From 861b22637fad8720bc9a2dc1a958e474a1c3b47a Mon Sep 17 00:00:00 2001 From: Andreas Zweili Date: Sat, 30 Jan 2021 15:07:05 +0100 Subject: [PATCH] improve the docker setup --- .gitignore | 2 + grav/Dockerfile | 107 ++++++++++++++-------------------------- grav/docker-compose.yml | 12 +++++ grav/files/nginx.conf | 68 +++++++++++++++++++++++++ grav/files/php-fpm.conf | 32 ++++++++++++ grav/files/run.sh | 37 ++++++++++++++ 6 files changed, 188 insertions(+), 70 deletions(-) create mode 100644 grav/docker-compose.yml create mode 100644 grav/files/nginx.conf create mode 100644 grav/files/php-fpm.conf create mode 100644 grav/files/run.sh diff --git a/.gitignore b/.gitignore index 2d5975f..6355ff2 100644 --- a/.gitignore +++ b/.gitignore @@ -81,3 +81,5 @@ tags letsencrypt/ traefik.yaml + +grav/data/ diff --git a/grav/Dockerfile b/grav/Dockerfile index 7e59890..f058756 100644 --- a/grav/Dockerfile +++ b/grav/Dockerfile @@ -1,78 +1,45 @@ -FROM php:7.4-apache -LABEL maintainer="Andy Miller (@rhukster)" +FROM alpine -# Enable Apache Rewrite + Expires Module -RUN a2enmod rewrite expires && \ - sed -i 's/ServerTokens OS/ServerTokens ProductOnly/g' \ - /etc/apache2/conf-available/security.conf +ARG BUILD_DATE +ARG VCS_REF -# Install dependencies -RUN apt-get update && apt-get install -y --no-install-recommends \ - unzip \ - libfreetype6-dev \ - libjpeg62-turbo-dev \ - libpng-dev \ - libyaml-dev \ - libzip4 \ - libzip-dev \ - zlib1g-dev \ - libicu-dev \ - g++ \ - git \ - cron \ - vim \ - && docker-php-ext-install opcache \ - && docker-php-ext-configure intl \ - && docker-php-ext-install intl \ - && docker-php-ext-configure gd --with-freetype --with-jpeg \ - && docker-php-ext-install -j$(nproc) gd \ - && docker-php-ext-install zip \ - && rm -rf /var/lib/apt/lists/* +LABEL maintainer="Dominic Taylor " \ + architecture="amd64/x86_64" \ + grav-version="latest" \ + alpine-version="3.10.1" \ + build="19-Aug-2019" \ + org.opencontainers.image.title="alpine-grav" \ + org.opencontainers.image.description="Grav Docker image running on Alpine Linux" \ + org.opencontainers.image.authors="Dominic Taylor " \ + org.opencontainers.image.vendor="Yoba Systems" \ + org.opencontainers.image.version="latest" \ + org.opencontainers.image.url="https://hub.docker.com/r/yobasystems/alpine-grav/" \ + org.opencontainers.image.source="https://github.com/yobasystems/alpine-grav" \ + org.opencontainers.image.revision=$VCS_REF \ + org.opencontainers.image.created=$BUILD_DATE -# set recommended PHP.ini settings -# see https://secure.php.net/manual/en/opcache.installation.php -RUN { \ - echo 'opcache.memory_consumption=128'; \ - echo 'opcache.interned_strings_buffer=8'; \ - echo 'opcache.max_accelerated_files=4000'; \ - echo 'opcache.revalidate_freq=2'; \ - echo 'opcache.fast_shutdown=1'; \ - echo 'opcache.enable_cli=1'; \ - echo 'upload_max_filesize=128M'; \ - echo 'post_max_size=128M'; \ - echo 'expose_php=off'; \ - } > /usr/local/etc/php/conf.d/php-recommended.ini +ENV TERM="xterm" \ + GRAV_VERSION="1.6.14" -RUN pecl install apcu \ - && pecl install yaml-2.0.4 \ - && docker-php-ext-enable apcu yaml +RUN apk add --no-cache bash ca-certificates curl git less musl nginx tzdata vim yaml zip \ + php7-fpm php7-json php7-zlib php7-xml php7-pdo php7-phar php7-openssl \ + php7-gd php7-iconv php7-mcrypt php7-session php7-zip \ + php7-curl php7-opcache php7-ctype php7-apcu \ + php7-intl php7-bcmath php7-dom php7-mbstring php7-simplexml php7-xmlreader && \ + rm -rf /var/cache/apk/* -# Set user to www-data -RUN chown www-data:www-data /var/www -USER www-data +RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php7/php.ini && \ + sed -i 's/expose_php = On/expose_php = Off/g' /etc/php7/php.ini && \ + sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd && \ + sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd- && \ + ln -s /sbin/php-fpm7 /sbin/php-fpm -# Define Grav specific version of Grav or use latest stable -ENV GRAV_VERSION latest +ADD files/nginx.conf /etc/nginx/ +ADD files/php-fpm.conf /etc/php7/ +ADD files/run.sh / +RUN chmod +x /run.sh -# Install grav -WORKDIR /var/www -RUN curl -o grav-admin.zip -SL https://getgrav.org/download/core/grav-admin/${GRAV_VERSION} && \ - unzip grav-admin.zip && \ - mv -T /var/www/grav-admin /var/www/html && \ - rm grav-admin.zip -# Create cron job for Grav maintenance scripts -RUN (crontab -l; echo "* * * * * cd /var/www/html;/usr/local/bin/php bin/grav scheduler 1>> /dev/null 2>&1") | crontab - - -# Return to root user -USER root - -# Copy init scripts -# COPY docker-entrypoint.sh /entrypoint.sh - -# provide container inside image for data persistence -VOLUME ["/var/www/html"] - -# ENTRYPOINT ["/entrypoint.sh"] -# CMD ["apache2-foreground"] -CMD ["sh", "-c", "cron && apache2-foreground"] +EXPOSE 80 +VOLUME ["/usr"] +CMD ["/run.sh"] diff --git a/grav/docker-compose.yml b/grav/docker-compose.yml new