Skip to content

Commit b2139c3

Browse files
Tob1asTob1as
committed
examples
1 parent bca991b commit b2139c3

File tree

10 files changed

+342
-1
lines changed

10 files changed

+342
-1
lines changed

‎examples/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,5 @@ All examples for [WSC (WoltLab Suite Core)](https://www.woltlab.com/en/woltlab-s
77
* fpm-nginx-doi: like fpm-nginx-dhi, but Docker Offical Images (DOI, from Community) and also without entrypoint script.
88
* fpm-nginx: like fpm-nginx-doi, but Docker Offical Images with entrypoint script from this repo. (Notice: mysql replaced by mariadb)
99
* fpm-nginx-aio: like fpm-nginx, but php-fpm and nginx in single container/image with entrypoint script from this repo.
10-
* apache: apache2 and php in single container/image, mariadb, traefik, prometheus-exporters with entrypoint script from this repo.
10+
* apache: apache2 and php in single container/image, mariadb, traefik, prometheus-exporters with entrypoint script from this repo.
11+
* apache-doi: like apache, but without entryoint script.

‎examples/apache-doi/.env.example‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# General
2+
DOMAIN=example.com
3+
TIMEZONE=Europe/Berlin
4+
# Database (MySQL/MariaDB)
5+
MYSQL_ROOT_PASSWORD=my-secret-pw
6+
MYSQL_DATABASE=woltlab_suite
7+
MYSQL_USER=woltlab_suite
8+
MYSQL_PASSWORD=my-secret-pw
9+
# Exporter
10+
MYSQL_EXPORTER_USER=exporter
11+
MYSQL_EXPORTER_PASSWORD=my-secret-pw

‎examples/apache-doi/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# PHP - Examples: [PHP & Apache2] & MariaDB (using DOI)
2+
3+
> PHP & Apache2
4+
> ... without entrypoint Script from this repo! Or you must mount it.

‎examples/apache-doi/config/mysql_exporter-user.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# SOURCE: https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/config_mariadb/20_exporter-user.sh
5+
6+
: "${EXPORTER_USER:="exporter"}"
7+
: "${EXPORTER_PASSWORD:="Exp0rt3r!"}"
8+
: "${EXPORTER_MAXUSERCONNECTIONS:="3"}"
9+
host='%' # set '%' to allow from all host
10+
11+
mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sNe \
12+
"SELECT user FROM mysql.user WHERE user = '${EXPORTER_USER}' GROUP BY user;" \
13+
| grep -q ${EXPORTER_USER}} \
14+
|| mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sN <<EOSQL
15+
CREATE USER '${EXPORTER_USER}'@'${host}' IDENTIFIED BY '${EXPORTER_PASSWORD}' WITH MAX_USER_CONNECTIONS ${EXPORTER_MAXUSERCONNECTIONS};
16+
GRANT PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR ON *.* TO '${EXPORTER_USER}'@'${host}';
17+
GRANT SELECT ON performance_schema.* TO '${EXPORTER_USER}'@'${host}';
18+
FLUSH PRIVILEGES;
19+
EOSQL
20+
21+
mariadb -h localhost -u root --password=${MARIADB_ROOT_PASSWORD} -e "SELECT user, host, max_user_connections FROM mysql.user;"

‎examples/apache-doi/config/mysql_wsc.cnf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[server]
2+
innodb_buffer_pool_size = 512M

‎examples/apache-doi/config/php_wsc.ini‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[PHP]
2+
date.timezone=Europe/Berlin
3+
display_errors = Off
4+
memory_limit = 256M
5+
post_max_size = 250M
6+
upload_max_filesize = 250M
7+
max_file_uploads = 20
8+
max_execution_time = 120
9+
10+
; https://www.php.net/manual/en/opcache.configuration.php
11+
[opcache]
12+
opcache.enable=1
13+
opcache.memory_consumption=192
14+
opcache.interned_strings_buffer=16
15+
opcache.max_accelerated_files=10000
16+
opcache.max_wasted_percentage=10
17+
opcache.validate_timestamps=1
18+
opcache.revalidate_freq=2
19+
opcache.save_comments=1

‎examples/apache-doi/config/traefik/dynamic/disable-traefik-default-cert.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# https://github.com/traefik/traefik/issues/9945#issuecomment-1590229681
2+
# https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-certificates/#strict-sni-checking
3+
# https://www.ssllabs.com/ssltest/
4+
tls:
5+
options:
6+
default:
7+
sniStrict: true # <----- Strict SNI Checking
8+
# minVersion: VersionTLS12
9+
# cipherSuites:
10+
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
11+
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 # TLS 1.2
12+
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
13+
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
14+
# - TLS_AES_256_GCM_SHA384 # TLS 1.3
15+
# - TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
16+
# - TLS_FALLBACK_SCSV # TLS FALLBACK
17+
# curvePreferences:
18+
# - secp521r1
19+
# - secp384r1
20+
#modern:
21+
# minVersion: VersionTLS13

