Skip to content

Commit d786ee7

Browse files
Tob1asTob1as
committed
examples
1 parent 6f48be4 commit d786ee7

8 files changed

Lines changed: 487 additions & 14 deletions

File tree

‎examples/apache/docker-compose.yml‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,12 @@ services:
4949
- "traefik.http.routers.wsc-https.entrypoints=websecure"
5050
- "traefik.http.routers.wsc-https.service=wsc"
5151
# load middlewares for routes
52-
- "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
52+
#- "traefik.http.routers.wsc-http.middlewares=wsc-https@docker"
53+
- "traefik.http.routers.wsc-http.middlewares=redirect-to-https@file"
5354
#- "traefik.http.routers.wsc-https.middlewares="
5455
# http to https redirect
55-
- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
56-
- "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
56+
#- "traefik.http.middlewares.wsc-https.redirectscheme.scheme=https"
57+
#- "traefik.http.middlewares.wsc-https.redirectscheme.permanent=true"
5758
#- "traefik.http.middlewares.wsc-https.redirectscheme.port=443"
5859

5960
# https://hub.docker.com/_/mariadb
@@ -81,20 +82,20 @@ services:
8182
#EXPORTER_MAXUSERCONNECTIONS: "3"
8283
#ports:
8384
# - 127.0.0.1:3306:3306/tcp
84-
healthcheck:
85-
test: mariadb-admin ping -h 127.0.0.1 -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
86-
#test: mariadb-admin ping -h 127.0.0.1 -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
87-
#start_period: 10s
88-
interval: 30s
89-
timeout: 5s
90-
retries: 3
9185
networks:
9286
wsc-net:
9387
aliases:
9488
- wsc-database
9589
- wsc-mysql
9690
- wsc-mariadb
97-
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
91+
healthcheck:
92+
test: mariadb-admin ping -h localhost -u root --password=$$MARIADB_ROOT_PASSWORD || exit 1
93+
#test: mariadb-admin ping -h localhost -u $$MARIADB_USER --password=$$MARIADB_PASSWORD || exit 1
94+
#start_period: 10s
95+
interval: 30s
96+
timeout: 5s
97+
retries: 3
98+
# check with: "docker inspect --format='{{json .State.Health}}' wsc-db | jq"
9899

99100
# # https://github.com/prometheus/mysqld_exporter
100101
# wsc-db-exporter:
@@ -232,11 +233,12 @@ services:
232233
- "traefik.http.routers.traefik-https.entrypoints=websecure"
233234
- "traefik.http.routers.traefik-https.service=api@internal"
234235
# load middlewares for routes
235-
- "traefik.http.routers.traefik-http.middlewares=traefik-https@docker,traefik-auth@docker"
236+
#- "traefik.http.routers.traefik-http.middlewares=traefik-https@docker,traefik-auth@docker"
237+
- "traefik.http.routers.traefik-http.middlewares=redirect-to-https@file,traefik-auth@docker"
236238
- "traefik.http.routers.traefik-https.middlewares=traefik-auth@docker"
237239
# Middleware: http to https redirect
238-
- "traefik.http.middlewares.traefik-https.redirectscheme.scheme=https"
239-
- "traefik.http.middlewares.traefik-https.redirectscheme.permanent=true"
240+
#- "traefik.http.middlewares.traefik-https.redirectscheme.scheme=https"
241+
#- "traefik.http.middlewares.traefik-https.redirectscheme.permanent=true"
240242
#- "traefik.http.middlewares.traefik-https.redirectscheme.port=443"
241243
# Middleware: auth
242244
# basic auth with htpasswd (You may need to escape any $ with another $ in password. create password: "docker run --rm tobi312/tools:htpasswd -bn admin 'passw0rd' | sed 's/\$/\$\$/g'" OR only for Password: "openssl passwd -apr1 'passw0rd' | sed 's/\$/\$\$/g'")

‎examples/fpm-nginx/config/mysql_exporter-user.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# SOURCE: https://github.com/Tob1as/docker-kubernetes-collection/blob/master/examples_docker-compose/config_mariadb/20_exporter-user.sh
5+
6+
: "${EXPORTER_USER:="exporter"}"
7+
: "${EXPORTER_PASSWORD:="Exp0rt3r!"}"
8+
: "${EXPORTER_MAXUSERCONNECTIONS:="3"}"
9+
host='%' # set '%' to allow from all host
10+
11+
mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sNe \
12+
"SELECT user FROM mysql.user WHERE user = '${EXPORTER_USER}' GROUP BY user;" \
13+
| grep -q ${EXPORTER_USER}} \
14+
|| mariadb -h localhost -u root --password="${MARIADB_ROOT_PASSWORD}" -sN <<EOSQL
15+
CREATE USER '${EXPORTER_USER}'@'${host}' IDENTIFIED BY '${EXPORTER_PASSWORD}' WITH MAX_USER_CONNECTIONS ${EXPORTER_MAXUSERCONNECTIONS};
16+
GRANT PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR ON *.* TO '${EXPORTER_USER}'@'${host}';
17+
GRANT SELECT ON performance_schema.* TO '${EXPORTER_USER}'@'${host}';
18+
FLUSH PRIVILEGES;
19+
EOSQL
20+
21+
mariadb -h localhost -u root --password=${MARIADB_ROOT_PASSWORD} -e "SELECT user, host, max_user_connections FROM mysql.user;"

