improve the docker setup
This commit is contained in:
Andreas Zweili
parent
16e2f145fe
commit
861b22637f
|
|
@ -81,3 +81,5 @@ tags
|
|||
|
||||
letsencrypt/
|
||||
traefik.yaml
|
||||
|
||||
grav/data/
|
||||
|
|
|
|||
107
grav/Dockerfile
107
grav/Dockerfile
|
|
@ -1,78 +1,45 @@
|
|||
FROM php:7.4-apache
|
||||
LABEL maintainer="Andy Miller <rhuk@getgrav.org> (@rhukster)"
|
||||
FROM alpine
|
||||
|
||||
# Enable Apache Rewrite + Expires Module
|
||||
RUN a2enmod rewrite expires && \
|
||||
sed -i 's/ServerTokens OS/ServerTokens ProductOnly/g' \
|
||||
/etc/apache2/conf-available/security.conf
|
||||
ARG BUILD_DATE
|
||||
ARG VCS_REF
|
||||
|
||||
# Install dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
unzip \
|
||||
libfreetype6-dev \
|
||||
libjpeg62-turbo-dev \
|
||||
libpng-dev \
|
||||
libyaml-dev \
|
||||
libzip4 \
|
||||
libzip-dev \
|
||||
zlib1g-dev \
|
||||
libicu-dev \
|
||||
g++ \
|
||||
git \
|
||||
cron \
|
||||
vim \
|
||||
&& docker-php-ext-install opcache \
|
||||
&& docker-php-ext-configure intl \
|
||||
&& docker-php-ext-install intl \
|
||||
&& docker-php-ext-configure gd --with-freetype --with-jpeg \
|
||||
&& docker-php-ext-install -j$(nproc) gd \
|
||||
&& docker-php-ext-install zip \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
LABEL maintainer="Dominic Taylor <dominic@yobasystems.co.uk>" \
|
||||
architecture="amd64/x86_64" \
|
||||
grav-version="latest" \
|
||||
alpine-version="3.10.1" \
|
||||
build="19-Aug-2019" \
|
||||
org.opencontainers.image.title="alpine-grav" \
|
||||
org.opencontainers.image.description="Grav Docker image running on Alpine Linux" \
|
||||
org.opencontainers.image.authors="Dominic Taylor <dominic@yobasystems.co.uk>" \
|
||||
org.opencontainers.image.vendor="Yoba Systems" \
|
||||
org.opencontainers.image.version="latest" \
|
||||
org.opencontainers.image.url="https://hub.docker.com/r/yobasystems/alpine-grav/" \
|
||||
org.opencontainers.image.source="https://github.com/yobasystems/alpine-grav" \
|
||||
org.opencontainers.image.revision=$VCS_REF \
|
||||
org.opencontainers.image.created=$BUILD_DATE
|
||||
|
||||
# set recommended PHP.ini settings
|
||||
# see https://secure.php.net/manual/en/opcache.installation.php
|
||||
RUN { \
|
||||
echo 'opcache.memory_consumption=128'; \
|
||||
echo 'opcache.interned_strings_buffer=8'; \
|
||||
echo 'opcache.max_accelerated_files=4000'; \
|
||||
echo 'opcache.revalidate_freq=2'; \
|
||||
echo 'opcache.fast_shutdown=1'; \
|
||||
echo 'opcache.enable_cli=1'; \
|
||||
echo 'upload_max_filesize=128M'; \
|
||||
echo 'post_max_size=128M'; \
|
||||
echo 'expose_php=off'; \
|
||||
} > /usr/local/etc/php/conf.d/php-recommended.ini
|
||||
ENV TERM="xterm" \
|
||||
GRAV_VERSION="1.6.14"
|
||||
|
||||
RUN pecl install apcu \
|
||||
&& pecl install yaml-2.0.4 \
|
||||
&& docker-php-ext-enable apcu yaml
|
||||
RUN apk add --no-cache bash ca-certificates curl git less musl nginx tzdata vim yaml zip \
|
||||
php7-fpm php7-json php7-zlib php7-xml php7-pdo php7-phar php7-openssl \
|
||||
php7-gd php7-iconv php7-mcrypt php7-session php7-zip \
|
||||
php7-curl php7-opcache php7-ctype php7-apcu \
|
||||
php7-intl php7-bcmath php7-dom php7-mbstring php7-simplexml php7-xmlreader && \
|
||||
rm -rf /var/cache/apk/*
