{"id":13553011,"url":"https://github.com/schnatterer/smeagol-galore","last_synced_at":"2025-06-17T13:33:12.673Z","repository":{"id":146782023,"uuid":"135928914","full_name":"schnatterer/smeagol-galore","owner":"schnatterer","description":"A git-based wiki featuring markdown, a WYSIWYG Editor, PlantUML, and much more","archived":false,"fork":false,"pushed_at":"2022-08-08T22:15:19.000Z","size":4106,"stargazers_count":24,"open_issues_count":2,"forks_count":4,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-04T15:53:50.748Z","etag":null,"topics":["cas","cloudogu","docker","git","gollum","markdown","plantuml","scm-manager","tomcat","wiki"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/schnatterer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-06-03T18:15:17.000Z","updated_at":"2024-02-02T21:22:28.000Z","dependencies_parsed_at":"2023-03-27T14:35:43.457Z","dependency_job_id":null,"html_url":"https://github.com/schnatterer/smeagol-galore","commit_stats":null,"previous_names":[],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/schnatterer/smeagol-galore","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schnatterer%2Fsmeagol-galore","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schnatterer%2Fsmeagol-galore/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schnatterer%2Fsmeagol-galore/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schnatterer%2Fsmeagol-galore/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/schnatterer","download_url":"https://codeload.github.com/schnatterer/smeagol-galore/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schnatterer%2Fsmeagol-galore/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260369675,"owners_count":22998667,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cas","cloudogu","docker","git","gollum","markdown","plantuml","scm-manager","tomcat","wiki"],"created_at":"2024-08-01T12:02:15.517Z","updated_at":"2025-06-17T13:33:07.590Z","avatar_url":"https://github.com/schnatterer.png","language":"Java","funding_links":[],"categories":["Java","git"],"sub_categories":[],"readme":"Smeagol galore\n============================\n[![Build Status](https://img.shields.io/github/workflow/status/schnatterer/smeagol-galore/Build)](https://github.com/schnatterer/smeagol-galore/actions)\n\nA lightweight version of [cloudogu's](https://cloudogu.com) git-based wiki system [smeagol](https://github.com/cloudogu/smeagol),\nthe lightning-fast alternative to [gollum](https://github.com/gollum/gollum).\n\n![GIF showcasing smeagol-galore](https://github.com/schnatterer/smeagol-galore/wiki/smeagol-galore.gif)\n\nRuns without a full Cloudogu ecosystem, but still features\n* Markdown,\n* WYSIWYG Editors,\n* [PlantUML](http://plantuml.com/),\n* [SCM-Manager](https://www.scm-manager.org/) as Git backend,\n* Single Sign On using [CAS](https://github.com/apereo/cas),\n* built-in let's encrypt support,\n* everything deployed on an [Apache Tomcat](https://github.com/apache/tomcat) and\n* neatly packed into a docker image.\n\n[![Diagram showing components and their relationships](http://www.plantuml.com/plantuml/svg/Z9BVIYCn58VlvocEkXSkE9Fw1oaYijsfYj1kfRNiXKWv9d4QEac69ACBuhjl9ZETjagbkJhjxvkJBoVvPHqQLyeyscFyHIWEwM0qxOzkfzFn0ERE5VQ248DlIIRSl7mkBJTKAyULIwYMXEQwP3ehIP6Zglh4otzYMnZXk2KIhUCcYlQ4edd9U6dozKr81LjYgKoAuF4z9ZbcEg_Hrlak7VtPpTUL1J9pkj8LFerVFD7wlfuadQIpuT7q9xw3rEgBPvip_bhrirwMBhZP3eODyOrRBJdnYgyxmuBDA1hsQG2J-_7Tm_LajnaOVEOvLmm93QTlPz5Eu3ZfaER7Xj5g6-AqfEXg3R_iGgW23Kf0O_GRl4S0gSwrWODEMD77EgGquu7vhGtZfY6Fpy-xNRP98dNQr2ZIHMPqgLY3dvpYAMDRcW3SQEM-ADJjfhPwa45Yln-kQX_G0WibmENbZxgykeA3bx22GVt1GpXv-C25ikBhQfCFgtg-iqawFBHK7e4luY4gpBZvkKGtmE5rxtOqE6oUkV-WBZx3DxtPNN-MziRzGuhs2DBUP1tvg8vQszvNbpiT3eBlygOhusNjdTyhl9e9nF4LD7l31LmpuU2lM8Yra4eVt787Orve6otXxoAVUKcVzKetvye9Yev77jyQhPgsnfuPSyMy1XEO6PGsQhFuSIuOu-gfRXT5KVrueJqaF9vr_vrroV7vq_zcwo39SH26ml2LdgGdmBl19Bx_aKQ9WPwakojcD_yovIyInOOuBLPIO0rm5QH5a6mDMC4Iu1P6hmDMI5PS1beXTMMbZIYs0eg6MG5EvBe2a20xLm0KsPO0u5W4M0Ba4c1oKg-3dDrfPfV1LX9f2if5K4hEPagx3B9R8e45G24MWVv_m7u5SWNedj0pAdfRav-1RBVMTaKapaWG-H7bdm3RcGEaHMJW_NYsopkmUckzFPan3CbypD8ho6ssjvRjGOncwNxSkzZ_0MnlxMwFGjXspAfR1tlxLhPH31arGf-WRhNzCiHUXsJhe6pVHEK0h5-20-HStmQ0fs0YZju6J92yjDaj2pf8Bi1vZ1ln0kXZoAQ8B01TWFFwxXaOm4vWLcwFl_V-EvaCpqfSW-8B0Aa4e8dLLZ1oeiUnpGHWJW5Kn1696u1pCLT0vCae4qJk3p2-4fbZ5BriEi7vrGJIb-yJXdLv0H3Q2Juq0Q2w221ga4zrCCXdy7Wt_ucdLpoZ_W80)](http://www.plantuml.com/plantuml/uml/Z9BVIYCn58VlvocEkXSkE9Fw1oaYijsfYj1kfRNiXKWv9d4QEac69ACBuhjl9ZETjagbkJhjxvkJBoVvPHqQLyeyscFyHIWEwM0qxOzkfzFn0ERE5VQ248DlIIRSl7mkBJTKAyULIwYMXEQwP3ehIP6Zglh4otzYMnZXk2KIhUCcYlQ4edd9U6dozKr81LjYgKoAuF4z9ZbcEg_Hrlak7VtPpTUL1J9pkj8LFerVFD7wlfuadQIpuT7q9xw3rEgBPvip_bhrirwMBhZP3eODyOrRBJdnYgyxmuBDA1hsQG2J-_7Tm_LajnaOVEOvLmm93QTlPz5Eu3ZfaER7Xj5g6-AqfEXg3R_iGgW23Kf0O_GRl4S0gSwrWODEMD77EgGquu7vhGtZfY6Fpy-xNRP98dNQr2ZIHMPqgLY3dvpYAMDRcW3SQEM-ADJjfhPwa45Yln-kQX_G0WibmENbZxgykeA3bx22GVt1GpXv-C25ikBhQfCFgtg-iqawFBHK7e4luY4gpBZvkKGtmE5rxtOqE6oUkV-WBZx3DxtPNN-MziRzGuhs2DBUP1tvg8vQszvNbpiT3eBlygOhusNjdTyhl9e9nF4LD7l31LmpuU2lM8Yra4eVt787Orve6otXxoAVUKcVzKetvye9Yev77jyQhPgsnfuPSyMy1XEO6PGsQhFuSIuOu-gfRXT5KVrueJqaF9vr_vrroV7vq_zcwo39SH26ml2LdgGdmBl19Bx_aKQ9WPwakojcD_yovIyInOOuBLPIO0rm5QH5a6mDMC4Iu1P6hmDMI5PS1beXTMMbZIYs0eg6MG5EvBe2a20xLm0KsPO0u5W4M0Ba4c1oKg-3dDrfPfV1LX9f2if5K4hEPagx3B9R8e45G24MWVv_m7u5SWNedj0pAdfRav-1RBVMTaKapaWG-H7bdm3RcGEaHMJW_NYsopkmUckzFPan3CbypD8ho6ssjvRjGOncwNxSkzZ_0MnlxMwFGjXspAfR1tlxLhPH31arGf-WRhNzCiHUXsJhe6pVHEK0h5-20-HStmQ0fs0YZju6J92yjDaj2pf8Bi1vZ1ln0kXZoAQ8B01TWFFwxXaOm4vWLcwFl_V-EvaCpqfSW-8B0Aa4e8dLLZ1oeiUnpGHWJW5Kn1696u1pCLT0vCae4qJk3p2-4fbZ5BriEi7vrGJIb-yJXdLv0H3Q2Juq0Q2w221ga4zrCCXdy7Wt_ucdLpoZ_W80)\n\n# Table of contents\n\n\u003c!-- Update with `doctoc --notitle README.md`. See https://github.com/thlorenz/doctoc --\u003e\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n\n- [Usage](#usage)\n  - [Getting started](#getting-started)\n  - [Persist state](#persist-state)\n    - [SCM-Manager (Repos/Wikis)](#scm-manager-reposwikis)\n    - [Smeagol's Repo Cache](#smeagols-repo-cache)\n  - [Custom Certificate](#custom-certificate)\n    - [Mount your own certs](#mount-your-own-certs)\n    - [Built-in Let's Encrypt support](#built-in-lets-encrypt-support)\n  - [Create more wikis](#create-more-wikis)\n  - [Credentials](#credentials)\n  - [Configuration](#configuration)\n  - [More substantial example](#more-substantial-example)\n  - [Kubernetes](#kubernetes)\n- [Import from Gollum](#import-from-gollum)\n- [Troubleshooting](#troubleshooting)\n  - [Extend Log output](#extend-log-output)\n    - [SCM-Manager](#scm-manager)\n    - [Smeagol](#smeagol)\n    - [CAS](#cas)\n  - [Debugging](#debugging)\n- [Links](#links)\n  - [SCM](#scm)\n  - [CAS](#cas-1)\n- [Building](#building)\n- [TODOs](#todos)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n# Usage\n\n## Getting started\n\n```bash\ndocker run -p 8443:8443 ghcr.io/schnatterer/smeagol-galore\n```\n\nNote that\n\n* SCM-Manager installs plugins via the internet on first startup, so it might take some time.  \n  You can choose which plugins are installed by editing `plugin-config.yml`, e.g. by mounting your own version into the\n  container: `-v your-plugin-config.yml:/etc/scm/plugin-config.yml`.  \n  See [SCM-Jenkins](https://oss.cloudogu.com/jenkins/job/scm-manager/) for available plugins.