Skip to content

Commit efde1c9

Browse files
mstrazdsmstrazds
committed
Added updated baseimage, NVM for node, New Relic APM and HTTPS configuration
1 parent 8a6bfe2 commit efde1c9

File tree

6 files changed

+197
-6
lines changed

6 files changed

+197
-6
lines changed

‎Changelog.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
## 0.9.3 (release date: 2016-01-10)
2+
3+
* Removed latest version of nodejs installation
4+
* Updated `phusion/baseimage` to `0.9.18`
5+
* Added NVM `0.30.2` for switching node to `0.10.37`
6+
* Added New Relic APM setup script for monitoring
7+
* Added HTTPS configuration with generated certificate
8+
* Added system timezone setting to: "Australia/Sydney"
9+
110
## 0.9.2 (release date: 2015-11-30)
211

312
* Added PostgreSQL Support

‎Dockerfile

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM phusion/baseimage:0.9.17
1+
FROM phusion/baseimage:0.9.18
22

33
# Phusion setup
44
ENV HOME /root
@@ -14,9 +14,25 @@ RUN apt-get update -y && sudo apt-get upgrade -y && apt-get install -y php5 php5
1414
php5-pgsql php5-curl php5-gd php5-mcrypt php5-intl php5-imap php5-tidy \
1515
php-pear php5-xmlrpc
1616

17-
# Install latest version of nodejs
18-
RUN curl --silent --location https://deb.nodesource.com/setup_4.x | sudo bash -
19-
RUN apt-get install -y nodejs
17+
# Run update timezone replace city with relevant city. eg. "Australia/Sydney"
18+
RUN cp -p /usr/share/zoneinfo/Australia/Sydney /etc/localtime
19+
20+
# Replace shell with bash so we can source files
21+
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
22+
23+
# Install Node Version Manager and install node specific version
24+
ENV NVM_DIR /usr/local/nvm
25+
ENV NODE_VERSION 0.10.37
26+
27+
# Install nvm with node and npm
28+
RUN curl https://raw.githubusercontent.com/creationix/nvm/v0.30.2/install.sh | bash \
29+
&& source $NVM_DIR/nvm.sh \
30+
&& nvm install $NODE_VERSION \
31+
&& nvm alias default $NODE_VERSION \
32+
&& nvm use default
33+
34+
ENV NODE_PATH $NVM_DIR/v$NODE_VERSION/lib/node_modules
35+
ENV PATH $NVM_DIR/v$NODE_VERSION/bin:$PATH
2036

2137
# Install nginx (full)
2238
RUN apt-get install -y nginx-full
@@ -55,6 +71,25 @@ ADD build/index.php /var/www/public/index.php
5571
RUN chown -R www-data:www-data /var/www
5672
RUN chmod -R 755 /var/www
5773

74+
# Install New Relic daemon
75+
RUN apt-get update && \
76+
apt-get -yq install wget && \
77+
wget -O - https://download.newrelic.com/548C16BF.gpg | apt-key add - && \
78+
echo "deb http://apt.newrelic.com/debian/ newrelic non-free" > /etc/apt/sources.list.d/newrelic.list
79+
80+
RUN apt-get update && \
81+
apt-get -yq install newrelic-php5
82+
83+
# Add New Relic APM install script
84+
RUN mkdir -p /etc/my_init.d
85+
ADD build/newrelic.sh /etc/my_init.d/newrelic.sh
86+
RUN chmod +x /etc/my_init.d/newrelic.sh
87+
88+
# Setup environment variables for initializing New Relic APM
89+
ENV NR_INSTALL_SILENT 1
90+
ENV NR_INSTALL_KEY **ChangeMe**
91+
ENV NR_APP_NAME "Docker PHP Application"
92+
5893
# Set terminal environment
5994
ENV TERM=xterm
6095

