chore: remove retundant .env files. some additional fixes

This commit is contained in:
2025-10-27 19:07:12 +01:00
parent 62999c40cd
commit 8ef2b8547d
21 changed files with 74 additions and 1570 deletions

View File

@@ -1,310 +0,0 @@
# Development Environment Overrides
# Custom PHP Framework - Development Tools and Debugging
version: '3.8'
services:
php:
build:
target: development
args:
- ENV=development
- XDEBUG_ENABLE=true
- COMPOSER_INSTALL_FLAGS=--dev --optimize-autoloader
environment:
APP_ENV: development
APP_DEBUG: true
XDEBUG_MODE: ${XDEBUG_MODE:-develop,debug}
XDEBUG_CONFIG: "client_host=host.docker.internal client_port=9003 start_with_request=yes"
XDEBUG_SESSION: 1
PHP_MEMORY_LIMIT: 1G
PHP_MAX_EXECUTION_TIME: 0
PHP_OPCACHE_ENABLE: 0
PHP_OPCACHE_VALIDATE_TIMESTAMPS: 1
PHP_ERROR_REPORTING: E_ALL
PHP_DISPLAY_ERRORS: 1
PHP_LOG_ERRORS: 1
volumes:
# Development bind mounts for live reload
- type: bind
source: ../../
target: /var/www/html
consistency: cached
# Override vendor for faster access
- type: volume
source: composer_cache_dev
target: /root/.composer/cache
# Node modules volume to prevent conflicts
- type: volume
source: node_modules
target: /var/www/html/node_modules
ports:
# Expose Xdebug port
- "9003:9003"
read_only: false
deploy:
resources:
limits:
memory: 2G
cpus: '4.0'
reservations:
memory: 512M
cpus: '1.0'
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
labels: "service=php,environment=development"
nginx:
environment:
APP_ENV: development
NGINX_WORKER_PROCESSES: 1
NGINX_WORKER_CONNECTIONS: 1024
NGINX_ERROR_LOG_LEVEL: debug
NGINX_ACCESS_LOG_FORMAT: combined
volumes:
# Development Nginx config with Vite proxy
- type: bind
source: deployment/applications/configs/nginx/development.conf
target: /etc/nginx/conf.d/default.conf
read_only: true
# Local SSL certificates for development
- type: bind
source: ../../ssl
target: /etc/nginx/ssl
read_only: true
ports:
# Additional ports for development
- "${APP_PORT:-8080}:80"
- "${APP_SSL_PORT:-8443}:443"
- "8081:8081" # Alternative port
read_only: false
deploy:
resources:
limits:
memory: 256M
cpus: '1.0'
reservations:
memory: 64M
cpus: '0.25'
mysql:
environment:
# Development database settings
MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-dev_root_password}
MYSQL_PASSWORD: ${DB_PASSWORD:-dev_password}
volumes:
# Development MySQL configuration
- type: bind
source: deployment/applications/configs/mysql/development.cnf
target: /etc/mysql/conf.d/development.cnf
read_only: true
# Development data volume
- type: volume
source: mysql_data_dev
target: /var/lib/mysql
ports:
# Expose MySQL for development tools
- "33060:3306"
read_only: false
command:
- mysqld
- --general-log=1
- --general-log-file=/var/log/mysql/general.log
- --slow-query-log=1
- --slow-query-log-file=/var/log/mysql/slow.log
- --long-query-time=1
deploy:
resources:
limits:
memory: 1G
cpus: '2.0'
reservations:
memory: 256M
cpus: '0.5'
redis:
environment:
REDIS_PASSWORD: ${REDIS_PASSWORD:-dev_redis_password}
REDIS_MAXMEMORY: 128m
REDIS_SAVE: "60 1000" # More frequent saves in development
volumes:
# Development Redis configuration
- type: bind
source: deployment/applications/configs/redis/development.conf
target: /usr/local/etc/redis/redis.conf
read_only: true
- type: volume
