Skip to content

Commit fc82778

Browse files
zxpowerzxpower
committed
added image building
1 parent f4b297b commit fc82778

File tree

6 files changed

+2210
-0
lines changed

6 files changed

+2210
-0
lines changed

‎Dockerfile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
FROM php:8.4.11-fpm-alpine3.21
2+
3+
RUN apk add -U --no-cache \
4+
nginx \
5+
ca-certificates \
6+
bash \
7+
sed \
8+
curl \
9+
tar \
10+
git \
11+
openssl \
12+
openssh \
13+
libpng-dev \
14+
libjpeg-turbo-dev \
15+
freetype-dev \
16+
libzip-dev \
17+
unzip
18+
19+
RUN docker-php-ext-configure gd --with-freetype --with-jpeg && docker-php-ext-install gd
20+
RUN docker-php-ext-install bcmath ftp mysqli pdo_mysql zip
21+
22+
ENV TERM="xterm" \
23+
PAGER="more" \
24+
DB_HOST="mysql" \
25+
DB_NAME="" \
26+
DB_USER=""\
27+
DB_PASS="" \
28+
PATH="/DATA/bin:$PATH"
29+
30+
COPY files/nginx.conf /etc/nginx/
31+
COPY files/php-fpm.conf /usr/local/etc/
32+
COPY files/php.ini /usr/local/etc/php/
33+
COPY files/run.sh /
34+
RUN chmod +x /run.sh
35+
36+
RUN curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && chmod +x wp-cli.phar && mv wp-cli.phar /usr/bin/wp-cli && chown www-data:www-data /usr/bin/wp-cli
37+
38+
EXPOSE 80
39+
40+
VOLUME ["/DATA"]
41+
42+
WORKDIR /DATA
43+
44+
CMD ["/run.sh"]

‎docker-build.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
docker build --no-cache -t ghcr.io/digiblink/alpine-nginx-php-fpm .