‎README.md

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
</a>
55
</p>
66
-----
7-
# nginx-php56
7+
# nginx-php56 [![](https://badge.imagelayers.io/mstrazds/nginx-php56:latest.svg)](https://imagelayers.io/?images=mstrazds/nginx-php56:latest 'Get your own badge on imagelayers.io')
88
A Nginx + PHP 5.6 (FPM) base container. Builds upon on the excellent [phusion/baseimage-docker](https://github.com/phusion/baseimage-docker) container. You can find the docker automated build [here](https://registry.hub.docker.com/u/mstrazds/nginx-php56/).
99

1010
### Services
@@ -26,7 +26,32 @@ The following folder is specified as the default root web folder:
2626

2727
``/var/www/public``
2828

29-
Note that the ``/var/www/public`` is the root folder for serving PHP files for your web server.
29+
Note that the ``/var/www/public`` is the root folder for serving PHP files for your web server. The following ports are exposed:
30+
31+
* 80 (HTTP)
32+
* 443 (HTTPS/SSL)
33+
34+
### SSL Self Signed Certificate
35+
The image generates a self-signed certificate for each container within the folder:
36+
37+
``/etc/nginx/certs.d/``
38+
39+
During build the ``build/default`` file is used to copy and configure nginx default settings. This includes a cipher suite for legacy browser (IE8+) support. See: [https://cipherli.st/](https://cipherli.st/)
40+
41+
### Node + NVM
42+
The image contains installation and configuration of node ``0.10.37`` by default using NVM [(Node Version Manager)](https://github.com/creationix/nvm). This can be changed by running: ``nvm install $NODE_VERSION`` and using the new node version by running the following command: ``nvm use $NODE_VERSION``
43+
44+
### New Relic APM
45+
Installs New Relic APM daemon on [container startup](https://github.com/phusion/baseimage-docker#running_startup_scripts) to monitor the php application within the image. See [this tutorial](http://code.tutsplus.com/tutorials/how-to-monitor-docker-based-applications-using-new-relic--cms-24891) for more information.
46+
47+
The following environment variables are required in order to complete the New Relic configuration:
48+
49+
* ``NR_INSTALL_KEY`` 134adf09dsfblahsomething
50+
* ``NR_APP_NAME`` "Docker PHP App Name"
51+
52+
If the ``NR_INSTALL_KEY`` New Relic will not be setup. By default this will prevent monitoring as the key is invalid until entered on startup. Eg:
53+
54+
``docker run --name nginx -e NR_INSTALL_KEY="134adf09dsfblahsomething" -e NR_APP_NAME="nginx-test" -p 80:80 -p 443:443 -d mstrazds/nginx-php56:latest``
3055

3156
### Build Folder (within repo)
3257
Contains nginx config files as well as php-fpm settings. Also include setup.sh file that offloads tasks from the Dockerfile to reduce layers.

‎build/default

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,114 @@ server {
3636
fastcgi_param HTTPS off;
3737
}
3838

