chore: initial upload
This commit is contained in:
parent
71a904dc63
commit
9585718e0e
8 changed files with 532 additions and 0 deletions
56
docker-images/backend-node.Dockerfile
Normal file
56
docker-images/backend-node.Dockerfile
Normal file
|
|
@ -0,0 +1,56 @@
|
||||||
|
# Start from base image (built on Docker host)
|
||||||
|
FROM git.kakio.us/kakious/coder-base:latest
|
||||||
|
|
||||||
|
# Install everything as root
|
||||||
|
USER root
|
||||||
|
|
||||||
|
# Install Node
|
||||||
|
RUN curl -sL https://deb.nodesource.com/setup_19.x | bash -
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get update -y && \
|
||||||
|
apt-get install -y nodejs
|
||||||
|
|
||||||
|
# Install Yarn
|
||||||
|
RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
|
||||||
|
RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get update && apt-get install -y yarn
|
||||||
|
|
||||||
|
# Create the persistent data folder
|
||||||
|
RUN mkdir -p /data
|
||||||
|
|
||||||
|
# Install MySQL
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y mysql-server
|
||||||
|
|
||||||
|
# Move the data folder to the persistent data folder and grant mysql access to it
|
||||||
|
RUN mv /var/lib/mysql /data/mysql
|
||||||
|
RUN echo "datadir = /data/mysql" >> /etc/mysql/mysql.conf.d/mysqld.cnf
|
||||||
|
RUN usermod -a -G coder mysql
|
||||||
|
|
||||||
|
# Create a symbolic link to the persistent data folder just in case
|
||||||
|
RUN ln -s /data/mysql /var/lib/mysql
|
||||||
|
|
||||||
|
# Install Redis
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y redis-server
|
||||||
|
|
||||||
|
# Install the latest redisjson
|
||||||
|
RUN wget https://redismodules.s3.amazonaws.com/rejson/rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip
|
||||||
|
RUN unzip rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip
|
||||||
|
RUN mkdir -p /usr/lib/redis/modules
|
||||||
|
RUN cp rejson.so /usr/lib/redis/modules/rejson.so
|
||||||
|
RUN rm rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip && rm rejson.so
|
||||||
|
|
||||||
|
# Update the redis config to include loadmodule
|
||||||
|
RUN echo "loadmodule /usr/lib/redis/modules/rejson.so" >> /etc/redis/redis.conf
|
||||||
|
|
||||||
|
# Install the latest rabbitmq
|
||||||
|
RUN apt install -y rabbitmq-server
|
||||||
|
RUN ln -s /data/rabbitmq /var/lib/rabbitmq
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
RUN sudo usermod -d /data/mysql/ mysql
|
||||||
|
|
||||||
|
# Make sure the services are started on the start of the container
|
||||||
|
CMD service mysql start && service redis-server start && service rabbitmq-server start && /usr/bin/code-server --bind-addr
|
||||||
|
|
||||||
|
# Set back to coder user
|
||||||
|
USER coder
|
||||||
69
docker-images/backend-php.Dockerfile
Normal file
69
docker-images/backend-php.Dockerfile
Normal file
|
|
@ -0,0 +1,69 @@
|
||||||
|
# Start from base image (built on Docker host)
|
||||||
|
FROM git.kakio.us/kakious/coder-base:latest
|
||||||
|
|
||||||
|
# Install everything as root
|
||||||
|
USER root
|
||||||
|
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get update
|
||||||
|
|
||||||
|
# Create the persistent data folder
|
||||||
|
RUN mkdir -p /data
|
||||||
|
|
||||||
|
# Install MySQL
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y mysql-server
|
||||||
|
|
||||||
|
# Move the data folder to the persistent data folder and grant mysql access to it
|
||||||
|
RUN mv /var/lib/mysql /data/mysql
|
||||||
|
RUN echo "datadir = /data/mysql" >> /etc/mysql/mysql.conf.d/mysqld.cnf
|
||||||
|
RUN usermod -a -G coder mysql
|
||||||
|
|
||||||
|
# Create a symbolic link to the persistent data folder just in case
|
||||||
|
RUN ln -s /data/mysql /var/lib/mysql
|
