chore: complete update
This commit is contained in:
48
docker/DOCKER-TODO.md
Normal file
48
docker/DOCKER-TODO.md
Normal file
@@ -0,0 +1,48 @@
|
||||
# Optimierungsvorschläge für die Docker-Compose Umgebung
|
||||
|
||||
## ToDo-Liste
|
||||
|
||||
- [ ] **Datenbank Passwörter & Secrets absichern**
|
||||
- Datenbankpasswörter nicht im Klartext in der YAML speichern, sondern `secrets`-Mechanismus verwenden.
|
||||
- `.env` Werte für Datenbanken statt statischer Angaben verwenden.
|
||||
- Beispiel: `MYSQL_ROOT_PASSWORD_FILE` und `MYSQL_PASSWORD_FILE` setzen und Secrets einbinden.
|
||||
|
||||
- [ ] **Performance & Caching verbessern**
|
||||
- `cache_from` und `cache_to` im Build-Prozess (BuildKit) einrichten.
|
||||
- Für PHP einen dedizierten Volume für den Composer-Cache nutzen.
|
||||
- Nginx-Cache als eigenes Volume deklarieren.
|
||||
- Die Vendor-Ordner aus Mounts ausschließen oder gesondert berücksichtigen, damit lokale Änderungen keine Build-Optimierungen verhindern.
|
||||
|
||||
- [ ] **Netzwerk- und Bind-Mounts optimieren**
|
||||
- Bei Nginx nur das Public-Verzeichnis (`public/`) einbinden, nicht das gesamte Projektverzeichnis.
|
||||
- Nicht benötigte Verzeichnisse (wie z.B. `vendor/`) explizit ausschließen.
|
||||
- Healthchecks und Startbedingungen konsistent definieren.
|
||||
|
||||
- [ ] **Image-Versionen festlegen**
|
||||
- Keine `latest`-Images nutzen, sondern möglichst immer eine feste Version angeben (z.B. `mariadb:11.3` statt `mariadb:latest`).
|
||||
- Gilt auch für Redis, PHP und weitere Services.
|
||||
|
||||
- [ ] **Ressourcenlimits setzen**
|
||||
- `deploy.resources` für Speicher und CPU bei allen Services, nicht nur beim Worker.
|
||||
|
||||
- [ ] **Security-Best-Practices**
|
||||
- Nicht produktive Ports (z.B. bei Entwicklung) durch `.env` variabel und gezielt auf localhost begrenzen.
|
||||
- Feste Netzwerkbereiche und eigene Netzwerke für sensible Kommunikation (z.B. Backend, Cache).
|
||||
|
||||
- [ ] **Multi-Stage Builds in Dockerfiles nutzen**
|
||||
- Die Images im PHP- und Worker-Bereich sollten über Multi-Stage-Builds möglichst klein gehalten werden (z.B. `FROM php:X-cli AS base`, dann Production-Image).
|
||||
|
||||
- [ ] **Environment-Konfiguration für Dev/Prod trennen**
|
||||
- Eine `docker-compose.override.yml` für Entwicklung mit vollem Source-Mount und Debug-Konfiguration anlegen.
|
||||
- Für Produktion keine Source-Mounts, keine Debug-Variablen, optimierte Settings.
|
||||
|
||||
- [ ] **Log-Rotation aktivieren**
|
||||
- Logging-Driver auf `json-file` einstellen und Optionen für Größe/Rotation setzen.
|
||||
|
||||
- [ ] **Monitoring & Healthchecks**
|
||||
- Für alle Services sinnvolle Healthchecks ergänzen.
|
||||
- (Optional) Monitoring und/oder Alerting ergänzen.
