feat: Refacto + hardening PHP 8.5 Dev
This commit is contained in:
Vincent BRIDIER
Alexis Gousseau
parent
142c09158d
commit
3bdf3f5d19
9 changed files with 73 additions and 2002 deletions
|
|
@ -1,15 +1,7 @@
|
|||
# Stage n°1: builder.
|
||||
# Cette étape ne sert qu'à l'installation et la compilation des extensions php.
|
||||
# Une fois fait, on copie les fichiers compilés vers le stage base,
|
||||
# et on supprime celui-là qui n'est donc plus utile, on gagne à peu près ~653MB.
|
||||
FROM php:8.5.4-fpm-alpine AS builder
|
||||
# Utilisation de l'image docker php:8.5.4-fpm-alpine: https://hub.docker.com/layers/library/php/8.5.4-fpm-alpine/images
|
||||
# Bien plus légère que l'ancienne image php:8.5.4-apache-trixie.
|
||||
|
||||
# Récupération de la valeur de l'argument passé lors de la commande pour utiliser notre proxy.
|
||||
ARG http_proxy
|
||||
|
||||
# Définit des variables d'environnement dans l'image sous plusieurs formats car ça peu varier selon les outils.
|
||||
ENV http_proxy=${http_proxy} \
|
||||
https_proxy=${http_proxy} \
|
||||
HTTP_PROXY=${http_proxy} \
|
||||
|
|
@ -79,20 +71,15 @@ RUN curl -fsSL https://getcomposer.org/installer -o /tmp/composer-installer \
|
|||
&& php /tmp/composer-installer --install-dir=/usr/local/bin --filename=composer --version=2.9.7 \
|
||||
\
|
||||
&& curl -fsSL -o /tmp/bun.zip "https://github.com/oven-sh/bun/releases/download/bun-v1.2.10/bun-linux-x64-musl.zip" \
|
||||
&& rm /tmp/composer-installer \
|
||||
&& unzip -oqd /tmp/bun-extracted /tmp/bun.zip \
|
||||
&& mv $(find /tmp/bun-extracted -type f -name 'bun' -perm /a+x | head -n1) /usr/local/bin/bun \
|
||||
&& unzip -q /tmp/bun.zip -d /tmp/bun-extracted \
|
||||
&& mv /tmp/bun-extracted/bun-linux-x64-musl/bun /usr/local/bin/bun \
|
||||
&& chmod +x /usr/local/bin/bun \
|
||||
&& rm -rf /tmp/bun.zip /tmp/bun-extracted
|
||||
|
||||
# Stage n°2: base.
|
||||
# Image finale qui sera utilisée sans compilateurs.
|
||||
FROM php:8.5.4-fpm-alpine AS base
|
||||
|
||||
# Récupération de la valeur de l'argument passé lors de la commande pour utiliser notre proxy.
|
||||
ARG http_proxy
|
||||
|
||||
# Définit des variables d'environnement dans l'image sous plusieurs formats car ça peu varier selon les outils.
|
||||
ENV http_proxy=${http_proxy} \
|
||||
https_proxy=${http_proxy} \
|
||||
HTTP_PROXY=${http_proxy} \
|
||||
|
|
@ -100,7 +87,9 @@ ENV http_proxy=${http_proxy} \
|
|||
LC_ALL=fr_FR.UTF-8 \
|
||||
LANG=fr_FR.UTF-8 \
|
||||
LANGUAGE=fr_FR.UTF-8:fr \
|
||||
SHELL=/bin/zsh
|
||||
SHELL=/bin/zsh \
|
||||
XDEBUG_MODE=develop,debug \
|
||||
XDEBUG_CONFIG="client_host=host.docker.internal client_port=9003"
