Allow configuration setting to run Apache HTTPD on different ports

[arizon-dread]

Configurable Ports

It would be great to be able to run Matomo on unprivileged ports, like 8080 and 8443 for HTTP and HTTPS respectively.

Why?

The default OpenShift security settings does not allow privilege escalation. That would require creating a SecurityContextConstraint to run containers that binds to ports below 1024. Cluster Edge is already listening on 80/443 so the container port should be functionally irrelevant to Matomo and in regards to the client expecting standard ports.

Suggestion

Implement a way to set env-vars in the container to overwrite the Apache ports.

Env-variables

• MATOMO_HTTP_PORT - defaults to 80 but is configurable
• MATOMO_HTTPS_PORT - defaults to 443 but is configurable.

Alternative solution

Document the below solution and its cons in detail in the README and on Docker Hub.

WorkAround

I have started to create a workaround that overwrites the following files:

• /etc/apache2/ports.conf
• /etc/apache2/sites-available/000-default.conf
• /etc/apache2/sites-available/default-ssl.conf

That is replacing 80 with 8080 and 443 with 8443, mounting them with configMaps in OpenShift.

Cons of the workAround

If the Matomo project decides to make configuration changes to the apache sites down the line, these will be overwritten by the configuration mounts used in the workAround.

Disclaimer

I don't know if it would be functionally possible to make Apache read env variables from the OS environment or replace the ports using sed in the entrypoint script. Using sed would probably fail due to permissions when starting the container (the file system is read only on OpenShift).