\n* A self-signed certificate will be created on startup.\n  These will result in warnings in your browser.  \n  See bellow for custom certificates.\n* Smeagol galore will be available on [https://localhost:8443](https://localhost:8443) (and via `/smeagol`).  \n  SCM-Manager will be available on [https://localhost:8443/scm](https://localhost:8443/scm).\n* Default user/pw: `admin/admin` (see bellow for custom credentials)\n* PlantUML Rendering uses plantuml.com by default. Note that this might be blocked by browser plugins such as uBlock 🤔\n  You can use your own instance with a custom image, though. See [Building](#building).\n* You might find older versions of smeagol galore on [DockerHub](https://hub.docker.com/repository/docker/schnatterer/smeagol-galore/tags), if they haven't been deleted by their\n  [image retention policy](https://www.docker.com/blog/scaling-dockers-business-to-serve-millions-more-developers-storage/).\n\n## Persist state\n\n### SCM-Manager (Repos/Wikis)\nMount SCMM Volume to persist your repos/wikis: `-v $(pwd)/dev/scm:/home/tomcat/.scm `.\nThis will also persist SCMM plugins, so the second start will be much faster.\n\nMake sure the smeagol galore container use (UID 1001) is allowed to write to this folder by either `chown`ing or\n`chmod`. For development the following will do\n\n```bash\nmkdir -p dev/scm\nchmod 777 dev/scm\ndocker run --rm --name smeagol-galore -p 8443:8443 -v $(pwd)/dev/scm:/home/tomcat/.scm schnatterer/s\nmeagol-galore\n```\n\n### Smeagol's Repo Cache\n\nAlthough not strictly necessary, it is recommended to persist Smeagol's repo Cache at `/home/tomcat/.smeagol`.\nWithout it smeagol will have to clone every repo from SCM-Manager again. Especially for large repos (100MB+) this will\nslow down the first request to each repo after the container has been restarted.\n\n## Custom Certificate\n\nThe self-signed certificate that is generated on startup by default is only a valid option for trying out and development.\nIn production, you should provide a proper certificate, which can be done by either:\n* mounting your certs\n* enabling built'in Lets's Encrypt support\n\nNote that smeagol, cas and SCMM communicate with each other via HTTPS.\nIf you're certificate is not trusted by the JVM you should add it to the trust store and then mount it like so:\n`-v $(pwd)/dev/cacerts:/opt/java/openjdk/lib/security/cacerts`.\n\nSee [entrypoint.sh](entrypoint.sh) for an example.\n\n### Mount your own certs\n\nJust mount your certs into the container like so: `-v $(pwd)/certs:/config/certs/${FQDN}`.\n\nSmeagol galore's server loads the certs from the following files inside the `/config/certs/${FQDN}` folder:\n\n* `cert.pem`\n* `fullchain.pem`\n* `privkey.pem`\n\n### Built-in Let's Encrypt support\n\nIf you don't have any reverse proxy infrastructure that handles TLS temrination, the most convenient way of handling\nTLS is to use Smeagol Galore's built-in Let's Encrypt support.\n\nBefore getting started, make sure\n\n* to set the DNS record to match the external IP address of your host and\n* that ports 80 and 443 are routed to the container ports. By default:\n  * external port 443 to container port 8443 (`-p443:8443`) and\n  * external port 80 to container port 8080 (`-p80:8080`)\n\nThen just enable let's encrypt via the environment:\n* `-e ENABLE_LETSENCRYPT=true` - enable let's encrypt support\n* `-eFQDN=example.com` - determines the domain to request the cert for\n* `-eSTAGING=true` - If set to `true` creates certs against Lets Encrypt's staging, which has no rate limit but is not\n  accepted by your browser.\n\nFor a full example see [examples](example/docker-compose-letsencrypt.yaml).