Revize a60193de

Feature Re #7745 nginx configuration

.vscode/extensions.json

@@ -1 +1 @@
 {
     "recommendations": [
-        "ms-vscode-remote.remote-containers"
+        "ms-vscode-remote.remote-containers",
+        "vscode-icons-team.vscode-icons",
+        "ms-azuretools.vscode-docker",
+        "raynigon.nginx-formatter",
+        "mads-hartmann.bash-ide-vscode",
+        "shakram02.bash-beautify"
     ]
 
 }

.vscode/settings.json

@@ +1 @@
+{
+    "editor.formatOnSave": true
+}

docker-compose-dev.yml

@@ -12 +12 @@
                volumes:
                         - data-db:/data/db
                         - ./dev-dump:/dev-dump
+       nginx: 
+               volumes: 
+                        - ./docker/nginx/sites-dev:/etc/nginx/sites-available
 volumes:
     data-db:
     vscode-extensions-php:

docker-compose-prod.yml

@@ -1 +1 @@
 version: "3.2"
 services:
        database:
-               volumes:
-                        - /database:/data/db
+                volumes:
+                         - /database:/data/db
+       nginx:
+              ports: 
+                     - "443:443"
+              volumes: 
+                     - /etc/letsencrypt:/root/.acme.sh/heatmap.zcu.cz
+                     - ./docker/nginx/sites-dev:/etc/nginx/sites-available

docker-compose.yml

@@ -42 +42 @@
                volumes:
                        - ./logs/nginx:/var/nginx/log
                        - ./website/:/var/www/symfony
+                       - ./docker/nginx/sites:/etc/nginx/sites-available
+
                container_name: "heatmap_nginx"
        database:
                image: 'mongo'

docker/nginx/Dockerfile

@@ -1 +1 @@
 FROM nginx:alpine
 COPY nginx.conf /etc/nginx
 COPY conf.d /etc/nginx/conf.d
-ADD ./sites /etc/nginx/sites-available
+RUN apk add netcat-openbsd bc curl bash wget openssl; \
+    apk add libressl; \
+    wget -O -  https://get.acme.sh | sh;
 WORKDIR /var/www/
 CMD ["nginx"]

docker/nginx/sites-dev/default.conf

@@ +1 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server ipv6only=on;
+
+    server_name localhost;
+    root /var/www/symfony/public;
+    index index.php index.html index.htm;
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    location ~ \.php$ {
+        try_files $uri /index.php =404;
+        fastcgi_pass php-upstream;
+        fastcgi_index index.php;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_read_timeout 600;
+        include fastcgi_params;
+    }
+
+    location ~ /\.ht {
+        deny all;
+    }
+}

docker/nginx/sites/default.conf

@@ -1 +1 @@
 server {
+    listen 443 ssl;
     listen 80 default_server;
     listen [::]:80 default_server ipv6only=on;
 
-    server_name localhost;
+    server_name heatmap.zcu.cz www.heatmap.zcu.cz;
+    ssl_certificate /etc/letsencrypt/heatmap.zcu.cz/heatmap.zcu.cz.cer;
+    ssl_certificate_key /etc/letsencrypt/heatmap.zcu.cz/privkey.key;
+
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+
     root /var/www/symfony/public;
+
     index index.php index.html index.htm;
 
     location / {
-         try_files $uri $uri/ /index.php$is_args$args;
+        try_files $uri $uri/ /index.php$is_args$args;
     }
 