file mode 100644 index 0000000..d3f740c --- /dev/null +++ b/grav/docker-compose.yml @@ -0,0 +1,12 @@ +version: "3" + +services: + grav: + build: . + environment: + VIRTUAL_HOST: www.2li.ch + ports: + - 8080:80 + volumes: + - ./data:/usr/html + restart: always diff --git a/grav/files/nginx.conf b/grav/files/nginx.conf new file mode 100644 index 0000000..5abcc3d --- /dev/null +++ b/grav/files/nginx.conf @@ -0,0 +1,68 @@ +daemon off; +error_log stderr notice; +pid /var/run/nginx.pid; +env DB_HOST; +env DB_NAME; +env DB_USER; +env DB_PASS; +worker_processes 1; +events { + worker_connections 1024; +} +http { + sendfile on; + include /etc/nginx/mime.types; + include /etc/nginx/fastcgi.conf; + default_type application/octet-stream; + access_log stdout; + tcp_nopush on; + client_body_temp_path /tmp/nginx/body 1 2; + fastcgi_temp_path /tmp/nginx/fastcgi_temp 1 2; + log_format blocked '$time_local: Blocked request from $http_x_real_ip $request'; + log_format specialLog '$http_x_real_ip - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent"'; + client_max_body_size 512M; + server { + listen 80; + root /usr/html; + index index.php index.html index.htm; + access_log stdout; + error_log stderr notice; + disable_symlinks off; + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + location / { + try_files $uri $uri/ /index.php?_url=$uri&$query_string; + } + + location ~ [^/]\.php(/|$) { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + if (!-f $document_root$fastcgi_script_name) { + return 404; + } + fastcgi_pass unix:/var/run/php7-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name; + include fastcgi_params; + } + ## Block common exploits + location ~* (<|%3C).*script.*(>|%3E) { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* base64_(en|de)code\(.*\) { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* (%24&x) { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* (%0|%A|%B|%C|%D|%E|%F|127\.0) { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* \.\.\/ { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* ~$ { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* proc/self/environ { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* /\.(htaccess|htpasswd|svn) { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* [a-zA-Z0-9_]=(\.\.//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; } + location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 403; } + location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; } + location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; } + location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; } + } +} diff --git a/grav/files/php-fpm.conf b/grav/files/php-fpm.conf new file mode 100644 index 0000000..96b15a5 --- /dev/null +++ b/grav/files/php-fpm.conf @@ -0,0 +1,32 @@ +error_log = /usr/logs/php-fpm/php-fpm.log +log_level = warning +[www] +user = nginx +group = nginx +listen = /var/run/php7-fpm.sock +listen.owner = nginx +listen.group = nginx +pm = ondemand +; Total RAM dedicated to the web server / Max child process size +pm.max_children = 75 +pm.process_idle_timeout = 10s +pm.max_requests = 500 +chdir = /usr/html +php_flag[display_errors] = on +php_admin_value[memory_limit] = 128M +php_admin_value[upload_max_filesize] = 32M +php_admin_value[post_max_size] = 32M +php_admin_value[output_buffering] = 0 +php_admin_value[openssl.cafile] = /etc/ssl/certs/ca-certificates.crt +php_admin_value[openssl.capath] = /etc/ssl/certs +php_admin_value[max_input_nesting_level] = 256 +php_admin_value[max_input_vars] = 10000 +; Redirect worker stdout and stderr into main error log. If not set, stdout and +; stderr will be redirected to /dev/null according to FastCGI specs. +; Default Value: no +catch_workers_output = yes +; Database variables passed via -e argument on Docker +env["DB_HOST"] = "$DB_HOST" +env["DB_USER"] = "$DB_USER" +env["DB_PASS"] = "$DB_PASS" +env["DB_NAME"] = "$DB_NAME" diff --git a/grav/files/run.sh b/grav/files/run.sh new file mode 100644 index 0000000..6fddb7e --- /dev/null +++ b/grav/files/run.sh @@ -0,0 +1,37 @@ +#!/bin/ash + +[ -f /run-pre.sh ] && /run-pre.sh + +if [ ! -d /usr/html ] ; then + mkdir -p /usr/html + chown -R nginx:nginx /usr/html +else + chown -R nginx:nginx /usr/html +fi + +if [ ! -d /usr/html/system ] ; then + curl -fLk -o /tmp/grav.zip "https://getgrav.org/download/core/grav-admin/latest" + mkdir /tmp/grav-src + unzip /tmp/grav.zip -d /tmp/grav-src + mv -f /tmp/grav-src/grav-admin/* /usr/html/ + rm -R /tmp/grav* + chown -R nginx:nginx /usr/html +else + chown -R nginx:nginx /usr/html +fi + +chown -R nginx:nginx /usr/html + +find /usr/html -type f | xargs chmod 664 +find /usr/html -type d | xargs chmod 775 +find /usr/html -type d | xargs chmod +s + +# start php-fpm +mkdir -p /usr/logs/php-fpm +php-fpm7 + +# start nginx +mkdir -p /usr/logs/nginx +mkdir -p /tmp/nginx +chown nginx /tmp/nginx +nginx