\n\nAt startup Smeagol Galore still generates self-signed certs, if none are there, as it needs cert files to get the\nserver started.  \nOnce the server is up, a background process queries the certs from Let's Encrypt, if their validity is less than 30 days.\nThe process checks once a day if the certs are valid less than 30 days and renews them, if necessary.\n\n## Create more wikis\n\nNote that the git arg `-c http.sslVerify=false ` is only necessary for testing with a self-signed cert .\nIf you use an official TLS cert this won't be necessary.\n\n* Go to https://localhost:8443/scm\n* Log in as administrator\n* Create a git repo\n* Clone into git wiki, e.g. for localhost: `git -c http.sslVerify=false clone https://admin@localhost:8443/scm/git/test`\n* Add empty `.smeagol.yml` file: `touch .smeagol.yml \u0026\u0026 git add .smeagol.yml \u0026\u0026 git commit -m 'Create smeagol wiki'`\n* Push, e.g. for localhost: `git -c http.sslVerify=false push`\n* Go to https://localhost:8443/smeagol\n\nAll in one:\n\n```bash\ngit -c http.sslVerify=false clone https://admin@localhost:8443/scm/git/test\ncd test\ntouch .smeagol.yml\ngit add .smeagol.yml\ngit commit -m 'Creates smeagol wiki'\ngit -c http.sslVerify=false push --set-upstream origin master\n```\n\n## Credentials\n\nDefault user/pw: `admin/admin`\n\nCredentials defined in `/etc/cas/users.txt` and `/etc/cas/attributes.xml`. Custom ones can be mounted into the container like so for example: `-v $(pwd)/dev/users.txt:/etc/cas/users.txt`.\n\nSee [users.txt](cas/etc/cas/users.txt) and [attributes.xml](cas/etc/cas/attributes.xml).\n\nCAS has \"pluggable authentication support (LDAP, database, X.509, 2-factor)\" see [CAS 4 docs](https://apereo.github.io/cas/4.0.x/index.html).\nGet started at [deployerConfigContext.xml](cas/src/main/webapp/WEB-INF/deployerConfigContext.xml)\n\n\n## Configuration\n\nVia Environment Variables:\n\n* Set the name of SCM-Manager's `ADMIN_GROUP`\n* Set your Fully Qualified Domain name (including Port) - `FQDN`  \n  Note that the smeagol galore container must be able to resolve this address as well,\n  because the webb apps communicate with each other (smeagol -\u003e cas, smeagol -\u003e scm, scm -\u003e cas).\n  You can try this out locally, by adding the following entry to your `/etc/hosts`: `127.0.0.1 smeagol` and then passing\n  the following parameters to the container: `-v /etc/hosts:/etc/hosts -e FQDN=smeagol:8443`. You can then reach smeagol\n  at `https://smeagol:8443`.\n* `HTTP_PORT` and `HTTPS_PORT`. Ports to listen on. Note that FQDN contains the HTTPS port (if != 443).  \n  For now, the `tomcat` user is allowed to listen on ports 80,443 and of course \u003e 1024.  \n  Other ports are only possible when run as root (`docker run -u0`), which you shouldn't.  \n  **Note*: This seems to only work when the image is built with newer versions of docker (tested with 19.03.08) but not\n  with the one use by DockerHub. As the image is built from source there, these image will result in\n  `Socket bind failed: [13] [Permission denied].`  \n  To showcase the feature I pushed an image with tag `0.2.0-SNAPSHOT-2e1ec28f`. If this works for you, you might want to\n  build the most recent version from source yourself.\n* `-e DEBUG=true` exposes port 8000 as Tomcat debug port\n* Additional arguments can be passed to tomcat, or the webapps (CAS, smeagol, SCM-Manager)\n  * As Docker `CMD`, e.g.  \n    `docker run ghcr.io/schnatterer/smeagol-galore '-Xmx1g -Dabc=def'`\n  * Via env var `EXTRA_JVM_ARGUMENTS`, e.g.   \n    `docker run -e EXTRA_JVM_ARGUMENTS='-Xmx1g -Dabc=def' ghcr.io/schnatterer/smeagol-galore`\n  * Examples:\n    * `-XmX2g` to virtual machine / tomcat process\n    * See CAS's [`cas.properties`](cas/etc/cas/cas.properties) and\n    * Smeagol's [application.yml](https://github.com/cloudogu/smeagol/blob/develop/src/main/resources/application.yml)\n    * for options. These can either be set\n      * as System Property, e.g. `docker run -e EXTRA_JVM_ARGUMENTS='-Dproperty.name=value'...`) or\n      * Environment Variable, e.g. (`docker run -e -e PROPERTY_NAME=value ...`).\n    * This is used in the [example](example/docker-compose.yaml) to increase session timeout / token expiration.\n* Via `SMEAGOL_GALORE_LOGIN_WELCOME` you can customize the welcome message on the login screen. Default is `Smeagol Galore`\n\nThe container is run as with UID and GID = 1000.\nIf you want to run it as a different user you pass `-u` param when running the container.\nHowever, you should make sure that the user exists (e.g. mount `/etc/passwd`).\n\nAnother option is to build your own image and set `--build-arg USER_ID` and `GROUP_ID` to your liking.\n\n## More substantial example\n\nSee [example](example/README.md) for a more substantial example using docker-compose.\n\n## Kubernetes\n\nThere was an example on how to deploy to kubernetes see [this revision](https://github.com/schnatterer/smeagol-galore/tree/d51bfbfca8dda63a2675cc3f14c66b0106403bf3/k8s).\nIt was no longer maintained, so if needed it could be used as a starting point.\nEven more convenient would be a helm chart.\nPRs welcome.\n\n# Import from Gollum\n\n- Just create a new repo in SCM-Manager and push Gollum's wiki there. Then do the following, add and commit each step. Finally push.\n- `touch .smeagol.yml`\n- `mkdir docs`\n- Move all files to /docs\n    ```bash\n    mkdir docs\n    git mv -k * docs #-k ignores errors such as moving docs to docs\n    git mv -k .* docs #hidden files\n    ```\n- There are [a couple of limitations regarding file names](https://github.com/cloudogu/smeagol/blob/50330fa6ded55d8cf62ced9d9b45e5ca8bbbe7a4/src/main/java/com/cloudogu/smeagol/wiki/domain/Path.java#L74).    \n  Find an `rename` or `git mv` them.\n  - For example, find files that end with a blank before the file extension: `ll | grep ' \\.md'.`\n  - Find files that do not match the [character whitelist of smeagol](https://github.com/cloudogu/smeagol/blob/50330fa6ded55d8cf62ced9d9b45e5ca8bbbe7a4/src/main/java/com/cloudogu/smeagol/wiki/domain/Path.java#L20):\n    `find ./  -printf \"%f\\n\" | grep -Pv '^[\\w\\.\\-_/ ]+$'`.  \n    You could just replace them: `rename 's/[(),#+~\u0026]/_/g' *` (add more characters to replace in the first part of the regex, if needed).      \n    But keep in mind that changing the name of a file might break links to those.\n  - If you used uploads in Gollum, you might have to change the links.  \n    If you used fully qualified (absolute) links (like `https://mygoll.um/uploads`) or relative links starting in `/`\n    (like `/uploads`) you should change all to `uploads`.  \n    You can find them like so: ` grep -r https://mygoll.um/uploads/` and `grep -r /uploads/`.\n- For some reason the version overview in smeagol shows only changes occurred after moving the files.  \n  However, the history can still be found in git via scm-manager.\n- Note that it is also possible to run Gollum and Smeagol in parallel:\n  - Just add a git origin to Gollum's Git repo pointing to the Git Repo in SCM-Manager.\n  - You can then sync via push and pull in Gollum's git repo.