|
||||
|
||||
---
|
||||
|
||||
**Tipp:** Die oben stehenden Punkte können Schritt für Schritt umgesetzt und pro optimiertem Bereich abgehakt werden.
|
||||
@@ -1,33 +1,73 @@
|
||||
FROM nginx:alpine
|
||||
FROM macbre/nginx-http3
|
||||
|
||||
# Standard-Konfiguration entfernen
|
||||
RUN rm /etc/nginx/conf.d/default.conf
|
||||
# Zurück zu root wechseln
|
||||
USER root
|
||||
|
||||
# Verzeichnisse erstellen mit korrekten Berechtigungen
|
||||
RUN mkdir -p /var/cache/nginx /var/log/nginx /etc/nginx/template && \
|
||||
chmod -R 777 /var/cache/nginx /var/log/nginx
|
||||
# Entferne Default-Site
|
||||
RUN rm -f /etc/nginx/conf.d/default.conf || true
|
||||
|
||||
# Kopiere die Template-Konfiguration
|
||||
# Verzeichnisse erstellen
|
||||
RUN mkdir -p /var/cache/nginx /var/log/nginx /var/www/ssl && \
|
||||
chmod 755 /var/cache/nginx /var/log/nginx /var/www/ssl
|
||||
|
||||
# Konfigurationen kopieren
|
||||
COPY ./nginx.conf /etc/nginx/nginx.conf
|
||||
COPY ./default.conf /etc/nginx/conf.d/default.conf
|
||||
COPY ./ssl/ /var/www/ssl/
|
||||
|
||||
# Kopiere die SSL-Zertifikate
|
||||
COPY ./ssl/ /etc/nginx/ssl/
|
||||
# Entry-Script kopieren
|
||||
COPY ./docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
# Startup-Skript zum Ersetzen der Variablen
|
||||
COPY ./docker-entrypoint.sh /
|
||||
RUN chmod +x /docker-entrypoint.sh
|
||||
# su-exec und netcat installieren
|
||||
RUN apk add --no-cache su-exec netcat-openbsd
|
||||
|
||||
#Install Netcat
|
||||
RUN apk add --no-cache netcat-openbsd
|
||||
# Berechtigungen für stdout/stderr anpassen
|
||||
RUN chmod a+rw /dev/stdout /dev/stderr
|
||||
|
||||
|
||||
# Als user www-data laufen lassen
|
||||
RUN addgroup -g 1000 www && adduser -D -G www -u 1000 www-data \
|
||||
&& chown -R www-data:www /var/cache/nginx /var/log/nginx /etc/nginx
|
||||
USER www-data
|
||||
# Ordner-Berechtigungen für den nginx-User setzen
|
||||
RUN chown -R nginx:nginx /var/cache/nginx /var/log/nginx /var/www/ssl
|
||||
|
||||
EXPOSE 80 443
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
||||
#CMD ["nginx", "-g", "daemon off;"]
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Standard-Konfiguration entfernen
|
||||
#RUN rm -f /etc/nginx/conf.d/default.conf
|
||||
#
|
||||
## Verzeichnisse erstellen mit korrekten Berechtigungen
|
||||
#RUN mkdir -p /var/cache/nginx /var/log/nginx /etc/nginx/template && \
|
||||
# chmod -R 777 /var/cache/nginx /var/log/nginx
|
||||
#
|
||||
## Kopiere die Template-Konfiguration
|
||||
#COPY ./nginx.conf /etc/nginx/nginx.conf
|
||||
#COPY ./default.conf /etc/nginx/conf.d/default.conf
|
||||
#
|
||||
## Kopiert config Include
|
||||
#COPY ./vite-proxy.inc.dev /etc/nginx/vite-proxy.inc
|
||||
#
|
||||
## Kopiere die SSL-Zertifikate
|
||||
#COPY ./ssl/ /etc/nginx/ssl/
|
||||
#
|
||||
## Startup-Skript zum Ersetzen der Variablen
|
||||
#COPY ./docker-entrypoint.sh /
|
||||
#RUN chmod +x /docker-entrypoint.sh
|
||||
#
|
||||
##Install Netcat
|
||||
#RUN apk add --no-cache netcat-openbsd
|
||||
#
|
||||
#
|
||||
## Als user www-data laufen lassen
|
||||
#RUN addgroup -g 1000 www && adduser -D -G www -u 1000 www-data \
|
||||
# && chown -R www-data:www /var/cache/nginx /var/log/nginx /etc/nginx
|
||||
#USER www-data
|
||||
#
|
||||
#EXPOSE 80 443
|
||||
#
|
||||
#ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
#CMD ["nginx", "-g", "daemon off;"]
|
||||
|
||||
@@ -18,8 +18,8 @@ map $env_mode $should_skip_cache {
|
||||
|
||||
# Skip-Cache für Sessions und basierend auf Umgebung
|
