Skip to content

Commit 086dc4a

Browse files
Tob1asTob1as
committed
examples
1 parent bcf3741 commit 086dc4a

File tree

9 files changed

+249
-35
lines changed

9 files changed

+249
-35
lines changed

‎examples/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
All examples for WSC!
44

5-
* apache
65
* fpm-nginx-dhi
6+
* apache
77
* ...

‎examples/apache/.env.example‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,7 @@ TIMEZONE=Europe/Berlin
55
MYSQL_ROOT_PASSWORD=my-secret-pw
66
MYSQL_DATABASE=woltlab_suite
77
MYSQL_USER=woltlab_suite
8-
MYSQL_PASSWORD=my-secret-pw
8+
MYSQL_PASSWORD=my-secret-pw
9+
# Exporter
10+
MYSQL_EXPORTER_USER=exporter
11+
MYSQL_EXPORTER_PASSWORD=my-secret-pw

‎examples/apache/config/mysql_exporter-user.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# SOURCE: https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/config_mariadb/20_exporter-user.sh
5+
6+
: "${EXPORTER_USER:="exporter"}"
7+
: "${EXPORTER_PASSWORD:="Exp0rt3r!"}"
8+
: "${EXPORTER_MAXUSERCONNECTIONS:="3"}"
9+
host='%' # set '%' to allow from all host
10+
11+
mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sNe \
12+
"SELECT user FROM mysql.user WHERE user = '${EXPORTER_USER}' GROUP BY user;" \
13+
| grep -q ${EXPORTER_USER}} \
14+
|| mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sN <<EOSQL
15+
CREATE USER '${EXPORTER_USER}'@'${host}' IDENTIFIED BY '${EXPORTER_PASSWORD}' WITH MAX_USER_CONNECTIONS ${EXPORTER_MAXUSERCONNECTIONS};
16+
GRANT PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR ON *.* TO '${EXPORTER_USER}'@'${host}';
17+
GRANT SELECT ON performance_schema.* TO '${EXPORTER_USER}'@'${host}';
18+
FLUSH PRIVILEGES;
19+
EOSQL
20+
21+
mariadb -h localhost -u root --password=${MARIADB_ROOT_PASSWORD} -e "SELECT user, host, max_user_connections FROM mysql.user;"

‎examples/apache/config/traefik/dynamic/redirect-to-https.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
http:
2+
middlewares:
3+
redirect-to-https:
4+
redirectScheme:
5+
scheme: https
6+
permanent: true
7+
#port: 443

‎examples/apache/config/traefik/dynamic/ssl.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
tls:
2+
#stores:
3+
# default:
4+
# defaultCertificate:
5+
# certFile: /config/certs/ssl.crt
6+
# keyFile: /config/certs/ssl.key
7+
certificates:
8+
# first certificate
9+
- certFile: /config/certs/ssl.crt
10+
keyFile: /config/certs/ssl.key
11+
# second certificate
12+
#- certFile: /config/certs/other.crt
13+
# keyFile: /config/certs/other.key
14+
# and more ...

