amacocian/monica
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

docs: update docker doc (#4408)

Browse Source
This commit is contained in:
Alexis Saettler
2020-09-04 07:53:07 +02:00
committed by GitHub
parent 2c554d6db4
commit 23856439c7
37 changed files with 32 additions and 2025 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/docker/.examples/nginx-proxy-self-signed-ssl/docker-compose.yml
-121
View File
@@ -1,121 +0,0 @@
# Run Monica with a self-signed-ssl certificate
#
# You might want to set these variables in you .env file:
#
#- APP_ENV=production
#- APP_URL with your domain (https scheme)
#- APP_TRUSTED_PROXIES=*
#
#- DB_HOST=db
# See `db` container for these values:
#- DB_DATABASE=monica
#- DB_USERNAME=homestead
#- DB_PASSWORD=secret
#
# To use redis:
#- REDIS_HOST=redis
#- CACHE_DRIVER=redis
#- QUEUE_DRIVER=redis
#
version: "3.4"
services:
app:
image: monicahq/monicahq:fpm
env_file: .env
volumes:
- data:/var/www/monica/storage
restart: always
depends_on:
- db
- redis
db:
image: mysql:5.7
environment:
- MYSQL_RANDOM_ROOT_PASSWORD=true
- MYSQL_DATABASE=monica
- MYSQL_USER=homestead
- MYSQL_PASSWORD=secret
volumes:
- db:/var/lib/mysql
restart: always
redis:
image: redis:alpine
restart: always
cron:
image: monicahq/monicahq:fpm
env_file: .env
restart: always
volumes:
- data:/var/www/monica/storage
command: cron.sh
depends_on:
- db
- redis
queue:
image: monicahq/monicahq:fpm
env_file: .env
restart: always
volumes:
- data:/var/www/monica/storage
command: queue.sh
depends_on:
- db
- redis
web:
build: ./web
restart: always
environment:
- VIRTUAL_HOST=monica.local
volumes:
- data:/var/www/monica/storage:ro
depends_on:
- app
networks:
- proxy-tier
- default
proxy:
build: ./proxy
restart: always
ports:
- 80:80
- 443:443
volumes:
- certs:/etc/nginx/certs:ro
- /var/run/docker.sock:/tmp/docker.sock:ro
networks:
- proxy-tier
depends_on:
- omgwtfssl
omgwtfssl:
image: paulczar/omgwtfssl
restart: "no"
volumes:
- certs:/certs
environment:
- SSL_SUBJECT=monica.local
- CA_SUBJECT=my@example.com
- SSL_KEY=/certs/monica.local.key
- SSL_CSR=/certs/monica.local.csr
- SSL_CERT=/certs/monica.local.crt
networks:
- proxy-tier
volumes:
data:
name: data
db:
name: db
certs:
name: certs
networks:
proxy-tier:
scripts/docker/.examples/nginx-proxy-self-signed-ssl/proxy/Dockerfile
-3
View File
@@ -1,3 +0,0 @@
FROM jwilder/nginx-proxy:alpine
COPY vhost.conf /etc/nginx/vhost.d/default
scripts/docker/.examples/nginx-proxy-self-signed-ssl/proxy/vhost.conf
-2
View File
@@ -1,2 +0,0 @@
client_max_body_size 10G;
server_tokens off;
scripts/docker/.examples/nginx-proxy-self-signed-ssl/web/Dockerfile
-9
View File
@@ -1,9 +0,0 @@
FROM monicahq/monicahq:fpm AS monica
FROM nginx:alpine
COPY nginx.conf /etc/nginx/nginx.conf
# Copy content of monica image
COPY --from=monica /var/www/monica /var/www/monica
RUN ln -sf /var/www/monica/storage/app/public /var/www/monica/public/storage
scripts/docker/.examples/nginx-proxy-self-signed-ssl/web/nginx.conf
-161
View File
@@ -1,161 +0,0 @@
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
real_ip_header X-Real-IP;
# Connect to app service
upstream php-handler {
server app:9000;
}
server {
listen 80;
server_name monica;
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
root /var/www/monica/public;
index index.html index.htm index.php;
charset utf-8;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ~ ^/(?:robots.txt|security.txt) {
allow all;
log_not_found off;
access_log off;
}
error_page 404 500 502 503 504 /index.php;
location ~ /\.well-known/(?:carddav|caldav) {
return 301 $scheme://$host/dav;
}
location = /.well-known/security.txt {
return 301 $scheme://$host/security.txt;
}
location ~ /\.(?!well-known).* {
deny all;
}
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location ~ \.php$ {
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
fastcgi_pass php-handler;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|json)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# Note it is intended to have those duplicated to the ones above.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to assets
access_log off;
}
