Skip to content

Commit ade9bbb

Browse files
Tob1asTob1as
committed
examples
1 parent f7e9a30 commit ade9bbb

File tree

9 files changed

+387
-17
lines changed

9 files changed

+387
-17
lines changed

‎examples/README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
# PHP - Examples
22

3-
All examples for WSC!
3+
All examples for [WSC (WoltLab Suite Core)](https://www.woltlab.com/en/woltlab-suite-download/)!
44

5-
* fpm-nginx-dhi
6-
* apache
7-
* ...
5+
* fpm-nginx-dhi: php-fpm, nginx, mysql, traefik, prometheus-exporters - only using DHI (Docker Hardened Images)
6+
* fpm-nginx: like fpm-nginx-dhi, but offical docker community images and other (Notice: mysql replaced by mariadb)
7+
* fpm-nginx-aio: like fpm-nginx, but php-fpm and nginx in single container/image
8+
* apache: apache2 and php in single container/image, mariadb, traefik, prometheus-exporters

‎examples/apache/docker-compose.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ services:
1919
PHP_UPLOAD_MAX_FILESIZE: 250
2020
PHP_MAX_FILE_UPLOADS: 20
2121
PHP_MAX_EXECUTION_TIME: 120
22+
PHP_SET_OPCACHE_SETTINGS: 1
2223
## next env only with apache
2324
ENABLE_APACHE_REWRITE: 1
2425
ENABLE_APACHE_ALLOWOVERRIDE: 1

‎examples/fpm-nginx-aio/config/mysql_exporter-user.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# SOURCE: https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/config_mariadb/20_exporter-user.sh
5+
6+
: "${EXPORTER_USER:="exporter"}"
7+
: "${EXPORTER_PASSWORD:="Exp0rt3r!"}"
8+
: "${EXPORTER_MAXUSERCONNECTIONS:="3"}"
9+
host='%' # set '%' to allow from all host
10+
11+
mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sNe \
12+
"SELECT user FROM mysql.user WHERE user = '${EXPORTER_USER}' GROUP BY user;" \
13+
| grep -q ${EXPORTER_USER}} \
14+
|| mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sN <<EOSQL
15+
CREATE USER '${EXPORTER_USER}'@'${host}' IDENTIFIED BY '${EXPORTER_PASSWORD}' WITH MAX_USER_CONNECTIONS ${EXPORTER_MAXUSERCONNECTIONS};
16+
GRANT PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR ON *.* TO '${EXPORTER_USER}'@'${host}';
17+
GRANT SELECT ON performance_schema.* TO '${EXPORTER_USER}'@'${host}';
18+
FLUSH PRIVILEGES;
19+
EOSQL
20+
21+
mariadb -h localhost -u root --password=${MARIADB_ROOT_PASSWORD} -e "SELECT user, host, max_user_connections FROM mysql.user;"

‎examples/fpm-nginx-aio/config/mysql_wsc.cnf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[server]
2+
innodb_buffer_pool_size = 512M

‎examples/fpm-nginx-aio/config/traefik/dynamic/disable-traefik-default-cert.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# https://github.com/traefik/traefik/issues/9945#issuecomment-1590229681
2+
# https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-certificates/#strict-sni-checking
3+
# https://www.ssllabs.com/ssltest/
4+
tls:
5+
options:
6+
default:
7+
sniStrict: true # <----- Strict SNI Checking
8+
# minVersion: VersionTLS12
9+
# cipherSuites:
10+
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
11+
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 # TLS 1.2
12+
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
13+
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
14+
# - TLS_AES_256_GCM_SHA384 # TLS 1.3
15+
# - TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
16+
# - TLS_FALLBACK_SCSV # TLS FALLBACK
17+
# curvePreferences:
18+
# - secp521r1
19+
# - secp384r1
20+
#modern:
21+
# minVersion: VersionTLS13

‎examples/fpm-nginx-aio/config/traefik/dynamic/redirect-to-https.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
http:
2+
middlewares:
3+
redirect-to-https:
4+
redirectScheme:
5+
scheme: https
6+
permanent: true
7+
#port: 443

