[FEATURE] Healthcheck fails when admin interface credentials are enabled

[tmthn]

Describe the bug
The container's healthcheck script does not support authentication. When basic auth credentials are configured for Solr's admin interface, the healthcheck endpoint receives a 401 Unauthorized response, causing the container to be marked as unhealthy.

To Reproduce

1. Pull and run typo3solr/ext-solr:13.1.1
2. Enable basic authentication for the Solr admin interface*
3. Restart the container
4. Observe the container health status via docker inspect --format='{{.State.Health.Status}}'

*To enable authentication for the Solr admin interface follow these steps:

Create security.json on your host

{
  "authentication": {
    "blockUnknown": true,
    "class": "solr.BasicAuthPlugin",
    "credentials": {
      "solr": "<YOUR ENCODED PASSWORD>"
    },
    "realm": "My Solr users",
    "forwardCredentials": false
  },
  "authorization": {
    "class": "solr.RuleBasedAuthorizationPlugin",
    "permissions": [
      { "name": "security-edit", "role": "admin" }
    ],
    "user-role": {
      "solr": "admin"
    }
  }
}

To create the password you can use this tool.

Mount via docker-compose.yaml

services:
  solr:
    container_name: typo3s-solr-server
    image: typo3solr/ext-solr:<VERSION>
    ports:
      - "8983:8983"
    volumes:
      - typo3s-solr-server-data:/var/solr
      - ./security.json:/var/solr/data/security.json
 
volumes:
  typo3s-solr-server-data:
    driver: local
    driver_opts:
      type: none
      device: $PWD/.solrdata
      o: bind

Make sure the file is readable by UID 8983 (the Solr user inside the container):

chmod 644 security.json

Expected behavior
The healthcheck should succeed even when admin credentials are enabled. Possible approaches:

• Support passing credentials to the healthcheck script via environment variables (e.g., SOLR_HEALTH_USER, SOLR_HEALTH_PASS)
• Use an unauthenticated health endpoint that bypasses admin auth

Used versions (please complete the following information):

• Container image: typo3solr/ext-solr:13.1.1

[dkd-kaehm]

@tmthn Thanks for reporting this.
Please describe how to enable the auth for admin interface.

[dkd-kaehm]

@tmthn
Please react and answer the questions.

[tmthn]

Ah, sorry, I forgot to answer! I have updated the steps to reproduce accordingly.

[dkd-kaehm]

Thanks for the detailed clarification. First of all, the Image does not support setting up Auth plugins yet. You need to generate and mount or copy the security.json into the
container's volume explicitly. This feature must be implemented before integrating it into a Healthcheck.

Currently, whenever you make modifications to the container/image, you must apply them consistently across all relevant places - so adjust the healthcheck script and ensure it's
properly mounted in your container.

If you (or the community) want this feature, please implement both features and provide a pull-request including tests.

Important requirements for this feature:

Both features must [re]use the same variables:

• BASIC_AUTH must be an array or JSON format with already encrypted passwords, so it can be committed to the repository and used in CI/CD pipelines
• The image/container MUST generate its own random password for the healthcheck user, encrypt it, add it to security.json, and export the plaintext password as an environment
  variable for the healthcheck script. This must happen on each container start.
• The Docker Image has two new dependencies:
  • jq binary must be added to apt
  • The encryption binary must be placed/installed (shell script) to be able to generate password for healthcheck user

Feel free to reach out if you plan to work on this feature!