# deny access to .htaccess files
location ~ /\.ht {
deny all;
}
}
}
scripts/docker/.examples/nginx-proxy/docker-compose.yml
-127
View File
@@ -1,127 +0,0 @@
# Run Monica with Let's Encrypt certificate
#
# You might want to set these variables in you .env file:
#
#- APP_ENV=production
#- APP_URL with your domain (https scheme)
#
#- DB_HOST=db
# See `db` container for these values:
#- DB_DATABASE=monica
#- DB_USERNAME=homestead
#- DB_PASSWORD=secret
#
# To use redis:
#- REDIS_HOST=redis
#- CACHE_DRIVER=redis
#- QUEUE_CONNECTION=redis
#
version: "3.4"
services:
app:
image: monicahq/monicahq:fpm
env_file: .env
volumes:
- data:/var/www/monica/storage
restart: always
depends_on:
- db
- redis
db:
image: mysql:5.7
environment:
- MYSQL_RANDOM_ROOT_PASSWORD=true
- MYSQL_DATABASE=monica
- MYSQL_USER=homestead
- MYSQL_PASSWORD=secret
volumes:
- mysql:/var/lib/mysql
restart: always
redis:
image: redis:alpine
restart: always
cron:
image: monicahq/monicahq:fpm
env_file: .env
restart: always
volumes:
- data:/var/www/monica/storage
command: cron.sh
depends_on:
- db
- redis
queue:
image: monicahq/monicahq:fpm
env_file: .env
restart: always
volumes:
- data:/var/www/monica/storage
command: queue.sh
depends_on:
- db
- redis
web:
build: ./web
restart: always
environment:
- VIRTUAL_HOST=
- LETSENCRYPT_HOST=
- LETSENCRYPT_EMAIL=
volumes:
- data:/var/www/monica/storage:ro
depends_on:
- app
networks:
- proxy-tier
- default
proxy:
build: ./proxy
restart: always
ports:
- 80:80
- 443:443
labels:
com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
volumes:
- certs:/etc/nginx/certs:ro
- vhost.d:/etc/nginx/vhost.d
- html:/usr/share/nginx/html
- /var/run/docker.sock:/tmp/docker.sock:ro
networks:
- proxy-tier
letsencrypt-companion:
image: jrcs/letsencrypt-nginx-proxy-companion
restart: always
volumes:
- certs:/etc/nginx/certs
- vhost.d:/etc/nginx/vhost.d
- html:/usr/share/nginx/html
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- proxy-tier
depends_on:
- proxy
volumes:
data:
name: data
mysql:
name: mysql
certs:
name: certs
vhost.d:
name: vhost.d
html:
name: html
networks:
proxy-tier:
scripts/docker/.examples/nginx-proxy/proxy/Dockerfile
-3
View File
@@ -1,3 +0,0 @@
FROM jwilder/nginx-proxy:alpine
COPY vhost.conf /etc/nginx/vhost.d/default
scripts/docker/.examples/nginx-proxy/proxy/vhost.conf
-2
View File
@@ -1,2 +0,0 @@
client_max_body_size 10G;
server_tokens off;
scripts/docker/.examples/nginx-proxy/web/Dockerfile
-9
View File
@@ -1,9 +0,0 @@
FROM monicahq/monicahq:fpm AS monica
FROM nginx:alpine
COPY nginx.conf /etc/nginx/nginx.conf
# Copy content of monica image
COPY --from=monica /var/www/monica /var/www/monica
RUN ln -sf /var/www/monica/storage/app/public /var/www/monica/public/storage
scripts/docker/.examples/nginx-proxy/web/nginx.conf
-161
View File
@@ -1,161 +0,0 @@
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
real_ip_header X-Real-IP;
# Connect to app service
upstream php-handler {
server app:9000;
}
server {
listen 80;
server_name monica;
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
root /var/www/monica/public;
index index.html index.htm index.php;
charset utf-8;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ~ ^/(?:robots.txt|security.txt) {
allow all;
log_not_found off;
access_log off;
}
error_page 404 500 502 503 504 /index.php;
location ~ /\.well-known/(?:carddav|caldav) {
return 301 $scheme://$host/dav;
}
location = /.well-known/security.txt {
return 301 $scheme://$host/security.txt;
}
location ~ /\.(?!well-known).* {
deny all;
}
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location ~ \.php$ {
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
fastcgi_pass php-handler;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|json)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# Note it is intended to have those duplicated to the ones above.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to assets
access_log off;
}
# deny access to .htaccess files
location ~ /\.ht {
deny all;
}
}
}
scripts/docker/.examples/readme.md
-65
View File
@@ -1,65 +0,0 @@
# Docker examples for Monica
In this section you will find some examples about how to use monica's docker images.