‎examples/fpm-nginx-aio/config/traefik/dynamic/ssl.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
tls:
2+
#stores:
3+
# default:
4+
# defaultCertificate:
5+
# certFile: /config/certs/ssl.crt
6+
# keyFile: /config/certs/ssl.key
7+
certificates:
8+
# first certificate
9+
- certFile: /config/certs/ssl.crt
10+
keyFile: /config/certs/ssl.key
11+
# second certificate
12+
#- certFile: /config/certs/other.crt
13+
# keyFile: /config/certs/other.key
14+
# and more ...

‎examples/fpm-nginx-aio/docker-compose.yml‎

Lines changed: 295 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,295 @@
1+
services:
2+
3+
# https://github.com/Tob1as/docker-php
4+
# based on: https://hub.docker.com/_/php (https://github.com/docker-library/php)
5+
# command: mkdir ./html && chown 33:33 ./html
6+
wsc-php:
7+
image: docker.io/tobi312/php:8.4-fpm-nginx-alpine-wsc
8+
container_name: wsc-php
9+
restart: unless-stopped
10+
#ports:
11+
# - 80:80/tcp
12+
volumes:
13+
- ./html:/var/www/html:rw
14+
environment:
15+
TZ: "${TIMEZONE:-Europe/Berlin}"
16+
PHP_ERRORS: 0
17+
PHP_MEM_LIMIT: 256
18+
PHP_POST_MAX_SIZE: 250
19+
PHP_UPLOAD_MAX_FILESIZE: 250
20+
PHP_MAX_FILE_UPLOADS: 20
21+
PHP_MAX_EXECUTION_TIME: 120
22+
ENABLE_PHP_FPM_STATUS: 1
23+
PHP_SET_OPCACHE_SETTINGS: 1
24+
# nginx
25+
ENABLE_NGINX_REMOTEIP: 1
26+
ENABLE_NGINX_STATUS: 1
27+
#depends_on:
28+
# wsc-db:
29+
# condition: service_started # service_started or service_healthy
30+
networks:
31+
- wsc-net
32+
- traefik-net
33+
labels:
34+
# Explicitly tell Traefik to expose this container
35+
- "traefik.enable=true"
36+
- "traefik.docker.network=traefik-net"
37+
# Tell Traefik to use the http port to connect to container
38+
- "traefik.http.services.wsc.loadbalancer.server.port=80"
39+
- "traefik.http.services.wsc.loadbalancer.server.scheme=http" # when "https" then set "--serversTransport.insecureSkipVerify=true" for traefik
40+
# http
41+
- "traefik.http.routers.wsc-http.rule=Host(`${DOMAIN}`)"
42+
- "traefik.http.routers.wsc-http.entrypoints=web"
43+
- "traefik.http.routers.wsc-http.service=wsc"
44+
# https
45+
- "traefik.http.routers.wsc-https.tls=true"
46+
- "traefik.http.routers.wsc-https.rule=Host(`${DOMAIN}`)"
47+
- "traefik.http.routers.wsc-https.entrypoints=websecure"
48+
- "traefik.http.routers.wsc-https.service=wsc"
49+
# load middlewares for routes
50+
#- "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
51+
- "traefik.http.routers.wsc-http.middlewares=redirect-to-https@file"
52+
#- "traefik.http.routers.wsc-https.middlewares="
53+
# http to https redirect
54+
#- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
55+
#- "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
56+
#- "traefik.http.middlewares.wsc-https.redirectscheme.port=443"
57+
healthcheck:
58+
test: curl --silent --fail --insecure http://localhost:80/php_fpm_ping || exit 1
59+
#start_period: 10s
60+
interval: 30s
61+
timeout: 5s
62+
retries: 3
63+
# check with: "docker inspect --format='{{json .State.Health}}' wsc-php | jq"
64+
65+
# https://hub.docker.com/_/mariadb
66+
# https://github.com/MariaDB/mariadb-docker
67+
# command: mkdir ./data-db && chown 999:999 ./data-db
68+
wsc-db:
69+