||||
map $http_cookie$should_skip_cache $skip_cache {
|
||||
"~PHPSESSID" 1; # Sessions nie cachen
|
||||
"1" 1; # Cache überspringen, wenn should_skip_cache = 1
|
||||
"~ms_context" 1; # Sessions nie cachen
|
||||
"~1$" 1; # Cache überspringen, wenn should_skip_cache = 1
|
||||
default 0; # Ansonsten cachen
|
||||
}
|
||||
|
||||
@@ -41,23 +41,38 @@ server {
|
||||
server {
|
||||
# Korrigierte HTTP/2 Syntax
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
listen 443 quic; # QUIC für HTTP/3 // Removed "reuseport"
|
||||
listen [::]:443 quic;
|
||||
|
||||
http2 on; # Neue Syntax für HTTP/2
|
||||
http3 on;
|
||||
|
||||
add_header Alt-Svc 'h3=":443"; ma=86400; persist=1, h2=":443"; ma=86400';
|
||||
|
||||
server_name localhost;
|
||||
|
||||
#ssl_certificate /etc/nginx/ssl/localhost+2.pem;
|
||||
#ssl_certificate_key /etc/nginx/ssl/localhost+2-key.pem;
|
||||
ssl_certificate /etc/nginx/ssl/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
|
||||
#ssl_certificate /etc/nginx/ssl/fullchain.pem;
|
||||
#ssl_certificate_key /etc/nginx/ssl/privkey.pem;
|
||||
|
||||
ssl_certificate /var/www/ssl/fullchain.pem;
|
||||
ssl_certificate_key /var/www/ssl/privkey.pem;
|
||||
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
# add_header Alt-Svc 'h3=":443"'; # Für HTTP/3 Unterstützung
|
||||
#add_header QUIC-Status $quic;
|
||||
|
||||
|
||||
ssl_protocols TLSv1.3 TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
# Verbesserte SSL-Konfiguration
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_tickets off;
|
||||
#ssl_session_timeout 1d;
|
||||
#ssl_session_cache shared:SSL:10m;
|
||||
#ssl_session_tickets off;
|
||||
|
||||
# OCSP Stapling (auskommentiert, wenn Zertifikate fehlen)
|
||||
# ssl_stapling on;
|
||||
@@ -68,6 +83,11 @@ server {
|
||||
root /var/www/html/public;
|
||||
index index.php index.html;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
autoindex off;
|
||||
}
|
||||
|
||||
# Debug-Header für die Entwicklung
|
||||
add_header X-Environment $env_mode always;
|
||||
|
||||
@@ -88,6 +108,34 @@ server {
|
||||
client_max_body_size 10m;
|
||||
large_client_header_buffers 2 1k;
|
||||
|
||||
brotli on;
|
||||
brotli_comp_level 6;
|
||||
brotli_types
|
||||
application/atom+xml
|
||||
application/javascript
|
||||
application/json
|
||||
application/ld+json
|
||||
application/manifest+json
|
||||
application/rss+xml
|
||||
application/vnd.geo+json
|
||||
application/vnd.ms-fontobject
|
||||
application/x-font-ttf
|
||||
application/x-web-app-manifest+json
|
||||
application/xhtml+xml
|
||||
application/xml
|
||||
font/opentype
|
||||
image/bmp
|
||||
image/svg+xml
|
||||
image/x-icon
|
||||
text/cache-manifest
|
||||
text/css
|
||||
text/plain
|
||||
text/vcard
|
||||
text/vnd.rim.location.xloc
|
||||
text/vtt
|
||||
text/x-componentFs
|
||||
text/x-cross-domain-policy;
|
||||
|
||||
# Verbesserte Gzip-Kompression
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
@@ -119,33 +167,43 @@ server {
|
||||
text/vcard
|
||||
text/vnd.rim.location.xloc
|
||||
text/vtt
|
||||
text/x-component
|
||||
text/x-componentFs
|
||||
text/x-cross-domain-policy;
|
||||
|
||||
# Logs
|
||||
access_log /var/log/nginx/access.log combined;
|
||||
error_log /var/log/nginx/error.log error;
|
||||
#access_log /var/log/nginx/access.log combined;
|
||||
#error_log /var/log/nginx/error.log error;
|
||||
access_log /dev/stdout;
|
||||
error_log /dev/stderr warn;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
autoindex off;