source: redis_data_dev
target: /data
ports:
# Expose Redis for development tools
- "63790:6379"
read_only: false
deploy:
resources:
limits:
memory: 256M
cpus: '0.5'
reservations:
memory: 64M
cpus: '0.25'
queue-worker:
environment:
APP_ENV: development
APP_DEBUG: true
WORKER_QUEUE: development
WORKER_TIMEOUT: 60
WORKER_MEMORY_LIMIT: 256
WORKER_SLEEP: 5
WORKER_TRIES: 1
WORKER_DEBUG: true
read_only: false
deploy:
replicas: 1
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 128M
cpus: '0.25'
# Development-specific services
vite:
image: node:20-alpine
container_name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_vite
working_dir: /app
command: sh -c "npm install && npm run dev"
volumes:
- type: bind
source: ../../
target: /app
consistency: cached
- type: volume
source: node_modules
target: /app/node_modules
ports:
- "5173:5173"
- "24678:24678" # HMR port
environment:
NODE_ENV: development
VITE_DEV_SERVER_HOST: 0.0.0.0
VITE_DEV_SERVER_PORT: 5173
CHOKIDAR_USEPOLLING: true
networks:
- frontend
user: "node:node"
deploy:
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 128M
cpus: '0.25'
mailhog:
image: mailhog/mailhog:v1.0.1
container_name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_mailhog
ports:
- "1025:1025" # SMTP
- "8025:8025" # Web interface
environment:
MH_STORAGE: maildir
MH_MAILDIR_PATH: /maildir
volumes:
- type: volume
source: mailhog_data
target: /maildir
networks:
- backend
- frontend
user: "mailhog:mailhog"
read_only: true
tmpfs:
- /tmp:noexec,nosuid,size=100m
security_opt:
- no-new-privileges:true
deploy:
resources:
limits:
memory: 128M
cpus: '0.25'
reservations:
memory: 64M
cpus: '0.1'
phpmyadmin:
image: phpmyadmin:5.2-apache
container_name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_phpmyadmin
environment:
PMA_HOST: mysql
PMA_USER: ${DB_USERNAME:-dev_user}
PMA_PASSWORD: ${DB_PASSWORD:-dev_password}
PMA_ABSOLUTE_URI: http://localhost:8080/phpmyadmin/
UPLOAD_LIMIT: 64M
MEMORY_LIMIT: 512M
MAX_EXECUTION_TIME: 600
ports:
- "8080:80"
networks:
- backend
- frontend
depends_on:
mysql:
condition: service_healthy
read_only: false
deploy:
resources:
limits:
memory: 256M
cpus: '0.5'
reservations:
memory: 128M
cpus: '0.25'
redis-commander:
image: rediscommander/redis-commander:latest
container_name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_redis_commander
environment:
REDIS_HOSTS: local:redis:6379:0:${REDIS_PASSWORD:-dev_redis_password}
HTTP_USER: admin
HTTP_PASSWORD: ${REDIS_COMMANDER_PASSWORD:-dev_admin_password}
ports:
- "8081:8081"
networks:
- cache
- frontend
depends_on:
redis:
condition: service_healthy
user: "node:node"
read_only: true
tmpfs:
- /tmp:noexec,nosuid,size=100m
security_opt:
- no-new-privileges:true
deploy:
resources:
limits:
memory: 128M
cpus: '0.25'
reservations:
memory: 64M
cpus: '0.1'
volumes:
# Development volumes
composer_cache_dev:
name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_composer_cache_dev
node_modules:
name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_node_modules
mysql_data_dev:
name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_mysql_data_dev
redis_data_dev:
name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_redis_data_dev
mailhog_data:
name: ${COMPOSE_PROJECT_NAME:-michaelschiemer}_mailhog_data