\n\n# Troubleshooting\n\n## Extend Log output\n\nDetails for SCM-Manager, CAS, and Smeagol bellow. Process is the same for each component:\n\n* Copy log files from source\n* Increase levels for appenders\n* Mount into container\n\nSee also [more substantial example ](example/README.md) using docker-compose.\n\n### SCM-Manager\n\n* [`logback.xml`](scm/logback.xml)\n* Run Container with `-v $(pwd)scm-logback.xml:/tomcat/webapps/scm/WEB-INF/classes/logback.xml`\n* [See also](https://bitbucket.org/sdorra/scm-manager/src/default/scm-webapp/src/main/resources/logback.default.xml)\n\n### Smeagol\n\n* [`logback.xml`](smeagol/logback.xml)\n* Run Container with `-v $(pwd)/smeagol-logback.xml:/tomcat/webapps/smeagol/WEB-INF/classes/logback.xml`\n* [See also](https://github.com/cloudogu/smeagol/blob/develop/src/main/resources/logback.xml)\n\n### CAS\n\n* [`log4j.xml`](cas/src/main/resources/log4j.xml)\n* Run Container with `-v $(pwd)/cas-log4j.xml:/tomcat/webapps/cas/WEB-INF/classes/log4j.xml`\n\n\n## Debugging\n\n* Start container with `-p8000:8000 -e DEBUG=true`\n* Load sources for [SCM-Manager](https://github.com/sdorra/scm-manager) and related plugins, CAS from this repo and/or [smeagol](https://github.com/cloudogu/smeagol) into your IDE.\n* Start debugger, e.g. in [IntelliJ](https://stackoverflow.com/a/6734028/1845976) on port 8000\n\n# Security\n## Log4Shell / CVE-2021-44228\n\n[CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).\n\nSmeagol-galore does not use Log4j version 2, so it is not affected. \n* CAS includes log4j version 1, Smeagol includes log4j-api and log4j-to-slf4j and SCM-Manager uses logback [which all are not vulnerable in terms of CVE-2021-44228](https://wwe.e.slf4j.org/log4shell.html).\n* However, when an attacker has write access to the cas log4j config, the `JMSAppender` class could abused for an attack similar to log4shell.  \n  This class was removed preventively in 1.6.1-1-r1.\n* A similar attack vector exists in Logback used in SCM-Manager, which [was patched in version 2.27.3 of SCM-Manager](https://scm-manager.org/blog/posts/2021-12-13-log4shell/), contained in galore 1.6.1-1-r1.  \n  The above link states that SCM-Manager plugins _might_ be affected, which you should check via script plugin.\n\nSo in Smeagol galore \u003e= 1.6.1-1-r1, with default SCM-Manager plugins there is no vulnerability similar to log4shell, according to current knowledge, \nas of 22 December, 2021. \n\n\n# Links\n\n[Unidata/tomcat-docker: Security-hardened Tomcat container](https://github.com/Unidata/tomcat-docker)\n\n## SCM\n\n* [scm-cas-plugin](https://bitbucket.org/scm-manager/scm-cas-plugin/src/master/)\n* [cloudogu/scm docker image](https://github.com/cloudogu/scm/blob/master/Dockerfile)\n\n## CAS\n\n* [Cas 4 Overlay example](https://github.com/UniconLabs/simple-cas4-overlay-template/blob/master/pom.xml)\n* [CAS 4 code](https://github.com/apereo/cas/tree/v4.0.7)\n* [CAS 4 docs](https://apereo.github.io/cas/4.0.x/index.html)\n\n# Building\n\n`docker build -t smeagol-galore .`\n\n* Optionally, you can choose your own PlantUML server like so: `--build-arg PLANTUMLSERVER=\"https://[...]/png/\"`\n\n\n# TODOs\n\n- Convert to a more 12-factor-like app using multiple containers and docker-compose\n- Create helm chart\n- Maybe persist CAS Tickets, so we can stay logged in even in case of a restart? HSQL stored to file=\n  Docs seem a bit unconsistent for cas [4.0.x](https://apereo.github.io/cas/4.0.x/installation/JPA-Ticket-Registry.html), though. Better with 4.1.x.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschnatterer%2Fsmeagol-galore","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fschnatterer%2Fsmeagol-galore","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschnatterer%2Fsmeagol-galore/lists"}