||||||
|
|
||||||
|
# Install Redis
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y redis-server
|
||||||
|
|
||||||
|
# Install the latest redisjson
|
||||||
|
RUN wget https://redismodules.s3.amazonaws.com/rejson/rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip
|
||||||
|
RUN unzip rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip
|
||||||
|
RUN mkdir -p /usr/lib/redis/modules
|
||||||
|
RUN cp rejson.so /usr/lib/redis/modules/rejson.so
|
||||||
|
RUN rm rejson.Linux-ubuntu20.04-x86_64.2.4.5.zip && rm rejson.so
|
||||||
|
|
||||||
|
# Update the redis config to include loadmodule
|
||||||
|
RUN echo "loadmodule /usr/lib/redis/modules/rejson.so" >> /etc/redis/redis.conf
|
||||||
|
|
||||||
|
# Install the latest rabbitmq
|
||||||
|
RUN apt install -y rabbitmq-server
|
||||||
|
RUN ln -s /data/rabbitmq /var/lib/rabbitmq
|
||||||
|
|
||||||
|
RUN sudo usermod -d /data/mysql/ mysql
|
||||||
|
|
||||||
|
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" add-apt-repository ppa:ondrej/php -y
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get update
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y php8.2 php8.2-cli php8.2-bz2 php8.2-curl php8.2-mbstring php8.2-intl php8.2-apcu php8.2-redis php8.2-fpm
|
||||||
|
|
||||||
|
# Install Composer
|
||||||
|
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
|
||||||
|
|
||||||
|
|
||||||
|
#Configure PHP-FPM
|
||||||
|
RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php/8.2/fpm/php.ini
|
||||||
|
RUN sed -i 's/;apc.enable_cli=0/apc.enable_cli=1/g' /etc/php/8.2/fpm/php.ini
|
||||||
|
|
||||||
|
# Install NGINX
|
||||||
|
RUN DEBIAN_FRONTEND="noninteractive" apt-get install -y nginx
|
||||||
|
|
||||||
|
# Setup Nginx config
|
||||||
|
RUN rm /etc/nginx/sites-enabled/default
|
||||||
|
|
||||||
|
#Download nginx config from git
|
||||||
|
RUN wget https://raw.githubusercontent.com/kakious/coder/main/nginx.conf -O /etc/nginx/sites-enabled/default
|
||||||
|
|
||||||
|
|
||||||
|
# Make sure the services are started on the start of the container
|
||||||
|
CMD service mysql start && service redis-server start && service rabbitmq-server start && service php8.2-fpm start && service nginx start
|
||||||
|
|
||||||
|
# Set back to coder user
|
||||||
|
USER coder
|
||||||
33
docker-images/main.Dockerfile
Normal file
33
docker-images/main.Dockerfile
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
FROM ubuntu:jammy
|
||||||
|
|
||||||
|
RUN apt-get update && \
|
||||||
|
DEBIAN_FRONTEND="noninteractive" apt-get install --yes \
|
||||||
|
bash \
|
||||||
|
build-essential \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
htop \
|
||||||
|
locales \
|
||||||
|
man \
|
||||||
|
python3 \
|
||||||
|
python3-pip \
|
||||||
|
software-properties-common \
|
||||||
|
sudo \
|
||||||
|
systemd \
|
||||||
|
systemd-sysv \
|
||||||
|
unzip \
|
||||||
|
vim \
|
||||||
|
wget && \
|
||||||
|
# Install latest Git using their official PPA
|
||||||
|
add-apt-repository ppa:git-core/ppa && \
|
||||||
|
DEBIAN_FRONTEND="noninteractive" apt-get install --yes git
|
||||||
|
|
||||||
|
# Add a user `coder` so that you're not developing as the `root` user
|
||||||
|
RUN useradd coder \
|
||||||
|
--create-home \
|
||||||
|
--shell=/bin/bash \
|
||||||
|
--uid=1001 \
|
||||||
|
--user-group && \
|
||||||
|
echo "coder ALL=(ALL) NOPASSWD:ALL" >>/etc/sudoers.d/nopasswd
|
||||||
|
|
||||||
|
USER coder
|
||||||
259
fox-api/main.tf
Normal file
259
fox-api/main.tf
Normal file
|
|
@ -0,0 +1,259 @@
|
||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
coder = {
|
||||||
|
source = "coder/coder"
|
||||||
|
version = "~> 0.8.3"
|
||||||
|
}
|
||||||
|
docker = {
|
||||||
|
source = "kreuzwerker/docker"