‎examples/apache/docker-compose.yml‎

Lines changed: 172 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ services:
4949
- "traefik.http.routers.wsc-https.entrypoints=websecure"
5050
- "traefik.http.routers.wsc-https.service=wsc"
5151
# load middlewares for routes
52-
- "traefik.http.routers.wsc-http.middlewares=wsc-https"
52+
- "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
5353
#- "traefik.http.routers.wsc-https.middlewares="
5454
# http to https redirect
5555
- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
@@ -66,6 +66,7 @@ services:
6666
volumes:
6767
- ./data-db:/var/lib/mysql:rw
6868
- ./config/mysql_wsc.cnf:/etc/mysql/conf.d/70-wsc.cnf:ro
69+
- ./config/mysql_exporter-user.sh:/docker-entrypoint-initdb.d/20_exporter-user.sh:ro
6970
environment:
7071
TZ: "${TIMEZONE:-Europe/Berlin}"
7172
MARIADB_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
@@ -74,11 +75,15 @@ services:
7475
MARIADB_PASSWORD: "${MYSQL_PASSWORD}"
7576
MARIADB_MYSQL_LOCALHOST_USER: "true"
7677
#MARIADB_AUTO_UPGRADE: 1
78+
# Exporter (mounted by script)
79+
EXPORTER_USER: "${MYSQL_EXPORTER_USER}"
80+
EXPORTER_PASSWORD: "${MYSQL_EXPORTER_PASSWORD}"
81+
#EXPORTER_MAXUSERCONNECTIONS: "3"
7782
#ports:
7883
# - 127.0.0.1:3306:3306/tcp
7984
healthcheck:
80-
test: mysqladmin ping -h 127.0.0.1 -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
81-
#test: mysqladmin ping -h 127.0.0.1 -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
85+
test: mariadb-admin ping -h 127.0.0.1 -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
86+
#test: mariadb-admin ping -h 127.0.0.1 -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
8287
#start_period: 10s
8388
interval: 30s
8489
timeout: 5s
@@ -89,10 +94,173 @@ services:
8994
- wsc-database
9095
- wsc-mysql
9196
- wsc-mariadb
97+
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
98+
99+
# # https://github.com/prometheus/mysqld_exporter
100+
# wsc-db-exporter:
101+
# image: docker.io/prom/mysqld-exporter:latest # quay.io/prometheus/mysqld-exporter:latest
102+
# container_name: wsc-db-exporter
103+
# restart: unless-stopped
104+
# command:
105+
# - --web.listen-address=:9104
106+
# - --web.telemetry-path=/metrics
107+
# - --mysqld.address=wsc-db:3306
108+
# - --mysqld.username=${MYSQL_EXPORTER_USER}
109+
# - --log.level=info
110+
# environment:
111+
# MYSQLD_EXPORTER_PASSWORD: ${MYSQL_EXPORTER_PASSWORD}
112+
# ports:
113+
# - 127.0.0.1:9104:9104/tcp
114+
# networks:
115+
# - wsc-net
116+
# #- monitoring-net
117+
# depends_on:
118+
# wsc-db:
119+
# condition: service_started # service_started or service_healthy
120+
# # Test: curl http://localhost:9104/metrics
121+
#
122+
# # https://github.com/Lusitaniae/apache_exporter
123+
# wsc-apache-exporter:
124+
# image: docker.io/lusotycoon/apache-exporter:latest # quay.io/lusitaniae/apache-exporter:latest
125+
# container_name: wsc-apache-exporter
126+
# restart: unless-stopped
127+
# command:
128+
# - --web.listen-address=:9117
129+
# - --telemetry.endpoint=/metrics
130+
# - --scrape_uri='http://wsc-php:80/server-status?auto'
131+
# - --log.level=info
132+
# ports:
133+
# - 127.0.0.1:9117:9117/tcp
134+
# networks:
135+
# - wsc-net
136+
# #- monitoring-net
137+
# depends_on:
138+
# wsc-php:
139+
# condition: service_started
140+
# # Test: curl http://127.0.0.1:9117/metrics
141+
142+
# https://hub.docker.com/_/traefik
143+
# https://github.com/traefik/traefik/
144+
# Docs: https://doc.traefik.io/traefik/
145+
traefik:
146+
image: docker.io/library/traefik:3
147+
container_name: traefik
148+
restart: unless-stopped
149+
environment:
150+
- TZ="${TIMEZONE:-Europe/Berlin}"
151+
ports:
152+
- "80:80/tcp" # http
153+
- "443:443/tcp" # https (tcp)
154+
- "443:443/udp" # https (udp) / HTTP3
155+
- "127.0.0.1:8082:8082/tcp" # Traefik Metrics
156+
#- "127.0.0.1:8080:8080/tcp" # Traefik Dashboard (if insecure enabled)
157+
command:
158+
# Entrypoints and Ports
159+
- "--entrypoints.web.address=:80"
160+
- "--entrypoints.websecure.address=:443"
161+
- "--entryPoints.websecure.http3"
162+
#- "--entryPoints.websecure.http3.advertisedport=443"
163+
- "--entryPoints.traefik.address=:8080"
164+
- "--entryPoints.metrics.address=:8082"
165+
# Monitoring (Prometheus and Ping)
166+
- "--entryPoints.metrics.address=:8082"
167+
- "--metrics.prometheus=true"