View File

@@ -1,211 +0,0 @@
# Production overlay for Custom PHP Framework
# Extends base docker-compose.yml with production optimizations
version: '3.8'
services:
web:
environment:
- APP_ENV=production
- PHP_IDE_CONFIG= # Remove IDE config in production
ports:
# Remove development ports, only expose HTTPS
- "${APP_SSL_PORT:-443}:443/tcp"
- "443:443/udp"
volumes:
# Read-only application code in production
- ./:/var/www/html:ro
- ./ssl:/var/www/ssl:ro
healthcheck:
test: ["CMD", "curl", "-f", "-k", "https://localhost/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 30s
restart: always
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
labels: "service=nginx,environment=production"
deploy:
resources:
limits:
memory: 256M
cpus: '0.5'
reservations:
memory: 128M
cpus: '0.25'
php:
environment:
APP_ENV: production
APP_DEBUG: false
PHP_IDE_CONFIG: "" # Remove IDE config
XDEBUG_MODE: off # Disable Xdebug in production
build:
args:
- ENV=production
- COMPOSER_INSTALL_FLAGS=--no-dev --optimize-autoloader --classmap-authoritative
user: "www-data:www-data" # Use www-data in production
volumes:
# Read-only application code
- ./:/var/www/html:ro
# Writable storage volumes
- storage-data:/var/www/html/storage:rw
- var-data:/var/www/html/var:rw
# Composer cache (but less aggressive caching in prod)
- composer-cache:/var/www/.composer/cache
healthcheck:
test: ["CMD", "php", "/var/www/html/public/health.php"]
interval: 30s
timeout: 10s
retries: 3
start_period: 60s
restart: always
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
labels: "service=php,environment=production"
deploy:
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 256M
cpus: '0.5'
db:
environment:
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
- MYSQL_DATABASE=${DB_DATABASE}
- MYSQL_USER=${DB_USERNAME}
- MYSQL_PASSWORD=${DB_PASSWORD}
ports: [] # No external ports in production
volumes:
- db_data:/var/lib/mysql
# Production MySQL configuration
- ./docker/mysql/conf.d/security.cnf:/etc/mysql/conf.d/security.cnf:ro
healthcheck:
test: ["CMD", "mariadb-admin", "ping", "-h", "127.0.0.1", "-u", "root", "-p${DB_ROOT_PASSWORD}"]
interval: 30s
timeout: 10s
retries: 5
start_period: 60s
restart: always
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
labels: "service=mariadb,environment=production"
deploy:
resources:
limits:
memory: 1G
cpus: '1.0'
reservations:
memory: 512M
cpus: '0.5'
redis:
volumes:
# Use secure Redis configuration in production
- ./docker/redis/redis-secure.conf:/usr/local/etc/redis/redis.conf:ro
- redis_data:/data
command: ["redis-server", "/usr/local/etc/redis/redis.conf"]
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 30s
timeout: 5s
retries: 3
start_period: 30s
restart: always
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
labels: "service=redis,environment=production"
deploy:
resources:
limits:
memory: 256M
cpus: '0.5'
reservations:
memory: 128M
cpus: '0.25'
queue-worker:
environment:
- APP_ENV=production
- APP_DEBUG=false
- WORKER_DEBUG=false
- WORKER_SLEEP_TIME=${WORKER_SLEEP_TIME:-100000}
- WORKER_MAX_JOBS=${WORKER_MAX_JOBS:-1000}
- WORKER_MEMORY_LIMIT=${WORKER_MEMORY_LIMIT:-384M}
build:
args:
- ENV=production
- COMPOSER_INSTALL_FLAGS=--no-dev --optimize-autoloader
user: "www-data:www-data"
volumes:
# Read-only application code
- ./:/var/www/html:ro
# Writable logs and storage
- ./storage/logs:/var/www/html/storage/logs:rw
- ./src/Framework/CommandBus/storage:/var/www/html/src/Framework/CommandBus/storage:rw
restart: always
stop_grace_period: 60s # Longer grace period for production
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
labels: "service=queue-worker,environment=production"
deploy:
resources:
limits:
memory: 512M
cpus: '0.5'
reservations:
memory: 256M
cpus: '0.25'
# Security-focused network configuration
networks:
frontend:
driver: bridge
ipam:
driver: default
config:
- subnet: 172.24.0.0/24
backend:
driver: bridge
internal: true # Backend network is internal-only
ipam:
driver: default
config:
- subnet: 172.25.0.0/24
cache:
driver: bridge
internal: true # Cache network is internal-only
ipam:
driver: default
config:
- subnet: 172.26.0.0/24
volumes:
redis_data:
driver: local
composer-cache:
driver: local
storage-data:
driver: local
var-data:
driver: local
db_data:
driver: local