|
||||||
|
version = "~> 3.0.1"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
username = data.coder_workspace.me.owner
|
||||||
|
}
|
||||||
|
|
||||||
|
data "coder_provisioner" "me" {
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "docker" {
|
||||||
|
}
|
||||||
|
|
||||||
|
data "coder_workspace" "me" {
|
||||||
|
}
|
||||||
|
|
||||||
|
data "coder_git_auth" "github" {
|
||||||
|
# Matches the ID of the git auth provider in Coder.
|
||||||
|
id = "primary-github"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "coder_app" "fox_api" {
|
||||||
|
agent_id = coder_agent.main.id
|
||||||
|
slug = "fox-api"
|
||||||
|
display_name = "F.O.X. API"
|
||||||
|
icon = "https://media.furality.online/boop/furality.png"
|
||||||
|
url = "http://localhost:8080"
|
||||||
|
share = "public"
|
||||||
|
subdomain = false
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "coder_agent" "main" {
|
||||||
|
arch = data.coder_provisioner.me.arch
|
||||||
|
os = "linux"
|
||||||
|
|
||||||
|
startup_script_timeout = 180
|
||||||
|
startup_script = <<-EOT
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# start the services
|
||||||
|
echo "[SETUP] Starting core services (sql and redis)"
|
||||||
|
sudo service mysql start 2>&1 /dev/null
|
||||||
|
sudo service redis-server start 2>&1 /dev/null
|
||||||
|
echo "[SETUP] Core services started"
|
||||||
|
|
||||||
|
if [ ! -f ~/.coder-env ]; then
|
||||||
|
echo "[SETUP] Creating ~/.coder-env"
|
||||||
|
echo "WORKSPACE_ENV=$WORKSPACE_ENV" >> ~/.coder-env
|
||||||
|
echo "USERNAME_ENV=$USERNAME_ENV" >> ~/.coder-env
|
||||||
|
echo "[SETUP] Created ~/.coder-env"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -d ~/oauth-provider ]; then
|
||||||
|
echo "[SETUP] Cloning Github Repo"
|
||||||
|
git clone https://github.com/furality/oauth-provider/
|
||||||
|
|
||||||
|
echo "[SETUP] Git Keys imported"
|
||||||
|
|
||||||
|
|
||||||
|
echo "Downloading setup script from git"
|
||||||
|
wget -q -O ~/setup-script.sh https://git.kakio.us/kakious/docker-images/raw/branch/main/boop-keys/setup-fox.sh
|
||||||
|
echo "[SETUP] Downloaded setup script from git"
|
||||||
|
chmod +x ~/setup-script.sh
|
||||||
|
|
||||||
|
echo "[SETUP] Running Setup Script"
|
||||||
|
sudo ./setup-script.sh 2>&1 /dev/null
|
||||||
|
echo "[SETUP] Setup Script Done"
|
||||||
|
cd ~/oauth-provider
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[SETUP] Setup Complete"
|
||||||
|
EOT
|
||||||
|
|
||||||
|
env = {
|
||||||
|
GIT_AUTHOR_NAME = "${data.coder_workspace.me.owner}"
|
||||||
|
GIT_COMMITTER_NAME = "${data.coder_workspace.me.owner}"
|
||||||
|
GIT_AUTHOR_EMAIL = "${data.coder_workspace.me.owner_email}"
|
||||||
|
GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
|
||||||
|
GITHUB_TOKEN = "${data.coder_git_auth.github.access_token}"
|
||||||
|
WORKSPACE_ENV = "${data.coder_workspace.me.name}"
|
||||||
|
USERNAME_ENV = "${data.coder_workspace.me.owner}"
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "RAM Usage"
|
||||||
|
key = "1_ram_usage"
|
||||||
|
script = "coder stat mem"
|
||||||
|
interval = 10
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "Home Disk"
|
||||||
|
key = "3_home_disk"
|
||||||
|
script = "coder stat disk --path $${HOME}"
|
||||||
|
interval = 60
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "CPU Usage (Host)"
|
||||||
|
key = "4_cpu_usage_host"
|
||||||
|
script = "coder stat cpu --host"
|
||||||
|
interval = 10
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "Memory Usage (Host)"
|
||||||
|
key = "5_mem_usage_host"
|
||||||
|
script = "coder stat mem --host"
|
||||||
|
interval = 10
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "Load Average (Host)"
|
||||||
|
key = "6_load_host"
|
||||||
|
# get load avg scaled by number of cores
|
||||||
|
script = <<EOT
|
||||||
|
echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
|
||||||
|
EOT
|
||||||
|
interval = 60
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
metadata {
|
||||||
|
display_name = "Swap Usage (Host)"
|
||||||
|
key = "7_swap_host"
|
||||||
|
script = <<EOT
|
||||||
|
free -b | awk '/^Swap/ { printf("%.1f/%.1f", $3/1024.0/1024.0/1024.0, $2/1024.0/1024.0/1024.0) }'
|
||||||
|
EOT
|
||||||
|
interval = 10
|
||||||
|
timeout = 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "docker_volume" "home_volume" {
|
||||||
|
name = "coder-${data.coder_workspace.me.id}-home"
