From 33c17e7adba5eaf4367121f8a6d0636cea2a85fc Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 22 May 2024 23:49:35 +0000
Subject: [PATCH] Bug 33563: Add comments for Elasticsearch security config

This patch adds some commented Elasticsearch security configuration,
which shows how to use username/password with HTTPS.

Test plan:
0. Apply patch
1. cp debian/templates/koha-conf-site.xml.in /etc/koha/koha-conf-site.xml.in
2. koha-create --create-db test
3. vi /etc/koha/sites/test/koha-conf.xml
4. Note that the comments for userinfo and use_https are in the koha-conf.xml

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ce90d65603dbffd2c6b8a18468f09f2e66df34c4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 591da06a39083981f1076dc82d9dd25a978444e2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 debian/templates/koha-conf-site.xml.in | 7 +++++++
 etc/koha-conf.xml                      | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in
index c35b6d8432..9ae9e47e26 100644
--- a/debian/templates/koha-conf-site.xml.in
+++ b/debian/templates/koha-conf-site.xml.in
@@ -350,6 +350,13 @@ __END_SRU_PUBLICSERVER__
      <server>__ELASTICSEARCH_SERVER__</server> <!-- may be repeated to include all servers on your cluster -->
      <index_name>koha___KOHASITE__</index_name> <!-- should be unique amongst all the indices on your cluster. _biblios and _authorities will be appended. -->
 
+     <!-- If you are using authentication, you will also need to use HTTPS. Uncomment and tweak the following for your ES setup. -->
+     <!-- NOTE: instead of userinfo, you can alternatively provide the username and password in URL in the server element -->
+     <!--
+     <userinfo>elastic:CHANGEME</userinfo>
+     <use_https>1</use_https>
+     -->
+
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#cxn_pool -->
      <cxn_pool>Static</cxn_pool>
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#trace_to -->
diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml
index f7cdd2f8d0..15d49272a0 100644
--- a/etc/koha-conf.xml
+++ b/etc/koha-conf.xml
@@ -167,6 +167,13 @@
      <server>__ELASTICSEARCH_SERVERS__</server>
      <index_name>__ELASTICSEARCH_INDEX_____DB_NAME__</index_name>
 
+     <!-- If you are using authentication, you will also need to use HTTPS. Uncomment and tweak the following for your ES setup. -->
+     <!-- NOTE: instead of userinfo, you can alternatively provide the username and password in URL in the server element -->
+     <!--
+     <userinfo>elastic:CHANGEME</userinfo>
+     <use_https>1</use_https>
+     -->
+
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#cxn_pool -->
      <cxn_pool>Static</cxn_pool>
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#trace_to -->
-- 
2.39.5