-
Notifications
You must be signed in to change notification settings - Fork 21
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- revamp project structure for easy manage - add SSL support - add DB_PORT for support non standard port - update README to address new changes
- Loading branch information
Showing
16 changed files
with
193 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| #!/bin/sh | ||
| set -e | ||
| set -u | ||
| export DEBIAN_FRONTEND=noninteractive | ||
| n=0 | ||
| max=2 | ||
| until [ $n -gt $max ]; do | ||
| set +e | ||
| ( | ||
| apt-get update -qq && | ||
| apt-get install -y --no-install-recommends "$@" | ||
| ) | ||
| CODE=$? | ||
| set -e | ||
| if [ $CODE -eq 0 ]; then | ||
| break | ||
| fi | ||
| if [ $n -eq $max ]; then | ||
| exit $CODE | ||
| fi | ||
| echo "apt failed, retrying" | ||
| n=$(($n + 1)) | ||
| done | ||
| rm -r /var/lib/apt/lists /var/cache/apt/archives |
1 change: 0 additions & 1 deletion
1
configs/supervisord-debian.conf → rootfs/etc/supervisor/supervisord.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| server { | ||
| listen $NGINX_LISTEN_SSL_PORT ssl; | ||
| listen [::]:$NGINX_LISTEN_SSL_PORT ssl; | ||
|
|
||
| ssl_certificate $NGINX_SSL_CERT; | ||
| ssl_certificate_key $NGINX_SSL_KEY; | ||
|
|
||
| ssl_session_cache shared:SSL:1m; | ||
| ssl_session_timeout 5m; | ||
|
|
||
| ssl_ciphers HIGH:!aNULL:!MD5; | ||
| ssl_prefer_server_ciphers on; | ||
|
|
||
| proxy_http_version 1.1; | ||
|
|
||
| client_max_body_size $NGINX_MAX_UPLOAD; | ||
| location / { | ||
|
|
||
| include uwsgi_params; | ||
| uwsgi_pass unix:///tmp/uwsgi.sock; | ||
| } | ||
| } |
6 changes: 4 additions & 2 deletions
6
configs/nginx/pi.conf.template → rootfs/opt/templates/nginx-pi.conf.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
configs/nginx/nginx.conf.template → rootfs/opt/templates/nginx.conf.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -e | ||
|
|
||
| function main { | ||
|
|
||
| envsubst < /opt/templates/nginx.conf.template > /etc/nginx/nginx.conf | ||
| envsubst < /opt/templates/nginx-pi.conf.template > /etc/nginx/conf.d/pi.conf | ||
| if [ "$NGINX_SSL_ENABLED" = true ]; then | ||
| if [ -z "$NGINX_SSL_CERT" ] && [ -z "$NGINX_SSL_CERT" ]; | ||
| then | ||
| echo "SSL enabled but NGINX_SSL_CERT and NGINX_SSL_KEY are not defined, using generated certifiacate" | ||
| echo "Generate self signed certificate" | ||
| generate_cert | ||
| echo "" | ||
| echo "Finished generate certificates" | ||
|
|
||
| export NGINX_SSL_CERT=/etc/nginx/certs/pi-server-cert.pem | ||
| export NGINX_SSL_KEY=/etc/nginx/certs/pi-server-key.pem | ||
| fi | ||
| envsubst < /opt/templates/nginx-pi-ssl.conf.template > /etc/nginx/conf.d/pi-ssl.conf | ||
| fi | ||
|
|
||
| } | ||
|
|
||
| function generate_cert { | ||
|
|
||
| # Create certificate directory | ||
| mkdir -p /etc/nginx/certs | ||
|
|
||
| # [ global parameters ] | ||
| # certificate configuration | ||
| readonly CERT_DAYS=36500 | ||
| readonly RSA_STR_LEN=4096 | ||
| readonly PREFIX=pi- | ||
| readonly CERT_DIR=/etc/nginx/certs | ||
| readonly KEY_DIR=/etc/nginx/certs | ||
| # certificate content definition | ||
| readonly ADDRESS_COUNTRY_CODE=KH | ||
| readonly ADDRESS_PREFECTURE=PI | ||
| readonly ADDRESS_CITY='Phnom Penh' | ||
| readonly COMPANY_NAME=Khalibre | ||
| readonly COMPANY_SECTION=DevOps | ||
| readonly CERT_PASSWORD= # no password | ||
| # - ca | ||
| readonly CA_DOMAIN='Khalibre DevOps' | ||
| readonly CA_EMAIL=ca@email.address | ||
| # - server | ||
| readonly SERVER_DOMAIN=localhost | ||
| readonly SERVER_EMAIL=server@email.address | ||
|
|
||
| # [ functions ] | ||
| echo_cert_params() { | ||
| local company_domain="$1" | ||
| local company_email="$2" | ||
|
|
||
| echo $ADDRESS_COUNTRY_CODE | ||
| echo $ADDRESS_PREFECTURE | ||
| echo $ADDRESS_CITY | ||
| echo $COMPANY_NAME | ||
| echo $COMPANY_SECTION | ||
| echo $company_domain | ||
| echo $company_email | ||
| echo $CERT_PASSWORD # password | ||
| echo $CERT_PASSWORD # password (again) | ||
| } | ||
| echo_ca_cert_params() { | ||
| echo_cert_params "$CA_DOMAIN" "$CA_EMAIL" | ||
| } | ||
| echo_server_cert_params() { | ||
| echo_cert_params "$SERVER_DOMAIN" "$SERVER_EMAIL" | ||
| } | ||
|
|
||
| # [ main ] | ||
| # generate certificates | ||
| # - ca | ||
| openssl genrsa $RSA_STR_LEN > $KEY_DIR/${PREFIX}ca-key.pem | ||
| echo_ca_cert_params | \ | ||
| openssl req -new -x509 -nodes -days $CERT_DAYS -key $KEY_DIR/${PREFIX}ca-key.pem -out $CERT_DIR/${PREFIX}ca-cert.pem | ||
| # - server | ||
| echo_server_cert_params | \ | ||
| openssl req -newkey rsa:$RSA_STR_LEN -days $CERT_DAYS -nodes -keyout $KEY_DIR/${PREFIX}server-key.pem -out $CERT_DIR/${PREFIX}server-req.pem | ||
| openssl rsa -in $KEY_DIR/${PREFIX}server-key.pem -out $KEY_DIR/${PREFIX}server-key.pem | ||
| openssl x509 -req -in $CERT_DIR/${PREFIX}server-req.pem -days $CERT_DAYS -CA $CERT_DIR/${PREFIX}ca-cert.pem -CAkey $KEY_DIR/${PREFIX}ca-key.pem -set_serial 01 -out $CERT_DIR/${PREFIX}server-cert.pem | ||
|
|
||
| # clean up (before permission changed) | ||
| rm $KEY_DIR/${PREFIX}ca-key.pem | ||
| rm $CERT_DIR/${PREFIX}server-req.pem | ||
|
|
||
| # validate permission | ||
| chmod 400 $KEY_DIR/${PREFIX}server-key.pem | ||
|
|
||
| # verify relationship among certificates | ||
| openssl verify -CAfile $CERT_DIR/${PREFIX}ca-cert.pem $CERT_DIR/${PREFIX}server-cert.pem | ||
| } | ||
|
|
||
| main |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.