Example|Description
-------|-----------
[`supervisor`](supervisor)| uses supervisor to run a cron and a queue inside your container.
[`nginx-proxy-self-signed-ssl`](nginx-proxy-self-signed-ssl)| shows you how to run monica with a self signed ssl certificate.
[`nginx-proxy`](nginx-proxy)| shows you how to run monica with https and generate a [Let's Encrypt](https://letsencrypt.org/) certificate.
## Run with docker-compose
### Configuration (all versions)
First, download a copy of Monica example configuration file:
```sh
curl -sS https://raw.githubusercontent.com/monicahq/monica/master/.env.example -o .env
```
Open the file in an editor and update it for your own needs:
- Set `APP_KEY` to a random 32-character string. For example, if you
have the `pwgen` utility installed, you could copy and paste the
output of `pwgen -s 32 1`.
- Edit the `MAIL_*` settings to point to your own [mailserver](/docs/installation/mail.md).
- Set `DB_*` settings to point to your database configuration. If you don't want to set a db prefix, be careful to set `DB_PREFIX=` and not `DB_PREFIX=''` as docker will not expand this as an empty string.
- Set `DB_HOST=db` or any name of the database container you will link to.
### With supervisor
The [`supervisor`](supervisor) examples shows you how to run monica with
- a db container (mysql:5.7)
- an app container, which run `supervisord` to handle a web server/fpm, a cron, and a queue.
This let you use `QUEUE_CONNECTION=database` in your `.env` file.
### With nginx proxy and a self-signed certificate
[`nginx-proxy-self-signed-ssl`](nginx-proxy-self-signed-ssl) example shows you how to run monica with a self signed ssl certificate, to run the application in `https` mode.
Set `VIRTUAL_HOST` and `SSL_SUBJECT` with the right domain name, and update `SSL_KEY`, `SSL_CSR`, and `SSL_CERT` accordingly.
This example generates a new self-signed certificate.
Your browser might warn you about security issue, as a self-signed certificate is not trusted in production mode. For a real domain certificate, see the next section.
### With nginx proxy and a Let's Encrypt certificate
[`nginx-proxy`](nginx-proxy) example shows you how to run monica and generate a [Let's Encrypt](https://letsencrypt.org/) certificate for your domain.
Don't forget to set:
- `VIRTUAL_HOST` and `LETSENCRYPT_HOST` with your domain
- `LETSENCRYPT_EMAIL` with a valid email
- `APP_URL` in your `.env` file with the right domain url
You may want to set `APP_ENV=production` to force the use of `https` scheme.
This example add a `redis` container, that can be used too, adding these variables to your `.env` file:
- `REDIS_HOST=redis`: mandatory
- `CACHE_DRIVER=redis`: to use redis as a cache table
- `QUEUE_CONNECTION=redis`: to use redis as a queue table
scripts/docker/.examples/supervisor/apache/app/Dockerfile
-4
View File
@@ -1,4 +0,0 @@
FROM monicahq/monicahq:apache
COPY supervisord.conf /etc/supervisord.conf
CMD ["supervisord", "-c", "/etc/supervisord.conf"]
scripts/docker/.examples/supervisor/apache/app/supervisord.conf
-30
View File
@@ -1,30 +0,0 @@
[supervisord]
nodaemon=true
user=root
[program:cron]
command=/usr/sbin/crond -f -l 0
autostart=true
autorestart=true
[program:queue]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/monica/artisan queue:work --sleep=10 --timeout=0 --tries=3 --queue=default,migration
numprocs=1
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
