Database secured connection by bdalsass · Pull Request #23 · Combodo/docker-environment

bdalsass · 2026-04-30T08:18:39Z

Base information

Question	Answer
Related to a SourceForge thread / Another PR / Combodo ticket?	NO
Type of change?	Enhancement

Symptom (bug) / Objective (enhancement)

Add configuration for secured connection between database server and client

Copilot

Pull request overview

This PR adds optional TLS/SSL configuration for MariaDB/MySQL connections in the Docker iTop environment, wiring certificate mounts into the DB/client containers and documenting how to enable secure transport.

Changes:

Add database TLS configuration (cert paths, TLS versions/ciphers, require_secure_transport) for MySQL/MariaDB.
Mount DB/webserver certificate directories into services (PHP, DBs, Adminer) and add a PHP client config (client.cnf).
Extend documentation to describe TLS enablement and Adminer SSL usage.

Reviewed changes

Copilot reviewed 16 out of 19 changed files in this pull request and generated 18 comments.

Show a summary per file

File	Description
readme.md	Updates container descriptions and mentions DB TLS/cert availability.
docker-compose.yml	Mounts certs into PHP/DB/Adminer and adds Adminer SSL env vars/plugins mount.
build/default_configuration/php/client.cnf	Adds MySQL/MariaDB client TLS configuration.
build/default_configuration/mysql/my.cnf	Adds MySQL server TLS settings and `require_secure_transport`.
build/default_configuration/mariadb/my.cnf	Adds MariaDB server TLS settings and `require_secure_transport`.
build/default_configuration/certs/webserver/certificate.key	Adds bundled webserver private key (sensitive).
build/default_configuration/certs/webserver/certificate.crt	Adds bundled webserver certificate.
build/default_configuration/certs/database/*	Adds CA/client/server certs and private keys for DB TLS.
build/default_configuration/adminer/plugins-enabled/enable-ssl;php.php	Adds Adminer plugin to enable SSL connections.
addons/documentation/how_to.md	Adds/updates TLS and dump import/export guidance.
addons/docker_scripts/down_and_up.sh	Adds helper script to restart compose with `.env.local`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCg8bWnm5ld3N9P
+bYg00E4Z5KCtUz5FBBBJo6UTUO7rRufkOnLeB7RFwk9bzjnhciGvE25q/ggU8Iyq
+qK+otNGSrKYd7EGjAmMZsd6mMD56/kECriK9hWmH2FAKbA0GiTDhsw1T7FgpHMMP
+n1EP5IPLBd0AGr7ZfinkW4VhokQpV7yN4fvWHBID3aXYlsyd+KcDpZNupvpI2tM+
+2Hf+Xzei7lElASRy9TnD6u0Ua6v6MDjiCSUSu0WqgBGSnodYgfPiJ9n7QFF5+a5b
+1tF+EJxoG2z3KQ8hJpSXXL36eIfRLvrnVpdp8tRFQl7TwwNFHqV8ulzmPHqnVn8g
+LLWGyCq7AgMBAAECggEAIjlD15BO3JbLJai0/gYNlZP4VuMMqsBidkZGJAVhyMYb
+KX0EUBJzUyIunecMh9QtNX18TWQXc9xzDRcxwz4wEnCEInjKvE8Vo7EfF1fK8Xx/
+doJxALwN5MUqwAyZ+HnT2yqn+uCXHqbvE7NdGXQOUm28wPju/HDHl7eedVR8Cg43
+bhPX9VhGjXESaTfPK0rNoIt4o/j+Lrxk9RdLKBrd6uWBLzWrfv3fXVgUYJPIlRW3
+lI/mGZOGdue+LunuzQe270+xJ0PtNmxIiyPibslQ5/EHp3YTnyKunpHAm2KRKGS8
+FhHTFJkya01y6WWgDjl5UFatvoOGNUKB0+DNgAY7gQKBgQDd+VK7tbd7a+mEtr4X
+ejU4X162HJ50v6GFE4TCTN+YWpnbtCoK30IpYwfSY7oG/t4HdiWmhks3GdsRjKVk
+QZPweOY4zHtOwZVkl19uRJ9geUDXDuzjTumOvYhFBLqzGbGFcKkOslLDFr90K2ov
+QvBjBGQdwfWFLUfu+yIqsutqxwKBgQC5nXa+opfOCdpEgcTcd6PRxsqp5UE1J75h
+ilSWQWf/lK9ZueYv1DBNTocTxWl3jk9QrnhQOtiwnVDYz3MnXtG5gmlMs4aeTh0u
+AMjYvcg9Feizb8WFE18ogofGmyhKq1TQ93N29uKoK95bZS1y8iJdVHq6MlyfMsT0
+QJ7xrsKsbQKBgQDEX/10eSfQ9cAKnA0CAiixLZZBsIHysVH4xDLQHmg1hfnV58bG
+BYunx6e01mtOIw5UNY7LisViAurO1MnBL07tEFhEaYqxOwuqiUxw5h7Fn5/gYqDp
+2/c+Q6kZvjxZlGJ7thaqHNKhKy/HW10+YI8AWnMj7GMEJfIcl2o7sjwZIwKBgEG5
+diCOpj440ubLJJAEdSeEwqJiITLXPdyABO+nfVHMrkKRRubMtcXJ9p6TmoLRC1jA
+Tq3qCGyRZ909p8LbGlwbx3l3YEWR11dAw92rZcnrhhhzjXdPorRPdBBpRF0cSc4s
+sOABD8UIs5WdP/ihsHVnwoVH6/AbJA5xC1b80MYJAoGAQ8/Cx4ylHJFjJjv4BWJb
+5Pu0CVyEvDR+ADY4+Dcfx6h43nJ8kfhIUtUCVNfvttNoJsCbPx4mwhYjRbWcCaEm
+r3N4P6TUwvBw4D1ZFTwcZ0fM6Y9huw34KaTxePlRhNrz7IgbXqspkH4NzIT6wzdB
+57pufY7n+6Fwfh6UBSpAjl4=
+-----END PRIVATE KEY-----


