923..f1d1c92 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,30 +1,33 @@
-portal:
-  image: nginx
-  ports:
-   - "8080:80"
-  volumes:
-   - ./cluster/default.conf:/etc/nginx/conf.d/default.conf
-  links:
-   - tomcatOne:tomcat1
-   - tomcatTwo:tomcat2
-   - tomcatThree:tomcat3
-tomcatOne:
-  image: tomcat
-  volumes:
-   - ./cluster/server.xml:/usr/local/tomcat/conf/server.xml
-   - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-   - ./ramki/cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
-tomcatTwo:
-  image: tomcat
-  volumes:
-   - ./cluster/server.xml:/usr/local/tomcat/conf/server.xml
-   - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-   - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
-tomcatThree:
-  image: tomcat
-  volumes:
-   - ./cluster/server.xml:/usr/local/tomcat/conf/server.xml
-   - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
-   - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
+services:
+  portal:
+    image: nginx:1.27.2-alpine
+    ports:
+     - "8888:80"
+    volumes:
+     - ./cluster/default.conf:/etc/nginx/conf.d/default.conf
+    networks:
+      - tomcat-cluster
+    depends_on:
+      tomcat:
+        condition: service_healthy
 
+  tomcat:
+    image: tomcat:11.0.1-jdk21-temurin-noble
+    deploy:
+      replicas: 3
+    networks:
+      tomcat-cluster:
+        aliases:
+          - "backend"
+    volumes:
+     - ./cluster/server.xml:/usr/local/tomcat/conf/server.xml
+     - ./cluster/ROOT:/usr/local/tomcat/webapps/ROOT
+     - ./cluster/tomcat-users.xml:/usr/local/tomcat/conf/tomcat-users.xml
+    healthcheck:
+      test: [ "CMD-SHELL", "curl --fail http://localhost:8080/ || exit 1" ]
+      interval: 5s
+      timeout: 10s
+      retries: 120
 
+networks:
+  tomcat-cluster: {}