image: docker.io/library/mariadb:11.4
70+
container_name: wsc-db
71+
restart: unless-stopped
72+
volumes:
73+
- ./data-db:/var/lib/mysql:rw
74+
- ./config/mysql_wsc.cnf:/etc/mysql/conf.d/70-wsc.cnf:ro
75+
- ./config/mysql_exporter-user.sh:/docker-entrypoint-initdb.d/20_exporter-user.sh:ro
76+
environment:
77+
TZ: "${TIMEZONE:-Europe/Berlin}"
78+
MARIADB_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
79+
MARIADB_DATABASE: "${MYSQL_DATABASE:-wcf}"
80+
MARIADB_USER: "${MYSQL_USER}"
81+
MARIADB_PASSWORD: "${MYSQL_PASSWORD}"
82+
MARIADB_MYSQL_LOCALHOST_USER: "true"
83+
#MARIADB_AUTO_UPGRADE: 1
84+
# Exporter (mounted by script)
85+
EXPORTER_USER: "${MYSQL_EXPORTER_USER}"
86+
EXPORTER_PASSWORD: "${MYSQL_EXPORTER_PASSWORD}"
87+
#EXPORTER_MAXUSERCONNECTIONS: "3"
88+
#ports:
89+
# - 127.0.0.1:3306:3306/tcp
90+
networks:
91+
wsc-net:
92+
aliases:
93+
- wsc-database
94+
- wsc-mysql
95+
- wsc-mariadb
96+
healthcheck:
97+
test: mariadb-admin ping -h localhost -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
98+
#test: mariadb-admin ping -h localhost -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
99+
#start_period: 10s
100+
interval: 30s
101+
timeout: 5s
102+
retries: 3
103+
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
104+
105+
# # https://github.com/prometheus/mysqld_exporter
106+
# wsc-db-exporter:
107+
# image: docker.io/prom/mysqld-exporter:latest # quay.io/prometheus/mysqld-exporter:latest
108+
# container_name: wsc-db-exporter
109+
# restart: unless-stopped
110+
# command:
111+
# - --web.listen-address=:9104
112+
# - --web.telemetry-path=/metrics
113+
# - --mysqld.address=wsc-db:3306
114+
# - --mysqld.username=${MYSQL_EXPORTER_USER}
115+
# - --log.level=info
116+
# environment:
117+
# MYSQLD_EXPORTER_PASSWORD: ${MYSQL_EXPORTER_PASSWORD}
118+
# ports:
119+
# - 127.0.0.1:9104:9104/tcp
120+
# networks:
121+
# - wsc-net
122+
# #- monitoring-net
123+
# depends_on:
124+
# wsc-db:
125+
# condition: service_started # service_started or service_healthy
126+
# # Test: curl http://localhost:9104/metrics
127+
#
128+
# # https://github.com/nginx/nginx-prometheus-exporter
129+
# wsc-nginx-exporter:
130+
# image: docker.io/nginx/nginx-prometheus-exporter:latest
131+
# container_name: wsc-nginx-exporter
132+
# restart: unless-stopped
133+
# command:
134+
# - --web.listen-address=:9113
135+
# - --web.telemetry-path=/metrics
136+
# - --nginx.scrape-uri=http://wsc-php:80/nginx_status
137+
# #- --no-nginx.ssl-verify
138+
# - --log.level=info
139+
# ports:
140+
# - 127.0.0.1:9113:9113/tcp
141+
# networks:
142+
# - wsc-net
143+
# #- monitoring-net
144+
# depends_on:
145+
# wsc-php:
146+
# condition: service_started # service_started or service_healthy
147+
# # Test: curl http://127.0.0.1:9113/metrics
148+
#
149+
# # https://github.com/hipages/php-fpm_exporter
150+
# wsc-php-fpm-exporter:
151+
# image: docker.io/hipages/php-fpm_exporter:latest # ghcr.io/hipages/php-fpm_exporter:latest
152+
# container_name: wsc-php-fpm-exporter
153+
# restart: unless-stopped
154+
# command:
155+
# - --web.listen-address=:9253
156+
# - --web.telemetry-path=/metrics
157+
# - --phpfpm.scrape-uri=tcp://wsc-php:9001/php_fpm_status
158+