|
||||
# läuft aktuell oben über dynamischen include!
|
||||
#location / {
|
||||
# try_files $uri $uri/ /index.php?$query_string;
|
||||
# autoindex off;
|
||||
#}
|
||||
|
||||
# Service-Worker explizit erlauben (auch im Production-Server ungefährlich!)
|
||||
location = /sw.js {
|
||||
# je nach Build-Ordner anpassen!
|
||||
alias /var/www/html/public/sw.js;
|
||||
add_header Cache-Control "no-cache, must-revalidate";
|
||||
}
|
||||
|
||||
# Caching Header für statische Dateien
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable, max-age=31536000";
|
||||
}
|
||||
#location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
# expires 1y;
|
||||
# add_header Cache-Control "public, immutable, max-age=31536000";
|
||||
#}
|
||||
|
||||
location ~* \.(css|js)$ {
|
||||
expires 1w;
|
||||
add_header Cache-Control "public, max-age=604800";
|
||||
}
|
||||
|
||||
location ~* \.(json|xml)$ {
|
||||
expires 1d;
|
||||
add_header Cache-Control "public, max-age=86400";
|
||||
}
|
||||
# location ~* \.(json|xml)$ {
|
||||
# expires 1d;
|
||||
# add_header Cache-Control "public, max-age=86400";
|
||||
# }
|
||||
|
||||
location ~ \.php$ {
|
||||
try_files $uri =404;
|
||||
@@ -182,6 +240,8 @@ server {
|
||||
|
||||
# Für bessere Performance
|
||||
fastcgi_keep_conn on;
|
||||
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
}
|
||||
|
||||
# Sicherheitseinstellungen
|
||||
|
||||
@@ -1,20 +1,58 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# Umgebungsvariablen-Substitution in Nginx-Konfiguration
|
||||
if [ -n "$APP_ENV" ]; then
|
||||
echo "Setting APP_ENV to: $APP_ENV"
|
||||
sed -i "s/\${APP_ENV}/$APP_ENV/g" /etc/nginx/conf.d/default.conf
|
||||
fi
|
||||
|
||||
# Warte auf PHP-FPM Container
|
||||
echo "Waiting for PHP-FPM to be ready..."
|
||||
while ! nc -z php 9000; do
|
||||
sleep 1
|
||||
done
|
||||
echo "PHP-FPM is ready!"
|
||||
|
||||
# SSL-Zertifikate prüfen
|
||||
if [ ! -f "/var/www/ssl/fullchain.pem" ] || [ ! -f "/var/www/ssl/privkey.pem" ]; then
|
||||
echo "Warning: SSL certificates not found. HTTPS may not work properly."
|
||||
fi
|
||||
|
||||
# Nginx-Konfiguration testen
|
||||
echo "Testing Nginx configuration..."
|
||||
nginx -t
|
||||
|
||||
# Nginx starten
|
||||
echo "Starting Nginx..."
|
||||
exec "$@"
|
||||
until nc -z -w 2 php 9000; do
|
||||
echo "Warte auf PHP-FPM..."