|
||||||
|
# Protect the volume from being deleted due to changes in attributes.
|
||||||
|
lifecycle {
|
||||||
|
ignore_changes = all
|
||||||
|
}
|
||||||
|
# Add labels in Docker to keep track of orphan resources.
|
||||||
|
labels {
|
||||||
|
label = "coder.owner"
|
||||||
|
value = data.coder_workspace.me.owner
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.owner_id"
|
||||||
|
value = data.coder_workspace.me.owner_id
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_id"
|
||||||
|
value = data.coder_workspace.me.id
|
||||||
|
}
|
||||||
|
# This field becomes outdated if the workspace is renamed but can
|
||||||
|
# be useful for debugging or cleaning out dangling volumes.
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_name_at_creation"
|
||||||
|
value = data.coder_workspace.me.name
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "docker_volume" "data_volume" {
|
||||||
|
name = "coder-${data.coder_workspace.me.id}-data"
|
||||||
|
# Protect the volume from being deleted due to changes in attributes.
|
||||||
|
lifecycle {
|
||||||
|
ignore_changes = all
|
||||||
|
}
|
||||||
|
# Add labels in Docker to keep track of orphan resources.
|
||||||
|
labels {
|
||||||
|
label = "coder.owner"
|
||||||
|
value = data.coder_workspace.me.owner
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.owner_id"
|
||||||
|
value = data.coder_workspace.me.owner_id
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_id"
|
||||||
|
value = data.coder_workspace.me.id
|
||||||
|
}
|
||||||
|
# This field becomes outdated if the workspace is renamed but can
|
||||||
|
# be useful for debugging or cleaning out dangling volumes.
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_name_at_creation"
|
||||||
|
value = data.coder_workspace.me.name
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
data "docker_registry_image" "main" {
|
||||||
|
name = "git.kakio.us/kakious/coder-backend:latest"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "docker_image" "main" {
|
||||||
|
name = data.docker_registry_image.main.name
|
||||||
|
pull_triggers = [data.docker_registry_image.main.sha256_digest]
|
||||||
|
force_remove = false
|
||||||
|
keep_locally = true
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "docker_container" "workspace" {
|
||||||
|
count = data.coder_workspace.me.start_count
|
||||||
|
image = docker_image.main.name
|
||||||
|
# Uses lower() to avoid Docker restriction on container names.
|
||||||
|
name = "${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
|
||||||
|
# Hostname makes the shell more user friendly: coder@my-workspace:~$
|
||||||
|
hostname = data.coder_workspace.me.name
|
||||||
|
memory = "4098"
|
||||||
|
memory_swap = "-1"
|
||||||
|
# Use the docker gateway if the access URL is 127.0.0.1
|
||||||
|
entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
|
||||||
|
env = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
|
||||||
|
host {
|
||||||
|
host = "host.docker.internal"
|
||||||
|
ip = "host-gateway"
|
||||||
|
}
|
||||||
|
volumes {
|
||||||
|
container_path = "/home/coder"
|
||||||
|
volume_name = docker_volume.home_volume.name
|
||||||
|
read_only = false
|
||||||
|
}
|
||||||
|
|
||||||
|
volumes {
|
||||||
|
container_path = "/data"