‎examples/apache-doi/config/traefik/dynamic/redirect-to-https.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
http:
2+
middlewares:
3+
redirect-to-https:
4+
redirectScheme:
5+
scheme: https
6+
permanent: true
7+
#port: 443

‎examples/apache-doi/config/traefik/dynamic/ssl.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
tls:
2+
#stores:
3+
# default:
4+
# defaultCertificate:
5+
# certFile: /config/certs/ssl.crt
6+
# keyFile: /config/certs/ssl.key
7+
certificates:
8+
# first certificate
9+
- certFile: /config/certs/ssl.crt
10+
keyFile: /config/certs/ssl.key
11+
# second certificate
12+
#- certFile: /config/certs/other.crt
13+
# keyFile: /config/certs/other.key
14+
# and more ...

‎examples/apache-doi/docker-compose.yml‎

Lines changed: 241 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,241 @@
1+
services:
2+
3+
# https://github.com/Tob1as/docker-php
4+
# based on: https://hub.docker.com/_/php (https://github.com/docker-library/php)
5+
# command: mkdir ./html && chown 33:33 ./html
6+
wsc-php:
7+
image: docker.io/tobi312/php:8.4-doi-apache-debian-wsc
8+
container_name: wsc-php
9+
restart: unless-stopped
10+
#ports:
11+
# - 80:80/tcp
12+
volumes:
13+
- ./html:/var/www/html:rw
14+
- ./config/php_wsc.ini:/usr/local/etc/php/conf.d/60-wsc.ini:ro # use for php settings when not mount entrypoint.sh
15+
#- ./config/entrypoint.sh:/usr/local/bin/entrypoint.sh:ro # source: https://github.com/Tob1as/docker-php/raw/refs/heads/master/entrypoint.sh
16+
#entrypoint: [ "entrypoint.sh" ]
17+
#command: [ "apache2-foreground" ]
18+
environment:
19+
TZ: "${TIMEZONE:-Europe/Berlin}"
20+
## next ENVs only works when mount entrypoint.sh !
21+
#PHP_ERRORS: 0
22+
#PHP_MEM_LIMIT: 256
23+
#PHP_POST_MAX_SIZE: 250
24+
#PHP_UPLOAD_MAX_FILESIZE: 250
25+
#PHP_MAX_FILE_UPLOADS: 20
26+
#PHP_MAX_EXECUTION_TIME: 120
27+
#PHP_SET_OPCACHE_SETTINGS: 1
28+
#ENABLE_APACHE_REWRITE: 1
29+
#ENABLE_APACHE_ALLOWOVERRIDE: 1
30+
#ENABLE_APACHE_REMOTEIP: 1
31+
#ENABLE_APACHE_STATUS: 1
32+
#APACHE_SERVER_NAME: "${DOMAIN}"
33+
#APACHE_SERVER_ADMIN: "webmaster@${DOMAIN}"
34+
#depends_on:
35+
# wsc-mariadb:
36+
# condition: service_started # service_started or service_healthy
37+
networks:
38+
- wsc-net
39+
- traefik-net
40+
healthcheck:
41+
test: ["CMD-SHELL", "nc -zv -w 3 127.0.0.1 80 || exit 1"]
42+
#start_period: 10s
43+
interval: 30s
44+
timeout: 5s
45+
retries: 3
46+
labels:
47+
# Explicitly tell Traefik to expose this container
48+
- "traefik.enable=true"
49+
- "traefik.docker.network=traefik-net"
50+
# Tell Traefik to use the http port 80 to connect to container
51+
- "traefik.http.services.wsc.loadbalancer.server.port=80"
52+
- "traefik.http.services.wsc.loadbalancer.server.scheme=http" # when "https" then set "--serversTransport.insecureSkipVerify=true" for traefik
53+
# http
54+
- "traefik.http.routers.wsc-http.rule=Host(`${DOMAIN}`) && PathPrefix(`/`)"
55+
- "traefik.http.routers.wsc-http.entrypoints=web"
56+
- "traefik.http.routers.wsc-http.service=wsc"
57+
# https
58+
- "traefik.http.routers.wsc-https.tls=true"
59+
- "traefik.http.routers.wsc-https.rule=Host(`${DOMAIN}`) && PathPrefix(`/`)"
60+
- "traefik.http.routers.wsc-https.entrypoints=websecure"
61+
- "traefik.http.routers.wsc-https.service=wsc"
62+
# load middlewares for routes
63+
#- "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
64+
- "traefik.http.routers.wsc-http.middlewares=redirect-to-https@file"
65+
#- "traefik.http.routers.wsc-https.middlewares="
66+
# http to https redirect
67+
#- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
68+
#- "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
69+
#- "traefik.http.middlewares.wsc-https.redirectscheme.port=443"
70+
71+
# https://hub.docker.com/_/mariadb
72+
# https://github.com/MariaDB/mariadb-docker
73+