|
||||
|
||||
# Set user to www-data
|
||||
RUN chown www-data:www-data /var/www
|
||||
USER www-data
|
||||
RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php7/php.ini && \
|
||||
sed -i 's/expose_php = On/expose_php = Off/g' /etc/php7/php.ini && \
|
||||
sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd && \
|
||||
sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd- && \
|
||||
ln -s /sbin/php-fpm7 /sbin/php-fpm
|
||||
|
||||
# Define Grav specific version of Grav or use latest stable
|
||||
ENV GRAV_VERSION latest
|
||||
ADD files/nginx.conf /etc/nginx/
|
||||
ADD files/php-fpm.conf /etc/php7/
|
||||
ADD files/run.sh /
|
||||
RUN chmod +x /run.sh
|
||||
|
||||
# Install grav
|
||||
WORKDIR /var/www
|
||||
RUN curl -o grav-admin.zip -SL https://getgrav.org/download/core/grav-admin/${GRAV_VERSION} && \
|
||||
unzip grav-admin.zip && \
|
||||
mv -T /var/www/grav-admin /var/www/html && \
|
||||
rm grav-admin.zip
|
||||
|
||||
# Create cron job for Grav maintenance scripts
|
||||
RUN (crontab -l; echo "* * * * * cd /var/www/html;/usr/local/bin/php bin/grav scheduler 1>> /dev/null 2>&1") | crontab -
|
||||
|
||||
# Return to root user
|
||||
USER root
|
||||
|
||||
# Copy init scripts
|
||||
# COPY docker-entrypoint.sh /entrypoint.sh
|
||||
|
||||
# provide container inside image for data persistence
|
||||
VOLUME ["/var/www/html"]
|
||||
|
||||
# ENTRYPOINT ["/entrypoint.sh"]
|
||||
# CMD ["apache2-foreground"]
|
||||
CMD ["sh", "-c", "cron && apache2-foreground"]
|
||||
EXPOSE 80
|
||||
VOLUME ["/usr"]
|
||||
CMD ["/run.sh"]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,12 @@
|
|||
version: "3"
|
||||
|
||||
services:
|
||||
grav:
|
||||
build: .
|
||||
environment:
|
||||
VIRTUAL_HOST: www.2li.ch
|
||||
ports:
|
||||
- 8080:80
|
||||
volumes:
|
||||
- ./data:/usr/html
|
||||
restart: always
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
daemon off;
|
||||
error_log stderr notice;
|
||||
pid /var/run/nginx.pid;
|
||||
env DB_HOST;
|
||||
env DB_NAME;
|
||||
env DB_USER;
|
||||
env DB_PASS;
|
||||
worker_processes 1;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
http {
|
||||
sendfile on;
|
||||
include /etc/nginx/mime.types;
|
||||
include /etc/nginx/fastcgi.conf;
|
||||
default_type application/octet-stream;
|
||||
access_log stdout;
|
||||
tcp_nopush on;
|
||||
client_body_temp_path /tmp/nginx/body 1 2;
|
||||
fastcgi_temp_path /tmp/nginx/fastcgi_temp 1 2;
|
||||
log_format blocked '$time_local: Blocked request from $http_x_real_ip $request';
|
||||
log_format specialLog '$http_x_real_ip - $remote_user [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
client_max_body_size 512M;
|
||||
server {
|
||||
listen 80;
|
||||
root /usr/html;
|
||||
index index.php index.html index.htm;
|
||||
access_log stdout;
|
||||
error_log stderr notice;
|
||||
disable_symlinks off;
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?_url=$uri&$query_string;
|
||||
}
|
||||
|
||||
location ~ [^/]\.php(/|$) {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
if (!-f $document_root$fastcgi_script_name) {
|
||||
return 404;
|
||||
}
|
||||
fastcgi_pass unix:/var/run/php7-fpm.sock;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
}
|
||||
