tobybatch / kimai2

Docker containers for the kimai2 web application including docker-compose and kubernetes/helm deployment.
MIT License
181 stars 96 forks source link

[BUG] "/opt/kimai/public/" is forbidden, #300

Closed gerroon closed 3 years ago

gerroon commented 3 years ago

Hi

I cloned the repository and using the docker-compose file. I only modified the volumes and port (from 8001 to 18001) The containers start fine as far as I can tell but when I try to acces the page at IP:18001 I am getting the forbidden message.

I even tried 777 on the folder, that did not help. I wont be serving this over the web so 777 is ok for my testing here.


ginx_1    | 192.168.144.5 - - [19/Oct/2021:01:27:39 +0000] "GET /health HTTP/1.1" 200 5 "-" "Wget" "-"
│kimai_1    | 127.0.0.1 -  19/Oct/2021:02:27:40 +0100 "GET /ping" 404
│nginx_1    | 2021/10/19 01:27:51 [error] 7#7: *276 directory index of "/opt/kimai/public/" is forbidden, client: 192.168.2.100, server: nginx, request: "GET / HTTP/1.1", host: "192.168.2.99:18001"
│nginx_1    | 192.168.2.100 - - [19/Oct/2021:01:27:51 +0000] "GET / HTTP/1.1" 403 556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" "-"
│nginx_1    | 2021/10/19 01:27:52 [error] 7#7: *276 directory index of "/opt/kimai/public/" is forbidden, client: 192.168.2.100, server: nginx, request: "GET / HTTP/1.1", host: "192.168.2.99:18001"
│nginx_1    | 192.168.2.100 - - [19/Oct/2021:01:27:52 +0000] "GET / HTTP/1.1" 403 556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" "-"
│nginx_1    | 192.168.144.5 - - [19/Oct/2021:01:27:59 +0000] "GET /health HTTP/1.1" 200 5 "-" "Wget" "-"
tobybatch commented 3 years ago

It would be easier to debug if you had filled in the issue template. I have no idea which image you are using on which OS with what volumes.

You have permissions wrong in the container. 777 should have worked but I can't see how it is mounted. I need (at least) the docker-compose file with pwords redacted.

gerroon commented 3 years ago

Hi

I am using Docker on Debian Testing, docker-compose version 1.22.0, build f46880fe, Docker version 20.10.8, build 3967b7d

As far as I can tell ls publicis empty, no files are in there.

 ls mysql/

auto.cnf  ca-key.pem  ca.pem  client-cert.pem  client-key.pem  ib_buffer_pool  ibdata1  ib_logfile0  ib_logfile1  ibtmp1  kimai  mysql  performance_schema  private_key.pem  public_key.pem  server-cert.pem  server-key.pem  sys

Here is the Docker file

version: '3.5'
services:

  sqldb:
    image: mysql:5.7
    environment:
      - MYSQL_DATABASE=kimai
      - MYSQL_USER=kimaiuser
      - MYSQL_PASSWORD=PASSSSSSSSS
      - MYSQL_ROOT_PASSWORD=PASSSSSSSSS
    volumes:
      - /media/kimai/mysql:/var/lib/mysql
    command: --default-storage-engine innodb
    restart: unless-stopped
    healthcheck:
      test: mysqladmin -p$$MYSQL_ROOT_PASSWORD ping -h localhost
      interval: 20s
      start_period: 10s
      timeout: 10s
      retries: 3

  nginx:
    image: tobybatch/nginx-fpm-reverse-proxy
    ports:
      - 18001:80
    volumes:
      - /media/kimai/public:/opt/kimai/public:ro
    restart: unless-stopped
    depends_on:
      - kimai
    healthcheck:
      test:  wget --spider http://nginx/health || exit 1
      interval: 20s
      start_period: 10s
      timeout: 10s
      retries: 3

  kimai: # This is the latest FPM image of kimai
    image: kimai/kimai2:fpm
    environment:
      - ADMINMAIL=admin@kimai.local
      - ADMINPASS=PASSSSSSSSS
      - DATABASE_URL=mysql://kimaiuser:PASSSSSSSSS@sqldb/kimai
      - TRUSTED_HOSTS=nginx,localhost,127.0.0.1
    volumes:
      - /media/kimai/public:/opt/kimai/public
      # - var:/opt/kimai/var
      # - ./ldap.conf:/etc/openldap/ldap.conf:z
      # - ./ROOT-CA.pem:/etc/ssl/certs/ROOT-CA.pem:z
    restart: unless-stopped

  postfix:
    image: catatnight/postfix:latest
    environment:
      maildomain: neontribe.co.uk
      smtp_user: kimai:kimai
    restart: unless-stopped

volumes:
    var:
    public:
    mysql:
tobybatch commented 3 years ago

I suspect that your public folder existed before you started the containers and it is a file system rather than a docker volume mount.