# command: mkdir ./data-db && chown 999:999 ./data-db
74+
wsc-db:
75+
image: docker.io/library/mariadb:11.4
76+
container_name: wsc-db
77+
restart: unless-stopped
78+
volumes:
79+
- ./data-db:/var/lib/mysql:rw
80+
- ./config/mysql_wsc.cnf:/etc/mysql/conf.d/70-wsc.cnf:ro
81+
- ./config/mysql_exporter-user.sh:/docker-entrypoint-initdb.d/20_exporter-user.sh:ro
82+
environment:
83+
TZ: "${TIMEZONE:-Europe/Berlin}"
84+
MARIADB_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
85+
MARIADB_DATABASE: "${MYSQL_DATABASE:-wcf}"
86+
MARIADB_USER: "${MYSQL_USER}"
87+
MARIADB_PASSWORD: "${MYSQL_PASSWORD}"
88+
MARIADB_MYSQL_LOCALHOST_USER: "true"
89+
#MARIADB_AUTO_UPGRADE: 1
90+
# Exporter (mounted by script)
91+
EXPORTER_USER: "${MYSQL_EXPORTER_USER}"
92+
EXPORTER_PASSWORD: "${MYSQL_EXPORTER_PASSWORD}"
93+
#EXPORTER_MAXUSERCONNECTIONS: "3"
94+
#ports:
95+
# - 127.0.0.1:3306:3306/tcp
96+
networks:
97+
wsc-net:
98+
aliases:
99+
- wsc-database
100+
- wsc-mysql
101+
- wsc-mariadb
102+
healthcheck:
103+
test: mariadb-admin ping -h localhost -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
104+
#test: mariadb-admin ping -h localhost -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
105+
#start_period: 10s
106+
interval: 30s
107+
timeout: 5s
108+
retries: 3
109+
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
110+
111+
# need exporter ?, then :
112+
# 1. mount entrypoint.sh
113+
# 2. copy wsc-db-exporter and wsc-apache-exporter
114+
# from https://raw.githubusercontent.com/Tob1as/docker-php/refs/heads/master/examples/apache/docker-compose.yml
115+
116+
# https://hub.docker.com/_/traefik
117+
# https://github.com/traefik/traefik/
118+
# Docs: https://doc.traefik.io/traefik/
119+
traefik:
120+
image: docker.io/library/traefik:3
121+
container_name: traefik
122+
restart: unless-stopped
123+
environment:
124+
- TZ="${TIMEZONE:-Europe/Berlin}"
125+
ports:
126+
- "80:80/tcp" # http
127+
- "443:443/tcp" # https (tcp)
128+
- "443:443/udp" # https (udp) / HTTP3
129+
- "127.0.0.1:8082:8082/tcp" # Traefik Metrics
130+
#- "127.0.0.1:8080:8080/tcp" # Traefik Dashboard (if insecure enabled)
131+
command:
132+
# Entrypoints and Ports
133+
- "--entrypoints.web.address=:80"
134+
- "--entrypoints.websecure.address=:443"
135+
- "--entryPoints.websecure.http3"
136+
#- "--entryPoints.websecure.http3.advertisedport=443"
137+
- "--entryPoints.traefik.address=:8080"
138+
- "--entryPoints.metrics.address=:8082"
139+
# Monitoring (Prometheus and Ping)
140+
- "--entryPoints.metrics.address=:8082"
141+
- "--metrics.prometheus=true"
142+
- "--metrics.prometheus.entryPoint=metrics"
143+
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
144+
- "--metrics.prometheus.addEntryPointsLabels=true"
145+
- "--metrics.prometheus.addrouterslabels=true"
146+
- "--metrics.prometheus.addServicesLabels=true"
147+
- "--ping=true"
148+
- "--ping.entryPoint=metrics"
149+
# API and Dashboard
150+
- "--api=true"
151+
- "--api.dashboard=true"
152+
- "--api.basePath=/traefik"
153+
#- "--api.insecure=true"
154+
# Log and AccessLog
155+
- "--log.level=ERROR" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC
156+
- "--log.format=common" # common, json
157+
- "--accesslog=true"
158+
- "--accesslog.format=common" # common, genericCLF , json
159+
- "--accesslog.addinternals"
160+
- "--accesslog.fields.names.StartUTC=drop" # TimeZone (set to "drop", for use from env)
161+
# ServersTransport (internal/backend CA-Cert/SSL)
162+
- "--serversTransport.insecureSkipVerify=true"
163+
#- "--serversTransport.rootCAs=/config/certs/ca.crt"
164+
# Dynamic Configs
165+
- "--providers.file.directory=/config/dynamic"
166+
- "--providers.file.watch=true"
167+
# Optional: Plugins <https://plugins.traefik.io/plugins>
168+
# https://plugins.traefik.io/plugins/62947307108ecc83915d7783/rewrite-body
169+