|
||||
|
||||
# Installation des packages runtime + utilitaires + outils QA.
|
||||
RUN apk add --no-cache \
|
||||
|
|
@ -118,7 +107,14 @@ RUN apk add --no-cache \
|
|||
gmp gettext-libs \
|
||||
zsh-vcs
|
||||
|
||||
# Copie des extensions compilées depuis le stage builder.
|
||||
# Installation ohmyzsh + plugin + theme.
|
||||
RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \
|
||||
&& git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions \
|
||||
&& sed -i 's/plugins=(git)/plugins=(git laravel zsh-autosuggestions)/g' ~/.zshrc \
|
||||
&& sed -i 's/ZSH_THEME="robbyrussell"/ZSH_THEME="agnoster"/g' ~/.zshrc \
|
||||
&& chsh -s /bin/zsh
|
||||
|
||||
# Copie des extensions PHP compilées + conf PHP + Composer + Bun depuis le stage builder.
|
||||
COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
|
||||
COPY --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
|
||||
COPY --from=builder /usr/local/bin/composer /usr/local/bin/composer
|
||||
|
|
@ -126,45 +122,36 @@ COPY --from=builder /usr/local/bin/bun /usr/local/bin/bun
|
|||
|
||||
# Active les extensions PECL copiées + supprime xdebug.ini auto-généré car on veut utiliser notre propre fichier de config.
|
||||
RUN docker-php-ext-enable imagick memcached redis xdebug pcov \
|
||||
&& rm -f /usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini \
|
||||
&& mkdir -p /app/logs && chmod 777 /app/logs
|
||||
&& rm -f /usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini
|
||||
|
||||
# Installation omzsh + plugin + theme.
|
||||
RUN sh -c "$(curl -fsSL https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh)" \
|
||||
&& git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions \
|
||||
&& sed -i 's/plugins=(git)/plugins=(git laravel zsh-autosuggestions)/g' ~/.zshrc \
|
||||
&& sed -i 's/ZSH_THEME="robbyrussell"/ZSH_THEME="agnoster"/g' ~/.zshrc \
|
||||
&& chsh -s /bin/zsh
|
||||
|
||||
# Configuration des modules apache sans duplication (par défaut dans alpine c'est commenté, on décommente juste ce dont on a besoin),
|
||||
# + supprime ssl.conf auto-généré car on veut utiliser notre propre fichier de config.
|
||||
# Configuration des modules apache sans duplication (par défaut dans alpine c'est commenté, on décommente juste ce dont on a besoin)