View File

@@ -1,193 +0,0 @@
# Staging overlay for Custom PHP Framework
# Extends base docker-compose.yml with staging-specific configurations
version: '3.8'
services:
web:
environment:
- APP_ENV=staging
- PHP_IDE_CONFIG= # Remove IDE config in staging
ports:
# Expose both HTTP and HTTPS for staging testing
- "${APP_PORT:-8000}:80"
- "${APP_SSL_PORT:-443}:443/tcp"
- "443:443/udp"
volumes:
# Semi-readonly application code in staging
- ./:/var/www/html:cached
- ./ssl:/var/www/ssl:ro
healthcheck:
test: ["CMD", "curl", "-f", "-k", "https://localhost/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 20s
restart: unless-stopped
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
labels: "service=nginx,environment=staging"
deploy:
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 256M
cpus: '0.5'
php:
environment:
- APP_ENV=staging
- APP_DEBUG=true # Enable debug in staging
- PHP_IDE_CONFIG= # Remove IDE config
- XDEBUG_MODE=debug # Enable Xdebug in staging for debugging
build:
args:
- ENV=staging
- COMPOSER_INSTALL_FLAGS=--optimize-autoloader
user: "1000:1000" # Keep development user for staging
volumes:
# Cached application code for staging
- ./:/var/www/html:cached
- storage-data:/var/www/html/storage:rw
- var-data:/var/www/html/var:rw
- composer-cache:/root/.composer/cache
healthcheck:
test: ["CMD", "php", "/var/www/html/public/health.php"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
restart: unless-stopped
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
labels: "service=php,environment=staging"
deploy:
resources:
limits:
memory: 1G
cpus: '2.0'
reservations:
memory: 512M
cpus: '1.0'
db:
environment:
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
- MYSQL_DATABASE=${DB_DATABASE}
- MYSQL_USER=${DB_USERNAME}
- MYSQL_PASSWORD=${DB_PASSWORD}
ports:
- "33060:3306" # Keep external port for staging database access
volumes:
- db_data:/var/lib/mysql
healthcheck:
test: ["CMD", "mariadb-admin", "ping", "-h", "127.0.0.1", "-u", "root", "-p${DB_ROOT_PASSWORD}"]
interval: 30s
timeout: 10s
retries: 5
start_period: 60s
restart: unless-stopped
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
labels: "service=mariadb,environment=staging"
deploy:
resources:
limits:
memory: 1G
cpus: '1.0'
reservations:
memory: 512M
cpus: '0.5'
redis:
volumes:
# Use standard Redis configuration in staging
- ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
- redis_data:/data
command: ["redis-server", "/usr/local/etc/redis/redis.conf"]
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 30s
timeout: 5s
retries: 3
start_period: 20s
restart: unless-stopped
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
labels: "service=redis,environment=staging"
deploy:
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 256M
cpus: '0.5'
queue-worker:
environment:
- APP_ENV=staging
- APP_DEBUG=true # Enable debug for staging
- WORKER_DEBUG=true
- WORKER_SLEEP_TIME=${WORKER_SLEEP_TIME:-100000}
- WORKER_MAX_JOBS=${WORKER_MAX_JOBS:-500}
- WORKER_MEMORY_LIMIT=${WORKER_MEMORY_LIMIT:-512M}
build:
args:
- ENV=staging
- COMPOSER_INSTALL_FLAGS=--optimize-autoloader
user: "1000:1000"
volumes:
- ./:/var/www/html:cached
- ./storage/logs:/var/www/html/storage/logs:rw
- ./src/Framework/CommandBus/storage:/var/www/html/src/Framework/CommandBus/storage:rw
restart: unless-stopped
stop_grace_period: 45s
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
labels: "service=queue-worker,environment=staging"
deploy:
resources:
limits:
memory: 768M
cpus: '1.0'
reservations:
memory: 384M
cpus: '0.5'
# Staging network configuration - more permissive than production
networks:
frontend:
driver: bridge
backend:
driver: bridge
cache:
driver: bridge
volumes:
redis_data:
driver: local
composer-cache:
driver: local
storage-data:
driver: local
var-data:
driver: local
db_data:
driver: local

