diff options
Diffstat (limited to '')
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | cgit/Dockerfile | 67 | ||||
| -rwxr-xr-x | cgit/docker-entrypoint.sh | 17 | ||||
| -rw-r--r-- | cgit/nginx/conf.d/default.conf (renamed from cgit/nginx.conf) | 0 | ||||
| -rw-r--r-- | cgit/nginx/nginx.conf | 73 | ||||
| -rw-r--r-- | docker-compose.yml | 25 | ||||
| -rw-r--r-- | justfile | 6 | ||||
| -rw-r--r-- | send/Dockerfile | 4 | ||||
| -rwxr-xr-x | setup.sh | 33 |
9 files changed, 206 insertions, 20 deletions
@@ -1,2 +1,3 @@ *.ignore .env +tmp/ diff --git a/cgit/Dockerfile b/cgit/Dockerfile new file mode 100644 index 0000000..86b3005 --- /dev/null +++ b/cgit/Dockerfile @@ -0,0 +1,67 @@ +FROM nginx:1.28.1-alpine3.23 + +ARG VERSION=0.0.0 +ENV VERSION=${VERSION} + +RUN addgroup -S git -g 1001 && adduser -S -G git -u 1001 -D git + +# CGit +ARG CGIT_VERSION=1.2.3-r5 +ENV CGIT_VERSION=${CGIT_VERSION} + +LABEL version="${VERSION}" \ + description="The hyperfast web frontend for Git repositories on top of Alpine and Nginx." \ + maintainer="Jose Quintana <joseluisq.net>" + +RUN set -eux \ + && apk add --no-cache \ + ca-certificates \ + cgit=${CGIT_VERSION} \ + fcgiwrap \ + git \ + lua5.3-libs \ + py3-markdown \ + py3-pygments \ + py3-docutils \ + groff \ + python3 \ + spawn-fcgi \ + tzdata \ + xz \ + zlib \ + && rm -rf /var/cache/apk/* \ + && rm -rf /tmp/* \ + && true + +COPY docker-entrypoint.sh / +RUN chmod +x /docker-entrypoint.sh +COPY nginx/ /etc/nginx + +# RUN set -eux \ +# && echo "Creating application directories..." \ +# && mkdir -p /var/cache/cgit \ +# && mkdir -p /srv/git \ +# && true + +RUN set -eux \ + && echo "Testing Nginx server configuration files..." \ + && nginx -c /etc/nginx/nginx.conf -t \ + && true + +RUN ls -la /docker-entrypoint.sh + +ENTRYPOINT [ "/docker-entrypoint.sh" ] + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD [ "nginx", "-g", "daemon off;" ] + +# Metadata +LABEL org.opencontainers.image.vendor="Jose Quintana" \ + org.opencontainers.image.url="https://github.com/joseluisq/alpine-cgit" \ + org.opencontainers.image.title="cgit" \ + org.opencontainers.image.description="The hyperfast web frontend for Git repositories on top of Alpine and Nginx." \ + org.opencontainers.image.version="${VERSION}" \ + org.opencontainers.image.documentation="https://github.com/joseluisq/alpine-cgit" diff --git a/cgit/docker-entrypoint.sh b/cgit/docker-entrypoint.sh new file mode 100755 index 0000000..0c13086 --- /dev/null +++ b/cgit/docker-entrypoint.sh @@ -0,0 +1,17 @@ +#!/bin/sh + +set -eux + +CGIT_USER=git +CGIT_GROUP=git + +id + +chown $CGIT_USER:$CGIT_GROUP /var/cache/cgit +chmod u+g /var/cache/cgit + +spawn-fcgi \ + -u $CGIT_USER -g $CGIT_GROUP \ + -s /var/run/fcgiwrap.sock \ + -n -- /usr/bin/fcgiwrap \ + & exec "$@" diff --git a/cgit/nginx.conf b/cgit/nginx/conf.d/default.conf index a850744..a850744 100644 --- a/cgit/nginx.conf +++ b/cgit/nginx/conf.d/default.conf diff --git a/cgit/nginx/nginx.conf b/cgit/nginx/nginx.conf new file mode 100644 index 0000000..c5a713f --- /dev/null +++ b/cgit/nginx/nginx.conf @@ -0,0 +1,73 @@ +user git; +worker_processes auto; +error_log stderr crit; +pid /var/run/nginx.pid; + +events { + worker_connections 2048; + use epoll; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + open_file_cache max=200000 inactive=20s; + open_file_cache_valid 30s; + open_file_cache_min_uses 2; + open_file_cache_errors on; + + access_log off; + error_log stderr crit; + + sendfile on; + sendfile_max_chunk 512k; + tcp_nopush on; + tcp_nodelay on; + types_hash_max_size 4096; + + keepalive_timeout 35; + + gzip on; + gzip_min_length 10240; + gzip_comp_level 1; + gzip_vary on; + gzip_disable msie6; + gzip_proxied expired no-cache no-store private auth; + # text/html is always compressed by HttpGzipModule + gzip_types + text/css + text/javascript + text/xml + text/plain + text/x-component + application/javascript + application/x-javascript + application/json + application/xml + application/rss+xml + application/atom+xml + font/truetype + font/opentype + application/vnd.ms-fontobject + image/svg+xml; + + reset_timedout_connection on; + client_body_timeout 10; + send_timeout 5; + + server_tokens off; + add_header X-Frame-Options