|
||||
RUN sed -i \
|
||||
-e 's/#LoadModule proxy_module/LoadModule proxy_module/' \
|
||||
-e 's/#LoadModule proxy_fcgi_module/LoadModule proxy_fcgi_module/' \
|
||||
-e 's/#LoadModule rewrite_module/LoadModule rewrite_module/' \
|
||||
-e 's/#LoadModule remoteip_module/LoadModule remoteip_module/' \
|
||||
-e 's/#LoadModule headers_module/LoadModule headers_module/' \
|
||||
-e 's/#LoadModule http2_module/LoadModule http2_module/' \
|
||||
-e 's/#LoadModule expires_module/LoadModule expires_module/' \
|
||||
-e 's/#LoadModule deflate_module/LoadModule deflate_module/' \
|
||||
-e 's/#LoadModule mime_module/LoadModule mime_module/' \
|
||||
-e 's/#LoadModule brotli_module/LoadModule brotli_module/' \
|
||||
/etc/apache2/httpd.conf \
|
||||
\
|
||||
&& rm -f /etc/apache2/conf.d/ssl.conf
|
||||
/etc/apache2/httpd.conf
|
||||
|
||||
# Copie des fichiers de configuration.
|
||||
COPY conf/php-fpm.conf /usr/local/etc/php-fpm.d/www.conf
|
||||
COPY DEV/conf/php.ini /usr/local/etc/php/conf.d/app.ini
|
||||
COPY DEV/conf/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini
|
||||
COPY DEV/conf/vhost.conf /etc/apache2/conf.d/vhost.conf
|
||||
COPY DEV/conf/common-apache.conf /etc/apache2/conf.d/z-app.conf
|
||||
COPY DEV/conf/common-ports.conf /etc/apache2/conf.d/ports.conf
|
||||
COPY DEV/conf/common-security.conf /etc/apache2/conf.d/security.conf
|
||||
# Copie des fichiers de configuration + Entrypoint
|
||||
COPY conf/php-fpm.conf /usr/local/etc/php-fpm.d/www.conf
|
||||
COPY conf/php.ini /usr/local/etc/php/conf.d/app.ini
|
||||
COPY conf/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini
|
||||
COPY conf/vhost.conf /etc/apache2/conf.d/vhost.conf
|
||||
COPY conf/common-apache.conf /etc/apache2/conf.d/z-app.conf
|
||||
COPY conf/common-security.conf /etc/apache2/conf.d/security.conf
|
||||
COPY --chmod=755 conf/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
# Création des répertoires avec les bons droits.
|
||||
RUN mkdir -p /app/tmp /app/logs /app/srcs \
|
||||
&& chown -R www-data:www-data /app \
|
||||
&& chmod 770 /app/tmp /app/logs
|
||||
|
||||
# Définit le répertoire de travail par défaut dans le conteneur.
|
||||
WORKDIR /app/srcs
|
||||
|
||||
# Entrypoint custom pour démarrer php-fpm et apache (en executable seule).
|
||||
COPY --chmod=755 DEV/conf/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
||||
3
PHP8.5/DEV/README.md
Normal file
3
PHP8.5/DEV/README.md
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# DEV
|
||||
|
||||
Déjà chargés dans php:8.5.4-fpm-alpine : http2_module et brotli_module
|
||||
|
|
@ -1,47 +1,25 @@
|
|||
#User noroot
|
||||
#Group noroot
|
||||
#
|
||||
# Timeout: The number of seconds before receives and sends time out.
|
||||
#
|
||||
ServerName localhost
|
||||
Timeout 300
|
||||
|
||||
#
|
||||
# KeepAlive: Whether or not to allow persistent connections (more than
|
||||
# one request per connection). Set to "Off" to deactivate.
|
||||
#
|
||||
KeepAlive On
|
||||
|
||||
#
|
||||
# MaxKeepAliveRequests: The maximum number of requests to allow
|
||||
# during a persistent connection. Set to 0 to allow an unlimited amount.
|
||||
# We recommend you leave this number high, for maximum performance.
|
||||
#
|
||||
MaxKeepAliveRequests 100
|
||||
|
||||
#
|
||||
# KeepAliveTimeout: Number of seconds to wait for the next request from the
|
||||
# same client on the same connection.
|
||||
#
|
||||
KeepAliveTimeout 5
|
||||
|
||||
#
|
||||
# AccessFileName: The name of the file to look for in each directory
|
||||
# for additional configuration directives. See also the AllowOverride
|
||||
# directive.
|
||||
#
|
||||
|
||||
AccessFileName .htaccess
|
||||
DefaultType None
|
||||