# - --phpfpm.fix-process-count=false
159+
# - --log.level=info
160+
# ports:
161+
# - 127.0.0.1:9253:9253/tcp
162+
# networks:
163+
# - wsc-net
164+
# #- monitoring-net
165+
# depends_on:
166+
# wsc-php:
167+
# condition: service_started # service_started or service_healthy
168+
# # Test: curl http://127.0.0.1:9253/metrics
169+
170+
# https://hub.docker.com/_/traefik
171+
# https://github.com/traefik/traefik/
172+
# Docs: https://doc.traefik.io/traefik/
173+
traefik:
174+
image: docker.io/library/traefik:3
175+
container_name: traefik
176+
restart: unless-stopped
177+
environment:
178+
- TZ="${TIMEZONE:-Europe/Berlin}"
179+
ports:
180+
- "80:80/tcp" # http
181+
- "443:443/tcp" # https (tcp)
182+
- "443:443/udp" # https (udp) / HTTP3
183+
- "127.0.0.1:8082:8082/tcp" # Traefik Metrics
184+
#- "127.0.0.1:8080:8080/tcp" # Traefik Dashboard (if insecure enabled)
185+
command:
186+
# Entrypoints and Ports
187+
- "--entrypoints.web.address=:80"
188+
- "--entrypoints.websecure.address=:443"
189+
- "--entryPoints.websecure.http3"
190+
#- "--entryPoints.websecure.http3.advertisedport=443"
191+
- "--entryPoints.traefik.address=:8080"
192+
- "--entryPoints.metrics.address=:8082"
193+
# Monitoring (Prometheus and Ping)
194+
- "--entryPoints.metrics.address=:8082"
195+
- "--metrics.prometheus=true"
196+
- "--metrics.prometheus.entryPoint=metrics"
197+
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
198+
- "--metrics.prometheus.addEntryPointsLabels=true"
199+
- "--metrics.prometheus.addrouterslabels=true"
200+
- "--metrics.prometheus.addServicesLabels=true"
201+
- "--ping=true"
202+
- "--ping.entryPoint=metrics"
203+
# API and Dashboard
204+
- "--api=true"
205+
- "--api.dashboard=true"
206+
- "--api.basePath=/traefik"
207+
#- "--api.insecure=true"
208+
# Log and AccessLog
209+
- "--log.level=ERROR" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC
210+
- "--log.format=common" # common, json
211+
- "--accesslog=true"
212+
- "--accesslog.format=common" # common, genericCLF , json
213+
- "--accesslog.addinternals"
214+
- "--accesslog.fields.names.StartUTC=drop" # TimeZone (set to "drop", for use from env)
215+
# ServersTransport (internal/backend CA-Cert/SSL)
216+
- "--serversTransport.insecureSkipVerify=true"
217+
#- "--serversTransport.rootCAs=/config/certs/ca.crt"
218+
# Dynamic Configs
219+
- "--providers.file.directory=/config/dynamic"
220+
- "--providers.file.watch=true"
221+
# Optional: Plugins <https://plugins.traefik.io/plugins>
222+
# https://plugins.traefik.io/plugins/62947307108ecc83915d7783/rewrite-body
223+
#- "--experimental.plugins.rewrite.modulename=github.com/traefik/plugin-rewritebody"
224+
#- "--experimental.plugins.rewrite.version=v0.3.1"
225+
# https://plugins.traefik.io/plugins/62947354108ecc83915d778e/block-path
226+
#- "--experimental.plugins.block.modulename=github.com/traefik/plugin-blockpath"
227+
#- "--experimental.plugins.block.version=v0.2.1"
228+
# https://plugins.traefik.io/plugins/62947302108ecc83915d7781/geoblock
229+
#- "--experimental.plugins.geoblock.modulename=github.com/nscuro/traefik-plugin-geoblock"
230+
#- "--experimental.plugins.geoblock.version=v0.14.0"
231+
