setup inicial

.dockerignore

+.git
+*.md
+
+# Excluir archivos grandes que no se usan en el build
+prod_humboldt-2026-04-30/var/
+prod_humboldt-2026-04-30/prod_humboldt-2026-04-30.tar.gz
+prod_humboldt-2026-04-30/etc/apache2/
+
+# Excluir logs del backup
+prod_humboldt-2026-04-30/var/log/

.env.example

+# -------------------------------------------------------
+# Copia este archivo a .env y ajusta los valores.
+# -------------------------------------------------------
+
+# Base de datos
+# Local (perfil docker "local"):  DB_HOST=db
+# RDS AWS:                        DB_HOST=<endpoint>.rds.amazonaws.com
+DB_HOST=db
+DB_PORT=3306
+DB_NAME=koha_prod_humboldt
+DB_USER=db_koha_prod_humboldt
+DB_PASSWORD=cambia_esto
+DB_ADMIN_PASSWORD=cambia_esto   # Solo requerido en perfil local (MariaDB)
+
+# Dominios de acceso
+# Pruebas locales: agregar al /etc/hosts del cliente:
+#   127.0.0.1  koha.local koha-intra.local
+# Producción: usar los dominios reales (catalogo.humboldt.org.co, etc.)
+KOHA_OPAC_SERVER_NAME=koha.local
+KOHA_INTRA_SERVER_NAME=koha-intra.local
+
+# Memcached (interno al contenedor — no cambiar)
+MEMCACHED_SERVERS=127.0.0.1:11211

.gitignore

+# Credenciales — nunca committear
+.env
+
+# Archivos binarios grandes de migración (se copian al contenedor en build time,
+# no tienen valor en el historial de git)
+prod_humboldt-*/prod_humboldt-*.sql.gz
+prod_humboldt-*/prod_humboldt-*.tar.gz
+prod_humboldt-*/koha_files.tar.gz
+prod_humboldt-*.tar.zip
+
+# Datos de runtime extraídos del backup
+prod_humboldt-*/var/
+
+# Configuración Apache del backup (no se usa en Docker — se genera por koha-create)
+prod_humboldt-*/etc/apache2/
+
+# Certificados TLS generados localmente para pruebas con nginx proxy
+docker/certs/
+
+# Documentación PDF — almacenar en Drive/Notion
+*.pdf