startretries=0
[program:httpd]
process_name=%(program_name)s_%(process_num)02d
command=/usr/local/bin/apache2-foreground
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
scripts/docker/.examples/supervisor/apache/docker-compose.yml
-30
View File
@@ -1,30 +0,0 @@
version: "3.4"
services:
app:
build: ./app
depends_on:
- db
env_file: .env
ports:
- 80:80
volumes:
- data:/var/www/monica/storage
restart: always
db:
image: mysql:5.7
environment:
- MYSQL_RANDOM_ROOT_PASSWORD=true
- MYSQL_DATABASE=monica
- MYSQL_USER=homestead
- MYSQL_PASSWORD=secret
volumes:
- mysql:/var/lib/mysql
restart: always
volumes:
data:
name: data
mysql:
name: mysql
scripts/docker/.examples/supervisor/fpm/app/Dockerfile
-4
View File
@@ -1,4 +0,0 @@
FROM monicahq/monicahq:fpm
COPY supervisord.conf /etc/supervisord.conf
CMD ["supervisord", "-c", "/etc/supervisord.conf"]
scripts/docker/.examples/supervisor/fpm/app/supervisord.conf
-30
View File
@@ -1,30 +0,0 @@
[supervisord]
nodaemon=true
user=root
[program:cron]
command=/usr/sbin/crond -f -l 0
autostart=true
autorestart=true
[program:queue]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/monica/artisan queue:work --sleep=10 --timeout=0 --tries=3 --queue=default,migration
numprocs=1
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
startretries=0
[program:fpm]
process_name=%(program_name)s_%(process_num)02d
command=/usr/sbin/php-fpm7
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
scripts/docker/.examples/supervisor/fpm/docker-compose.yml
-38
View File
@@ -1,38 +0,0 @@
version: "3.4"
services:
app:
build: ./app
depends_on:
- db
env_file: .env
volumes:
- data:/var/www/monica/storage
restart: always
web:
build: ./web
restart: always
ports:
- 80:80
volumes:
- data:/var/www/monica/storage:ro
depends_on:
- app
db:
image: mysql:5.7
environment:
- MYSQL_RANDOM_ROOT_PASSWORD=true
- MYSQL_DATABASE=monica
- MYSQL_USER=homestead
- MYSQL_PASSWORD=secret
volumes:
- mysql:/var/lib/mysql
restart: always
volumes:
data:
name: data
mysql:
name: mysql
scripts/docker/.examples/supervisor/fpm/web/Dockerfile
-9
View File
@@ -1,9 +0,0 @@
FROM monicahq/monicahq:fpm AS monica
FROM nginx:alpine
COPY nginx.conf /etc/nginx/nginx.conf
# Copy content of monica image
COPY --from=monica /var/www/monica /var/www/monica
RUN ln -sf /var/www/monica/storage/app/public /var/www/monica/public/storage
scripts/docker/.examples/supervisor/fpm/web/nginx.conf
-161
View File
@@ -1,161 +0,0 @@
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
real_ip_header X-Real-IP;
# Connect to app service
upstream php-handler {
server app:9000;
}
server {
listen 80;
server_name monica;
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
root /var/www/monica/public;
index index.html index.htm index.php;
charset utf-8;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ~ ^/(?:robots.txt|security.txt) {
allow all;
log_not_found off;
access_log off;
}
error_page 404 500 502 503 504 /index.php;
location ~ /\.well-known/(?:carddav|caldav) {
return 301 $scheme://$host/dav;
}
location = /.well-known/security.txt {
return 301 $scheme://$host/security.txt;
}
location ~ /\.(?!well-known).* {
deny all;
}
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location ~ \.php$ {
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
fastcgi_pass php-handler;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|json)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
