-
Notifications
You must be signed in to change notification settings - Fork 14
added debian image variant #122
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
16 commits
Select commit
Hold shift + click to select a range
24e5b23
added debian image variant
fabriciojs ca9d996
fix debian supervisor
fabriciojs e0dfd74
change base to stable debian bookworm
fabriciojs 5684e0e
Review Changes
dbpolito e0edb16
Merge branch 'master' into debian
fabriciojs 3c892f9
update ci-cd fix sequence issue
fabriciojs 23db27d
attempt to fix local img just built usage
fabriciojs 0ac22cb
test local build
fabriciojs d309f6d
Merge branch 'master' of github.com:kool-dev/docker-php into debian
fabriciojs e3d9a35
refactor(ci): implement local build and test workflow (US-001)
fabriciojs b07079a
update docs
fabriciojs 4db4d2e
feat(ci): add multi-arch push jobs with dependency order (US-002)
fabriciojs c640fe4
docs: mark US-003 Alpine image builds as completed
fabriciojs 871dbf6
docs: mark US-004 Debian image builds as completed
fabriciojs 2c032cb
feat(ci): add downstream repository triggers (US-005)
fabriciojs 4c8fca9
consolidate single supervidord config
fabriciojs File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| FROM debian:bookworm AS cert | ||
|
|
||
| WORKDIR /kool/ssl | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y openssl && \ | ||
| openssl genrsa -des3 -passout pass:x -out server.pass.key 2048 && \ | ||
| openssl rsa -passin pass:x -in server.pass.key -out _.localhost.key && \ | ||
| rm server.pass.key && \ | ||
| openssl req -new -key _.localhost.key -out server.csr \ | ||
| -subj "/C=XX/ST=XX/L=XX/O=Kool-Local/OU=Localhost/CN=*.localhost" && \ | ||
| openssl x509 -req -days 365 -in server.csr -signkey _.localhost.key -out _.localhost.crt && \ | ||
| openssl x509 -in _.localhost.crt -out _.localhost.pem | ||
|
|
||
| FROM kooldev/php:8.4-debian-prod | ||
|
|
||
| ENV PHP_FPM_LISTEN=/run/php-fpm.sock \ | ||
| NGINX_LISTEN=80 \ | ||
| NGINX_HTTPS=false \ | ||
| NGINX_LISTEN_HTTPS=443 \ | ||
| NGINX_HTTPS_CERT=/kool/ssl/_.localhost.pem \ | ||
| NGINX_HTTPS_CERT_KEY=/kool/ssl/_.localhost.key \ | ||
| NGINX_ROOT=/app/public \ | ||
| NGINX_INDEX=index.php \ | ||
| NGINX_CLIENT_MAX_BODY_SIZE=25M \ | ||
| NGINX_PHP_FPM=unix:/run/php-fpm.sock \ | ||
| NGINX_FASTCGI_READ_TIMEOUT=60s \ | ||
| NGINX_FASTCGI_BUFFERS='8 8k' \ | ||
| NGINX_FASTCGI_BUFFER_SIZE='16k' \ | ||
| NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE=true | ||
|
|
||
| RUN apt-get update && apt-get install -y --no-install-recommends supervisor nginx wget \ | ||
| && chown -R kool:kool /var/lib/nginx \ | ||
| && chmod 770 /var/lib/nginx \ | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log \ | ||
| # add h5bp/server-configs-nginx | ||
| && mkdir -p /etc/nginx/conf.d \ | ||
| && mkdir /etc/nginx/h5bp \ | ||
| && cd /etc/nginx/h5bp \ | ||
| && wget https://github.com/h5bp/server-configs-nginx/archive/refs/tags/5.0.1.tar.gz -O h5bp.tgz \ | ||
| && tar xzvf h5bp.tgz \ | ||
| && rm -f h5bp.tgz \ | ||
| && mv server-configs-nginx-*/h5bp/* . \ | ||
| && mv server-configs-nginx-*/nginx.conf /etc/nginx/nginx.conf \ | ||
| && sed -i "s|^user .*|user\ kool kool;|g" /etc/nginx/nginx.conf \ | ||
| && mv server-configs-nginx-*/mime.types /etc/nginx/mime.types \ | ||
| && rm -rf server-configs-nginx-* \ | ||
| && curl -L https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \ | ||
| && chmod +x /kool/30-tune-worker-processes.sh \ | ||
fabriciojs marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| && apt-get purge -y --auto-remove wget \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| COPY supervisor.conf /kool/supervisor.conf | ||
