try to merge three services onto one system
This commit is contained in:
parent
6cf750fe08
commit
9bb0d76951
|
|
@ -0,0 +1,45 @@
|
|||
FROM alpine
|
||||
|
||||
ARG BUILD_DATE
|
||||
ARG VCS_REF
|
||||
|
||||
LABEL maintainer="Dominic Taylor <dominic@yobasystems.co.uk>" \
|
||||
architecture="amd64/x86_64" \
|
||||
grav-version="latest" \
|
||||
alpine-version="3.10.1" \
|
||||
build="19-Aug-2019" \
|
||||
org.opencontainers.image.title="alpine-grav" \
|
||||
org.opencontainers.image.description="Grav Docker image running on Alpine Linux" \
|
||||
org.opencontainers.image.authors="Dominic Taylor <dominic@yobasystems.co.uk>" \
|
||||
org.opencontainers.image.vendor="Yoba Systems" \
|
||||
org.opencontainers.image.version="latest" \
|
||||
org.opencontainers.image.url="https://hub.docker.com/r/yobasystems/alpine-grav/" \
|
||||
org.opencontainers.image.source="https://github.com/yobasystems/alpine-grav" \
|
||||
org.opencontainers.image.revision=$VCS_REF \
|
||||
org.opencontainers.image.created=$BUILD_DATE
|
||||
|
||||
ENV TERM="xterm" \
|
||||
GRAV_VERSION="1.6.14"
|
||||
|
||||
RUN apk add --no-cache bash ca-certificates curl git less musl nginx tzdata vim yaml zip \
|
||||
php7-fpm php7-json php7-zlib php7-xml php7-pdo php7-phar php7-openssl \
|
||||
php7-gd php7-iconv php7-mcrypt php7-session php7-zip \
|
||||
php7-curl php7-opcache php7-ctype php7-apcu \
|
||||
php7-intl php7-bcmath php7-dom php7-mbstring php7-simplexml php7-xmlreader && \
|
||||
rm -rf /var/cache/apk/*
|
||||
|
||||
RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php7/php.ini && \
|
||||
sed -i 's/expose_php = On/expose_php = Off/g' /etc/php7/php.ini && \
|
||||
sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd && \
|
||||
sed -i "s/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/nginx:x:100:101:nginx:\/usr:\/bin\/bash/g" /etc/passwd- && \
|
||||
ln -s /sbin/php-fpm7 /sbin/php-fpm
|
||||
|
||||
ADD files/nginx.conf /etc/nginx/
|
||||
ADD files/php-fpm.conf /etc/php7/
|
||||
ADD files/run.sh /
|
||||
RUN chmod +x /run.sh
|
||||
|
||||
|
||||
EXPOSE 80
|
||||
VOLUME ["/usr"]
|
||||
CMD ["/run.sh"]
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
version: "3"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.2"
|
||||
ports:
|
||||
- "4433:443"
|
||||
volumes:
|
||||
- "./traefik.yaml:/etc/traefik/traefik.yaml:ro"
|
||||
- "./letsencrypt:/letsencrypt"
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik_proxy
|
||||
|
||||
grav:
|
||||
build: .
|
||||
environment:
|
||||
VIRTUAL_HOST: www.2li.ch
|
||||
volumes:
|
||||
- grav:/usr/html
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.grav.rule=Host(`2li.ch`,`www.2li.ch`)"
|
||||
- "traefik.http.routers.grav.entrypoints=websecure"
|
||||
- "traefik.http.routers.grav.tls.certresolver=myresolver"
|
||||
- "traefik.http.services.grav.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.grav.middlewares=default-headers@file"
|
||||
networks:
|
||||
- traefik_proxy
|
||||
|
||||
volumes:
|
||||
grav:
|
||||
driver_opts:
|
||||
type: "nfs"
|
||||
o: "addr=10.7.89.108,nolock,soft,rw,vers=4.1"
|
||||
device: ":/server_data/grav"
|
||||
|
||||
networks:
|
||||
proxy:
|
||||
name: "traefik_proxy"
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
daemon off;
|
||||
error_log stderr notice;
|
||||
pid /var/run/nginx.pid;
|
||||
env DB_HOST;
|
||||
env DB_NAME;
|
||||
env DB_USER;
|
||||
env DB_PASS;
|
||||
worker_processes 1;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
http {
|
||||
sendfile on;
|
||||
include /etc/nginx/mime.types;
|
||||
include /etc/nginx/fastcgi.conf;
|
||||
default_type application/octet-stream;
|
||||
access_log stdout;
|
||||
tcp_nopush on;
|
||||
client_body_temp_path /tmp/nginx/body 1 2;
|
||||
fastcgi_temp_path /tmp/nginx/fastcgi_temp 1 2;
|
||||
log_format blocked '$time_local: Blocked request from $http_x_real_ip $request';
|
||||
log_format specialLog '$http_x_real_ip - $remote_user [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
client_max_body_size 512M;
|
||||
server {
|
||||
listen 80;
|
||||
root /usr/html;
|
||||
index index.php index.html index.htm;
|
||||
access_log stdout;
|
||||
error_log stderr notice;
|
||||
disable_symlinks off;
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?_url=$uri&$query_string;
|
||||
}
|
||||
|
||||
location ~ [^/]\.php(/|$) {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
if (!-f $document_root$fastcgi_script_name) {