168+
- "--metrics.prometheus.entryPoint=metrics"
169+
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
170+
- "--metrics.prometheus.addEntryPointsLabels=true"
171+
- "--metrics.prometheus.addrouterslabels=true"
172+
- "--metrics.prometheus.addServicesLabels=true"
173+
- "--ping=true"
174+
- "--ping.entryPoint=metrics"
175+
# API and Dashboard
176+
- "--api=true"
177+
- "--api.dashboard=true"
178+
- "--api.basePath=/traefik"
179+
#- "--api.insecure=true"
180+
# Log and AccessLog
181+
- "--log.level=ERROR" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC
182+
- "--log.format=common" # common, json
183+
- "--accesslog=true"
184+
- "--accesslog.format=common" # common, genericCLF , json
185+
- "--accesslog.addinternals"
186+
- "--accesslog.fields.names.StartUTC=drop" # TimeZone (set to "drop", for use from env)
187+
# ServersTransport (internal/backend CA-Cert/SSL)
188+
- "--serversTransport.insecureSkipVerify=true"
189+
#- "--serversTransport.rootCAs=/config/certs/ca.crt"
190+
# Dynamic Configs
191+
- "--providers.file.directory=/config/dynamic"
192+
- "--providers.file.watch=true"
193+
# Optional: Plugins <https://plugins.traefik.io/plugins>
194+
# https://plugins.traefik.io/plugins/62947307108ecc83915d7783/rewrite-body
195+
#- "--experimental.plugins.rewrite.modulename=github.com/traefik/plugin-rewritebody"
196+
#- "--experimental.plugins.rewrite.version=v0.3.1"
197+
# https://plugins.traefik.io/plugins/62947354108ecc83915d778e/block-path
198+
#- "--experimental.plugins.block.modulename=github.com/traefik/plugin-blockpath"
199+
#- "--experimental.plugins.block.version=v0.2.1"
200+
# https://plugins.traefik.io/plugins/62947302108ecc83915d7781/geoblock
201+
#- "--experimental.plugins.geoblock.modulename=github.com/nscuro/traefik-plugin-geoblock"
202+
#- "--experimental.plugins.geoblock.version=v0.14.0"
203+
# Docker Provider (Traefik must run as root)
204+
- "--providers.docker=true"
205+
#- "--providers.docker.endpoint=unix:///var/run/docker.sock"
206+
- "--providers.docker.exposedbydefault=false"
207+
#- "--providers.docker.network=traefik"
208+
volumes:
209+
- /var/run/docker.sock:/var/run/docker.sock:ro # docker.sock for read labels
210+
- ./config/traefik/dynamic/:/config/dynamic/:ro # dynamic config files
211+
- ./ssl-certs/:/config/certs/:ro # ssl certs files
212+
networks:
213+
- traefik-net
214+
healthcheck:
215+
test: ['CMD', 'traefik', 'healthcheck', '--ping', "--entryPoints.ping.address=:8082", "--ping.entryPoint=ping"]
216+
#start_period: 10s
217+
interval: 30s
218+
timeout: 5s
219+
retries: 3
220+
# check with: "docker inspect --format='{{json .State.Health}}' traefik | jq"
221+
labels:
222+
# Explicitly tell Traefik to expose this container
223+
- "traefik.enable=true"
224+
- "traefik.docker.network=traefik-net"
225+
# http
226+
- "traefik.http.routers.traefik-http.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
227+
- "traefik.http.routers.traefik-http.entrypoints=web"
228+
- "traefik.http.routers.traefik-http.service=api@internal"
229+
# https
230+
- "traefik.http.routers.traefik-https.tls=true"
231+
- "traefik.http.routers.traefik-https.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
232+
- "traefik.http.routers.traefik-https.entrypoints=websecure"
233+
- "traefik.http.routers.traefik-https.service=api@internal"
234+
# load middlewares for routes
235+
- "traefik.http.routers.traefik-http.middlewares=traefik-https@docker,traefik-auth@docker"
236+
- "traefik.http.routers.traefik-https.middlewares=traefik-auth@docker"
237+
# Middleware: http to https redirect
238+
- "traefik.http.middlewares.traefik-https.redirectscheme.scheme=https"
239+
- "traefik.http.middlewares.traefik-https.redirectscheme.permanent=true"
240+
#- "traefik.http.middlewares.traefik-https.redirectscheme.port=443"
241+
# Middleware: auth
242+
# basic auth with htpasswd (You may need to escape any $ with another $ in password. create password: "docker run --rm tobi312/tools:htpasswd -bn admin 'passw0rd' | sed 's/\$/\$\$/g'" OR only for Password: "openssl passwd -apr1 'passw0rd' | sed 's/\$/\$\$/g'")
243+
- "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$6Yq5UCPq$$ZmXnIrJwqH0qfKRurLAiR1,traefik:$$apr1$$zIohxmBm$$TVYfYKcqYXOdONsU93L8w0"
244+
# URL for Webbrowser: https://example.com/traefik
92245

