Git-Mirrors/mat2-web
1
0
Fork 0
mirror of https://0xacab.org/jvoisin/mat2-web.git synced 2025-05-21 07:30:33 -04:00
Code Issues Projects Releases Packages Wiki Activity

use a non root user to start nginx

Browse source
This commit is contained in:
Jan Friedli 2020-03-28 13:45:19 +01:00
parent 853ace7d83
commit 40d4fdad9e
No known key found for this signature in database
GPG key ID: F945FA2FCA30549D
3 changed files with 116 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

47
Dockerfile.production
View file

@ -1,23 +1,46 @@
# https://github.com/nginxinc/docker-nginx-unprivileged/blob/master/stable/buster/Dockerfile
From debian:buster-slim
LABEL maintainer="Mat-Web Maintainer <jan.friedli@immerda.ch>"
WORKDIR /var/www/mat2-web
COPY . /var/www/mat2-web
RUN apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests --yes \
RUN set -x \
&& addgroup --system --gid 101 nginx \
&& adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 101 nginx \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y \
gnupg1 \
ca-certificates \
nginx \
gettext-base \
systemd \
mat2 \
uwsgi \
uwsgi-plugin-python3 \
nginx-light \
python3-pip \
python3-setuptools \
python3-wheel \
&& rm -rf /var/cache/apt/* /var/lib/apt/lists/* \
&& pip3 install -r requirements.txt \
&& mkdir ./uploads \
&& chown -R www-data:www-data . \
&& cp ./config/uwsgi.config /etc/uwsgi/apps-enabled/mat2-web.ini \
&& rm /etc/nginx/sites-enabled/default \
&& mkdir -p /etc/nginx/sites-enabled/ \
&& cp ./config/nginx.config /etc/nginx/sites-enabled/mat2.conf
&& pip3 install -r requirements.txt \
&& rm /etc/nginx/sites-enabled/default /etc/nginx/nginx.conf \
&& cp ./config/nginx-default.conf /etc/nginx/sites-enabled/default \
&& cp ./config/nginx.conf /etc/nginx/nginx.conf \
&& cp ./config/uwsgi.config /etc/uwsgi/apps-enabled/mat2-web.ini \
&& chown 101:101 /etc/uwsgi/apps-enabled/mat2-web.ini \
&& mkdir -p /var/cache/nginx \
&& chown -R 101:0 /var/cache/nginx \
&& chmod -R g+w /var/cache/nginx \
&& ln -sf /dev/stdout /var/log/nginx/access.log \
&& ln -sf /dev/stderr /var/log/nginx/error.log \
&& rm -rf /var/cache/apt/* /var/lib/apt/lists/* \
&& mkdir ./uploads \
&& chown -R nginx:nginx .
CMD ["sh", "-c", "/etc/init.d/nginx restart; uwsgi --ini /etc/uwsgi/apps-enabled/mat2-web.ini"]
STOPSIGNAL SIGTERM
USER 101
CMD ["sh", "-c", "nginx; uwsgi --ini /etc/uwsgi/apps-enabled/mat2-web.ini;"]

4
config/nginx.config → config/nginx-default.conf
View file

@ -1,7 +1,7 @@
server {
server_name _;
listen 80 default_server;
listen [::]:80 default_server;
listen 8080 default_server;
listen [::]:8080 default_server;
client_max_body_size 20M;
root /var/www/mat2-web;

69
config/nginx.conf Normal file
View file

@ -0,0 +1,69 @@
user nginx;
worker_processes auto;
pid /tmp/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
proxy_temp_path /tmp/proxy_temp;
client_body_temp_path /tmp/client_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
}