     location ~ \.php$ {

docker/php-fpm/dev/Dockerfile

@@ -1 +1 @@
 #DEV ONLY DOCKERFILE
 FROM php:7.4-fpm-alpine
 RUN apk update; \
-	apk upgrade; \
+    apk upgrade; \
     apk add --no-cache $PHPIZE_DEPS; \
     pecl install xdebug-2.9.5; \
     docker-php-ext-enable xdebug; \
-	apk add autoconf openssl-dev g++ make && \
-	pecl install mongodb && \
-	docker-php-ext-enable mongodb; \
-	apk del --purge autoconf openssl-dev g++ make;
+    apk add autoconf openssl-dev g++ make && \
+    pecl install mongodb && \
+    docker-php-ext-enable mongodb; \
+    apk del --purge autoconf openssl-dev g++ make;
 RUN apk add npm;
 RUN echo "**** install PHP Composer ****\n" && \
     curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer
 RUN rm -rf /usr/local/etc/php/conf.d/docker-php-ext-igbinary.ini;
 RUN rm -fr /usr/local/etc/php/conf.d/docker-php-ext-sodium.ini;
 RUN { \
-        echo '[xdebug]'; \
-        echo "zend_extension=$(find /usr/local/lib/php/extensions/ -name xdebug.so)"; \
-        echo 'xdebug.remote_enable = 1'; \
-        echo 'xdebug.remote_port = 9001'; \
-        echo 'xdebug.remote_autostart = 1'; \
-        echo 'xdebug.remote_connect_back = 0'; \
-        echo 'xdebug.remote_host = localhost'; \
-        echo 'xdebug.idekey = VSCODE'; \
-        echo 'xdebug.remote_log=/var/www/symfony/xdebug/xdebug.log'; \
+    echo '[xdebug]'; \
+    echo "zend_extension=$(find /usr/local/lib/php/extensions/ -name xdebug.so)"; \
+    echo 'xdebug.remote_enable = 1'; \
+    echo 'xdebug.remote_port = 9001'; \
+    echo 'xdebug.remote_autostart = 1'; \
+    echo 'xdebug.remote_connect_back = 0'; \
+    echo 'xdebug.remote_host = localhost'; \
+    echo 'xdebug.idekey = VSCODE'; \
+    echo 'xdebug.remote_log=/var/www/symfony/xdebug/xdebug.log'; \
     } > /usr/local/etc/php/conf.d/php-config.ini

scripts/dev/build.sh

@@ -3 +3 @@
 docker-compose -f docker-compose.yml -f docker-compose-dev.yml up --build -d
 
 cat << "EOF"
- ______  ______  __    __  ______ ______  ______  ______  ______       __  __   __  ______  ______ ______  __      __        
-/\  ___\/\  __ \/\ "-./  \/\  == /\  __ \/\  ___\/\  ___\/\  == \     /\ \/\ "-.\ \/\  ___\/\__  _/\  __ \/\ \    /\ \       
-\ \ \___\ \ \/\ \ \ \-./\ \ \  _-\ \ \/\ \ \___  \ \  __\\ \  __<     \ \ \ \ \-.  \ \___  \/_/\ \\ \  __ \ \ \___\ \ \____  
- \ \_____\ \_____\ \_\ \ \_\ \_\  \ \_____\/\_____\ \_____\ \_\ \_\    \ \_\ \_\\"\_\/\_____\ \ \_\\ \_\ \_\ \_____\ \_____\ 
-  \/_____/\/_____/\/_/  \/_/\/_/   \/_____/\/_____/\/_____/\/_/ /_/     \/_/\/_/ \/_/\/_____/  \/_/ \/_/\/_/\/_____/\/_____/                                                                                                                                                                                                                                                                                                                                                                                                                                      
+ ______  ______  __    __  ______ ______  ______  ______  ______       __  __   __  ______  ______ ______  __      __
+/\  ___\/\  __ \/\ "-./  \/\  == /\  __ \/\  ___\/\  ___\/\  == \     /\ \/\ "-.\ \/\  ___\/\__  _/\  __ \/\ \    /\ \
+\ \ \___\ \ \/\ \ \ \-./\ \ \  _-\ \ \/\ \ \___  \ \  __\\ \  __<     \ \ \ \ \-.  \ \___  \/_/\ \\ \  __ \ \ \___\ \ \____
+ \ \_____\ \_____\ \_\ \ \_\ \_\  \ \_____\/\_____\ \_____\ \_\ \_\    \ \_\ \_\\"\_\/\_____\ \ \_\\ \_\ \_\ \_____\ \_____\
+  \/_____/\/_____/\/_/  \/_/\/_/   \/_____/\/_____/\/_____/\/_/ /_/     \/_/\/_/ \/_/\/_____/  \/_/ \/_/\/_/\/_____/\/_____/
 EOF
 docker-compose exec php-fpm composer config extra.symfony.allow-contrib true --no-interaction --working-dir=/var/www/symfony
 docker-compose exec php-fpm composer update --no-interaction --working-dir=/var/www/symfony
 docker-compose exec php-fpm composer install --no-interaction --working-dir=/var/www/symfony
 