View File

@@ -1,149 +0,0 @@
# Environment Configuration Guide
This directory contains environment templates for different deployment environments of the Custom PHP Framework.
## Environment Templates
### `.env.production.template`
Production environment template with security-focused configurations:
- APP_DEBUG=false
- Strict session fingerprinting
- Xdebug disabled
- Production logging levels
- Strong password requirements
### `.env.staging.template`
Staging environment template for testing:
- APP_DEBUG=true
- Moderate security settings
- Xdebug enabled for debugging
- Verbose logging
- Test API configurations
## Usage
1. **Copy the appropriate template:**
```bash
cp .env.production.template .env.production
# or
cp .env.staging.template .env.staging
```
2. **Fill in required values:**
- Replace all `*** REQUIRED ***` placeholders with actual values
- Generate strong passwords for database credentials
- Configure API keys and service credentials
- Set proper domain names and SSL certificate paths
3. **Security Considerations:**
- Never commit actual `.env.production` or `.env.staging` files to version control
- Use strong, unique passwords for each environment
- Rotate credentials regularly
- Enable appropriate session fingerprinting for security
## Environment-Specific Settings
### Development → Staging Changes
- Enable Xdebug but remove IDE configurations
- Use staging database and credentials
- Enable detailed logging for debugging
- Use test API endpoints where available
### Staging → Production Changes
- Disable all debug features (APP_DEBUG=false, XDEBUG_MODE=off)
- Enable strict security settings
- Use production database with strong credentials
- Set warning-level logging only
- Configure production SSL certificates
- Use production API keys and webhooks
## Required Values by Environment
### Production Requirements
- **Database:** Strong passwords, production database name
- **APIs:** Production webhook secrets, SMTP credentials
- **SSL:** Valid SSL certificate paths
- **Monitoring:** Production-grade logging configuration
### Staging Requirements
- **Database:** Separate staging database credentials
- **APIs:** Test/staging API keys where available
- **SSL:** Test certificates or self-signed certificates
- **Monitoring:** Verbose logging for debugging
## Environment Variable Categories
### Core Application
- `APP_ENV`, `APP_DEBUG`, `APP_URL`, `APP_DOMAIN`
### Database Configuration
- `DB_HOST`, `DB_DATABASE`, `DB_USERNAME`, `DB_PASSWORD`, `DB_ROOT_PASSWORD`
### Security & Session
- Session fingerprinting settings
- SSL certificate paths
- Authentication configurations
### External Services
- SMTP configuration for emails
- Third-party API credentials
- Webhook secrets
### Performance & Caching
- OPcache settings
- Redis configuration
- Worker process limits
### Monitoring & Logging
- Log levels and channels
- Error reporting settings
- Analytics configuration
## Deployment Integration
These environment files are used by:
- Docker Compose overlays (`docker-compose.production.yml`, `docker-compose.staging.yml`)
- Ansible deployment playbooks
- Application deployment scripts
## Security Best Practices
1. **Credential Management:**
- Use strong, unique passwords for each environment
- Consider using a password manager or secrets management service
- Rotate credentials regularly
2. **Environment Isolation:**
- Keep staging and production completely separate
- Use different database servers and API keys
- Monitor access to production credentials
3. **File Permissions:**
- Set restrictive permissions on environment files (600)
- Ensure only necessary users can read the files
- Never include in version control
4. **SSL/TLS Configuration:**
- Use valid SSL certificates in production
- Enable HTTPS everywhere
- Configure proper cipher suites
## Troubleshooting
### Common Issues
- **Missing required values:** Check for `*** REQUIRED ***` placeholders
- **Database connection failures:** Verify database credentials and host
- **SSL certificate errors:** Check certificate paths and permissions
- **API failures:** Verify API keys and endpoint configurations
### Environment-Specific Debugging
- **Staging:** Enable verbose logging and Xdebug
- **Production:** Check application logs and monitoring systems
- **Both:** Verify environment variable loading in application
## Integration with Deployment
The environment templates integrate with:
1. **Docker Compose overlays** for environment-specific container configuration
2. **Ansible playbooks** for automated environment setup
3. **Application deployment scripts** for environment validation and deployment