93246
networks:
94247
wsc-net:
95248
name: wsc-net
249+
#monitoring-net:
250+
# name: monitoring-net
251+
# external: true
96252
traefik-net:
97253
name: traefik-net
98-
external: true
254+
# external, script? https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/docker_network_create.sh
255+
#external: true
256+
# not external, but with IPv4 and IPv6:
257+
#driver: bridge
258+
#attachable: true
259+
#enable_ipv6: true
260+
#labels:
261+
# created.by: "docker-compose_WSC"
262+
#ipam:
263+
# driver: default
264+
# config:
265+
# - subnet: 172.20.0.0/24 # IPv4 Subnet
266+
# - subnet: fd00:dead:beef::/48 # IPv6 Subnet

‎examples/fpm-nginx-aio/config‎

Whitespace-only changes.

‎examples/fpm-nginx-dhi/config/traefik/dynamic/redirect-to-https.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@ http:
33
redirect-to-https:
44
redirectScheme:
55
scheme: https
6-
permanent: true
6+
permanent: true
7+
#port: 443

‎examples/fpm-nginx-dhi/docker-compose.yml‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ services:
1515
- ./config/php_fpm_status.conf:/opt/php/etc/php-fpm.d/y-status.conf:ro
1616
#depends_on:
1717
# wsc-db:
18-
# condition: service_started
18+
# condition: service_started # service_started or service_healthy
1919
networks:
2020
- wsc-net
2121