| COPY default.tmpl /kool/default.tmpl | ||
| COPY entrypoint /kool/entrypoint | ||
| COPY --from=cert /kool/ssl /kool/ssl | ||
| RUN chmod +x /kool/entrypoint | ||
|
|
||
| EXPOSE 80 | ||
|
|
||
| CMD [ "supervisord", "-c", "/kool/supervisor.conf" ] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| server { | ||
| listen {{ .Env.NGINX_LISTEN }} default_server; | ||
| server_name _; | ||
| {{ if isTrue .Env.NGINX_HTTPS }} | ||
| listen {{ .Env.NGINX_LISTEN_HTTPS }} ssl http2; | ||
| ssl_certificate {{ .Env.NGINX_HTTPS_CERT }}; | ||
| ssl_certificate_key {{ .Env.NGINX_HTTPS_CERT_KEY }}; | ||
| ssl_protocols TLSv1.2 TLSv1.3; | ||
| ssl_ciphers HIGH:!aNULL:!MD5; | ||
| {{ end }} | ||
| root {{ .Env.NGINX_ROOT }}; | ||
| index {{ .Env.NGINX_INDEX }}; | ||
| charset utf-8; | ||
|
|
||
| location = /favicon.ico { log_not_found off; access_log off; } | ||
| location = /robots.txt { log_not_found off; access_log off; } | ||
|
|
||
| client_max_body_size {{ .Env.NGINX_CLIENT_MAX_BODY_SIZE }}; | ||
|
|
||
| error_page 404 /index.php; | ||
|
|
||
| location / { | ||
| try_files $uri /{{ .Env.NGINX_INDEX }}?$query_string; | ||
| } | ||
|
|
||
| location ~ \.php$ { | ||
| fastcgi_buffers {{ .Env.NGINX_FASTCGI_BUFFERS }}; | ||
| fastcgi_buffer_size {{ .Env.NGINX_FASTCGI_BUFFER_SIZE }}; | ||
| fastcgi_pass {{ .Env.NGINX_PHP_FPM }}; | ||
| fastcgi_read_timeout {{ .Env.NGINX_FASTCGI_READ_TIMEOUT }}; | ||
| fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; | ||
| include fastcgi_params; | ||
| } | ||
|
|
||
| location ~ /\.ht { | ||
| deny all; | ||
| } | ||
|
|
||
| # good practices | ||
| add_header X-Frame-Options "SAMEORIGIN"; | ||
|
|
||
| # basic H5BP suggestions | ||
| include h5bp/security/referrer-policy.conf; | ||
| include h5bp/security/x-content-type-options.conf; | ||
| include h5bp/cross-origin/requests.conf; | ||
|
|
||
| # performance enhancements (mostly for caching static data) | ||
| include h5bp/web_performance/cache-file-descriptors.conf; | ||
| include h5bp/web_performance/compression.conf; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| #!/bin/bash | ||
| set -e | ||
|
|
||
|
|
||
| # Run as current user | ||
| CURRENT_USER=${ASUSER:-${UID:-0}} | ||
|
|
||
| if [ ! -z "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then | ||
| usermod -u $CURRENT_USER kool | ||
| fi | ||
|
|
||
| dockerize -template /kool/kool.tmpl:/usr/local/etc/php/conf.d/kool.ini -template /kool/zz-docker.tmpl:/usr/local/etc/php-fpm.d/zz-docker.conf -template /kool/default.tmpl:/etc/nginx/conf.d/default.conf | ||
|
|
||
| /kool/30-tune-worker-processes.sh | ||
|
|
||
| # Run entrypoint if provided | ||
| if [ ! -z "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then | ||
| bash $ENTRYPOINT | ||
| fi | ||
|
|
||
| if [ "$1" = "sh" ] || [ "$1" = "bash" ] || [ "$1" = "php-fpm" ] || [ "$1" = "nginx" ] || [ "$1" = "supervisord" ]; then | ||
| exec "$@" | ||
| else | ||
| exec gosu kool "$@" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| [supervisord] | ||
| logfile=/dev/stdout | ||
| logfile_maxbytes=0 | ||
| pidfile=/run/supervisord.pid | ||
| nodaemon=true | ||
|
|
||
| [program:php-fpm] | ||
| command = php-fpm | ||
| priority = 10 | ||
| autorestart = true | ||
| stopasgroup = true | ||
| killasgroup = true | ||
| stderr_logfile = /dev/stderr | ||
| stdout_logfile = /dev/stdout | ||
| stderr_logfile_maxbytes = 0 | ||
| stdout_logfile_maxbytes = 0 | ||
|
|
||
| [program:nginx] | ||