|
||||
sleep 1
|
||||
done
|
||||
|
||||
|
||||
# Optional: eigene Umgebungsvariable mit Default setzen
|
||||
export APP_ENV="${APP_ENV:-production}"
|
||||
|
||||
echo "Starte Nginx mit APP_ENV=$APP_ENV"
|
||||
|
||||
# Ersetze Umgebungsvariablen wie ${APP_ENV} in der Nginx-Config per envsubst
|
||||
envsubst '${APP_ENV}' < /etc/nginx/conf.d/default.conf > /etc/nginx/conf.d/default.conf.tmp
|
||||
mv /etc/nginx/conf.d/default.conf.tmp /etc/nginx/conf.d/default.conf
|
||||
# Ersetze Platzhalter in temporäre Datei
|
||||
envsubst '${APP_ENV}' < /etc/nginx/conf.d/default.conf > /tmp/default.conf
|
||||
|
||||
# Starte Nginx (Foreground)
|
||||
# Ersetzte Originalkonfiguration
|
||||
cp /tmp/default.conf /etc/nginx/conf.d/default.conf
|
||||
|
||||
# WICHTIG: Rechte für stdout/stderr anpassen
|
||||
chmod a+rw /dev/stdout /dev/stderr
|
||||
|
||||
# Nginx-Ordner Rechte anpassen
|
||||
mkdir -p /var/cache/nginx /var/log/nginx
|
||||
chown -R nginx:nginx /var/cache/nginx /var/log/nginx
|
||||
|
||||
# Stelle sicher, dass das SSL-Verzeichnis existiert
|
||||
mkdir -p /var/www/ssl
|
||||
|
||||
# Jetzt kann nginx sicher starten
|
||||
exec nginx -g 'daemon off;'
|
||||
|
||||
@@ -1,37 +1,78 @@
|
||||
# Standard Nginx User
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
pid /tmp/nginx.pid;
|
||||
error_log /var/log/nginx/error.log notice;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
# Worker-Prozess-Einstellungen
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
# MIME-Types
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Server-Tokens für Sicherheit ausblenden
|
||||
server_tokens off;
|
||||
|
||||
# Rate-Limiting für besseren DDoS-Schutz
|
||||
# Rate-Limiting
|
||||
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
|
||||
|
||||
# Logging-Einstellungen
|
||||
# Logging-Format
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
'"$http_user_agent" "$http_x_forwarded_for" '
|
||||
'rt=$request_time uct="$upstream_connect_time" '
|
||||
'uht="$upstream_header_time" urt="$upstream_response_time"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
# Container-optimierte Logs
|
||||
access_log /dev/stdout main;
|
||||
error_log /dev/stderr warn;
|
||||
|
||||
# Performance-Optimierungen
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
client_max_body_size 64M;
|
||||
|
||||
# TLS-Einstellungen
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
# Gzip-Kompression
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 1024;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_types
|
||||
text/plain
|
||||
text/css
|
||||
text/xml
|
||||
text/javascript
|
||||
application/json
|
||||
application/javascript
|
||||
application/xml+rss
|
||||
application/atom+xml
|
||||
image/svg+xml
|
||||
application/rss+xml
|
||||
application/vnd.ms-fontobject
|
||||
application/x-font-ttf
|
||||
font/opentype;
|
||||
|
||||
# Include server configs
|
||||
# Basis-Sicherheits-Header
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||
|
||||
# SSL-Session-Cache
|
||||
# ssl_session_cache shared:SSL:10m;
|
||||
# ssl_session_timeout 10m;
|
||||
# ssl_session_tickets off;
|
||||
|
||||
# Server-Konfigurationen einbinden
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
|
||||
4
docker/nginx/vite-proxy.inc.dev
Normal file
4
docker/nginx/vite-proxy.inc.dev
Normal file
@@ -0,0 +1,4 @@
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
autoindex off;
|
||||
}
|
||||
4
docker/nginx/vite-proxy.inc.prod
Normal file
4
docker/nginx/vite-proxy.inc.prod
Normal file
@@ -0,0 +1,4 @@
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
autoindex off;
|
||||
}
|
||||
@@ -7,10 +7,34 @@ RUN apt-get update && apt-get install -y \
|
||||
unzip \