HostnameLookups Off
|
||||
ErrorLog /var/log/apache2/error.log
|
||||
LogLevel warn
|
||||
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
|
||||
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common
|
||||
LogFormat "%{Referer}i -> %U" referer
|
||||
LogFormat "%{User-agent}i" agent
|
||||
SetEnvIf Request_URI "^check_http" dontlog
|
||||
SetEnvIf Remote_Addr "127.0.0.1" dontlog
|
||||
SetEnvIf Remote_Addr "::1" dontlog
|
||||
SetEnvIf Remote_Addr "127\.0\.0\.1" loopback
|
||||
|
||||
#
|
||||
# The following lines prevent .htaccess and .htpasswd files from being
|
||||
# viewed by Web clients.
|
||||
#
|
||||
<FilesMatch "^\.ht">
|
||||
Require all denied
|
||||
</FilesMatch>
|
||||
|
||||
# Block .git composer and npm files
|
||||
|
||||
<FilesMatch "^composer\.(json|lock)">
|
||||
Require all denied
|
||||
</FilesMatch>
|
||||
|
|
@ -53,58 +31,4 @@ AccessFileName .htaccess
|
|||
</FilesMatch>
|
||||
<DirectoryMatch "^\.|\/\.">
|
||||
Require all denied
|
||||
</Directorymatch>
|
||||
|
||||
#
|
||||
# DefaultType is the default MIME type the server will use for a document
|
||||
# if it cannot otherwise determine one, such as from filename extensions.
|
||||
# If your server contains mostly text or HTML documents, "text/plain" is
|
||||
# a good value. If most of your content is binary, such as applications
|
||||
# or images, you may want to use "application/octet-stream" instead to
|
||||
# keep browsers from trying to display binary files as though they are
|
||||
# text.
|
||||
#
|
||||
# It is also possible to omit any default MIME type and let the
|
||||
# client's browser guess an appropriate action instead. Typically the
|
||||
# browser will decide based on the file's extension then. In cases
|
||||
# where no good assumption can be made, letting the default MIME type
|
||||
# unset is suggested instead of forcing the browser to accept
|
||||
# incorrect metadata.
|
||||
#
|
||||
DefaultType None
|
||||
|
||||
#
|
||||
# HostnameLookups: Log the names of clients or just their IP addresses
|
||||
# e.g., www.apache.org (on) or 204.62.129.132 (off).
|
||||
# The default is off because it'd be overall better for the net if people
|
||||
# had to knowingly turn this feature on, since enabling it means that
|
||||
# each client request will result in AT LEAST one lookup request to the
|
||||
# nameserver.
|
||||
#
|
||||
HostnameLookups Off
|
||||
|
||||
# ErrorLog: The location of the error log file.
|
||||
# If you do not specify an ErrorLog directive within a <VirtualHost>
|
||||
# container, error messages relating to that virtual host will be
|
||||
# logged here. If you *do* define an error logfile for a <VirtualHost>
|
||||
# container, that host's errors will be logged there and not here.
|
||||
# APACHE_LOG_DIR n'existe pas sous alpine.
|
||||
#
|
||||
ErrorLog /var/log/apache2/error.log
|
||||
|
||||
#
|
||||
# LogLevel: Control the number of messages logged to the error_log.
|
||||
# Possible values include: debug, info, notice, warn, error, crit,
|
||||
# alert, emerg.
|
||||
#
|
||||
LogLevel warn
|
||||
|
||||
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
|
||||
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common
|
||||
LogFormat "%{Referer}i -> %U" referer
|
||||
LogFormat "%{User-agent}i" agent
|
||||
SetEnvIf Request_URI "^/haproxytest\.txt$" dontlog
|
||||
SetEnvIf Request_URI "^check_http" dontlog
|
||||
SetEnvIf Remote_Addr "127.0.0.1" dontlog
|
||||
SetEnvIf Remote_Addr "::1" dontlog
|
||||
SetEnvIf Remote_Addr "127\.0\.0\.1" loopback
|
||||
</Directorymatch>
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# If you just change the port or add more ports here, you will likely also
