Selinux support

.github/workflows/macos.yml

@@ -14,7 +14,7 @@ jobs:
             - name: Toolchain
               uses: actions-rs/toolchain@v1
               with:
-                  toolchain: stable
+                  toolchain: 1.49.0
                   target: x86_64-apple-darwin
                   override: true
 

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: stable
+          toolchain: 1.49.0
           override: true
 
       - name: Run cargo check
@@ -37,7 +37,7 @@ jobs:
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: stable
+          toolchain: 1.49.0
           override: true
 
       - name: Run cargo test
@@ -56,7 +56,7 @@ jobs:
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: stable
+          toolchain: 1.49.0
           override: true
           components: rustfmt, clippy
 

wf2_core/src/dc_service.rs

@@ -49,6 +49,9 @@ pub struct DcService {
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub networks: Option<HashMap<String, DcServiceNetwork>>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub privileged: Option<bool>,
 }
 
 impl DcService {
@@ -155,6 +158,10 @@ impl DcService {
         }
         self
     }
+    pub fn set_privileged(&mut self, privileged: bool) -> &mut Self {
+        self.privileged = Some(privileged);
+        self
+    }
     pub fn finish(&self) -> DcService {
         DcService { ..self.clone() }
     }

wf2_core/src/recipes/m2/services/db.rs

@@ -60,14 +60,14 @@ impl Service<M2Vars> for DbService {
         let opts = DbServiceOptions::from_ctx(&ctx);
         DcService::new(ctx.name(), Self::NAME, opts.image)
             .set_volumes(vec![
-                format!("{}:{}", M2Volumes::DB, DbService::VOLUME_DATA),
+                format!("{}:{}:z", M2Volumes::DB, DbService::VOLUME_DATA),
                 format!(
-                    "{}:{}",
+                    "{}:{}:z",
                     vars.content[&M2Var::DbConfDir],
                     DbService::VOLUME_CONF
                 ),
                 format!(
-                    "{}:{}",
+                    "{}:{}:z",
                     vars.content[&M2Var::DbInitDir],
                     DbService::VOLUME_ENTRY
                 ),
@@ -111,9 +111,9 @@ mod tests {
             container_name: wf2__project__db
             image: "mysql:8.0"
             volumes:
-              - "db-data:/var/lib/mysql"
-              - "/users/shane/project/.wf2_m2_project/mysql/mysqlconf:/etc/mysql/conf.d"
-              - "/users/shane/project/.wf2_m2_project/mysql/init-scripts:/docker-entrypoint-initdb.d"
+              - "db-data:/var/lib/mysql:z"
+              - "/users/shane/project/.wf2_m2_project/mysql/mysqlconf:/etc/mysql/conf.d:z"
+              - "/users/shane/project/.wf2_m2_project/mysql/init-scripts:/docker-entrypoint-initdb.d:z"
             env_file:
               - "/users/shane/project/.wf2_m2_project/.docker.env"
             restart: unless-stopped

wf2_core/src/recipes/m2/services/nginx.rs

@@ -20,16 +20,16 @@ impl Service<M2Vars> for M2NginxService {
             .dc_service(&ctx, &())
             .set_working_dir(M2_ROOT)
             .set_volumes(vec![
-                format!("{}:{}", M2Volumes::APP, M2_ROOT),
-                format!("{}:/etc/nginx/conf.d", vars.content[&M2Var::NginxDir]),
+                format!("{}:{}:z", M2Volumes::APP, M2_ROOT),
+                format!("{}:/etc/nginx/conf.d:z", vars.content[&M2Var::NginxDir]),
             ])
             .set_depends_on(vec![PhpService::NAME])
             .set_env_file(vec![vars.content[&M2Var::EnvFile].to_string()])
             .finish();
 
         if M2RecipeOptions::has_pwa_options(&ctx) {
             service.add_depends_on(vec![PwaService::NAME]);
-            service.add_volumes(vec![format!("{}:{}{}", M2Volumes::PWA, M2_ROOT, "/pwa")]);
+            service.add_volumes(vec![format!("{}:{}{}:z", M2Volumes::PWA, M2_ROOT, "/pwa")]);
         }
 