## HSTS ##
# Add the 'Strict-Transport-Security' headers to enable HSTS protocol.
# Note it is intended to have those duplicated to the ones above.
# WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/.
# This form will add the domain to a hardcoded list that is shipped in all major browsers and getting
# removed from this list could take several months.
#
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to assets
access_log off;
}
# deny access to .htaccess files
location ~ /\.ht {
deny all;
}
}
}
scripts/docker/.examples/supervisor/php-apache/app/Dockerfile
-4
View File
@@ -1,4 +0,0 @@
FROM monicahq/monicahq:php-apache
COPY supervisord.conf /etc/supervisord.conf
CMD ["supervisord", "-c", "/etc/supervisord.conf"]
scripts/docker/.examples/supervisor/php-apache/app/supervisord.conf
-30
View File
@@ -1,30 +0,0 @@
[supervisord]
nodaemon=true
user=root
[program:cron]
command=/usr/sbin/cron -f -L 0
autostart=true
autorestart=true
[program:queue]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/monica/artisan queue:work --sleep=10 --timeout=0 --tries=3 --queue=default,migration
numprocs=1
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
startretries=0
[program:apache]
process_name=%(program_name)s_%(process_num)02d
command=/usr/local/bin/apache2-foreground
stdout_logfile=/proc/1/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/proc/1/fd/2
stderr_logfile_maxbytes=0
autostart=true
autorestart=true
scripts/docker/.examples/supervisor/php-apache/docker-compose.yml
-30
View File
@@ -1,30 +0,0 @@
version: "3.4"
services:
app:
build: ./app
depends_on:
- db
env_file: .env
ports:
- 80:80
volumes:
- data:/var/www/monica/storage
restart: always
db:
image: mysql:5.7
environment:
- MYSQL_RANDOM_ROOT_PASSWORD=true
- MYSQL_DATABASE=monica
- MYSQL_USER=homestead
- MYSQL_PASSWORD=secret
volumes:
- mysql:/var/lib/mysql
restart: always
volumes:
data:
name: data
mysql:
name: mysql
scripts/docker/apache/Dockerfile
-164
View File
@@ -1,164 +0,0 @@
FROM alpine:latest
# Build-time metadata as defined at http://label-schema.org
ARG BUILD_DATE
ARG VCS_REF
ARG COMMIT
ARG VERSION
LABEL org.label-schema.build-date=$BUILD_DATE \
org.label-schema.name="MonicaHQ, the Personal Relationship Manager" \
org.label-schema.description="This is MonicaHQ, your personal memory! MonicaHQ is like a CRM but for the friends, family, and acquaintances around you." \
org.label-schema.url="https://monicahq.com" \
org.label-schema.vcs-ref=$VCS_REF \
org.label-schema.vcs-url="https://github.com/monicahq/monica" \
org.label-schema.vendor="Monica" \
org.label-schema.version=$VERSION \
org.label-schema.schema-version="1.0"
RUN set -ex; \
\
apk update; \
apk upgrade; \
apk add --virtual .build-deps \
curl openssl bash \
; \
apk add supervisor netcat-openbsd rsync \
#- base
php7 php7-intl php7-openssl php7-ctype \
php7-zip php7-zlib php7-opcache \
php7-redis \
#- Authentication Guards
php7-session php7-tokenizer \
#- laravel/cashier sabre/vobject sabre/xml
php7-dom \
#- intervention/image
php7-fileinfo \
#- laravel/cashier
php7-gd \
#- composer
php7-phar php7-json php7-iconv \
#- laravel/framework sabre/vobject
php7-mbstring \
#- league/flysystem-aws-s3-v3
php7-simplexml \
#- sabre/vobject sabre/xml
php7-xml php7-xmlreader php7-xmlwriter \
#- mysql
php7-mysqli php7-pdo_mysql \
#- pgsql
php7-pgsql php7-pdo_pgsql \
#- vinkla/hashids
php7-bcmath \
#- sentry/sentry
php7-curl \
#- cbor-php (webauthn)
php7-gmp \
#- web-token/jwt-signature-algorithm-eddsa
php7-sodium \
#- bacon/bacon-qr-code
php7-imagick
# Create a user to own all the code and assets and give them a working
# directory
RUN set -ex; \
\
mkdir -p /var/www/monica; \
grep -q apache /etc/group || addgroup -S apache; \
adduser -D monica apache -h /var/www/monica
WORKDIR /var/www/monica
# Copy the local (outside Docker) source into the working directory,
# copy system files into their proper homes, and set file ownership
# correctly
COPY --chown=monica:monica \