 cat << "EOF"
- ________    ________   _____ ______           ___   ________    ________   _________   ________   ___        ___          
-|\   ___  \ |\   __  \ |\   _ \  _   \        |\  \ |\   ___  \ |\   ____\ |\___   ___\|\   __  \ |\  \      |\  \         
-\ \  \\ \  \\ \  \|\  \\ \  \\\__\ \  \       \ \  \\ \  \\ \  \\ \  \___|_\|___ \  \_|\ \  \|\  \\ \  \     \ \  \        
- \ \  \\ \  \\ \   ____\\ \  \\|__| \  \       \ \  \\ \  \\ \  \\ \_____  \    \ \  \  \ \   __  \\ \  \     \ \  \       
-  \ \  \\ \  \\ \  \___| \ \  \    \ \  \       \ \  \\ \  \\ \  \\|____|\  \    \ \  \  \ \  \ \  \\ \  \____ \ \  \____  
+ ________    ________   _____ ______           ___   ________    ________   _________   ________   ___        ___
+|\   ___  \ |\   __  \ |\   _ \  _   \        |\  \ |\   ___  \ |\   ____\ |\___   ___\|\   __  \ |\  \      |\  \
+\ \  \\ \  \\ \  \|\  \\ \  \\\__\ \  \       \ \  \\ \  \\ \  \\ \  \___|_\|___ \  \_|\ \  \|\  \\ \  \     \ \  \
+ \ \  \\ \  \\ \   ____\\ \  \\|__| \  \       \ \  \\ \  \\ \  \\ \_____  \    \ \  \  \ \   __  \\ \  \     \ \  \
+  \ \  \\ \  \\ \  \___| \ \  \    \ \  \       \ \  \\ \  \\ \  \\|____|\  \    \ \  \  \ \  \ \  \\ \  \____ \ \  \____
    \ \__\\ \__\\ \__\     \ \__\    \ \__\       \ \__\\ \__\\ \__\ ____\_\  \    \ \__\  \ \__\ \__\\ \_______\\ \_______\
     \|__| \|__| \|__|      \|__|     \|__|        \|__| \|__| \|__||\_________\    \|__|   \|__|\|__| \|_______| \|_______|
                                                                    \|_________|
 EOF
-docker-compose exec php-fpm /bin/sh -c 'cd /var/www/symfony && npm install' 
+docker-compose exec php-fpm /bin/sh -c 'cd /var/www/symfony && npm install'

scripts/renew_certificate.sh

@@ +1 @@
+#!/bin/bash
+# Usage
+# if you want create new license run: renew_certificate new
+# if you want re-create the existing license run: renew_certificate
+
+if [ "$1" = "new" ]; then
+    docker-compose exec nginx /bin/sh -c "
+    cd /etc/letsencrypt && mkdir heatmap.zcu.cz && cd heatmap.zcu.cz; \
+    openssl dhparam -dsaparam -out dhparams.pem 4096; \
+    bash /root/.acme.sh/acme.sh --issue -w /var/www/symfony -d heatmap.zcu.cz -k 4096; \
+    bash /root/.acme.sh/acme.sh --installcert -d heatmap.zcu.cz \
+    --key-file /root/.acme.sh/heatmap.zcu.cz/heatmap.zcu.cz.key \
+    --fullchain-file /root/.acme.sh/heatmap.zcu.cz/fullchain.cer \
+    --reloadcmd 'bash /etc/init.d/nginx reload';
+    ";
+else
+    docker-compose exec nginx /bin/sh -c "acme.sh --renew -d heatmap.zcu.cz";
+fi