View File

@@ -1,164 +0,0 @@
# Production Environment Configuration Template
# Copy to .env.production and update with real values
# Project Configuration
COMPOSE_PROJECT_NAME=michaelschiemer
DOMAIN_NAME=michaelschiemer.de
# Environment
APP_ENV=production
APP_DEBUG=false
APP_TIMEZONE=Europe/Berlin
APP_LOCALE=de
# SSL/HTTPS Configuration
APP_SSL_ENABLED=true
SSL_CERT_PATH=/etc/letsencrypt/live/michaelschiemer.de
FORCE_HTTPS=true
# Database Configuration (Production)
DB_DRIVER=mysql
DB_HOST=db
DB_PORT=3306
DB_DATABASE=*** REQUIRED ***
DB_USERNAME=*** REQUIRED ***
DB_PASSWORD=*** REQUIRED ***
DB_ROOT_PASSWORD=*** REQUIRED ***
DB_CHARSET=utf8mb4
DB_COLLATION=utf8mb4_unicode_ci
# Redis Configuration
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=*** REQUIRED ***
REDIS_DATABASE=0
REDIS_PREFIX=michaelschiemer_prod_
# Session Configuration (Production Security)
SESSION_DRIVER=redis
SESSION_LIFETIME=120
SESSION_ENCRYPT=true
SESSION_SECURE_COOKIE=true
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=strict
# Session Fingerprinting (Production Security)
SESSION_FINGERPRINT_STRICT=true
SESSION_FINGERPRINT_USER_AGENT=true
SESSION_FINGERPRINT_ACCEPT_LANGUAGE=true
SESSION_FINGERPRINT_IP_PREFIX=true
SESSION_FINGERPRINT_THRESHOLD=0.8
# Cache Configuration
CACHE_DRIVER=redis
CACHE_TTL=3600
CACHE_PREFIX=michaelschiemer_cache_prod_
# Queue Configuration
QUEUE_DRIVER=redis
QUEUE_CONNECTION=redis
QUEUE_PREFIX=michaelschiemer_queue_prod_
WORKER_QUEUE=production
WORKER_TIMEOUT=300
WORKER_MEMORY_LIMIT=512
WORKER_SLEEP=1
WORKER_TRIES=5
WORKER_BATCH_SIZE=10
# Mail Configuration (Production)
MAIL_DRIVER=*** REQUIRED ***
MAIL_HOST=*** REQUIRED ***
MAIL_PORT=*** REQUIRED ***
MAIL_USERNAME=*** REQUIRED ***
MAIL_PASSWORD=*** REQUIRED ***
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=kontakt@michaelschiemer.de
MAIL_FROM_NAME="Michael Schiemer"
# Logging Configuration (Production)
LOG_CHANNEL=stack
LOG_LEVEL=warning
LOG_STACK_CHANNELS=single,syslog
LOG_ROTATE_DAYS=30
LOG_MAX_FILES=10
# External APIs (Production)
SHOPIFY_WEBHOOK_SECRET=*** REQUIRED ***
RAPIDMAIL_USERNAME=*** REQUIRED ***
RAPIDMAIL_PASSWORD=*** REQUIRED ***
RAPIDMAIL_TEST_MODE=false
# Analytics Configuration (Production)
ANALYTICS_ENABLED=true
ANALYTICS_TRACK_PAGE_VIEWS=true
ANALYTICS_TRACK_API_CALLS=true
ANALYTICS_TRACK_USER_ACTIONS=true
ANALYTICS_TRACK_ERRORS=true
ANALYTICS_TRACK_PERFORMANCE=true
# Monitoring & Health Checks
PROMETHEUS_ENABLED=true
PROMETHEUS_PORT=9090
GRAFANA_ADMIN_PASSWORD=*** REQUIRED ***
# Security Configuration
APP_KEY=*** REQUIRED - Generate with: openssl rand -base64 32 ***
CSRF_TOKEN_LIFETIME=7200
RATE_LIMIT_PER_MINUTE=60
MAX_LOGIN_ATTEMPTS=5
LOGIN_LOCKOUT_DURATION=900
# Performance Configuration (Production)
PHP_MEMORY_LIMIT=512M
PHP_MAX_EXECUTION_TIME=30
PHP_OPCACHE_ENABLE=1
PHP_OPCACHE_MEMORY_CONSUMPTION=256
PHP_OPCACHE_MAX_ACCELERATED_FILES=20000
PHP_OPCACHE_REVALIDATE_FREQ=0
PHP_OPCACHE_VALIDATE_TIMESTAMPS=0
PHP_REALPATH_CACHE_SIZE=4M
PHP_REALPATH_CACHE_TTL=3600
# Nginx Configuration (Production)
NGINX_WORKER_PROCESSES=4
NGINX_WORKER_CONNECTIONS=2048
NGINX_KEEPALIVE_TIMEOUT=65
NGINX_CLIENT_MAX_BODY_SIZE=50m
# Database Performance (Production)
MYSQL_INNODB_BUFFER_POOL_SIZE=1G
MYSQL_INNODB_LOG_FILE_SIZE=256M
MYSQL_MAX_CONNECTIONS=100
MYSQL_QUERY_CACHE_SIZE=0
# Backup Configuration
BACKUP_ENABLED=true
BACKUP_SCHEDULE=0 2 * * *
BACKUP_RETENTION_DAYS=30
BACKUP_S3_BUCKET=*** REQUIRED IF USING S3 ***
BACKUP_S3_ACCESS_KEY=*** REQUIRED IF USING S3 ***
BACKUP_S3_SECRET_KEY=*** REQUIRED IF USING S3 ***
# SSL/TLS Configuration
SSL_PROTOCOLS=TLSv1.2 TLSv1.3
SSL_CIPHERS=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSL_PREFER_SERVER_CIPHERS=off
SSL_SESSION_CACHE_SIZE=10m
SSL_SESSION_TIMEOUT=10m
# Container User IDs (Production)
UID=33
GID=33
# Restart Policy
RESTART_POLICY=always
# Resource Limits (Production)
PHP_MEMORY_LIMIT_DOCKER=2G
PHP_CPU_LIMIT=2.0
NGINX_MEMORY_LIMIT_DOCKER=256M
NGINX_CPU_LIMIT=0.5
DB_MEMORY_LIMIT_DOCKER=2G
DB_CPU_LIMIT=2.0
REDIS_MEMORY_LIMIT_DOCKER=1G
REDIS_CPU_LIMIT=0.5