readme.md \
CONTRIBUTING.md \
CHANGELOG.md \
CONTRIBUTORS \
LICENSE \
artisan \
composer.json \
composer.lock \
./
COPY --chown=monica:monica app ./app
COPY --chown=monica:monica bootstrap ./bootstrap
COPY --chown=monica:monica config ./config
COPY --chown=monica:monica database ./database
COPY --chown=monica:monica public ./public
COPY --chown=monica:monica resources ./resources
COPY --chown=monica:monica routes ./routes
RUN set -ex; \
\
mkdir -p bootstrap/cache; \
mkdir -p storage; \
chown -R monica:apache bootstrap/cache storage; \
chmod -R g+w bootstrap/cache storage
COPY --chown=monica:monica .env.example .env
# Php
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="0" \
PHP_OPCACHE_MAX_ACCELERATED_FILES="20000" \
PHP_OPCACHE_MEMORY_CONSUMPTION="192" \
PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
COPY scripts/docker/opcache.ini /usr/php7/conf.d/opcache.ini
# Sentry
RUN set -ex; \
\
echo $VCS_REF > .sentry-release; \
echo $COMMIT > .sentry-commit; \
mkdir -p /root/.local/bin; \
curl -sL https://sentry.io/get-cli/ | INSTALL_DIR=/root/.local/bin bash
# Composer installation
COPY scripts/docker/install-composer.sh /usr/local/sbin/
RUN install-composer.sh
# Install composer dependencies
USER monica
RUN set -ex; \
\
composer global require hirak/prestissimo; \
mkdir -p storage/framework/views; \
composer install --no-interaction --no-suggest --no-progress --no-dev --ignore-platform-reqs; \
composer global remove hirak/prestissimo; \
\
composer clear-cache; \
rm -rf .composer
USER root
# Set crontab for schedules
RUN set -ex; \
\
cd /etc/periodic/hourly/; \
{ \
echo '#!/bin/sh'; \
echo '/usr/bin/php /var/www/monica/artisan schedule:run -v > /proc/1/fd/1 2> /proc/1/fd/2'; \
} | tee monica; \
chmod a+x monica
# Cleanup
RUN set -ex; \
\
apk del .build-deps; \
rm -rf /var/cache/apk/*
COPY scripts/docker/entrypoint.sh \
scripts/docker/cron.sh \
scripts/docker/queue.sh \
/usr/local/bin/
ENTRYPOINT ["entrypoint.sh"]
# Apache2
RUN apk add apache2 php7-apache2
COPY scripts/docker/apache2-foreground /usr/local/bin/
COPY scripts/docker/000-default.conf /etc/apache2/conf.d/
RUN echo 'LoadModule rewrite_module modules/mod_rewrite.so' > /etc/apache2/conf.d/rewrite.conf; \
echo 'ServerName "monica"' > /etc/apache2/conf.d/hostname.conf
EXPOSE 80
CMD ["apache2-foreground"]
scripts/docker/fpm/Dockerfile
-177
View File
@@ -1,177 +0,0 @@
FROM alpine:latest
# Build-time metadata as defined at http://label-schema.org
ARG BUILD_DATE
ARG VCS_REF
ARG COMMIT
ARG VERSION
LABEL org.label-schema.build-date=$BUILD_DATE \
org.label-schema.name="MonicaHQ, the Personal Relationship Manager" \
org.label-schema.description="This is MonicaHQ, your personal memory! MonicaHQ is like a CRM but for the friends, family, and acquaintances around you." \
org.label-schema.url="https://monicahq.com" \
org.label-schema.vcs-ref=$VCS_REF \
org.label-schema.vcs-url="https://github.com/monicahq/monica" \
org.label-schema.vendor="Monica" \
org.label-schema.version=$VERSION \
org.label-schema.schema-version="1.0"
RUN set -ex; \
\
apk update; \
apk upgrade; \
apk add --virtual .build-deps \
curl openssl bash \
; \
apk add supervisor netcat-openbsd rsync \
#- base
php7 php7-intl php7-openssl php7-ctype \
php7-zip php7-zlib php7-opcache \
php7-redis \
#- Authentication Guards
php7-session php7-tokenizer \
#- laravel/cashier sabre/vobject sabre/xml
php7-dom \
#- intervention/image
php7-fileinfo \
#- laravel/cashier
php7-gd \
#- composer
php7-phar php7-json php7-iconv \
#- laravel/framework sabre/vobject
php7-mbstring \
#- league/flysystem-aws-s3-v3
php7-simplexml \
#- sabre/vobject sabre/xml
php7-xml php7-xmlreader php7-xmlwriter \
#- mysql
php7-mysqli php7-pdo_mysql \
#- pgsql
php7-pgsql php7-pdo_pgsql \
#- vinkla/hashids
php7-bcmath \
#- sentry/sentry
php7-curl \
#- cbor-php (webauthn)