|
||||
libzip-dev \
|
||||
zip \
|
||||
&& docker-php-ext-install zip pdo pdo_mysql \
|
||||
&& docker-php-ext-install opcache \
|
||||
libpng-dev \
|
||||
libjpeg-dev \
|
||||
libfreetype6-dev \
|
||||
libwebp-dev \
|
||||
libavif-dev \
|
||||
libxpm-dev \
|
||||
&& apt-get clean \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN docker-php-ext-configure gd \
|
||||
--with-freetype \
|
||||
--with-jpeg \
|
||||
--with-webp \
|
||||
--with-avif \
|
||||
--with-xpm \
|
||||
&& docker-php-ext-install -j$(nproc) gd
|
||||
|
||||
RUN docker-php-ext-install -j$(nproc) \
|
||||
zip \
|
||||
pdo \
|
||||
pdo_mysql \
|
||||
opcache \
|
||||
pcntl \
|
||||
posix \
|
||||
shmop
|
||||
|
||||
RUN pecl install apcu \
|
||||
&& docker-php-ext-enable apcu
|
||||
|
||||
# Composer installieren
|
||||
RUN curl -sS https://getcomposer.org/installer | php \
|
||||
@@ -25,14 +49,21 @@ RUN if [ "$ENV" = "dev" ]; then \
|
||||
|
||||
WORKDIR /var/www/html
|
||||
|
||||
# Kopiere zuerst nur composer.json/lock für besseres Layer-Caching
|
||||
COPY composer.json composer.lock ./
|
||||
# Kopiere composer.json
|
||||
COPY composer.json ./
|
||||
|
||||
# Installiere Abhängigkeiten - variiert je nach Umgebung
|
||||
RUN if [ "$ENV" = "prod" ]; then \
|
||||
composer install --no-dev --no-scripts --no-autoloader --optimize-autoloader; \
|
||||
# Kopiere composer.lock falls vorhanden (robuste Lösung)
|
||||
COPY composer.loc[k] ./
|
||||
|
||||
# Falls keine composer.lock existiert, erstelle eine leere um Layer-Caching zu ermöglichen
|
||||
RUN [ ! -f composer.lock ] && touch composer.lock || true
|
||||
|
||||
# Remove potentially corrupted composer.lock and install dependencies
|
||||
RUN rm -f composer.lock && \
|
||||
if [ "$ENV" = "prod" ]; then \
|
||||
composer install --no-dev --no-scripts --no-autoloader --optimize-autoloader; \
|
||||
else \
|
||||
composer install --no-scripts --no-autoloader; \
|
||||
composer install --no-scripts --no-autoloader; \
|
||||
fi
|
||||
|
||||
# Kopiere PHP-Konfigurationen
|
||||
|
||||
@@ -6,3 +6,5 @@ session.cookie_samesite = Lax
|
||||
|
||||
|
||||
date.timezone = Europe/Berlin
|
||||
|
||||
opcache.preload=/var/www/michaelschiemer/src/preload.php
|
||||
|
||||
@@ -4,7 +4,7 @@ include = php.common.ini
|
||||
|
||||
[opcache]
|
||||
opcache.enable=1
|
||||
opcache.enable_cli=0
|
||||
opcache.enable_cli=1
|
||||
opcache.memory_consumption=128
|
||||
opcache.max_accelerated_files=10000
|
||||
; Häufigere Validierung im Dev-Modus
|
||||
|
||||
115
docker/worker/Dockerfile
Normal file
115
docker/worker/Dockerfile
Normal file
@@ -0,0 +1,115 @@
|
||||
FROM php:8.4.8-cli
|
||||
|
||||
# Install system dependencies including libraries for GD and other extensions
|
||||
RUN apt-get update && apt-get install -y \
|
||||
git \
|
||||
curl \
|
||||
libpng-dev \
|
||||
libjpeg62-turbo-dev \
|
||||
libfreetype6-dev \
|
||||
libonig-dev \
|
||||
libxml2-dev \
|
||||
libzip-dev \
|
||||
libicu-dev \
|
||||
zip \
|
||||
unzip \
|
||||
procps \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& apt-get clean
|
||||
|
||||
# Configure GD extension with JPEG and FreeType support
|
||||
RUN docker-php-ext-configure gd --with-freetype --with-jpeg
|
||||
|
||||
# Install PHP extensions for worker functionality and web features
|
||||
RUN docker-php-ext-install -j$(nproc) \
|
||||
pdo_mysql \
|
||||
mbstring \
|
||||
exif \
|
||||
pcntl \
|
||||
posix \
|
||||
sockets \
|
||||
gd \
|
||||
zip \
|
||||
intl \
|
||||
opcache
|
||||
|
||||
# Install Composer
|
||||
COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
|
||||
|
||||
# Set working directory
|
||||
WORKDIR /var/www/html
|
||||
|
||||
# Copy application files
|
||||
COPY . .