View File

@@ -1,165 +0,0 @@
# Staging Environment Configuration Template
# Copy to .env.staging and update with real values
# Project Configuration
COMPOSE_PROJECT_NAME=michaelschiemer-staging
DOMAIN_NAME=staging.michaelschiemer.de
# Environment
APP_ENV=staging
APP_DEBUG=false
APP_TIMEZONE=Europe/Berlin
APP_LOCALE=de
# SSL/HTTPS Configuration (Staging with Let's Encrypt Staging CA)
APP_SSL_ENABLED=true
SSL_CERT_PATH=/etc/letsencrypt/live/staging.michaelschiemer.de
FORCE_HTTPS=true
# Database Configuration (Staging)
DB_DRIVER=mysql
DB_HOST=db
DB_PORT=3306
DB_DATABASE=*** REQUIRED ***
DB_USERNAME=*** REQUIRED ***
DB_PASSWORD=*** REQUIRED ***
DB_ROOT_PASSWORD=*** REQUIRED ***
DB_CHARSET=utf8mb4
DB_COLLATION=utf8mb4_unicode_ci
# Redis Configuration
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=*** REQUIRED ***
REDIS_DATABASE=1
REDIS_PREFIX=michaelschiemer_staging_
# Session Configuration (Staging)
SESSION_DRIVER=redis
SESSION_LIFETIME=240
SESSION_ENCRYPT=true
SESSION_SECURE_COOKIE=true
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=strict
# Session Fingerprinting (Staging - Less Strict)
SESSION_FINGERPRINT_STRICT=false
SESSION_FINGERPRINT_USER_AGENT=true
SESSION_FINGERPRINT_ACCEPT_LANGUAGE=true
SESSION_FINGERPRINT_IP_PREFIX=false
SESSION_FINGERPRINT_THRESHOLD=0.7
# Cache Configuration
CACHE_DRIVER=redis
CACHE_TTL=1800
CACHE_PREFIX=michaelschiemer_cache_staging_
# Queue Configuration
QUEUE_DRIVER=redis
QUEUE_CONNECTION=redis
QUEUE_PREFIX=michaelschiemer_queue_staging_
WORKER_QUEUE=staging
WORKER_TIMEOUT=120
WORKER_MEMORY_LIMIT=384
WORKER_SLEEP=3
WORKER_TRIES=3
WORKER_BATCH_SIZE=5
# Mail Configuration (Staging - Development SMTP or Mailtrap)
MAIL_DRIVER=smtp
MAIL_HOST=*** REQUIRED - Use Mailtrap or similar ***
MAIL_PORT=2525
MAIL_USERNAME=*** REQUIRED ***
MAIL_PASSWORD=*** REQUIRED ***
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=staging@michaelschiemer.de
MAIL_FROM_NAME="Michael Schiemer (Staging)"
# Logging Configuration (Staging - More Verbose)
LOG_CHANNEL=stack
LOG_LEVEL=info
LOG_STACK_CHANNELS=single,daily
LOG_ROTATE_DAYS=7
LOG_MAX_FILES=5
# External APIs (Staging - Test Mode)
SHOPIFY_WEBHOOK_SECRET=staging-webhook-secret
RAPIDMAIL_USERNAME=*** REQUIRED ***
RAPIDMAIL_PASSWORD=*** REQUIRED ***
RAPIDMAIL_TEST_MODE=true
# Analytics Configuration (Staging)
ANALYTICS_ENABLED=true
ANALYTICS_TRACK_PAGE_VIEWS=true
ANALYTICS_TRACK_API_CALLS=true
ANALYTICS_TRACK_USER_ACTIONS=true
