From 8d4912b2ed875f0e0fb3042f437ab2296325783f Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 22 May 2024 23:49:35 +0000
Subject: [PATCH] Bug 33563: Add comments for Elasticsearch security config

This patch adds some commented Elasticsearch security configuration,
which shows how to use username/password with HTTPS.

Test plan:
0. Apply patch
1. cp debian/templates/koha-conf-site.xml.in /etc/koha/koha-conf-site.xml.in
2. koha-create --create-db test
3. vi /etc/koha/sites/test/koha-conf.xml
4. Note that the comments for userinfo and use_https are in the koha-conf.xml

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised.
---
 debian/templates/koha-conf-site.xml.in | 7 +++++++
 etc/koha-conf.xml                      | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in
index bb53ce3c83..3cbb7fae31 100644
--- a/debian/templates/koha-conf-site.xml.in
+++ b/debian/templates/koha-conf-site.xml.in
@@ -350,6 +350,13 @@ __END_SRU_PUBLICSERVER__
      <server>__ELASTICSEARCH_SERVER__</server> <!-- may be repeated to include all servers on your cluster -->
      <index_name>koha___KOHASITE__</index_name> <!-- should be unique amongst all the indices on your cluster. _biblios and _authorities will be appended. -->
 
+     <!-- If you are using authentication, you will also need to use HTTPS. Uncomment and tweak the following for your ES setup. -->
+     <!-- NOTE: instead of userinfo, you can alternatively provide the username and password in URL in the server element -->
+     <!--
+     <userinfo>elastic:CHANGEME</userinfo>
+     <use_https>1</use_https>
+     -->
+
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#cxn_pool -->
      <cxn_pool>Static</cxn_pool>
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#trace_to -->
diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml
index 0272c110a9..d38a2f13f4 100644
--- a/etc/koha-conf.xml
+++ b/etc/koha-conf.xml
@@ -167,6 +167,13 @@
      <server>__ELASTICSEARCH_SERVERS__</server>
      <index_name>__ELASTICSEARCH_INDEX_____DB_NAME__</index_name>
 
+     <!-- If you are using authentication, you will also need to use HTTPS. Uncomment and tweak the following for your ES setup. -->
+     <!-- NOTE: instead of userinfo, you can alternatively provide the username and password in URL in the server element -->
+     <!--
+     <userinfo>elastic:CHANGEME</userinfo>
+     <use_https>1</use_https>
+     -->
+
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#cxn_pool -->
      <cxn_pool>Static</cxn_pool>
      <!-- See https://metacpan.org/pod/Search::Elasticsearch#trace_to -->
-- 
2.34.1