v11.0.1

Author: foxel

Dockerfile

@@ -1,29 +1,32 @@
-FROM ubuntu:22.04 as mysqlclient-builder
+FROM ubuntu:22.04 as builder
 RUN apt-get update
 
 RUN apt-get install --no-install-recommends -y \
         python3 python3-pip python3-setuptools python3-wheel \
-        libmysqlclient-dev python3-dev build-essential
+        libmysqlclient-dev libsasl2-dev libldap2-dev python3-dev build-essential pkg-config
 
-RUN pip3 wheel --no-cache-dir mysqlclient
+RUN pip3 wheel --no-cache-dir mysqlclient==2.1.*
+
+RUN pip3 wheel --no-cache-dir python-ldap==3.4.3
 
 FROM ubuntu:22.04
 
 ENV LANG=C.UTF-8 \
     DEBIAN_FRONTEND=noninteractive
 
-COPY --from=mysqlclient-builder /mysqlclient-*.whl /tmp/
+COPY --from=builder /mysqlclient-*.whl /python_ldap-*.whl /tmp/
 
 RUN \
     apt-get update && \
     apt-get install --no-install-recommends -y \
-        wget mysql-client libmysqlclient21 nginx ffmpeg python3 python3-pip python3-setuptools \
+        wget mysql-client libmysqlclient21 libldap-2.5-0 ldap-utils nginx ffmpeg python3 python3-pip python3-setuptools \
         python3-pil python3-jinja2 python3-sqlalchemy python3-future python3-markupsafe python3-pycryptodome \
         python3-ldap3 python3-pylibmc python3-urllib3 python3-lxml python3-cffi && \
     ln -s /usr/bin/python3 /usr/bin/python && \
     pip3 install --no-cache-dir supervisor iniparse \
-        pillow moviepy captcha django-pylibmc django-simple-captcha \
-        /tmp/mysqlclient-*.whl && \
+        pillow==10.0.* moviepy captcha==0.4 django-pylibmc django-simple-captcha==0.5.* \
+        djangosaml2==1.5.* pysaml2==7.2.* \
+        /tmp/mysqlclient-*.whl /tmp/python_ldap-*.whl && \
     apt-get remove -y --purge --autoremove python3-pip && \
     rm -rf /var/lib/apt/lists/* && \
     rm -f /etc/nginx/sites-enabled/*
@@ -33,7 +36,7 @@ RUN \
     wget -qO /usr/local/bin/crudini https://raw.githubusercontent.com/pixelb/crudini/0.9.3/crudini && \
     chmod +x /usr/local/bin/crudini
 
-ENV SEAFILE_VERSION 10.0.1
+ENV SEAFILE_VERSION 11.0.1
 ENV SEAFILE_PATH "/opt/seafile/$SEAFILE_VERSION"
 
 RUN \

README.md

@@ -13,7 +13,7 @@ version: '2'
 
 services:
   seafile:
-    image: foxel/seafile:10.0.1
+    image: foxel/seafile:11.0.1
     ports:
       - "9080:80"
     environment:
@@ -27,7 +27,7 @@ services:
       MYSQL_RANDOM_ROOT_PASSWORD: 1
     volumes:
       - mysql:/var/lib/mysql
-    image: mysql:5.7
+    image: mysql:8.0
 
 volumes:
   mysql:
@@ -40,6 +40,15 @@ volumes:
 
 Upgrading is possible in step-by-step manner:
 