|
||||
# have to change the VirtualHost statement in
|
||||
# /etc/apache2/sites-enabled/000-default.conf
|
||||
|
||||
Listen 443
|
||||
|
||||
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
|
||||
|
|
@ -1,74 +1,3 @@
|
|||
#
|
||||
# Disable access to the entire file system except for the directories that
|
||||
# are explicitly allowed later.
|
||||
#
|
||||
# This currently breaks the configurations that come with some web application
|
||||
# Debian packages.
|
||||
#
|
||||
#<Directory />
|
||||
# AllowOverride None
|
||||
# Order Deny,Allow
|
||||
# Deny from all
|
||||
#</Directory>
|
||||
|
||||
|
||||
# Changing the following options will not really affect the security of the
|
||||
# server, but might make attacks slightly more difficult in some cases.
|
||||
|
||||
#
|
||||
# ServerTokens
|
||||
# This directive configures what you return as the Server HTTP response
|
||||
# Header. The default is 'Full' which sends information about the OS-Type
|
||||
# and compiled in modules.
|
||||
# Set to one of: Full | OS | Minimal | Minor | Major | Prod
|
||||
# where Full conveys the most information, and Prod the least.
|
||||
#ServerTokens Minimal
|
||||
ServerTokens Prod
|
||||
#ServerTokens Full
|
||||
|
||||
#
|
||||
# Optionally add a line containing the server version and virtual host
|
||||
# name to server-generated pages (internal error documents, FTP directory
|
||||
# listings, mod_status and mod_info output etc., but not CGI generated
|
||||
# documents or custom error documents).
|
||||
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
|
||||
# Set to one of: On | Off | EMail
|
||||
#ServerSignature Off
|
||||
ServerSignature Off
|
||||
|
||||
#
|
||||
# Allow TRACE method
|
||||
#
|
||||
# Set to "extended" to also reflect the request body (only for testing and
|
||||
# diagnostic purposes).
|
||||
#
|
||||
# Set to one of: On | Off | extended
|
||||
TraceEnable Off
|
||||
#TraceEnable On
|
||||
|
||||
#
|
||||
# Forbid access to version control directories
|
||||
#
|
||||
# If you use version control systems in your document root, you should
|
||||
# probably deny access to their directories. For example, for subversion:
|
||||
#
|
||||
#<DirectoryMatch "/\.svn">
|
||||
# Require all denied
|
||||
#</DirectoryMatch>
|
||||
|
||||
#
|
||||
# Setting this header will prevent MSIE from interpreting files as something
|
||||
# else than declared by the content type in the HTTP headers.
|
||||
# Requires mod_headers to be enabled.
|
||||
#
|
||||
#Header set X-Content-Type-Options: "nosniff"
|
||||
|
||||
#
|
||||
# Setting this header will prevent other sites from embedding pages from this
|
||||
# site as frames. This defends against clickjacking attacks.
|
||||
# Requires mod_headers to be enabled.
|
||||
#
|
||||
#Header set X-Frame-Options: "sameorigin"
|
||||
|
||||
|
||||
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
|
||||
TraceEnable Off
|
||||
|
|
@ -1,10 +1,20 @@
|
|||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
mkdir -p /app/logs
|
||||
|
||||
# Démarrer php-fpm en arrière-plan (flag -D = --daemonize).
|
||||
php-fpm -D
|
||||
|
||||
# Attendre que php-fpm soit prêt (max 10s, échec si timeout).
|
||||
for i in $(seq 1 10); do
|
||||
if pgrep -f "php-fpm" > /dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
if [ "$i" -eq 10 ]; then
|
||||
echo "ERROR: php-fpm failed to start within 10 seconds" >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Démarrer apache au premier plan (flag -D = -Define <variable_name>).
|
||||
exec httpd -D FOREGROUND
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,4 +1,4 @@
|
|||
<VirtualHost *:443>
|
||||
<VirtualHost *:80>
|
||||
Protocols h2 h2c http/1.1
|
||||
ServerAdmin digital@ldc.fr
|
||||
DocumentRoot /app/${DOCUMENTROOT}
|
||||
|
|
@ -18,4 +18,8 @@
|
|||
|
||||
ErrorLog /app/logs/error_${PROJECT}.log
|
||||
CustomLog /app/logs/access_${PROJECT}.log combined
|
||||
|
||||
# + Logs sur stdout/stderr (pour docker logs)
|
||||
ErrorLog "|/usr/bin/tee -a /proc/self/fd/2"
|
||||
CustomLog "|/usr/bin/tee -a /proc/self/fd/1" combined
|
||||
</VirtualHost>
|
||||
Loading…
Add table
Reference in a new issue