SAMEORIGIN; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + + client_body_buffer_size 128k; + large_client_header_buffers 4 256k; + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + include /etc/nginx/conf.d/*.conf; +} diff --git a/docker-compose.yml b/docker-compose.yml index f8316af..646cb11 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,35 +1,36 @@ services: send: profiles: [services] - image: 'registry.gitlab.com/timvisee/send:v3.4.27' + build: + context: ./send restart: always ports: - '1234:1234' - volumes: - - /uploads:/uploads environment: - VIRTUAL_PORT=1234 - VIRTUAL_HOST=send.ediblemonad.dev - LETSENCRYPT_HOST=send.ediblemonad.dev - DHPARAM_GENERATION=false - # - LETSENCRYPT_EMAIL=ediblemonad@gmail.com + # send - NODE_ENV=production - BASE_URL=https://send.ediblemonad.dev - PORT=1234 - REDIS_HOST=redis - FILE_DIR=/uploads - # upload limits - - EXPIRE_TIMES_SECONDS=3600,86400,604800,2592000,31536000 + - EXPIRE_TIMES_SECONDS=3600,86400,604800,2592000 - DEFAULT_EXPIRE_SECONDS=86400 - - MAX_EXPIRE_SECONDS=31536000 + - MAX_EXPIRE_SECONDS=2592000 # 30 days - MAX_DOWNLOADS=100 - - MAX_FILE_SIZE=1073741824 + - MAX_FILE_SIZE=536870912 # 512M + volumes: + - ${SEND_UPLOADS_ROOT:-/uploads}:/uploads depends_on: - redis cgit: profiles: [services] - image: 'joseluisq/alpine-cgit:2.9' + build: + context: ./cgit restart: always ports: - 8080:80 @@ -39,12 +40,12 @@ services: - LETSENCRYPT_HOST=git.ediblemonad.dev - DHPARAM_GENERATION=false - USE_CUSTOM_CONFIG=true + - GIT_REPOS_ROOT=${GIT_REPOS_ROOT:-/git} volumes: - cgit-cache:/var/cache/cgit - - /home/imsohexy/dev/projects:/srv/git:ro + - ${GIT_REPOS_ROOT:-/git}:/srv/git:ro - ./cgit/cgitrc:/etc/cgitrc:ro - ./cgit/static:/usr/share/webapps/cgit/ediblemonad:ro - - ./cgit/nginx.conf:/etc/nginx/conf.d/default.conf:ro - ./cgit/filters:/usr/lib/cgit/filters/ediblemonad:ro - ./favicon.ico:/usr/share/webapps/cgit/favicon.ico:ro @@ -73,7 +74,7 @@ services: - DEFAULT_EMAIL=ediblemonad@gmail.com - NGINX_PROXY_CONTAINER=nginx-proxy - NGINX_DOCKER_GEN_CONTAINER=nginx-proxy - - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory + # - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - proxy-certs:/etc/nginx/certs @@ -23,4 +23,8 @@ setup *args: just ssh "{{TARGET_DIR}}/setup.sh" "$@" local-setup *args: - ROOT_DIR="$PWD" ./setup.sh "$@" + mkdir -p ./tmp/uploads + ROOT_DIR="$PWD" \ + GIT_REPOS_ROOT="$HOME/dev/projects" \ + SEND_UPLOADS_ROOT="$PWD/tmp/uploads" SEND_USER="$(id -u):$(id -g)" \ + ./setup.sh "$@" diff --git a/send/Dockerfile b/send/Dockerfile new file mode 100644 index 0000000..47144c0 --- /dev/null +++ b/send/Dockerfile @@ -0,0 +1,4 @@ +FROM registry.gitlab.com/timvisee/send:v3.4.27 +USER root +RUN addgroup -g 1002 send && adduser -D -u 1002 -G send send +USER send @@ -4,37 +4,56 @@ set -eu ROOT_DIR=${ROOT_DIR:-"/opt/project"} -setup() { packages; firewall; } +configure() { + configure_user && configure_fs && configure_packages && configure_firewall +} services() { cd "$ROOT_DIR"; docker compose --profile services "$@"; } core() { cd "$ROOT_DIR"; docker compose --profile core "$@"; } # TODO: use --wait and add health checks -start() { stop || true; services up -d; } +start() { stop || true; services up -d "$@"; } + +startfg() { stop || true; services up "$@"; } stop() { services down; } -packages() { +configure_packages() { apt install \ docker.io docker-buildx docker-compose-v2 \ ufw } -firewall() { +configure_firewall() { ufw allow 443/tcp ufw allow 80/tcp ufw allow 22 ufw enable } +configure_user() { + groupadd -f -g 1001 git + useradd --shell /usr/sbin/nologin --no-create-home git --uid 1001 --gid 1001 || true + groupadd -f -g 1002 send + useradd --shell /usr/sbin/nologin --no-create-home send --uid 1002 --gid 1002 || true +} + +configure_fs() { + mkdir -p /git + chown -R git:git /git + mkdir -p /uploads + chown -R send:send /uploads +} + update() { - apt update; - services build --pull; + apt update + services build --pull } cmd="$1"; shift; case "$cmd" in - setup|update|start|stop|firewall|packages|services|core) "$cmd" "$@" ;; + update|start|startfg|stop|services|core) "$cmd" "$@" ;; + configure|configure_firewall|configure_user|configure_fs|configure_packages) "$cmd" "$@" ;; *) echo "Invalid command: $cmd"; exit 1 ;; esac |