| command = nginx -g "daemon off;" | ||
| priority = 20 | ||
| autorestart = true | ||
| stopasgroup = true | ||
| killasgroup = true | ||
| stderr_logfile = /dev/stderr | ||
| stdout_logfile = /dev/stdout | ||
| stderr_logfile_maxbytes = 0 | ||
| stdout_logfile_maxbytes = 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| FROM debian:bookworm AS cert | ||
|
|
||
| WORKDIR /kool/ssl | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y openssl && \ | ||
| openssl genrsa -des3 -passout pass:x -out server.pass.key 2048 && \ | ||
| openssl rsa -passin pass:x -in server.pass.key -out _.localhost.key && \ | ||
| rm server.pass.key && \ | ||
| openssl req -new -key _.localhost.key -out server.csr \ | ||
| -subj "/C=XX/ST=XX/L=XX/O=Kool-Local/OU=Localhost/CN=*.localhost" && \ | ||
| openssl x509 -req -days 365 -in server.csr -signkey _.localhost.key -out _.localhost.crt && \ | ||
| openssl x509 -in _.localhost.crt -out _.localhost.pem | ||
|
|
||
| FROM kooldev/php:8.4-debian | ||
|
|
||
| ENV PHP_FPM_LISTEN=/run/php-fpm.sock \ | ||
| NGINX_LISTEN=80 \ | ||
| NGINX_HTTPS=false \ | ||
| NGINX_LISTEN_HTTPS=443 \ | ||
| NGINX_HTTPS_CERT=/kool/ssl/_.localhost.pem \ | ||
| NGINX_HTTPS_CERT_KEY=/kool/ssl/_.localhost.key \ | ||
| NGINX_ROOT=/app/public \ | ||
| NGINX_INDEX=index.php \ | ||
| NGINX_CLIENT_MAX_BODY_SIZE=25M \ | ||
| NGINX_PHP_FPM=unix:/run/php-fpm.sock \ | ||
| NGINX_FASTCGI_READ_TIMEOUT=60s \ | ||
| NGINX_FASTCGI_BUFFERS='8 8k' \ | ||
| NGINX_FASTCGI_BUFFER_SIZE='16k' \ | ||
| NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE=true | ||
|
|
||
| RUN apt-get update && apt-get install -y --no-install-recommends supervisor nginx wget \ | ||
| && chown -R kool:kool /var/lib/nginx \ | ||
| && chmod 770 /var/lib/nginx \ | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log \ | ||
| # add h5bp/server-configs-nginx | ||
| && mkdir -p /etc/nginx/conf.d \ | ||
| && mkdir /etc/nginx/h5bp \ | ||
| && cd /etc/nginx/h5bp \ | ||
| && wget https://github.com/h5bp/server-configs-nginx/archive/refs/tags/5.0.1.tar.gz -O h5bp.tgz \ | ||
| && tar xzvf h5bp.tgz \ | ||
|
Comment on lines
+41
to
+42
|
||
| && rm -f h5bp.tgz \ | ||
| && mv server-configs-nginx-*/h5bp/* . \ | ||
| && mv server-configs-nginx-*/nginx.conf /etc/nginx/nginx.conf \ | ||
| && sed -i "s|^user .*|user\ kool kool;|g" /etc/nginx/nginx.conf \ | ||
| && mv server-configs-nginx-*/mime.types /etc/nginx/mime.types \ | ||
| && rm -rf server-configs-nginx-* \ | ||
| && curl -L https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \ | ||
| && chmod +x /kool/30-tune-worker-processes.sh \ | ||
fabriciojs marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| && apt-get purge -y --auto-remove wget \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| COPY supervisor.conf /kool/supervisor.conf | ||
| COPY default.tmpl /kool/default.tmpl | ||
| COPY entrypoint /kool/entrypoint | ||
| COPY --from=cert /kool/ssl /kool/ssl | ||
| RUN chmod +x /kool/entrypoint | ||
|
|
||
| EXPOSE 80 | ||
|
|
||
| CMD [ "supervisord", "-c", "/kool/supervisor.conf" ] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| server { | ||
| listen {{ .Env.NGINX_LISTEN }} default_server; | ||
| server_name _; | ||
| {{ if isTrue .Env.NGINX_HTTPS }} | ||
| listen {{ .Env.NGINX_LISTEN_HTTPS }} ssl http2; | ||
| ssl_certificate {{ .Env.NGINX_HTTPS_CERT }}; | ||
| ssl_certificate_key {{ .Env.NGINX_HTTPS_CERT_KEY }}; | ||
| ssl_protocols TLSv1.2 TLSv1.3; | ||
| ssl_ciphers HIGH:!aNULL:!MD5; | ||
| {{ end }} | ||
| root {{ .Env.NGINX_ROOT }}; | ||
| index {{ .Env.NGINX_INDEX }}; | ||
