From edd6d0122902f088f3ccbaf8361b6e50d219941f Mon Sep 17 00:00:00 2001 From: Torsten Wierschin Date: Thu, 5 Nov 2026 17:43:15 +0000 Subject: [PATCH] Add air-gapped environment adaptation summary - Comprehensive documentation of all 7 Dockerfile adaptations - Configuration parameters for internal infrastructure - Before/after comparison examples - Verification checklist Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Entire-Checkpoint: 01M6PCXJR0ZV3V8XWBEKT0Z32X --- external-dependencies/AIRGAP-SUMMARY.md | 175 ++++++++++++++++++++++++ 1 file changed, 175 insertions(+) create mode 100644 external-dependencies/AIRGAP-SUMMARY.md diff --git a/external-dependencies/AIRGAP-SUMMARY.md b/external-dependencies/AIRGAP-SUMMARY.md new file mode 100644 index 000000000..e9806f439 --- /dev/null +++ b/external-dependencies/AIRGAP-SUMMARY.md @@ -0,0 +1,175 @@ +# Air-Gapped Environment Adaptation Summary + +## Overview + +All 7 Dockerfiles in `./external-dependencies/` have been adapted for air-gapped environment deployment using internal infrastructure. + +## Adapted Dockerfiles + +| Package | Version | Status | +|---------|---------|--------| +| ubuntu-26.04-build-container | base | ✅ Adapted | +| qt6-framework | 6.10.2 | ✅ Adapted | +| log4qt | 2.0.0 | ✅ Adapted | +| grantlee | 5.3.1 | ✅ Adapted | +| googletest | 1.15.2 | ✅ Adapted | +| postgresql | 16 | ✅ Adapted | +| kdreports | 2.3.0 | ✅ Adapted | + +## Air-Gap Configuration Applied + +### 1. Internal Nexus Repositories +``` +http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu +http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security +``` + +### 2. Proxy Configuration +``` +HTTP_PROXY=http://10.198.80.130:3128 +HTTPS_PROXY=http://10.198.80.130:3128 +NO_PROXY=localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158 +``` + +### 3. Harbor Registry for Base Images +``` +harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 +``` + +### 4. User Creation +- **ctc**: uid 1445, gid 1445, home: /shd/CTC/TOOLS +- **rme**: uid 1001, gid 1001, home: /home/rme + +### 5. CA Certificates and Signing Keys +``` +http://10.198.80.75/rme/SL-Netz.crt +http://10.198.80.75/rme/deb_and_rpm_signage_key.pub +``` + +### 6. Shell Configuration +```dockerfile +SHELL ["/bin/bash", "-o", "pipefail", "-c"] +``` + +### 7. Labels Standardization +- Changed from `maintainer` to `author` (lowercase) +- Added `project` label +- Standardized format across all Dockerfiles + +## Changes Made to Each Dockerfile + +### Before (Public Environment) +```dockerfile +FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 + +LABEL maintainer="Legatus Team" +LABEL description="..." +LABEL version="..." + +ENV DEBIAN_FRONTEND=noninteractive + +ARG HTTP_PROXY="" +ARG HTTPS_PROXY="" +ARG NO_PROXY="localhost,127.0.0.1,.sl.defence-elec.de" + +ENV http_proxy=${HTTP_PROXY} +ENV https_proxy=${HTTPS_PROXY} +ENV no_proxy=${NO_PROXY} +``` + +### After (Air-Gapped Environment) +```dockerfile +FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 + +ARG RME_USERPASS=ctc +ARG RME_ADMINSRV=10.198.80.75 +ARG RME_PROJECT=guez + +# Proxy configuration for air-gapped environments +ARG http_proxy="http://10.198.80.130:3128" +ARG no_proxy="localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158" +ARG HTTP_PROXY=${http_proxy} +ARG https_proxy=${http_proxy} +ARG HTTPS_PROXY=${http_proxy} +ARG NO_PROXY=${no_proxy} + +LABEL author="Legatus Team" +LABEL project=${RME_PROJECT} +LABEL version="..." +LABEL description="..." + +ENV DEBIAN_FRONTEND=noninteractive + +# OS and PATH configuration +ENV LANG=C.UTF-8 \ + LC_ALL=C.UTF-8 + +# Shell global auf Bash mit sicheren Pipes umstellen +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +# Originale Repositories durch Nexus Proxies ersetzen +RUN echo : > /etc/apt/sources.list && \ + echo -e "Types: deb\n\ +URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu\n\ +Suites: resolute resolute-updates resolute-backports\n\ +Components: main restricted universe multiverse\n\ +Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n\ +\n\ +Types: deb\n\ +URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security\n\ +Suites: resolute-security\n\ +Components: main restricted universe multiverse\n\ +Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" > /etc/apt/sources.list.d/ubuntu.sources + +# Create users (install openssl first for password hashing) +RUN apt-get update && apt-get install -y openssl \ + && groupadd ctc -g 1445 || true \ + && groupadd rme -g 1001 || true \ + && useradd -d /shd/CTC/TOOLS -u 1445 -g ctc -m -p $(openssl passwd -5 ${RME_USERPASS}) ctc || true \ + && useradd -d /home/rme -u 1001 -g rme -m -p $(openssl passwd -5 ${RME_USERPASS}) rme || true \ + && rm -rf /var/lib/apt/lists/* + +RUN curl -fsSL http://${RME_ADMINSRV}/rme/deb_and_rpm_signage_key.pub --output /etc/apt/keyrings/deb_and_rpm_signage_key.asc \ + && curl -fsSL http://${RME_ADMINSRV}/rme/SL-Netz.crt --output /usr/local/share/ca-certificates/SL-Netz.crt \ + && update-ca-certificates +``` + +## Reference Documentation + +- **Reference Dockerfile**: `prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile` +- **Detailed Adaptation Guide**: `external-dependencies/qt6-framework/AIRGAP-ADAPTATION.md` +- **Dependency Inventory**: `external-dependencies/DEPENDENCIES-INVENTORY.md` + +## Git Commits + +1. `50e0485fe` - Adapt remaining 5 Dockerfiles for air-gapped environment +2. Previous commits for qt6-framework and ubuntu-26.04-build-container + +## Verification + +All Dockerfiles now contain: +- ✅ Internal Nexus APT repositories +- ✅ Proxy configuration with comprehensive no_proxy list +- ✅ User creation (ctc and rme) +- ✅ CA certificates installation +- ✅ APT signing keys +- ✅ Standardized labels (lowercase) +- ✅ Shell configuration with pipefail +- ✅ Harbor registry for base images + +## Next Steps + +1. Build and test each Dockerfile in the air-gapped environment +2. Verify SBOM generation works with internal repositories +3. Update Jenkins pipeline configurations to use new Dockerfiles +4. Document any environment-specific adjustments needed + +## Environment Parameters + +| Parameter | Value | +|-----------|-------| +| Nexus Repository | remote-repo.sl.defence-elec.de:8081 | +| Proxy Server | 10.198.80.130:3128 | +| Admin Server | 10.198.80.75 | +| Harbor Registry | harbor.sl.defence-elec.de/proxydockerhub | +| PIP Index URL | http://remote-repo.sl.defence-elec.de:8081/repository/proxypipy/ | \ No newline at end of file