## Block common exploits
|
||||
location ~* (<|%3C).*script.*(>|%3E) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* base64_(en|de)code\(.*\) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* (%24&x) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* (%0|%A|%B|%C|%D|%E|%F|127\.0) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* \.\.\/ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* ~$ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* proc/self/environ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* /\.(htaccess|htpasswd|svn) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* [a-zA-Z0-9_]=(\.\.//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
|
||||
location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
|
||||
location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
|
||||
location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; }
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
error_log = /usr/logs/php-fpm/php-fpm.log
|
||||
log_level = warning
|
||||
[www]
|
||||
user = nginx
|
||||
group = nginx
|
||||
listen = /var/run/php7-fpm.sock
|
||||
listen.owner = nginx
|
||||
listen.group = nginx
|
||||
pm = ondemand
|
||||
; Total RAM dedicated to the web server / Max child process size
|
||||
pm.max_children = 75
|
||||
pm.process_idle_timeout = 10s
|
||||
pm.max_requests = 500
|
||||
chdir = /usr/html
|
||||
php_flag[display_errors] = on
|
||||
php_admin_value[memory_limit] = 128M
|
||||
php_admin_value[upload_max_filesize] = 32M
|
||||
php_admin_value[post_max_size] = 32M
|
||||
php_admin_value[output_buffering] = 0
|
||||
php_admin_value[openssl.cafile] = /etc/ssl/certs/ca-certificates.crt
|
||||
php_admin_value[openssl.capath] = /etc/ssl/certs
|
||||
php_admin_value[max_input_nesting_level] = 256
|
||||
php_admin_value[max_input_vars] = 10000
|
||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
||||
; Default Value: no
|
||||
catch_workers_output = yes
|
||||
; Database variables passed via -e argument on Docker
|
||||
env["DB_HOST"] = "$DB_HOST"
|
||||
env["DB_USER"] = "$DB_USER"
|
||||
env["DB_PASS"] = "$DB_PASS"
|
||||
env["DB_NAME"] = "$DB_NAME"
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
#!/bin/ash
|
||||
|
||||
[ -f /run-pre.sh ] && /run-pre.sh
|
||||
|
||||
if [ ! -d /usr/html ] ; then
|
||||
mkdir -p /usr/html
|
||||
chown -R nginx:nginx /usr/html
|
||||
else
|
||||
chown -R nginx:nginx /usr/html
|
||||
fi
|
||||
|
||||
if [ ! -d /usr/html/system ] ; then
|
||||
curl -fLk -o /tmp/grav.zip "https://getgrav.org/download/core/grav-admin/latest"
|
||||
mkdir /tmp/grav-src
|
||||
unzip /tmp/grav.zip -d /tmp/grav-src
|
||||
mv -f /tmp/grav-src/grav-admin/* /usr/html/
|
||||
rm -R /tmp/grav*
|
||||
chown -R nginx:nginx /usr/html
|
||||
else
|
||||
chown -R nginx:nginx /usr/html
|
||||
fi
|
||||
|
||||
chown -R nginx:nginx /usr/html
|
||||
|
||||
find /usr/html -type f | xargs chmod 664
|
||||
find /usr/html -type d | xargs chmod 775
|
||||
find /usr/html -type d | xargs chmod +s
|
||||
|
||||
# start php-fpm
|
||||
mkdir -p /usr/logs/php-fpm
|
||||
php-fpm7
|
||||
|
||||
# start nginx
|
||||
mkdir -p /usr/logs/nginx
|
||||
mkdir -p /tmp/nginx
|
||||
chown nginx /tmp/nginx
|
||||
nginx
|
||||
Reference in New Issue