|
||||||
|
volume_name = docker_volume.data_volume.name
|
||||||
|
read_only = false
|
||||||
|
}
|
||||||
|
# Add labels in Docker to keep track of orphan resources.
|
||||||
|
labels {
|
||||||
|
label = "coder.owner"
|
||||||
|
value = data.coder_workspace.me.owner
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.owner_id"
|
||||||
|
value = data.coder_workspace.me.owner_id
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_id"
|
||||||
|
value = data.coder_workspace.me.id
|
||||||
|
}
|
||||||
|
labels {
|
||||||
|
label = "coder.workspace_name"
|
||||||
|
value = data.coder_workspace.me.name
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
53
fox-api/nginx/nginx.conf
Normal file
53
fox-api/nginx/nginx.conf
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
# Generated by nginxconfig.io
|
||||||
|
|
||||||
|
user www-data;
|
||||||
|
pid /run/nginx.pid;
|
||||||
|
worker_processes auto;
|
||||||
|
worker_rlimit_nofile 65535;
|
||||||
|
|
||||||
|
events {
|
||||||
|
multi_accept on;
|
||||||
|
worker_connections 65535;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
charset utf-8;
|
||||||
|
sendfile on;
|
||||||
|
tcp_nopush on;
|
||||||
|
tcp_nodelay on;
|
||||||
|
server_tokens off;
|
||||||
|
log_not_found off;
|
||||||
|
types_hash_max_size 2048;
|
||||||
|
client_max_body_size 16M;
|
||||||
|
|
||||||
|
# MIME
|
||||||
|
include mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
# logging
|
||||||
|
access_log /var/log/nginx/access.log;
|
||||||
|
error_log /var/log/nginx/error.log warn;
|
||||||
|
|
||||||
|
# SSL
|
||||||
|
ssl_session_timeout 1d;
|
||||||
|
ssl_session_cache shared:SSL:10m;
|
||||||
|
ssl_session_tickets off;
|
||||||
|
|
||||||
|
# Diffie-Hellman parameter for DHE ciphersuites
|
||||||
|
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||||
|
|
||||||
|
# Mozilla Intermediate configuration
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||||
|
|
||||||
|
# OCSP Stapling
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
|
||||||
|
resolver_timeout 2s;
|
||||||
|
|
||||||
|
# load configs
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
include /etc/nginx/sites-enabled/*;
|
||||||
|
}
|
||||||
|
|
||||||
32
fox-api/nginx/nginxconfig.io/general.conf
Normal file
32
fox-api/nginx/nginxconfig.io/general.conf
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# favicon.ico
|
||||||
|
location = /favicon.ico {
|
||||||
|
log_not_found off;
|
||||||
|
access_log off;
|
||||||
|
}
|
||||||
|
|
||||||
|
# robots.txt
|
||||||
|
location = /robots.txt {
|
||||||
|
log_not_found off;
|
||||||
|
access_log off;
|
||||||
|
}
|
||||||
|
|
||||||
|
# assets, media
|
||||||
|
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
|
||||||
|
expires 7d;
|
||||||
|
access_log off;
|
||||||
|
}
|
||||||
|
|
||||||
|
# svg, fonts
|
||||||
|
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
|
||||||
|
add_header Access-Control-Allow-Origin "*";
|
||||||
|
expires 7d;
|
||||||
|
access_log off;
|
||||||
|
}
|
||||||
|
|
||||||
|
# gzip
|
||||||
|
gzip on;
|
||||||
|
gzip_vary on;
|
||||||
|
gzip_proxied any;
|
||||||
|
gzip_comp_level 6;
|
||||||
|
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
|
||||||
|
|
||||||
17
fox-api/nginx/nginxconfig.io/php_fastcgi.conf
Normal file
17
fox-api/nginx/nginxconfig.io/php_fastcgi.conf
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
# 404
|
||||||
|
try_files $fastcgi_script_name =404;
|
||||||
|
|
||||||
|
# default fastcgi_params
|
||||||
|
include fastcgi_params;
|
||||||
|
|
||||||
|
# fastcgi settings
|
||||||
|
fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
|
||||||
|
fastcgi_index index.php;
|
||||||
|
fastcgi_buffers 8 16k;
|
||||||
|
fastcgi_buffer_size 32k;
|
||||||
|
|
||||||
|
# fastcgi params
|
||||||
|
fastcgi_param DOCUMENT_ROOT $realpath_root;
|
||||||
|
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
|
||||||
|
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$base/:/usr/lib/php/:/tmp/";
|
||||||
|
|
||||||
13
fox-api/nginx/nginxconfig.io/security.conf
Normal file
13
fox-api/nginx/nginxconfig.io/security.conf
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# security headers
|
||||||
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||||
|
add_header X-XSS-Protection "1; mode=block" always;
|
||||||
|
add_header X-Content-Type-Options "nosniff" always;
|
||||||
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||||
|
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
|
||||||
|
# . files
|
||||||
|
location ~ /\.(?!well-known) {
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
|
||||||
Loading…
Reference in a new issue