php7-gmp \
#- web-token/jwt-signature-algorithm-eddsa
php7-sodium \
#- bacon/bacon-qr-code
php7-imagick
# Create a user to own all the code and assets and give them a working
# directory
RUN set -ex; \
\
mkdir -p /var/www/monica; \
grep -q apache /etc/group || addgroup -S apache; \
adduser -D monica apache -h /var/www/monica
WORKDIR /var/www/monica
# Copy the local (outside Docker) source into the working directory,
# copy system files into their proper homes, and set file ownership
# correctly
COPY --chown=monica:monica \
readme.md \
CONTRIBUTING.md \
CHANGELOG.md \
CONTRIBUTORS \
LICENSE \
artisan \
composer.json \
composer.lock \
./
COPY --chown=monica:monica app ./app
COPY --chown=monica:monica bootstrap ./bootstrap
COPY --chown=monica:monica config ./config
COPY --chown=monica:monica database ./database
COPY --chown=monica:monica public ./public
COPY --chown=monica:monica resources ./resources
COPY --chown=monica:monica routes ./routes
RUN set -ex; \
\
mkdir -p bootstrap/cache; \
mkdir -p storage; \
chown -R monica:apache bootstrap/cache storage; \
chmod -R g+w bootstrap/cache storage
COPY --chown=monica:monica .env.example .env
# Php
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="0" \
PHP_OPCACHE_MAX_ACCELERATED_FILES="20000" \
PHP_OPCACHE_MEMORY_CONSUMPTION="192" \
PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
COPY scripts/docker/opcache.ini /usr/php7/conf.d/opcache.ini
# Composer installation
COPY scripts/docker/install-composer.sh /usr/local/sbin/
RUN install-composer.sh
# Install composer dependencies
USER monica
RUN set -ex; \
\
composer global require hirak/prestissimo; \
mkdir -p storage/framework/views; \
composer install --no-interaction --no-suggest --no-progress --no-dev --ignore-platform-reqs; \
composer global remove hirak/prestissimo; \
\
composer clear-cache; \
rm -rf .composer
USER root
# Set crontab for schedules
RUN set -ex; \
\
cd /etc/periodic/hourly/; \
{ \
echo '#!/bin/sh'; \
echo '/usr/bin/php /var/www/monica/artisan schedule:run -v > /proc/1/fd/2 2> /proc/1/fd/2'; \
} | tee monica; \
chmod a+x monica
# Cleanup
RUN set -ex; \
\
apk del .build-deps; \
rm -rf /var/cache/apk/*
COPY scripts/docker/entrypoint.sh \
scripts/docker/cron.sh \
scripts/docker/queue.sh \
/usr/local/bin/
ENTRYPOINT ["entrypoint.sh"]
# FPM
RUN apk add php7-fpm
RUN set -ex; \
\
cd /etc/php7/php-fpm.d; \
{ \
echo '[global]'; \
echo 'error_log = /proc/1/fd/2'; \
echo; \
echo '[www]'; \
echo 'access.log = /proc/1/fd/2'; \
echo 'catch_workers_output = yes'; \
echo 'clear_env = no'; \
} | tee docker.conf; \
\
{ \
echo '[global]'; \
echo 'daemonize = no'; \
echo; \
echo '[www]'; \
echo 'group = apache'; \
echo 'listen = 9000'; \
} | tee zz-docker.conf
# Override stop signal to stop process gracefully
# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
STOPSIGNAL SIGQUIT
EXPOSE 9000
CMD ["php-fpm7"]
scripts/docker/php-apache/Dockerfile
-186
View File
@@ -1,186 +0,0 @@
FROM php:7.3-apache
# Build-time metadata as defined at http://label-schema.org
ARG BUILD_DATE
ARG VCS_REF
ARG COMMIT
ARG VERSION
LABEL org.label-schema.build-date=$BUILD_DATE \
org.label-schema.name="MonicaHQ, the Personal Relationship Manager" \
org.label-schema.description="This is MonicaHQ, your personal memory! MonicaHQ is like a CRM but for the friends, family, and acquaintances around you." \
org.label-schema.url="https://monicahq.com" \
org.label-schema.vcs-ref=$VCS_REF \
org.label-schema.vcs-url="https://github.com/monicahq/monica" \
org.label-schema.vendor="Monica" \
org.label-schema.version=$VERSION \
org.label-schema.schema-version="1.0"
RUN set -ex; \
\
apt-get update; \
apt-get -y --no-install-recommends install \
git cron netcat apt apt-transport-https \
locales sudo openssh-client ca-certificates \
curl unzip zip tar bzip2 supervisor rsync \
; \
mkdir /var/log/supervisord /var/run/supervisord; \
rm -rf /var/lib/apt/lists/*