| charset utf-8; | ||
|
|
||
| location = /favicon.ico { log_not_found off; access_log off; } | ||
| location = /robots.txt { log_not_found off; access_log off; } | ||
|
|
||
| client_max_body_size {{ .Env.NGINX_CLIENT_MAX_BODY_SIZE }}; | ||
|
|
||
| error_page 404 /index.php; | ||
|
|
||
| location / { | ||
| try_files $uri /{{ .Env.NGINX_INDEX }}?$query_string; | ||
| } | ||
|
|
||
| location ~ \.php$ { | ||
| fastcgi_buffers {{ .Env.NGINX_FASTCGI_BUFFERS }}; | ||
| fastcgi_buffer_size {{ .Env.NGINX_FASTCGI_BUFFER_SIZE }}; | ||
| fastcgi_pass {{ .Env.NGINX_PHP_FPM }}; | ||
| fastcgi_read_timeout {{ .Env.NGINX_FASTCGI_READ_TIMEOUT }}; | ||
| fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; | ||
| include fastcgi_params; | ||
| } | ||
|
|
||
| location ~ /\.ht { | ||
| deny all; | ||
| } | ||
|
|
||
| # good practices | ||
| add_header X-Frame-Options "SAMEORIGIN"; | ||
|
|
||
| # basic H5BP suggestions | ||
| include h5bp/security/referrer-policy.conf; | ||
| include h5bp/security/x-content-type-options.conf; | ||
| include h5bp/cross-origin/requests.conf; | ||
|
|
||
| # performance enhancements (mostly for caching static data) | ||
| include h5bp/web_performance/cache-file-descriptors.conf; | ||
| include h5bp/web_performance/compression.conf; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/bin/bash | ||
| set -e | ||
|
|
||
| if [ "$ENABLE_XDEBUG" = "true" ]; then | ||
| if ! docker-php-ext-enable xdebug >> /dev/null 2>&1; then | ||
| echo "[ERROR] An error happened enabling xdebug" | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| # Run as current user | ||
| CURRENT_USER=${ASUSER:-${UID:-0}} | ||
|
|
||
| if [ ! -z "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then | ||
| usermod -u $CURRENT_USER kool | ||
| fi | ||
|
|
||
| dockerize -template /kool/kool.tmpl:/usr/local/etc/php/conf.d/kool.ini -template /kool/zz-docker.tmpl:/usr/local/etc/php-fpm.d/zz-docker.conf -template /kool/default.tmpl:/etc/nginx/conf.d/default.conf | ||
|
|
||
| /kool/30-tune-worker-processes.sh | ||
|
|
||
| # Run entrypoint if provided | ||
| if [ ! -z "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then | ||
| bash $ENTRYPOINT | ||
| fi | ||
|
|
||
| if [ "$1" = "sh" ] || [ "$1" = "bash" ] || [ "$1" = "php-fpm" ] || [ "$1" = "nginx" ] || [ "$1" = "supervisord" ]; then | ||
| exec "$@" | ||
| else | ||
| exec gosu kool "$@" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| [supervisord] | ||
| logfile=/dev/stdout | ||
| logfile_maxbytes=0 | ||
| pidfile=/run/supervisord.pid | ||
| nodaemon=true | ||
|
|
||
| [program:php-fpm] | ||
| command = php-fpm | ||
| priority = 10 | ||
| autorestart = true | ||
| stopasgroup = true | ||
| killasgroup = true | ||
| stderr_logfile = /dev/stderr | ||
| stdout_logfile = /dev/stdout | ||
| stderr_logfile_maxbytes = 0 | ||
| stdout_logfile_maxbytes = 0 | ||
|
|
||
| [program:nginx] | ||
| command = nginx -g "daemon off;" | ||
| priority = 20 | ||
| autorestart = true | ||
| stopasgroup = true | ||
| killasgroup = true | ||
| stderr_logfile = /dev/stderr | ||
| stdout_logfile = /dev/stdout | ||
| stderr_logfile_maxbytes = 0 | ||
| stdout_logfile_maxbytes = 0 |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These commands pull Nginx configuration files from a third-party GitHub repository using
wgetand extract them without integrity verification. A compromised or malicious archive could alter the bundled Nginx configuration in unsafe ways in this production image. Use a pinned, trusted artifact and verify its checksum or signature before unpacking.