ANALYTICS_TRACK_ERRORS=true
ANALYTICS_TRACK_PERFORMANCE=true
# Monitoring & Health Checks (Staging)
PROMETHEUS_ENABLED=true
PROMETHEUS_PORT=9091
GRAFANA_ADMIN_PASSWORD=*** REQUIRED ***
# Security Configuration (Staging - Slightly Relaxed)
APP_KEY=*** REQUIRED - Generate with: openssl rand -base64 32 ***
CSRF_TOKEN_LIFETIME=7200
RATE_LIMIT_PER_MINUTE=120
MAX_LOGIN_ATTEMPTS=10
LOGIN_LOCKOUT_DURATION=300
# Performance Configuration (Staging)
PHP_MEMORY_LIMIT=512M
PHP_MAX_EXECUTION_TIME=60
PHP_OPCACHE_ENABLE=1
PHP_OPCACHE_MEMORY_CONSUMPTION=128
PHP_OPCACHE_MAX_ACCELERATED_FILES=10000
PHP_OPCACHE_REVALIDATE_FREQ=2
PHP_OPCACHE_VALIDATE_TIMESTAMPS=1
PHP_ERROR_REPORTING=E_ALL
PHP_DISPLAY_ERRORS=0
PHP_LOG_ERRORS=1
# Nginx Configuration (Staging)
NGINX_WORKER_PROCESSES=2
NGINX_WORKER_CONNECTIONS=1536
NGINX_KEEPALIVE_TIMEOUT=60
NGINX_CLIENT_MAX_BODY_SIZE=25m
# Database Performance (Staging)
MYSQL_INNODB_BUFFER_POOL_SIZE=512M
MYSQL_INNODB_LOG_FILE_SIZE=128M
MYSQL_MAX_CONNECTIONS=50
# Testing & Load Testing Configuration
K6_ENABLED=true
JAEGER_ENABLED=true
JAEGER_HOST=jaeger
JAEGER_PORT=14268
# Backup Configuration (Staging - Reduced)
BACKUP_ENABLED=true
BACKUP_SCHEDULE=0 3 * * 0
BACKUP_RETENTION_DAYS=7
# SSL/TLS Configuration (Staging)
SSL_PROTOCOLS=TLSv1.2 TLSv1.3
SSL_CIPHERS=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSL_PREFER_SERVER_CIPHERS=off
# Container User IDs (Staging)
UID=33
GID=33
# Restart Policy (Staging)
RESTART_POLICY=unless-stopped
# Resource Limits (Staging - Reduced)
PHP_MEMORY_LIMIT_DOCKER=768M
PHP_CPU_LIMIT=1.5
NGINX_MEMORY_LIMIT_DOCKER=192M
NGINX_CPU_LIMIT=0.4
DB_MEMORY_LIMIT_DOCKER=1G
DB_CPU_LIMIT=1.0
REDIS_MEMORY_LIMIT_DOCKER=640M
REDIS_CPU_LIMIT=0.4

View File

@@ -349,13 +349,20 @@
register: current_release_before
- name: Stop existing Docker containers (if any)
command: docker compose down
command: docker compose -f docker-compose.yml -f docker-compose.production.yml down
args:
chdir: "{{ current_path }}"
become_user: "{{ app_user }}"
when: current_release_before.stat.exists
ignore_errors: yes
- name: Remove any remaining containers (force cleanup all)
shell: |
docker stop certbot db redis php web queue-worker 2>/dev/null || true
docker rm certbot db redis php web queue-worker 2>/dev/null || true
become_user: "{{ app_user }}"
ignore_errors: yes
# ==========================================
# 8. Symlink Switch (Zero-Downtime)
# ==========================================