# Install common extensions
RUN set -ex; \
\
apt-get update; \
apt-get -y autoremove; \
apt-get -y --no-install-recommends install \
libicu-dev \
zlib1g-dev \
libzip-dev \
libpng-dev \
libxml2-dev \
libfreetype6-dev \
libjpeg62-turbo-dev \
libgmp-dev \
libsodium-dev \
libmagickwand-dev \
; \
docker-php-ext-configure intl; \
docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/; \
docker-php-ext-install -j$(nproc) \
intl \
zip \
json \
iconv \
bcmath \
gd \
gmp \
pdo_mysql \
mysqli \
soap \
sodium \
mbstring \
opcache \
; \
\
printf "\n" | pecl install imagick ; \
docker-php-ext-enable imagick ; \
\
apt-get -y remove \
icu-devtools \
libicu-dev \
zlib1g-dev \
libzip-dev \
libpng-dev \
libxml2-dev \
libfreetype6-dev \
libjpeg62-turbo-dev \
libgmp-dev \
libsodium-dev \
libmagickwand-dev \
; \
apt-get -y clean; \
rm -rf /var/lib/apt/lists/*
# Create a user to own all the code and assets and give them a working
# directory
RUN set -ex; \
\
mkdir -p /var/www/monica; \
addgroup --gid 1001 monica; \
adduser --uid 1001 --ingroup monica --home /var/www/monica --shell /bin/bash --no-create-home monica; \
adduser monica www-data; \
chown -R monica:www-data /var/www/monica; \
echo 'monica ALL=NOPASSWD: ALL' >> /etc/sudoers.d/50-monica; \
echo 'Defaults env_keep += "DEBIAN_FRONTEND"' >> /etc/sudoers.d/env_keep
WORKDIR /var/www/monica
# Copy the local (outside Docker) source into the working directory,
# copy system files into their proper homes, and set file ownership
# correctly
COPY --chown=monica:www-data \
readme.md \
CONTRIBUTING.md \
CHANGELOG.md \
CONTRIBUTORS \
LICENSE \
artisan \
composer.json \
composer.lock \
./
COPY --chown=monica:www-data app ./app
COPY --chown=monica:www-data bootstrap ./bootstrap
COPY --chown=monica:www-data config ./config
COPY --chown=monica:www-data database ./database
COPY --chown=monica:www-data public ./public
COPY --chown=monica:www-data resources ./resources
COPY --chown=monica:www-data routes ./routes
RUN set -ex; \
\
mkdir -p bootstrap/cache; \
mkdir -p storage; \
chown -R monica:www-data bootstrap/cache storage; \
chmod -R g+w bootstrap/cache storage
COPY --chown=monica:www-data .env.example .env
# Php
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="0" \
PHP_OPCACHE_MAX_ACCELERATED_FILES="20000" \
PHP_OPCACHE_MEMORY_CONSUMPTION="192" \
PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
COPY scripts/docker/opcache.ini /usr/local/etc/php/conf.d/opcache.ini
# Sentry
RUN set -ex; \
\
echo $VCS_REF > .sentry-release; \
echo $COMMIT > .sentry-commit; \
mkdir -p /root/.local/bin; \
curl -sL https://sentry.io/get-cli/ | INSTALL_DIR=/root/.local/bin bash
# Composer installation
COPY scripts/docker/install-composer.sh /usr/local/sbin/
RUN install-composer.sh
# Install composer dependencies
USER monica
RUN set -ex; \
\
composer global require hirak/prestissimo; \
mkdir -p storage/framework/views; \
composer install --no-interaction --no-suggest --no-progress --no-dev --ignore-platform-reqs; \
composer global remove hirak/prestissimo; \
\
composer clear-cache; \
rm -rf .composer
USER root
# Set crontab for schedules
RUN set -ex; \
\
cd /etc/cron.hourly; \
{ \
echo '#!/bin/sh'; \
echo '/usr/bin/php /var/www/monica/artisan schedule:run -v > /proc/1/fd/1 2> /proc/1/fd/2'; \
} | tee monica; \
chmod a+x monica
COPY scripts/docker/entrypoint.sh \
scripts/docker/php-apache/cron.sh \
scripts/docker/queue.sh \
/usr/local/bin/
RUN sed -ri -e 's!monica:apache!monica:www-data!g' /usr/local/bin/entrypoint.sh
ENTRYPOINT ["entrypoint.sh"]
# Apache2
COPY scripts/docker/000-default.conf /etc/apache2/sites-available/
RUN set -ex; \
\
echo 'ServerName "monica"' > /etc/apache2/conf-available/hostname.conf; \
a2enconf hostname; \
a2enmod rewrite cache headers
EXPOSE 80
CMD ["apache2-foreground"]
scripts/docker/php-apache/cron.sh
-4
View File
@@ -1,4 +0,0 @@
#!/bin/sh
set -eu
/usr/sbin/cron -f -L 0