+### 10.0.x => 11.0.x
+```
+docker-compose exec seafile /scripts/upgrade.sh 11.0.0
+```
+
+Notes:
+* version 11 requires MySQL 8. Note the updated version in compose file example above. The container will do the upgrade on first start.
+* django 4 uses new CSRF token security policy. Make sure the SSL termination is set up to correctly set `X-Forwarded-Proto` and `Host` headers.
+
 ### 9.0.x => 10.0.x
 ```
 docker-compose exec seafile /scripts/upgrade.sh 10.0.0

docker-compose.yml

@@ -12,7 +12,7 @@ services:
       MYSQL_RANDOM_ROOT_PASSWORD: 1
     volumes:
       - mysql:/var/lib/mysql
-    image: mysql:5.7
+    image: mysql:8.0
 
 volumes:
   mysql:

etc/nginx/nginx.conf

@@ -32,6 +32,19 @@ http {
     set_real_ip_from  192.168.0.0/16;
     real_ip_header    X-Real-IP;
 
+    # forwarding X-Forwarded-Proto from trusted proxies matching X-Real-IP config above
+    map $realip_remote_addr $trusted_proxy {
+        ~^10\.                      1;  # 10.0.0.0/8;
+        ~^172\.(1[6-9]|2\d|3[01])\. 1;  # 172.16.0.0/12;
+        ~^192\.168\.                1;  # 192.168.0.0/16;
+        default                     0;
+    }
+
+    map $trusted_proxy $forwarded_proto {
+        1       $http_x_forwarded_proto;
+        default $scheme;
+    }
+
     ##
     # Logging Settings
     ##

etc/nginx/sites-available/seafile.conf

@@ -3,11 +3,12 @@ server {
     server_name  "";
 
     location / {
-        proxy_pass         http://127.0.0.1:8000;
-        proxy_set_header   Host $host;
-        proxy_set_header   X-Real-IP $remote_addr;
-        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header   X-Forwarded-Host $server_name;
+        proxy_pass          http://127.0.0.1:8000;
+        proxy_set_header    Host $http_host;
+        proxy_set_header    Forwarded "for=$remote_addr;proto=$forwarded_proto";
+        proxy_set_header    X-Real-IP $remote_addr;
+        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header    X-Forwarded-Proto $forwarded_proto;
         proxy_read_timeout  1200s;
 
         # used for view/edit office file via Office Online Server
@@ -18,24 +19,23 @@ server {
     }
     location /seafhttp/ {
         rewrite ^/seafhttp(.*)$ $1 break;
-        proxy_pass http://127.0.0.1:8082;
-        client_max_body_size 0;
-        proxy_connect_timeout  36000s;
-        proxy_read_timeout  36000s;
+        proxy_pass              http://127.0.0.1:8082;
+        client_max_body_size    0;
+        proxy_connect_timeout   36000s;
+        proxy_read_timeout      36000s;
     }
     location /media/ {
         root /opt/seafile/latest/seahub;
     }
     location /seafdav {
-        proxy_pass         http://127.0.0.1:8080/seafdav;
-        proxy_set_header   Host $host;
-        proxy_set_header   X-Real-IP $remote_addr;
-        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header   X-Forwarded-Host $server_name;
-        proxy_set_header   X-Forwarded-Proto $scheme;
+        proxy_pass          http://127.0.0.1:8080/seafdav;
+        proxy_set_header    Host $http_host;
+        proxy_set_header    X-Real-IP $remote_addr;
+        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header    X-Forwarded-Proto $forwarded_proto;
 
         proxy_read_timeout  1200s;
-        client_max_body_size 0;
+        client_max_body_size    0;
         access_log      /var/log/nginx/seafdav.access.log;
         error_log       /var/log/nginx/seafdav.error.log;
     }

scripts/upgrade.sh

@@ -13,7 +13,8 @@ SQL_BASE_PATH="/opt/seafile/latest/upgrade/sql/${UPGRADE_VERSION}/mysql"
 for db in ccnet seafile seahub; do
     SQL_FILE="${SQL_BASE_PATH}/${db}.sql"
     if [[ -f "${SQL_FILE}" ]]; then
-        mysql -hmysql -useafile -pseafile -f "${db}_db" < "${SQL_FILE}"
+      # replaces `ADD INDEX IF NOT EXISTS` with `ADD INDEX` because it's not supported by MySQL 8
+      sed -e 's/ADD\s*INDEX\s*IF\s*NOT\s*EXISTS/ADD INDEX/g' "${SQL_FILE}" | mysql -hmysql -useafile -pseafile -f "${db}_db"
     fi
 done