Lets start by fixing your install. It's not one I have seen before. This should work.

In the directory that holds the public dir:

docker run -v $(pwd)/tmp:/public --rm --user=root --entrypoint /bin/cp kimai/kimai2:fpm -r /opt/kimai/public /public
rm -rf public
mv tmp public
rm -rf tmp
chown -R 82:82 public # <--- 33:33 if you are using apache

This should copy a copy of the public files from a working kimia into your public folder.

gerroon commented 3 years ago

Hi

Thanks for your help, I think that issue is resolved but I still can't access it properly.

I am still using the docker-compose I posted above.

Something is wrong
400: Bad Request
A critical error occurred, please try again. You may have found a software problem, please contact your administrator if the problem persists.
kimai_1    | 192.168.144.5 -  20/Oct/2021:16:40:44 +0100 "GET /index.php" 400
kimai_1    | 127.0.0.1 -  20/Oct/2021:16:40:48 +0100 "GET /ping" 404
nginx_1    | 192.168.144.5 - - [20/Oct/2021:15:40:55 +0000] "GET /health HTTP/1.1" 200 5 "-" "Wget" "-"
kimai_1    | 127.0.0.1 -  20/Oct/2021:16:41:10 +0100 "GET /ping" 404
nginx_1    | 192.168.144.5 - - [20/Oct/2021:15:41:16 +0000] "GET /health HTTP/1.1" 200 5 "-" "Wget" "-"
kimai_1    | 127.0.0.1 -  20/Oct/2021:16:41:30 +0100 "GET /ping" 404
kimai_1    | NOTICE: PHP message: [2021-10-20 15:41:33] request.ERROR: Uncaught PHP Exception Symfony\Component\HttpKernel\Exception\BadRequestHttpException: "Untrusted Host "192.168.2.99"." at /opt/kimai/vendor/symfony/http-kernel/HttpKernel.php line 83 {"exception":"[object] (Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException(code: 0): Untrusted Host \"192.168.2.99\". at /opt/kimai/vendor/symfony/http-kernel/HttpKernel.php:83, Symfony\\Component\\HttpFoundation\\Exception\\SuspiciousOperationException(code: 0): Untrusted Host \"192.168.2.99\". at /opt/kimai/vendor/symfony/http-foundation/Request.php:1197)"} []
kimai_1    | 192.168.144.5 -  20/Oct/2021:16:41:33 +0100 "GET /index.php" 400
nginx_1    | 2021/10/20 15:41:33 [error] 14#14: *2 FastCGI sent in stderr: "PHP message: [2021-10-20 15:41:33] request.ERROR: Uncaught PHP Exception Symfony\Component\HttpKernel\Exception\BadRequestHttpException: "Untrusted Host "192.168.2.99"." at /opt/kimai/vendor/symfony/http-kernel/HttpKernel.php line 83 {"exception":"[object] (Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException(code: 0): Untrusted Host \"192.168.2.99\". at /opt/kimai/vendor/symfony/http-kernel/HttpKernel.php:83, Symfony\\Component\\HttpFoundation\\Exception\\SuspiciousOperationException(code: 0): Untrusted Host \"192.168.2.99\". at /opt/kimai/vendor/symfony/http-foundation/Request.php:1197)"} []" while reading response header from upstream, client: 192.168.2.100, server: nginx, request: "GET /en/homepage HTTP/1.1", upstream: "fastcgi://192.168.144.2:9000", host: "192.168.2.99:18001", referrer: "http://192.168.2.99:18001/"
nginx_1    | 192.168.2.100 - - [20/Oct/2021:15:41:33 +0000] "GET /en/homepage HTTP/1.1" 400 431 "http://192.168.2.99:18001/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" "-"
nginx_1    | 192.168.144.5 - - [20/Oct/2021:15:41:36 +0000] "GET /health HTTP/1.1" 200 5 "-" "Wget" "-"
tobybatch commented 3 years ago

https://tobybatch.github.io/kimai2/troubleshooting.html#500-server-errors