@@ -35,30 +35,30 @@ services:
3535
networks:
3636
- wsc-net
3737
- traefik-net
38-
# Labels for Traefik, works only with offical image and not with DHI, then use dynamic config files.
39-
labels:
40-
# Explicitly tell Traefik to expose this container
41-
- "traefik.enable=true"
42-
- "traefik.docker.network=traefik-net"
43-
# Tell Traefik to use the http port 8080 to connect to container
44-
- "traefik.http.services.wsc.loadbalancer.server.port=8080"
45-
- "traefik.http.services.wsc.loadbalancer.server.scheme=http" # when "https" then set "--serversTransport.insecureSkipVerify=true" for traefik
46-
# http
47-
- "traefik.http.routers.wsc-http.rule=Host(`${DOMAIN}`)"
48-
- "traefik.http.routers.wsc-http.entrypoints=web"
49-
- "traefik.http.routers.wsc-http.service=wsc"
50-
# https
51-
- "traefik.http.routers.wsc-https.tls=true"
52-
- "traefik.http.routers.wsc-https.rule=Host(`${DOMAIN}`)"
53-
- "traefik.http.routers.wsc-https.entrypoints=websecure"
54-
- "traefik.http.routers.wsc-https.service=wsc"
55-
# load middlewares for routes
56-
- "traefik.http.routers.wsc-http.middlewares=wsc-https"
57-
#- "traefik.http.routers.wsc-https.middlewares="
58-
# http to https redirect
59-
- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
60-
- "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
61-
#- "traefik.http.middlewares.wsc-https.redirectscheme.port=443"
38+
## Labels for Traefik, it works only with offical image and not with DHI, then use dynamic config files.
39+
#labels:
40+
# # Explicitly tell Traefik to expose this container
41+
# - "traefik.enable=true"
42+
# - "traefik.docker.network=traefik-net"
43+
# # Tell Traefik to use the http port 8080 to connect to container
44+
# - "traefik.http.services.wsc.loadbalancer.server.port=8080"
45+
# - "traefik.http.services.wsc.loadbalancer.server.scheme=http" # when "https" then set "--serversTransport.insecureSkipVerify=true" for traefik
46+
# # http
47+
# - "traefik.http.routers.wsc-http.rule=Host(`${DOMAIN}`)"
48+
# - "traefik.http.routers.wsc-http.entrypoints=web"
49+
# - "traefik.http.routers.wsc-http.service=wsc"
50+
# # https
51+
# - "traefik.http.routers.wsc-https.tls=true"
52+
# - "traefik.http.routers.wsc-https.rule=Host(`${DOMAIN}`)"
53+
# - "traefik.http.routers.wsc-https.entrypoints=websecure"
54+
# - "traefik.http.routers.wsc-https.service=wsc"
55+
# # load middlewares for routes
56+
# - "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
57+
# #- "traefik.http.routers.wsc-https.middlewares="
58+
# # http to https redirect
59+
# - "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
60+
# - "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
61+
# #- "traefik.http.middlewares.wsc-https.redirectscheme.port=443"
6262

6363
# https://dhi.io/catalog/mysql
6464
# command: mkdir ./data-db && chown 65532:65532 ./data-db
@@ -94,8 +94,8 @@ services:
9494
retries: 3
9595
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
9696
# TODO: only do this commands after first start when using dhi mysql image (create database and user with password form environment vars):
97-
# docker exec -it wsc-mysql bash -c 'mysql -uroot -e "CREATE DATABASE ${MYSQL_DATABASE};"'
98-
# docker exec -it wsc-mysql bash -c 'mysql -uroot -e "CREATE USER \"${MYSQL_USER}\"@\"%\" IDENTIFIED BY \"${MYSQL_PASSWORD}\"; GRANT ALL PRIVILEGES ON ${MYSQL_DATABASE}.* TO \"${MYSQL_USER}\"@\"%\";"'
97+
# docker exec -it wsc-db bash -c 'mysql -uroot -e "CREATE DATABASE ${MYSQL_DATABASE};"'
98+
# docker exec -it wsc-db bash -c 'mysql -uroot -e "CREATE USER \"${MYSQL_USER}\"@\"%\" IDENTIFIED BY \"${MYSQL_PASSWORD}\"; GRANT ALL PRIVILEGES ON ${MYSQL_DATABASE}.* TO \"${MYSQL_USER}\"@\"%\";"'
9999

100100
# # https://dhi.io/catalog/mysqld-exporter
101101
# # (Docs: https://github.com/prometheus/mysqld_exporter)
@@ -118,7 +118,7 @@ services:
118118
# #- monitoring-net
119119
# depends_on:
120120
# wsc-db:
121-
# condition: service_started
121+
# condition: service_started # service_started or service_healthy
122122
# # TODO: only do this commands after first start (create exporter user and permission)
123123
# # MYSQL_EXPORTER_USER=$(grep '^MYSQL_EXPORTER_USER=' .env | cut -d= -f2-)
124124
# # MYSQL_EXPORTER_PASSWORD=$(grep '^MYSQL_EXPORTER_PASSWORD=' .env | cut -d= -f2-)

0 commit comments

Comments
 (0)