|
||||
return 404;
|
||||
}
|
||||
fastcgi_pass unix:/var/run/php7-fpm.sock;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
}
|
||||
## Block common exploits
|
||||
location ~* (<|%3C).*script.*(>|%3E) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* base64_(en|de)code\(.*\) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* (%24&x) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* (%0|%A|%B|%C|%D|%E|%F|127\.0) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* \.\.\/ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* ~$ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* proc/self/environ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* /\.(htaccess|htpasswd|svn) { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* [a-zA-Z0-9_]=(\.\.//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ { access_log /usr/logs/nginx/blocked.log blocked; deny all; }
|
||||
location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
|
||||
location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
|
||||
location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
|
||||
location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; }
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
error_log = /usr/logs/php-fpm/php-fpm.log
|
||||
log_level = warning
|
||||
[www]
|
||||
user = nginx
|
||||
group = nginx
|
||||
listen = /var/run/php7-fpm.sock
|
||||
listen.owner = nginx
|
||||
listen.group = nginx
|
||||
pm = ondemand
|
||||
; Total RAM dedicated to the web server / Max child process size
|
||||
pm.max_children = 75
|
||||
pm.process_idle_timeout = 10s
|
||||
pm.max_requests = 500
|
||||
chdir = /usr/html
|
||||
php_flag[display_errors] = on
|
||||
php_admin_value[memory_limit] = 128M
|
||||
php_admin_value[upload_max_filesize] = 32M
|
||||
php_admin_value[post_max_size] = 32M
|
||||
php_admin_value[output_buffering] = 0
|
||||
php_admin_value[openssl.cafile] = /etc/ssl/certs/ca-certificates.crt
|
||||
php_admin_value[openssl.capath] = /etc/ssl/certs
|
||||
php_admin_value[max_input_nesting_level] = 256
|
||||
php_admin_value[max_input_vars] = 10000
|
||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
||||
; Default Value: no
|
||||
catch_workers_output = yes
|
||||
; Database variables passed via -e argument on Docker
|
||||
env["DB_HOST"] = "$DB_HOST"
|
||||
env["DB_USER"] = "$DB_USER"
|
||||
env["DB_PASS"] = "$DB_PASS"
|
||||
env["DB_NAME"] = "$DB_NAME"
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ ! -d /usr/html ] ; then
|
||||
mkdir -p /usr/html
|
||||
chown -R nginx:nginx /usr/html
|
||||
else
|
||||
chown -R nginx:nginx /usr/html
|
||||
fi
|
||||
|
||||
if [ ! -d /usr/html/system ] ; then
|
||||
curl -fLk -o /tmp/grav.zip "https://getgrav.org/download/core/grav-admin/latest"
|
||||
mkdir /tmp/grav-src
|
||||
unzip /tmp/grav.zip -d /tmp/grav-src
|
||||
mv -f /tmp/grav-src/grav-admin/* /usr/html/
|
||||
rm -R /tmp/grav*
|
||||
chown -R nginx:nginx /usr/html
|
||||
else
|
||||
chown -R nginx:nginx /usr/html
|
||||
fi
|
||||
|
||||
chown -R nginx:nginx /usr/html
|
||||
|
||||
find /usr/html -type f | xargs chmod 664
|
||||
find /usr/html -type d | xargs chmod 775
|
||||
find /usr/html -type d | xargs chmod +s
|
||||
|
||||
# start php-fpm
|
||||
mkdir -p /usr/logs/php-fpm
|
||||
php-fpm7
|
||||
|
||||
# start nginx
|
||||
mkdir -p /usr/logs/nginx
|
||||
mkdir -p /tmp/nginx
|
||||
chown nginx /tmp/nginx
|
||||
nginx
|
||||
|
|
@ -1,23 +1,21 @@
|
|||
version: '3'
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.2"
|
||||
ports:
|
||||
- "443:443"
|
||||
volumes:
|
||||
- "./traefik.yaml:/etc/traefik/traefik.yaml:ro"
|
||||
- "./letsencrypt:/letsencrypt"
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
restart: unless-stopped
|
||||
|
||||
rss-bridge:
|
||||
image: rssbridge/rss-bridge:latest
|
||||
volumes:
|
||||
- ./whitelist.txt:/app/whitelist.txt
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.rss-bridge.rule=Host(`${APP_DOMAIN}`)"
|
||||
- "traefik.http.routers.rss-bridge.rule=Host(`rss-bridge.2li.ch`)"
|
||||
- "traefik.http.routers.rss-bridge.entrypoints=websecure"
|
||||
- "traefik.http.routers.rss-bridge.tls.certresolver=myresolver"
|
||||
- "traefik.http.routers.rss-bridge.middlewares=default-headers@file"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik_proxy
|
||||
|
||||
networks:
|
||||
proxy:
|
||||
external:
|
||||
name: "traefik_proxy"
|
||||
|
||||
Reference in New Issue