‎files/nginx.conf‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
# run nginx in foreground
2+
daemon off;
3+
error_log /DATA/logs/nginx/error.log warn;
4+
pid /var/run/nginx.pid;
5+
env DB_HOST;
6+
env DB_NAME;
7+
env DB_USER;
8+
env DB_PASS;
9+
worker_processes auto;
10+
events {
11+
worker_connections 4096;
12+
}
13+
http {
14+
sendfile on;
15+
include /etc/nginx/mime.types;
16+
include /etc/nginx/fastcgi.conf;
17+
default_type application/octet-stream;
18+
tcp_nopush on;
19+
client_body_temp_path /tmp/nginx/body 1 2;
20+
client_max_body_size 0;
21+
fastcgi_temp_path /tmp/nginx/fastcgi_temp 1 2;
22+
#a new log format for detecting bad bots.
23+
log_format blocked '$time_local: Blocked request from $http_x_real_ip $request';
24+
## This log format makes it so we can see real requester's IP address \
25+
## not just the reverse proxy server's IP address. Also note, that \
26+
## "specialLog" can be replaced with any name you would like to \
27+
## give to this log format.
28+
log_format specialLog '$http_x_real_ip - $remote_user [$time_local] '
29+
'"$request" $status $body_bytes_sent '
30+
'"$http_referer" "$http_user_agent"';
31+
# client_max_body_size 2G;
32+
server {
33+
#listen [::]:80; #uncomment for IPv6 support
34+
listen 80;
35+
root /DATA/htdocs/current;
36+
index index.php index.html index.htm;
37+
access_log /DATA/logs/nginx/access.log specialLog;
38+
error_log /DATA/logs/nginx/error.log;
39+
disable_symlinks off;
40+
location = /robots.txt {
41+
allow all;
42+
log_not_found off;
43+
access_log off;
44+
}
45+
# deny dot-files
46+
location ~ /\. {
47+
deny all;
48+
access_log off;
49+
log_not_found off;
50+
}
51+
#Yoast SEO Sitemaps
52+
location ~ ([^/]*)sitemap(.*).x(m|s)l$ {
53+
## this redirects sitemap.xml to /sitemap_index.xml
54+
rewrite ^/sitemap.xml$ /sitemap_index.xml permanent;
55+
## this makes the XML sitemaps work
56+
rewrite ^/([a-z]+)?-?sitemap.xsl$ /index.php?xsl=$1 last;
57+
rewrite ^/sitemap_index.xml$ /index.php?sitemap=1 last;
58+
rewrite ^/([^/]+?)-sitemap([0-9]+)?.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
59+
## The following lines are optional for the premium extensions
60+
## News SEO
61+
rewrite ^/news-sitemap.xml$ /index.php?sitemap=wpseo_news last;
62+
## Local SEO
63+
rewrite ^/locations.kml$ /index.php?sitemap=wpseo_local_kml last;
64+
rewrite ^/geo-sitemap.xml$ /index.php?sitemap=wpseo_local last;
65+
## Video SEO
66+
rewrite ^/video-sitemap.xsl$ /index.php?xsl=video last;
67+
}
68+
location / {
69+
try_files $uri $uri/ /index.php?$args;
70+
}
71+
# Deny access to any files with a .php extension in the uploads directory
72+
# Works in sub-directory installs and also in multisite network
73+
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
74+
location ~* /(?:uploads|files)/.*\.php$ {
75+
deny all;
76+
}
77+
## Disable .htaccess and other hidden files
78+
location ~ /\. {
79+
deny all;
80+
access_log off;
81+
log_not_found off;
82+
}
83+
location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
84+
access_log off;
85+
log_not_found off;
86+
expires 360d;
87+
}
88+
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
89+
location ~ [^/]\.php(/|$) {
90+
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
91+
if (!-f $document_root$fastcgi_script_name) {
92+
return 404;
93+
}
94+
fastcgi_pass 127.0.0.1:9000;
95+
fastcgi_index index.php;
96+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
97+
include fastcgi_params;
98+
fastcgi_buffers 16 16k;
99+
fastcgi_buffer_size 32k;
100+
}
101+
## Block SQL injections
102+
location ~* union.*select.*\( { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
103+
location ~* union.*all.*select.* { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
104+
location ~* concat.*\( { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
105+
## Block common exploits
106+
location ~* (<|%3C).*script.*(>|%3E) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
107+
location ~* base64_(en|de)code\(.*\) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
108+
location ~* (%24&x) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
109+
location ~* (%0|%A|%B|%C|%D|%E|%F|127\.0) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
110+
location ~* \.\.\/ { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
111+
location ~* ~$ { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
112+
location ~* proc/self/environ { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
113+
location ~* /\.(htaccess|htpasswd|svn) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
114+
## Block file injections
115+
location ~* [a-zA-Z0-9_]=(\.\.//?)+ { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
116+
location ~* [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
117+
## wordpress security
118+
location ~* wp-config.php { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
119+
location ~* wp-admin/includes { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
120+
location ~* wp-app\.log { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
121+
location ~* (licence|readme|license)\.(html|txt) { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
122+
location ~* xmlrpc.php { access_log /DATA/logs/nginx/blocked.log blocked; deny all; }
123+
# location ~ ^(wp-admin|wp-login.php) {
124+
# try_files $uri $uri/ /index.php?$args;
125+
# index index.html index.htm index.php;
126+
# allow 91.105.68.253; # First IP to allow access
127+
# allow x.x.x.x; # Second IP to allow access
128+
# allow x.x.x.x; # Third IP to allow access
129+
# deny all;
130+
# error_page 403 = @wp_admin_ban;
131+
# }
132+
location @wp_admin_ban {
133+
rewrite ^(.*) http://localhost permanent;
134+
}
135+
gzip on;
136+
gzip_disable "msie6";
137+
gzip_vary on;
138+
gzip_proxied any;
139+
gzip_comp_level 6;
140+
gzip_buffers 16 8k;
141+
gzip_http_version 1.1;
142+
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
143+
}
144+
}

‎files/php-fpm.conf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
error_log = /DATA/logs/php-fpm/php-fpm.log
2+
log_level = warning
3+
4+
[www]
5+
user = nginx
6+
group = www-data
7+
listen = 127.0.0.1:9000
8+
listen.owner = nginx
9+
listen.group = www-data
10+
pm = ondemand
11+
12+
; Total RAM dedicated to the web server / Max child process size
13+
pm.max_children = 75
14+
15+
pm.process_idle_timeout = 10s
16+
pm.max_requests = 500
17+
chdir = /DATA/htdocs
18+
php_flag[display_errors] = off
19+
; php_admin_value[memory_limit] = 256M
20+
; php_admin_value[upload_max_filesize] = 1G
21+
; php_admin_value[post_max_size] = 1G
22+
; php_admin_value[output_buffering] = 0
23+
; php_admin_value[php_value max_input_time] = 3600
24+
php_admin_value[openssl.cafile] = /etc/ssl/certs/ca-certificates.crt
25+
php_admin_value[openssl.capath] = /etc/ssl/certs
26+
; php_admin_value[max_input_nesting_level] = 256
27+
; php_admin_value[max_input_vars] = 10000
28+
29+
; Redirect worker stdout and stderr into main error log. If not set, stdout and
30+
; stderr will be redirected to /dev/null according to FastCGI specs.
31+
; Default Value: no
32+
catch_workers_output = yes
33+
34+
; Database variables passed via -e argument on Docker
35+
env["DB_HOST"] = "$DB_HOST"
36+
env["DB_USER"] = "$DB_USER"
37+
env["DB_PASS"] = "$DB_PASS"
38+
env["DB_NAME"] = "$DB_NAME"

0 commit comments

Comments
 (0)