|
||||
|
||||
# Install dependencies (composer.lock wird automatisch erstellt falls nicht vorhanden)
|
||||
# Check if composer.json exists, if not create a minimal one
|
||||
RUN if [ ! -f composer.json ]; then \
|
||||
echo "Creating minimal composer.json..."; \
|
||||
echo '{\
|
||||
"name": "worker/app",\
|
||||
"description": "Worker application",\
|
||||
"type": "project",\
|
||||
"require": {\
|
||||
"php": ">=8.4"\
|
||||
},\
|
||||
"autoload": {\
|
||||
"psr-4": {\
|
||||
"App\\\\": "src/"\
|
||||
}\
|
||||
},\
|
||||
"minimum-stability": "stable",\
|
||||
"prefer-stable": true\
|
||||
}' > composer.json; \
|
||||
fi && \
|
||||
composer install \
|
||||
--no-dev \
|
||||
--optimize-autoloader \
|
||||
--no-interaction || echo "Composer install skipped or failed - continuing without dependencies"
|
||||
|
||||
# Create startup script for permission fixing
|
||||
RUN echo '#!/bin/bash\n\
|
||||
set -e\n\
|
||||
\n\
|
||||
echo "🔧 Fixing permissions..."\n\
|
||||
\n\
|
||||
# Create directories if they do not exist\n\
|
||||
mkdir -p /var/www/html/src/Framework/CommandBus/storage/queue\n\
|
||||
mkdir -p /var/www/html/storage/logs\n\
|
||||
mkdir -p /var/www/html/storage/cache\n\
|
||||
\n\
|
||||
# Fix permissions on mounted volumes\n\
|
||||
chown -R www-data:www-data /var/www/html/storage || true\n\
|
||||
chown -R www-data:www-data /var/www/html/src/Framework/CommandBus/storage || true\n\
|
||||
chmod -R 775 /var/www/html/storage || true\n\
|
||||
chmod -R 775 /var/www/html/src/Framework/CommandBus/storage || true\n\
|
||||
\n\
|
||||
echo "✅ Permissions fixed"\n\
|
||||
echo "🚀 Starting worker..."\n\
|
||||
\n\
|
||||
# Switch to www-data user and run the worker\n\
|
||||
exec gosu www-data php /var/www/html/worker.php\n' > /usr/local/bin/start-worker.sh \
|
||||
&& chmod +x /usr/local/bin/start-worker.sh
|
||||
|
||||
# Install gosu for better user switching (alternative to su-exec for Debian)
|
||||
RUN apt-get update && apt-get install -y gosu && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Create necessary directories and set permissions
|
||||
RUN mkdir -p \
|
||||
/var/www/html/src/Framework/CommandBus/storage/queue \
|
||||
/var/www/html/storage/logs \
|
||||
/var/www/html/storage/cache \
|
||||
&& chown -R www-data:www-data /var/www/html/storage \
|
||||
&& chmod -R 775 /var/www/html/storage
|
||||
|
||||
# Create queue storage directory with proper permissions
|
||||
RUN mkdir -p /var/www/html/src/Framework/CommandBus/storage \
|
||||
&& chown -R www-data:www-data /var/www/html/src/Framework/CommandBus/storage \
|
||||
&& chmod -R 775 /var/www/html/src/Framework/CommandBus/storage
|
||||
|
||||
# Health check for the worker
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD ps aux | grep -v grep | grep "worker.php" || exit 1
|
||||
|
||||
# Use startup script instead of direct PHP command
|
||||
CMD ["/usr/local/bin/start-worker.sh"]
|
||||
Reference in New Issue
Block a user