  volumes:
    - ${CONF_FOLDER}/php/php.ini:/usr/local/etc/php/conf.d/php.ini
    - ${CONF_FOLDER}/php/xdebug.ini:/usr/local/etc/php/conf.d/xdebug.ini
+    - ${CONF_FOLDER}/php/client.cnf:/etc/mysql/conf.d/client.cnf


    - ${HTML_FOLDER}:/var/www/html/
    - ${DATA_FOLDER}/php/coverage:${PHP_COVERAGE_OUTPUT_FOLDER}
    - ${DATA_FOLDER}/php/profile:${PHP_PROFILE_OUTPUT_FOLDER}
+    - ${CONF_FOLDER}/certs/database:/etc/database/certs


      - ${CONF_FOLDER}/mariadb:/etc/mysql/conf.d
      - ${DATA_FOLDER}/mariadb/:/var/lib/mysql
      - ${DATA_FOLDER}/dbdump/:/tmp/dbdump
+      - ${CONF_FOLDER}/certs/database:/etc/mariadb/certs


+return new AdminerLoginSsl(
+    $ssl = [
+        'key' => $key,
+        'cert' => $cert,
+        'ca' => $ca,
+        'verify' => false,
+    ]


+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCpHm2Aeb4Rn8ke
+X4JSL+inGCVdLoDc9Ssy/qK7xTYqV5iscR1R07ZCHk/+r9icXY2I3HqxW64wAlCH
+/hHGMmF/dbN8CrNsB0GGU7mne2G+dHpYUKcjbP7jv8+RcCczRG3xz2t5WWaM0KmF
+DuJdBWVt/NMWAFD9ghMt0PThNOkHCYyg6z+cbkXypKJuQzi6Evpm3otH1k45PnAr
+fQgvHrYJVf1JqzOydzPwy5h8JSLIrf/EYgcddHVeRzI6SO+OJNvI76h1QO7pbgcn
+c1rqFJTcsPlrj59JZsmq6twbbtd1JYnRy6BpunSxUS0yMiBeHRSJK//Q23Cc37K0
+P2BT1rcPAgMBAAECggEACLbhq5oaWiwin+cJ/xQq59lNq5SG3VvgwvruBcDuvpXO
+7yvQ9/Nx08xeEOCcx8nmTiQWSmdP/XdREQDdh5n2/itheUXP4wQoszRDP8cSzU6R
+M1XMlv250KCEoJjn3DNteuVWQ2WA7EagRZPzxBlQFa/ObLbNdZKrTFQVGjmwvEUD
+KMrGicCoSZ4TP9tt+cnB3e2K7qOlH2C+6lCkaC/Z6Ee/T+F2prmD4xVX459H9/dU
+/4g/20BFOKQYR7Yijf4VyZew+5B2Xj69VEbJKk/2VM/dM4vNnJNZTaccuqIo9Wl2
+zAo1Qe5JWGFvn0d6ydWtMbIjjE6BL61x39twhAkPkQKBgQDkyHbal9dtw3+8Z4zI
+1RWhoAsKXtsAwzstU7WInYLLsrq31PQ/5BhmYBxzR4YkiTcUFzZNliWKpMC9phXA
+t5G8xgwc3+a6H6vV5pMy6TKm3h0Mn0mw9vL9cDgEtE0+Rkz0Tx/J45Ij5jC4/xF8
+k8sc2kOeHUXhaBIMPllEwDeOmQKBgQC9POdeYffzOfT/p3KaQQobxqS9xO36hsar
+TNvV7QM7q08dwuN8jC2iO+ogDaS1rpMfnU7yCuZEfKDXmPG9zOYSEp7SEIFAfAxd
+JPhOIHv/EXBe2zTwMEQzQDN08u15YGRHxSdOD6FIVAz4p/AxrVOiEaivchVBt7/2
+kMlZP1tD5wKBgQDj9KoYXDsW7ziTbUnlwgtvo5vclW75b43DOCklGmx8snVBPjqw
+foGhYBp48sdCGEZ9CjPdUsHNRyOU06vQ/heEVIE1NBMdWPlKhBgfHiSOB7pCHWS7
+oxOyWuI2LcDZUArVUxGFg+7VPkNF0UCHNGupMAE3xksesSdqc6VWz3+L4QKBgHvN
+6KC6/3jFJiBL8JIykuZxIz50JC2PF1LiycA/e6oB/ZS++A13uDM3d4jY5DVorSA1
+znxT3SpZTvE+QommD68rN3S/D5Ccl4oosbqLThQl2Jp2Vz/8k+Hj0sZkWDDcez7p
+ITnUx/OF6aaUWHRnrRuO6gk+XeHM0W4Cc3hMFu1pAoGBAORT+sBVRK82krDC3S2f
+5f+CzCIAku0tx1wiRcJk9TMQwqlDSb5DgfqyrnvXQNz5afkOnYt3j3naQdDS8qux
+gWEjxFhNK6K9C3J+YuzqaXaMEH6qxIhxrpYATGWSJBtXldytOAc8vEIhqSf3gFH9
+kJZUFZgmTlYoHLV40JEYeB8d
+-----END PRIVATE KEY-----


