undefined variable $response

[rosiel]

From the crayfits docker logs:

'request.CRITICAL: Uncaught PHP Exception ErrorException: "Warning: Undefined variable $response" at /var/www/crayfits/src/Controller/FitsController.php line 62 {"exception":"[object] (ErrorException(code: 0): Warning: Undefined variable $response at /var/www/crayfits/src/Controller/FitsController.php:62)"} []'

[rosiel]

Additional info: The logs in the Crayfits container's /var/log/islandora/fits.log contain

[2023-10-11 15:04:27] islandora_fits.ERROR: ERROR ["Warning: fopen(): SSL operation failed with code 1. OpenSSL Error messages:\nerror:0A000086:SSL routines::certificate verify failed"] []

[joshdentremont]

This seems to only be happening on sites created with the site template. Started a new site using buildkit 2.0.3 on isle-dc and one on site template. The isle-dc site did not have this error, and FITS was created.

[joshdentremont]

The issue seems to be here:

CrayFits/src/Controller/FitsController.php

Line 54 in 2a14ebf

'contents' => fopen($file_uri, 'r', FALSE, $context),

fopen doesn't appear to be able to access the certifcate to connect to https://islandora.dev/_flysystem

running php -i | grep openssl on the crayfits container gives this output

Openssl default config => /etc/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value

on both isle-dc and site template, but on isle it seems to connect OK. I'm thinking it might be an issue with the mkcert certs, or the Traefik config in docker-compose.yml

[joecorall]

My suspicion here is:

isle-site-template uses mkcert. That command adds the fake CA it creates as trusted on the host machine. Which is why when using a site created using site-template, https://islandora.dev loads OK in the browser on your local machine. Since the microservices docker containers do not have the CA in their trust store, the CA mkcert creates likely needs added using something like (from https://ubuntu.com/server/docs/security-trust-store)

$ sudo apt-get install -y ca-certificates
$ sudo cp local-ca.crt /usr/local/share/ca-certificates
$ sudo update-ca-certificates

That would need ran in every container that uses TLS to connect to another service in the stack. Or force the microservices the use http in its communication.

[joshdentremont]

I've just confirmed that when running a site created with the site template in a production environment the FITS file is created. I don't think this is an issue with this repo, but rather an issue with mkcert as Joe suggests.

Is it possible to transfer this issue to the site template repository instead of this one? If not, this can probably be closed and reopened as an issue there.

[rosiel]

Confirmed, the problem is solved if you change your docker-compose.yml from

crayfits:
  <<: [*common]

to

crayfits:
  <<: [*dev, *common]

Then it loads the certs and things talk. For some reason crayfits appears to be the only one without a dev and prod version. Anyway this is an issue on Isle Site Template so I'll move over there.