Dockerfile

+FROM ubuntu:20.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=America/Bogota
+
+# Fase 3.1 — Actualizar el sistema
+RUN apt-get update && apt-get upgrade -y
+
+# Fase 3.2 — Instalar dependencias previas
+RUN apt-get install -y wget gnupg2 apt-transport-https gettext-base \
+    && rm -rf /var/lib/apt/lists/*
+
+# Fase 3.3 — Agregar repositorio oficial de Koha
+RUN echo 'deb http://debian.koha-community.org/koha 25.11 main' \
+      > /etc/apt/sources.list.d/koha.list
+
+# Fase 3.4 — Agregar llave GPG
+RUN wget -qO- https://debian.koha-community.org/koha/gpg.asc \
+      | gpg --dearmor > /usr/share/keyrings/koha.gpg && \
+    sed -i \
+      's|deb http://debian.koha-community.org/koha|deb [signed-by=/usr/share/keyrings/koha.gpg] http://debian.koha-community.org/koha|' \
+      /etc/apt/sources.list.d/koha.list
+
+# Fase 3.5 — Instalar Koha (sin mariadb-server — usa RDS externo)
+# koha-common instala RabbitMQ, Memcached y todas las dependencias automáticamente.
+# Como efecto secundario instala mariadb-client vía default-mysql-client.
+RUN apt-get update && apt-get install -y koha-common \
+    && rm -rf /var/lib/apt/lists/*
+
+# List::MoreUtils: la versión de Ubuntu 20.04 no exporta zip6 correctamente.
+# cpanm instala una versión consistente PP+XS desde CPAN.
+RUN apt-get update && apt-get install -y cpanminus build-essential && \
+    cpanm --notest List::MoreUtils List::MoreUtils::XS && \
+    rm -rf /var/lib/apt/lists/*
+
+# Bypass mpm_itk initgroups()/setuid() que falla en Docker sin CAP_SETGID.
+# La biblioteca intercepta initgroups() y devuelve 0 para que Apache arranque.
+RUN printf '#include <grp.h>\nint initgroups(const char *u, gid_t g){return 0;}\n' \
+      > /tmp/fakegroups.c && \
+    gcc -shared -fPIC -o /usr/local/lib/libfakegroups.so /tmp/fakegroups.c && \
+    rm /tmp/fakegroups.c
+
+# Reemplazar mariadb-client con mysql-client-8.0.
+# Ubuntu 20.04 instala MariaDB client via default-mysql-client (dependencia de koha-common),
+# pero ese cliente NO soporta caching_sha2_password (plugin por defecto en RDS MySQL 8+).
+# --allow-downgrades + --force-overwrite fuerzan la instalación aunque haya conflictos
+# de paquetes, reemplazando el binario /usr/bin/mysql de MariaDB con el de MySQL 8.
+RUN apt-get update && \
+    apt-get install -y \
+      --allow-downgrades \
+      -o Dpkg::Options::="--force-overwrite" \
+      mysql-client-8.0 && \
+    rm -rf /var/lib/apt/lists/* && \
+    echo "MySQL client activo: $(mysql --version)"
+
+# Fase 3.7 — Habilitar módulos Apache requeridos
+RUN a2enmod rewrite cgi headers proxy_http
+
+# --- Archivos de migración ---
+# SQL dump de la base de datos (Fase 4.1)
+COPY prod_humboldt-2026-04-30/prod_humboldt-2026-04-30.sql.gz /migration/
+# Archivos de la instancia: uploads, plugins, índices Zebra (Fase 4.2)
+COPY prod_humboldt-2026-04-30/koha_files.tar.gz               /migration/
+# Assets personalizados (Fase 8)
+COPY prod_humboldt-2026-04-30/logo.png            /migration/assets/
+COPY prod_humboldt-2026-04-30/logo.svg            /migration/assets/
+COPY prod_humboldt-2026-04-30/hero-humboldt.jpg   /migration/assets/
+COPY prod_humboldt-2026-04-30/hero-humboldt.webp  /migration/assets/
+COPY prod_humboldt-2026-04-30/Amstelvar.ttf       /migration/assets/
+
+# Plantillas de configuración (se instancian con variables de entorno en runtime)
+COPY prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/koha-conf.xml \
+     /etc/koha/koha-conf.xml.tpl
+COPY prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/log4perl.conf \
+     /etc/koha/log4perl.conf.tpl
+
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 80
+
+ENTRYPOINT ["/entrypoint.sh"]

docker-compose.yml

+services:
+
+  # -------------------------------------------------------
+  # BD local para pruebas — reemplaza al RDS en desarrollo.
+  # Para usar RDS real: comentar este bloque y ajustar .env
+  # -------------------------------------------------------
+  db:
+    image: mariadb:10.6
+    environment:
+      MYSQL_ROOT_PASSWORD: ${DB_ADMIN_PASSWORD}
+      MYSQL_DATABASE:      ${DB_NAME:-koha_prod_humboldt}
+      MYSQL_USER:          ${DB_USER:-koha_prod_humboldt}
+      MYSQL_PASSWORD:      ${DB_PASSWORD}
+    volumes:
+      - db_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-p${DB_ADMIN_PASSWORD}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  koha:
+    build: .
+    ports:
+      - "8080:80"
+    env_file: .env
+    environment:
+      # Apuntar al servicio db local en vez del RDS
+      DB_HOST: db
+    depends_on:
+      db:
+        condition: service_healthy
+    volumes:
+      # Persistir estado de inicialización, uploads, plugins e índices Zebra.
+      # Si se elimina este volumen, el entrypoint ejecuta la restauración completa.
+      - koha_data:/var/lib/koha
+      - koha_logs:/var/log/koha
+    restart: unless-stopped
+
+volumes:
+  db_data:
+  koha_data:
+  koha_logs:

docker/alb-proxy.conf

+# Soporte para ALB / reverse proxy (Apache mod_remoteip + mod_headers).
+#
+# Confiamos en X-Forwarded-For de cualquier dirección RFC 1918:
+#   10.x.x.x   — VPC de AWS
+#   172.16-31.x — red interna de Docker
+#   192.168.x.x — red local
+# En producción restringir al CIDR exacto de la VPC.
+RemoteIPHeader X-Forwarded-For
+RemoteIPTrustedProxy 10.0.0.0/8
+RemoteIPTrustedProxy 172.16.0.0/12
+RemoteIPTrustedProxy 192.168.0.0/16
+
+# Propagar X-Forwarded-Proto → variable HTTPS que Koha y mod_perl leen
+# para emitir cookies Secure y generar URLs absolutas correctas.
+SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
+RequestHeader setifempty X-Forwarded-Proto "http"

docker/gen-local-certs.sh

+#!/bin/bash
+# Genera un certificado TLS autofirmado válido para koha.local y koha-intra.local.
+# El .crt se puede importar al navegador/sistema para evitar warnings de SSL.
+set -euo pipefail
+
+CERTS_DIR="$(cd "$(dirname "$0")" && pwd)/certs"
+mkdir -p "${CERTS_DIR}"
+
+openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
+  -keyout "${CERTS_DIR}/local.key" \
+  -out    "${CERTS_DIR}/local.crt" \
+  -subj   "/CN=koha.local/O=Humboldt Local Dev" \
+  -addext "subjectAltName=DNS:koha.local,DNS:koha-intra.local"
+
+chmod 600 "${CERTS_DIR}/local.key"
+
+echo ""
+echo "Certificados generados en ${CERTS_DIR}/"
+echo ""
+echo "Para que el navegador confíe en el cert (sin warnings):"
+echo "  macOS:   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERTS_DIR}/local.crt"
+echo "  Linux:   sudo cp ${CERTS_DIR}/local.crt /usr/local/share/ca-certificates/koha-local.crt && sudo update-ca-certificates"
+echo "  Windows: Importar ${CERTS_DIR}/local.crt en 'Trusted Root Certification Authorities'"

docker/nginx-local.conf

+# Proxy nginx local que simula el comportamiento de un ALB con terminación TLS.
+# Permite probar en local el flujo completo HTTPS → HTTP → Koha antes de
+# desplegar en ECS, sin necesitar el ALB real.
+#
+# Uso:
+#   1. Generar cert: bash docker/gen-local-certs.sh
+#   2. docker compose --profile local up
+#   3. Acceder a https://koha.local y https://koha-intra.local
+
+events { worker_connections 1024; }
+
+http {
+    # Redirigir HTTP → HTTPS (replica la regla del ALB listener 80)
+    server {
+        listen 80;
+        server_name koha.local koha-intra.local;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name koha.local koha-intra.local;
+
+        ssl_certificate     /etc/nginx/certs/local.crt;
+        ssl_certificate_key /etc/nginx/certs/local.key;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+
+        # Cabeceras que el ALB envía al target group
+        location / {
+            proxy_pass              http://koha:80;
+            proxy_set_header        Host              $host;
+            proxy_set_header        X-Real-IP         $remote_addr;
+            proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header        X-Forwarded-Proto https;
+            proxy_read_timeout      300s;
+            proxy_send_timeout      300s;
+            # Desactivar buffering para que los logs de Koha lleguen en tiempo real
+            proxy_buffering         off;
+            client_max_body_size    50m;
+        }
+    }
+}

prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/log4perl.conf

+log4perl.logger.intranet = WARN, INTRANET
+log4perl.appender.INTRANET=Log::Log4perl::Appender::File
+log4perl.appender.INTRANET.filename=/var/log/koha/prod_humboldt/intranet-error.log
+log4perl.appender.INTRANET.mode=append
+log4perl.appender.INTRANET.layout=PatternLayout
+log4perl.appender.INTRANET.layout.ConversionPattern=[%d] [%p] %m %l%n
+log4perl.appender.INTRANET.utf8=1
+
+log4perl.logger.opac = WARN, OPAC
+log4perl.appender.OPAC=Log::Log4perl::Appender::File
+log4perl.appender.OPAC.filename=/var/log/koha/prod_humboldt/opac-error.log
+log4perl.appender.OPAC.mode=append
+log4perl.appender.OPAC.layout=PatternLayout
+log4perl.appender.OPAC.layout.ConversionPattern=[%d] [%p] %m %l%n
+log4perl.appender.OPAC.utf8=1
+
+log4perl.logger.z3950 = WARN, Z3950
+log4perl.appender.Z3950=Log::Log4perl::Appender::File
+log4perl.appender.Z3950.filename=/var/log/koha/prod_humboldt/z3950-error.log
+log4perl.appender.Z3950.mode=append
+log4perl.appender.Z3950.layout=PatternLayout
+log4perl.appender.Z3950.layout.ConversionPattern=[%d] [%p] %m %l%n
+log4perl.appender.Z3950.utf8=1
+
+log4perl.logger.api = WARN, API
+log4perl.appender.API=Log::Log4perl::Appender::File
+log4perl.appender.API.filename=/var/log/koha/prod_humboldt/api-error.log
+log4perl.appender.API.mode=append
+log4perl.appender.API.layout=PatternLayout
+log4perl.appender.API.layout.ConversionPattern=[%d] [%p] %m %l%n
+log4perl.appender.API.utf8=1
+
+log4perl.logger.sip = DEBUG, SIP
+log4perl.appender.SIP=Log::Log4perl::Appender::File
+log4perl.appender.SIP.filename=/var/log/koha/prod_humboldt/sip-output.log
+log4perl.appender.SIP.mode=append
+log4perl.appender.SIP.layout=PatternLayout
+log4perl.appender.SIP.layout.ConversionPattern=[%d] [%P] [%p] %X{accountid}@%X{peeraddr}: %m{chomp} %l%n
+log4perl.appender.SIP.utf8=1
+
+log4perl.logger.plack-opac = WARN, PLACKOPAC
+log4perl.appender.PLACKOPAC=Log::Log4perl::Appender::File
+log4perl.appender.PLACKOPAC.filename=/var/log/koha/prod_humboldt/plack-opac-error.log
+log4perl.appender.PLACKOPAC.mode=append
+log4perl.appender.PLACKOPAC.layout=PatternLayout
+log4perl.appender.PLACKOPAC.layout.ConversionPattern=[%d] [%p] %m%n
+log4perl.appender.PLACKOPAC.utf8=1
+
+log4perl.logger.plack-api = WARN, PLACKAPI
+log4perl.appender.PLACKAPI=Log::Log4perl::Appender::File
+log4perl.appender.PLACKAPI.filename=/var/log/koha/prod_humboldt/plack-api-error.log
+log4perl.appender.PLACKAPI.mode=append
+log4perl.appender.PLACKAPI.layout=PatternLayout
+log4perl.appender.PLACKAPI.layout.ConversionPattern=[%d] [%p] %m%n
+log4perl.appender.PLACKAPI.utf8=1
+
+log4perl.logger.plack-intranet = WARN, PLACKINTRANET
+log4perl.appender.PLACKINTRANET=Log::Log4perl::Appender::File
+log4perl.appender.PLACKINTRANET.filename=/var/log/koha/prod_humboldt/plack-intranet-error.log
+log4perl.appender.PLACKINTRANET.mode=append
+log4perl.appender.PLACKINTRANET.layout=PatternLayout
+log4perl.appender.PLACKINTRANET.layout.ConversionPattern=[%d] [%p] %m%n
+log4perl.appender.PLACKINTRANET.utf8=1
+
+log4perl.logger.worker = WARN, WORKER
+log4perl.appender.WORKER=Log::Log4perl::Appender::Screen
+log4perl.appender.WORKER.stderr=1
+log4perl.appender.WORKER.layout=PatternLayout
+log4perl.appender.WORKER.layout.ConversionPattern=[%d] [%p] %m %l%n
+log4perl.appender.WORKER.utf8=1
+
+log4perl.logger.edi = TRACE, EDI
+log4perl.appender.EDI=Log::Log4perl::Appender::File
+log4perl.appender.EDI.filename=/var/log/koha/prod_humboldt/editrace.log
+log4perl.appender.EDI.mode=append
+log4perl.appender.EDI.layout=PatternLayout
+log4perl.appender.EDI.layout.ConversionPattern=[%d] [%P] [%p] %X{accountid}@%X{peeraddr}: %m %l%n
+log4perl.appender.EDI.utf8=1

prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/zebra-authorities-dom.cfg

+
+# Simple Zebra configuration file that defines
+# a database with MARCXML records.
+# $Id: zebra.cfg,v 1.1.2.2 2006/05/09 12:03:16 rangi Exp $
+#
+# Where are the config files located?
+profilePath:/etc/koha/sites/prod_humboldt:/etc/koha/zebradb/authorities/etc:/etc/koha/zebradb/etc:/etc/koha/zebradb/marc_defs/marc21/authorities:/etc/koha/zebradb/lang_defs/en:/etc/koha/zebradb/xsl
+
+encoding: UTF-8
+# modulePath - where to look for loadable zebra modules
+modulePath: /usr/lib64/idzebra-2.0/modules:/usr/lib/idzebra-2.0/modules:/usr/lib/x86_64-linux-gnu/idzebra-2.0/modules:/usr/lib/i386-linux-gnu/idzebra-2.0/modules:/usr/lib/aarch64-linux-gnu/idzebra-2.0/modules:/usr/lib/arm-linux-gnueabi/idzebra-2.0/modules:/usr/lib/arm-linux-gnueabihf/idzebra-2.0/modules:/usr/lib/mips-linux-gnu/idzebra-2.0/modules:/usr/lib/mipsel-linux-gnu/idzebra-2.0/modules:/usr/lib/powerpc-linux-gnu/idzebra-2.0/modules:/usr/lib/powerpc64le-linux-gnu/idzebra-2.0/modules:/usr/lib/s390x-linux-gnu/idzebra-2.0/modules
+
+# Files that describe the attribute sets supported.
+attset: bib1.att
+attset: explain.att
+attset: gils.att
+
+#systag sysno rank
+
+# Specify record type
+# group   .recordType[  .name  ]:  type
+# type is split into fundamental type. file-read-type . argument
+# http://www.indexdata.dk/zebra/doc/zebra-cfg.tkl
+# http://www.indexdata.dk/zebra/doc/grs.tkl
+recordtype: dom./etc/koha/zebradb/authorities/etc/dom-config.xml
+marcxml.recordtype: dom./etc/koha/zebradb/authorities/etc/dom-config.xml
+iso2709.recordtype: dom./etc/koha/zebradb/authorities/etc/dom-config-marc.xml
+
+recordId: (bib1,Local-Number)
+# was auth1
+storeKeys:1
+storeData:1
+
+# Lock File Area
+lockDir: /var/lock/koha/prod_humboldt/authorities
+perm.anonymous:ar
+perm.kohauser:rw
+register: /var/lib/koha/prod_humboldt/authorities/register:20G
+shadow: /var/lib/koha/prod_humboldt/authorities/shadow:20G
+
+# Temp File area for result sets
+setTmpDir: /var/lib/koha/prod_humboldt/authorities/tmp
+
+# Temp File area for index program
+keyTmpDir: /var/lib/koha/prod_humboldt/authorities/key
+
+# Approx. Memory usage during indexing
+memMax: 50M
+rank:rank-1
+

prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/zebra-biblios-dom.cfg

+# Simple Zebra configuration file that defines
+# a database with MARCXML records.
+# $Id: zebra.cfg,v 1.1.2.2 2006/05/09 12:03:16 rangi Exp $
+#
+# Where are the config files located?
+profilePath:/etc/koha/sites/prod_humboldt:/etc/koha/zebradb/biblios/etc:/etc/koha/zebradb/etc:/etc/koha/zebradb/marc_defs/marc21/biblios:/etc/koha/zebradb/lang_defs/en:/etc/koha/zebradb/xsl
+# modulePath - where to look for loadable zebra modules
+modulePath: /usr/lib64/idzebra-2.0/modules:/usr/lib/idzebra-2.0/modules:/usr/lib/x86_64-linux-gnu/idzebra-2.0/modules:/usr/lib/i386-linux-gnu/idzebra-2.0/modules:/usr/lib/aarch64-linux-gnu/idzebra-2.0/modules:/usr/lib/arm-linux-gnueabi/idzebra-2.0/modules:/usr/lib/arm-linux-gnueabihf/idzebra-2.0/modules:/usr/lib/mips-linux-gnu/idzebra-2.0/modules:/usr/lib/mipsel-linux-gnu/idzebra-2.0/modules:/usr/lib/powerpc-linux-gnu/idzebra-2.0/modules:/usr/lib/powerpc64le-linux-gnu/idzebra-2.0/modules:/usr/lib/s390x-linux-gnu/idzebra-2.0/modules
+
+encoding: UTF-8
+# Files that describe the attribute sets supported.
+attset: bib1.att
+attset: explain.att
+attset: gils.att
+
+# systag sysno rank
+
+# Specify record type
+# group   .recordType[  .name  ]:  type
+# type is split into fundamental type. file-read-type . argument
+# http://www.indexdata.dk/zebra/doc/zebra-cfg.tkl
+# http://www.indexdata.dk/zebra/doc/grs.tkl
+
+recordtype: dom./etc/koha/zebradb/biblios/etc/dom-config.xml
+marcxml.recordtype: dom./etc/koha/zebradb/biblios/etc/dom-config.xml
+iso2709.recordtype: dom./etc/koha/zebradb/biblios/etc/dom-config-marc.xml
+
+recordId: (bib1,Local-number)
+storeKeys:1
+storeData:1
+facetNumRecs:1000
+
+
+# Lock File Area
+lockDir: /var/lock/koha/prod_humboldt/biblios
+perm.anonymous:ar
+perm.kohauser:rw
+passwd: /etc/koha/sites/prod_humboldt/zebra.passwd
+register: /var/lib/koha/prod_humboldt/biblios/register:20G
+shadow: /var/lib/koha/prod_humboldt/biblios/shadow:20G
+
+# Temp File area for result sets
+setTmpDir: /var/lib/koha/prod_humboldt/biblios/tmp
+
+# Temp File area for index program
+keyTmpDir: /var/lib/koha/prod_humboldt/biblios/key
+
+# Approx. Memory usage during indexing
+memMax: 50M
+rank:rank-1
+truncmax: 1000000000
+
+# Specifies the maximum number of records that will be sorted in a result set.
+# If the result set contains more than that limit, the records after the limit
+# will not be sorted. If omitted, the default value is 1,000.
+sortmax: 1000

prod_humboldt-2026-04-30/etc/koha/sites/prod_humboldt/zebra.passwd

+kohauser:iBVqc7LThpaSk4FG