# Docker Provider (Traefik must run as root)
232+
- "--providers.docker=true"
233+
#- "--providers.docker.endpoint=unix:///var/run/docker.sock"
234+
- "--providers.docker.exposedbydefault=false"
235+
#- "--providers.docker.network=traefik"
236+
volumes:
237+
- /var/run/docker.sock:/var/run/docker.sock:ro # docker.sock for read labels
238+
- ./config/traefik/dynamic/:/config/dynamic/:ro # dynamic config files
239+
- ./ssl-certs/:/config/certs/:ro # ssl certs files
240+
networks:
241+
- traefik-net
242+
healthcheck:
243+
test: ['CMD', 'traefik', 'healthcheck', '--ping', "--entryPoints.ping.address=:8082", "--ping.entryPoint=ping"]
244+
#start_period: 10s
245+
interval: 30s
246+
timeout: 5s
247+
retries: 3
248+
# check with: "docker inspect --format='{{json .State.Health}}' traefik | jq"
249+
labels:
250+
# Explicitly tell Traefik to expose this container
251+
- "traefik.enable=true"
252+
- "traefik.docker.network=traefik-net"
253+
# http
254+
- "traefik.http.routers.traefik-http.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
255+
- "traefik.http.routers.traefik-http.entrypoints=web"
256+
- "traefik.http.routers.traefik-http.service=api@internal"
257+
# https
258+
- "traefik.http.routers.traefik-https.tls=true"
259+
- "traefik.http.routers.traefik-https.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
260+
- "traefik.http.routers.traefik-https.entrypoints=websecure"
261+
- "traefik.http.routers.traefik-https.service=api@internal"
262+
# load middlewares for routes
263+
#- "traefik.http.routers.traefik-http.middlewares=traefik-https@docker,traefik-auth@docker"
264+
- "traefik.http.routers.traefik-http.middlewares=redirect-to-https@file,traefik-auth@docker"
265+
- "traefik.http.routers.traefik-https.middlewares=traefik-auth@docker"
266+
# Middleware: http to https redirect
267+
#- "traefik.http.middlewares.traefik-https.redirectscheme.scheme=https"
268+
#- "traefik.http.middlewares.traefik-https.redirectscheme.permanent=true"
269+
#- "traefik.http.middlewares.traefik-https.redirectscheme.port=443"
270+
# Middleware: auth
271+
# basic auth with htpasswd (You may need to escape any $ with another $ in password. create password: "docker run --rm tobi312/tools:htpasswd -bn admin 'passw0rd' | sed 's/\$/\$\$/g'" OR only for Password: "openssl passwd -apr1 'passw0rd' | sed 's/\$/\$\$/g'")
272+
- "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$6Yq5UCPq$$ZmXnIrJwqH0qfKRurLAiR1,traefik:$$apr1$$zIohxmBm$$TVYfYKcqYXOdONsU93L8w0"
273+
# URL for Webbrowser: https://example.com/traefik
274+
275+
networks:
276+
wsc-net:
277+
name: wsc-net
278+
#monitoring-net:
279+
# name: monitoring-net
280+
# external: true
281+
traefik-net:
282+
name: traefik-net
283+
# external, script? https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/docker_network_create.sh
284+
#external: true
285+
# not external, but with IPv4 and IPv6:
286+
#driver: bridge
287+
#attachable: true
288+
#enable_ipv6: true
289+
#labels:
290+
# created.by: "docker-compose_WSC"
291+
#ipam:
292+
# driver: default
293+
# config:
294+
# - subnet: 172.20.0.0/24 # IPv4 Subnet
295+
# - subnet: fd00:dead:beef::/48 # IPv6 Subnet

0 commit comments

Comments
 (0)