#- "--experimental.plugins.rewrite.modulename=github.com/traefik/plugin-rewritebody"
170+
#- "--experimental.plugins.rewrite.version=v0.3.1"
171+
# https://plugins.traefik.io/plugins/62947354108ecc83915d778e/block-path
172+
#- "--experimental.plugins.block.modulename=github.com/traefik/plugin-blockpath"
173+
#- "--experimental.plugins.block.version=v0.2.1"
174+
# https://plugins.traefik.io/plugins/62947302108ecc83915d7781/geoblock
175+
#- "--experimental.plugins.geoblock.modulename=github.com/nscuro/traefik-plugin-geoblock"
176+
#- "--experimental.plugins.geoblock.version=v0.14.0"
177+
# Docker Provider (Traefik must run as root)
178+
- "--providers.docker=true"
179+
#- "--providers.docker.endpoint=unix:///var/run/docker.sock"
180+
- "--providers.docker.exposedbydefault=false"
181+
#- "--providers.docker.network=traefik"
182+
volumes:
183+
- /var/run/docker.sock:/var/run/docker.sock:ro # docker.sock for read labels
184+
- ./config/traefik/dynamic/:/config/dynamic/:ro # dynamic config files
185+
- ./ssl-certs/:/config/certs/:ro # ssl certs files
186+
networks:
187+
- traefik-net
188+
healthcheck:
189+
test: ['CMD', 'traefik', 'healthcheck', '--ping', "--entryPoints.ping.address=:8082", "--ping.entryPoint=ping"]
190+
#start_period: 10s
191+
interval: 30s
192+
timeout: 5s
193+
retries: 3
194+
# check with: "docker inspect --format='{{json .State.Health}}' traefik | jq"
195+
labels:
196+
# Explicitly tell Traefik to expose this container
197+
- "traefik.enable=true"
198+
- "traefik.docker.network=traefik-net"
199+
# http
200+
- "traefik.http.routers.traefik-http.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
201+
- "traefik.http.routers.traefik-http.entrypoints=web"
202+
- "traefik.http.routers.traefik-http.service=api@internal"
203+
# https
204+
- "traefik.http.routers.traefik-https.tls=true"
205+
- "traefik.http.routers.traefik-https.rule=Host(`${DOMAIN}`) && PathPrefix(`/traefik`)"
206+
- "traefik.http.routers.traefik-https.entrypoints=websecure"
207+
- "traefik.http.routers.traefik-https.service=api@internal"
208+
# load middlewares for routes
209+
#- "traefik.http.routers.traefik-http.middlewares=traefik-https@docker,traefik-auth@docker"
210+
- "traefik.http.routers.traefik-http.middlewares=redirect-to-https@file,traefik-auth@docker"
211+
- "traefik.http.routers.traefik-https.middlewares=traefik-auth@docker"
212+
# Middleware: http to https redirect
213+
#- "traefik.http.middlewares.traefik-https.redirectscheme.scheme=https"
214+
#- "traefik.http.middlewares.traefik-https.redirectscheme.permanent=true"
215+
#- "traefik.http.middlewares.traefik-https.redirectscheme.port=443"
216+
# Middleware: auth
217+
# basic auth with htpasswd (You may need to escape any $ with another $ in password. create password: "docker run --rm tobi312/tools:htpasswd -bn admin 'passw0rd' | sed 's/\$/\$\$/g'" OR only for Password: "openssl passwd -apr1 'passw0rd' | sed 's/\$/\$\$/g'")
218+
- "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$6Yq5UCPq$$ZmXnIrJwqH0qfKRurLAiR1,traefik:$$apr1$$zIohxmBm$$TVYfYKcqYXOdONsU93L8w0"
219+
# URL for Webbrowser: https://example.com/traefik
220+
221+
networks:
222+
wsc-net:
223+
name: wsc-net
224+
#monitoring-net:
225+
# name: monitoring-net
226+
# external: true
227+
traefik-net:
228+
name: traefik-net
229+
# external, script? https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/docker_network_create.sh
230+
#external: true
231+
# not external, but with IPv4 and IPv6:
232+
#driver: bridge
233+
#attachable: true
234+
#enable_ipv6: true
235+
#labels:
236+
# created.by: "docker-compose_WSC"
237+
#ipam:
238+
# driver: default
239+
# config:
240+
# - subnet: 172.20.0.0/24 # IPv4 Subnet
241+
# - subnet: fd00:dead:beef::/48 # IPv6 Subnet

0 commit comments

Comments
 (0)