39+
# Deny .htaccess file access
40+
location ~ /\.ht {
41+
deny all;
42+
}
43+
44+
# Redirect users to go to SSL Version
45+
#if ($ssl_protocol = "") {
46+
# rewrite ^ https://$server_name$request_uri? permanent;
47+
#}
48+
49+
}
50+
51+
server {
52+
53+
listen 443 ssl;
54+
server_name localhost;
55+
56+
# tell the browser we can only talk to self and google analytics.
57+
#add_header X-Content-Security-Policy "default-src 'self'; \
58+
#script-src 'self' https://ssl.google-analytics.com; \
59+
#img-src 'self' https://ssl.google-analytics.com";
60+
61+
# SSL Settings (see: https://cipherli.st/ )
62+
63+
# ciphers chosen and ordered for mix of performance, interoperability and security (supports IE8+)
64+
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
65+
66+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
67+
68+
ssl_prefer_server_ciphers on;
69+
ssl_session_cache shared:SSL:10m;
70+
ssl_session_timeout 10m;
71+
72+
# tell users to go to SSL version next time
73+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
74+
75+
# tell the browser dont allow hosting in a frame
76+
add_header X-Frame-Options DENY;
77+
78+
# certificate
79+
ssl_certificate_key certs.d/localhost.key;
80+
ssl_certificate certs.d/localhost.cer;
81+
82+
add_header X-Content-Type-Options nosniff;
83+
ssl_session_tickets off;
84+
85+
# enable ocsp stapling
86+
ssl_stapling on; # Requires nginx >= 1.3.7
87+
ssl_stapling_verify on; # Requires nginx >= 1.3.7
88+
resolver 8.8.8.8 4.4.4.4 valid=300s;
89+
resolver_timeout 5s;
90+
91+
# ssl trusted certificate
92+
ssl_trusted_certificate certs.d/localhost.cer;
93+
94+
root /var/www/public;
95+
index index.html index.htm index.php;
96+
97+
access_log off;
98+
error_log /var/log/nginx/localhost-error.log error;
99+
expires @30m;
100+
101+
#access_log /var/log/nginx/localhost.com-access.log;
102+
#error_log /var/log/nginx/localhost.com-error.log error;
103+
104+
charset utf-8;
105+
106+
location / {
107+
try_files $uri $uri/ /index.html /index.php?$query_string;
108+
}
109+
110+
location = /favicon.ico { log_not_found off; access_log off; }
111+
location = /robots.txt { access_log off; log_not_found off; }
112+
113+
error_page 404 /index.php;
114+
115+
# redirect server error pages to the static page /50x.html
116+
#error_page 500 502 503 504 /50x.html;
117+
118+
#location = /50x.html {
119+
#root /usr/share/nginx/html;
120+
#}
121+
122+
# pass the PHP scripts to php5-fpm
123+
# Note: \.php$ is susceptible to file upload attacks
124+
# Consider using: "location ~ ^/(index|app|app_dev|config)\.php(/|$) {"
125+
126+
location ~ \.php$ {
127+
128+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
129+
130+
# With php5-fpm:
131+
fastcgi_pass unix:/var/run/php5-fpm.sock;
132+
fastcgi_index index.php;
133+
include fastcgi_params;
134+
fastcgi_param REMOTE_ADDR $http_x_real_ip;
135+
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_script_name;
136+
137+
fastcgi_param SCRIPT_FILENAME $request_filename;
138+
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
139+
fastcgi_param REQUEST_URI $request_uri;
140+
fastcgi_param DOCUMENT_URI $document_uri;
141+
fastcgi_param DOCUMENT_ROOT $document_root;
142+
fastcgi_param SERVER_PROTOCOL $server_protocol;
143+
144+
fastcgi_param HTTPS on;
145+
}
146+
39147
# Deny .htaccess file access
40148
location ~ /\.ht {
41149
deny all;

‎build/newrelic.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
echo "Enabling APM metrics for ${NR_APP_NAME}"
5+
newrelic-install install
6+
7+
# Update the application name
8+
sed -i "s/newrelic.appname = \"PHP Application\"/newrelic.appname = \"${NR_APP_NAME}\"/" /etc/php5/fpm/conf.d/newrelic.ini

‎build/setup.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
#!/usr/bin/env bash
22

3+
##-------------------------------------------------------
4+
# SETUP SELF SIGNED SSL CERTIFICATES
5+
##-------------------------------------------------------
6+
mkdir -p /etc/nginx/certs.d
7+
openssl req -nodes -x509 -newkey rsa:4096 -keyout /etc/nginx/certs.d/localhost.key -out /etc/nginx/certs.d/localhost.cer -days 356 -subj /C=AU/ST=NSW/L=Sydney/O=IT/CN=localhost.com
8+
39
##-------------------------------------------------------
410
# UPDATE CONFIG FILES
511
##-------------------------------------------------------

0 commit comments

Comments
 (0)