         service
@@ -53,8 +53,8 @@ mod tests {
             container_name: wf2__wf2_default__nginx
             image: "wearejh/nginx:stable-m2"
             volumes:
-              - "app-src:/var/www"
-              - "./.wf2_default/nginx/sites:/etc/nginx/conf.d"
+              - "app-src:/var/www:z"
+              - "./.wf2_default/nginx/sites:/etc/nginx/conf.d:z"
             env_file:
               - "./.wf2_default/.docker.env"
             depends_on:
@@ -80,9 +80,9 @@ mod tests {
             container_name: wf2__wf2_default__nginx
             image: "wearejh/nginx:stable-m2"
             volumes:
-              - "app-src:/var/www"
-              - "./.wf2_m2_wf2_default/nginx/sites:/etc/nginx/conf.d"
-              - "pwa-src:/var/www/pwa"
+              - "app-src:/var/www:z"
+              - "./.wf2_m2_wf2_default/nginx/sites:/etc/nginx/conf.d:z"
+              - "pwa-src:/var/www/pwa:z"
             env_file:
               - "./.wf2_m2_wf2_default/.docker.env"
             depends_on:

wf2_core/src/recipes/m2/services/node.rs

@@ -18,7 +18,7 @@ impl Service<M2Vars> for M2NodeService {
             .dc_service(ctx, &())
             .set_working_dir(M2_ROOT)
             .set_init(true)
-            .set_volumes(vec![format!("{}:{}", M2Volumes::APP, M2_ROOT)])
+            .set_volumes(vec![format!("{}:{}:z", M2Volumes::APP, M2_ROOT)])
             .set_env_file(vec![vars.content[&M2Var::EnvFile].to_string()])
             .finish()
     }

wf2_core/src/recipes/m2/services/php.rs

@@ -39,9 +39,9 @@ impl Service<M2Vars> for PhpService {
         let image = &vars.content[&M2Var::PhpImage].clone();
         DcService::new(ctx.name(), Self::NAME, image)
             .set_volumes(vec![
-                format!("{}:{}", M2Volumes::APP, M2_ROOT),
+                format!("{}:{}:z", M2Volumes::APP, M2_ROOT),
                 format!(
-                    "{}:{}",
+                    "{}:{}:z",
                     M2Volumes::COMPOSER_CACHE,
                     PhpService::COMPOSER_CACHE_PATH,
                 ),

wf2_core/src/recipes/m2/services/unison.rs

@@ -26,13 +26,13 @@ impl Service<M2Vars> for UnisonService {
         DcService::new(ctx.name(), Self::NAME, Self::IMAGE)
             .set_volumes(vec![
                 format!(
-                    "{}:{}",
+                    "{}:{}:z",
                     vars.content[&M2Var::Pwd],
                     UnisonService::VOLUME_HOST
                 ),
-                format!("{}:{}", M2Volumes::APP, UnisonService::VOLUME_INTERNAL),
+                format!("{}:{}:z", M2Volumes::APP, UnisonService::VOLUME_INTERNAL),
                 format!(
-                    "{}:{}",
+                    "{}:{}:z",
                     vars.content[&M2Var::UnisonFile],
                     UnisonService::CONFIG_FILE
                 ),

wf2_core/src/services/pwa.rs

@@ -62,7 +62,7 @@ impl Service<PwaServiceOptions> for PwaService {
             .set_init(true)
             .set_ports(vec![PwaService::PORT.to_string()])
             .set_volumes(vec![format!(
-                "{}:{}",
+                "{}:{}:z",
                 M2Volumes::PWA,
                 opts.src_dir_in_volume
                     .clone()
@@ -110,7 +110,7 @@ mod tests {
                 args:
                     BUILD_COMMAND: "npm run build:debug"
             volumes:
-              - "pwa-src:/home/node/app/packages/server/pwa"
+              - "pwa-src:/home/node/app/packages/server/pwa:z"
             labels:
               - traefik.enable=false
             ports:

wf2_core/src/services/traefik.rs

@@ -52,6 +52,7 @@ impl Service for TraefikService {
                 "default",
                 DcServiceNetwork::with_aliases(ctx.domains.clone()),
             )
+            .set_privileged(true)
             .finish()
     }
 }
@@ -91,7 +92,7 @@ mod test {
               default:
                 aliases:
                   - local.m2
-
+            privileged: true
         "#;
         let expected_dc: DcService = serde_yaml::from_str(expected).expect("deserialize");
         assert_eq!(actual, expected_dc);