‎examples/fpm-nginx/config/mysql_wsc.cnf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[server]
2+
innodb_buffer_pool_size = 512M

‎examples/fpm-nginx/config/nginx_default.conf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# enable ONLY behind PROXY (Traefik, other NGINX, Caddy, lighttpd, K8s Ingress, ...) (ngx_http_realip_module)
2+
set_real_ip_from 172.16.0.0/12;
3+
set_real_ip_from fd00::/8;
4+
real_ip_header X-Forwarded-For;
5+
#real_ip_recursive on;
6+
7+
# Server (http)
8+
server {
9+
listen 8080;
10+
listen [::]:8080;
11+
server_name _;
12+
13+
# disable any limits to avoid HTTP 413 for large image uploads
14+
client_max_body_size 0;
15+
16+
# Error Page
17+
location @error_page {
18+
add_header Content-Type text/plain;
19+
return 200 'Maintenance mode!';
20+
}
21+
22+
root /var/www/html;
23+
index index.php index.html test.php;
24+
25+
location / {
26+
#root /var/www/html;
27+
#index index.php index.html;
28+
29+
try_files $uri $uri/ /index.php?$query_string;
30+
}
31+
32+
location ~ \.php$ {
33+
#root /var/www/html;
34+
35+
try_files $uri =404;
36+
37+
fastcgi_pass wsc-php:9000;
38+
fastcgi_index index.php;
39+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
40+
include fastcgi_params;
41+
42+
# Error Page (redirect)
43+
error_page 502 503 504 = @error_page;
44+
}
45+
46+
# nginx status
47+
location /nginx_status {
48+
stub_status on;
49+
access_log off;
50+
allow 127.0.0.1;
51+
allow 10.0.0.0/8;
52+
allow 172.16.0.0/12;
53+
allow 192.168.0.0/16;
54+
allow ::1;
55+
allow fd00::/8;
56+
deny all;
57+
}
58+
59+
# nginx ping
60+
location /nginx_ping {
61+
add_header Content-Type text/plain;
62+
return 200 'pong';
63+
access_log off;
64+
allow 127.0.0.1;
65+
allow 10.0.0.0/8;
66+
allow 172.16.0.0/12;
67+
allow 192.168.0.0/16;
68+
allow ::1;
69+
allow fd00::/8;
70+
deny all;
71+
}
72+
73+
# php-fpm status/ping
74+
location ~ ^/(php_fpm_status|php_fpm_ping)$ {
75+
fastcgi_pass wsc-php:9001;
76+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
77+
include fastcgi_params;
78+
access_log off;
79+
allow 127.0.0.1;
80+
allow 10.0.0.0/8;
81+
allow 172.16.0.0/12;
82+
allow 192.168.0.0/16;
83+
allow ::1;
84+
allow fd00::/8;
85+
deny all;
86+
87+
# Error Page (redirect)
88+
error_page 502 503 504 = @error_page;
89+
}
90+
91+
location ~ /\.ht {
92+
deny all;
93+
}
94+
#location = /favicon.ico { log_not_found off; access_log off; }
95+
#location = /robots.txt { log_not_found off; access_log off; }
96+
}

‎examples/fpm-nginx/config/traefik/dynamic/disable-traefik-default-cert.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# https://github.com/traefik/traefik/issues/9945#issuecomment-1590229681
2+
# https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-certificates/#strict-sni-checking
3+
# https://www.ssllabs.com/ssltest/
4+
tls:
5+
options:
6+
default:
7+
sniStrict: true # <----- Strict SNI Checking
8+
# minVersion: VersionTLS12
9+
# cipherSuites:
10+
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
11+
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 # TLS 1.2
12+
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
13+
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
14+
# - TLS_AES_256_GCM_SHA384 # TLS 1.3
15+
# - TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
16+
# - TLS_FALLBACK_SCSV # TLS FALLBACK
17+
# curvePreferences:
18+
# - secp521r1
19+
# - secp384r1
20+
#modern:
21+
# minVersion: VersionTLS13

‎examples/fpm-nginx/config/traefik/dynamic/redirect-to-https.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
http:
2+
middlewares:
3+
redirect-to-https:
4+
redirectScheme:
5+
scheme: https
6+
permanent: true
7+
#port: 443

‎examples/fpm-nginx/config/traefik/dynamic/ssl.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
tls:
2+
#stores:
3+
# default:
4+
# defaultCertificate:
5+
# certFile: /config/certs/ssl.crt
6+
# keyFile: /config/certs/ssl.key
7+
certificates:
8+
# first certificate
9+
- certFile: /config/certs/ssl.crt
10+
keyFile: /config/certs/ssl.key
11+
# second certificate
12+
#- certFile: /config/certs/other.crt
13+
# keyFile: /config/certs/other.key
14+
# and more ...

0 commit comments

Comments
 (0)