+      DB_SSL_CERT: '/etc/database/certs/client-cert.pem'
+      DB_SSL_CA: '/etc/database/certs/ca.pem'
+    volumes:
+      - ${CONF_FOLDER}/certs/database:/etc/database/certs


+$key = $_ENV['DB_SSL_KEY'];
+$cert = $_ENV['DB_SSL_CERT'];
+$ca = $_ENV['DB_SSL_CA'];
+


-🐳 [Docker official image page](https://hub.docker.com/_/mysql)
+> [!IMPORTANT]
+> `require_secure_transport` flag is set to `OFF` in the default configuration of the database.\
+If you want to enable it, you can change the `my.cnf` file included in the database conf directory. [How To...](./addons/documentation/how_to.md#edit-configuration-2)\


+> [!IMPORTANT]
+> `require_secure_transport` flag is set to `OFF` in the default configuration of the database.\
+If you want to enable it, you can change the `my.cnf` file included in the database conf directory. [How To...](./addons/documentation/how_to.md#edit-configuration-2)\
+You also need to set `db_tls.enabled' => true` in iTop configurations.


Molkobain · 2026-05-04T06:28:04Z

 - [PHP](#php)
  - [Change PHP settings](#change-php-settings)
  - [Change XDebug settings](#change-xdebug-settings)
+  - [Change MariaDB client settings](#change-mariadb-client-settings)


Should we say "MariaDB / MySQL" as it impacts MySQL as well?

Molkobain · 2026-05-04T06:28:26Z

 > [!NOTE]
 > Browse [XDebug settings](https://xdebug.org/docs/all_settings) for more information.

+### Change MariaDB client settings


Same as above.

Molkobain · 2026-05-04T07:11:01Z

Isn't there a typo in the file's name?

bdalsass added 7 commits April 29, 2026 10:39

🔒 Add secured connection configuration for databases

db7a98e

🔒 Add secured connection configuration for databases (doc)

5921f42

🔒 Add secured connection configuration for databases (doc)

74d5006

🔒 Add secured connection configuration for databases (doc)

d2800c5

🔒 Add secured connection configuration for databases (doc)

386ed12

🔒 Add secured connection configuration for databases (doc)

0e0e739

🔒 Add secured connection configuration for databases (doc)

618c52e

bdalsass changed the title ~~Feature/add database certificates~~ Database secured connection Apr 30, 2026

bdalsass requested review from Lenaick, Molkobain and Copilot May 4, 2026 05:57

bdalsass self-assigned this May 4, 2026

bdalsass added the enhancement New feature or request label May 4, 2026

Copilot started reviewing on behalf of bdalsass May 4, 2026 05:58 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

Molkobain reviewed May 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Database secured connection#23

Database secured connection#23
bdalsass wants to merge 7 commits intomasterfrom
feature/add-database-certificates

bdalsass commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Molkobain May 4, 2026

Uh oh!

Molkobain May 4, 2026

Uh oh!

Molkobain May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bdalsass commented Apr 30, 2026

Base information

Symptom (bug) / Objective (enhancement)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Molkobain May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Molkobain May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Molkobain May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants