From 1b47bdc126fed50ba6bd4c488f9d636d97be2fd7 Mon Sep 17 00:00:00 2001 From: Danny Houtworm Date: Mon, 14 Aug 2023 07:09:17 +0000 Subject: [PATCH] bla --- Makefile | 2 + srcs/.env | 5 + srcs/docker-compose.yml | 25 +- srcs/requirements/fail2ban/Dockerfile | 6 - srcs/requirements/ftp/Dockerfile | 2 - srcs/requirements/ftp/srcs/start.sh | 2 +- srcs/requirements/mariadb/srcs/start.sh | 6 +- srcs/requirements/nextcloud/Dockerfile | 29 ++ .../nextcloud/srcs/nextcloud.conf | 95 ++++ srcs/requirements/nextcloud/srcs/start.sh | 11 + srcs/requirements/nextcloud/srcs/www.conf | 471 ++++++++++++++++++ srcs/requirements/nginx/srcs/nginx.conf | 30 ++ srcs/requirements/wordpress/Dockerfile | 6 - 13 files changed, 669 insertions(+), 21 deletions(-) delete mode 100644 srcs/requirements/fail2ban/Dockerfile create mode 100644 srcs/requirements/nextcloud/Dockerfile create mode 100644 srcs/requirements/nextcloud/srcs/nextcloud.conf create mode 100644 srcs/requirements/nextcloud/srcs/start.sh create mode 100644 srcs/requirements/nextcloud/srcs/www.conf diff --git a/Makefile b/Makefile index 95c59e0..e74f676 100644 --- a/Makefile +++ b/Makefile @@ -8,6 +8,8 @@ build: sudo mv wp-cli.phar /home/djonker/data/wordpress/wp-cli.phar sudo chmod +x /home/djonker/data/wordpress/wp-cli.phar sudo curl -L https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php --output /home/djonker/data/adminer/adminer.php + sudo curl -L https://download.nextcloud.com/server/releases/latest.zip --output ~/data/nextcloud.zip + sudo unzip -d ~/data ~/data/nextcloud.zip up: build sudo docker-compose -f ./srcs/docker-compose.yml up -d diff --git a/srcs/.env b/srcs/.env index 9d2a693..3c8561a 100644 --- a/srcs/.env +++ b/srcs/.env @@ -9,3 +9,8 @@ WPUSERPASSWD=password WPUSEREMAIL=user42@houtworm.email FTPUSER=djonker FTPPASSWD=password +NEXTCLOUDDATABASE=nextcloud +NEXTCLOUDDATABASEUSER=nextcloud +NEXTCLOUDDATABASEPASSWD=password +NEXTCLOUDUSER=djonker +NEXTCLOUDPASSWD=password diff --git a/srcs/docker-compose.yml b/srcs/docker-compose.yml index 4e96403..135bed1 100644 --- a/srcs/docker-compose.yml +++ b/srcs/docker-compose.yml @@ -8,6 +8,7 @@ services: restart: always volumes: - /home/djonker/data/wordpress:/var/www/wordpress + - /home/djonker/data/nextcloud:/var/www/nextcloud - /home/djonker/data/adminer:/var/www/adminer ports: - 80:80 @@ -21,6 +22,9 @@ services: - WORDPRESSDATABASE=${WORDPRESSDATABASE} - WORDPRESSDATABASEUSER=${WORDPRESSDATABASEUSER} - WORDPRESSDATABASEPASSWD=${WORDPRESSDATABASEPASSWD} + - NEXTCLOUDDATABASE=${NEXTCLOUDDATABASE} + - NEXTCLOUDDATABASEUSER=${NEXTCLOUDDATABASEUSER} + - NEXTCLOUDDATABASEPASSWD=${NEXTCLOUDDATABASEPASSWD} init: true container_name: mariadb restart: always @@ -56,10 +60,11 @@ services: environment: - FTPUSER=${FTPUSER} - FTPPASSWD=${FTPPASSWD} + init: true container_name: ftp restart: always volumes: - - /home/djonker/data/wordpress:/home/admin + - /home/djonker/data/wordpress:/home/${FTPUSER} ports: - 21:21 - 21000:21000 @@ -79,10 +84,22 @@ services: networks: wordpress: ipv4_address: 172.20.30.50 - fail2ban: - build: ./requirements/fail2ban - container_name: fail2ban + nextcloud: + build: ./requirements/nextcloud + environment: + - NEXTCLOUDDATABASE=${NEXTCLOUDDATABASE} + - NEXTCLOUDDATABASEUSER=${NEXTCLOUDDATABASEUSER} + - NEXTCLOUDDATABASEPASSWD=${NEXTCLOUDDATABASEPASSWD} + - NEXTCLOUDUSER=${NEXTCLOUDUSER} + - NEXTCLOUDPASSWD=${NEXTCLOUDPASSWD} + init: true + container_name: nextcloud restart: always + volumes: + - /home/djonker/data/nextcloud:/var/www/nextcloud + networks: + wordpress: + ipv4_address: 172.20.30.60 networks: wordpress: diff --git a/srcs/requirements/fail2ban/Dockerfile b/srcs/requirements/fail2ban/Dockerfile deleted file mode 100644 index aa7e066..0000000 --- a/srcs/requirements/fail2ban/Dockerfile +++ /dev/null @@ -1,6 +0,0 @@ -FROM alpine -RUN sleep 10 -RUN apk update -RUN apk add fail2ban -WORKDIR /root/ -CMD sleep 1000000 diff --git a/srcs/requirements/ftp/Dockerfile b/srcs/requirements/ftp/Dockerfile index 505a1de..1b05a20 100644 --- a/srcs/requirements/ftp/Dockerfile +++ b/srcs/requirements/ftp/Dockerfile @@ -1,6 +1,4 @@ FROM alpine -ARG FTPUSER=${FTPUSER} -ARG FTPPASSWD=${FTPPASSWD} RUN sleep 10 RUN apk update RUN apk add openssl diff --git a/srcs/requirements/ftp/srcs/start.sh b/srcs/requirements/ftp/srcs/start.sh index 7a51503..e18c887 100644 --- a/srcs/requirements/ftp/srcs/start.sh +++ b/srcs/requirements/ftp/srcs/start.sh @@ -1,3 +1,3 @@ adduser --disabled-password ${FTPUSER} -echo "${FTPUSER:${FTPPASSWD}}" | chpasswd +echo "${FTPUSER}:${FTPPASSWD}" | chpasswd pure-ftpd -p 21000:21000 -P 127.0.0.1 diff --git a/srcs/requirements/mariadb/srcs/start.sh b/srcs/requirements/mariadb/srcs/start.sh index b9dc7c0..27d2c68 100644 --- a/srcs/requirements/mariadb/srcs/start.sh +++ b/srcs/requirements/mariadb/srcs/start.sh @@ -4,11 +4,13 @@ then touch /var/lib/mysql/initialized else mysql_install_db --user=mysql --datadir=/var/lib/mysql - mysqld & sleep 10 + mysqld & sleep 5 mysql -e "CREATE DATABASE $WORDPRESSDATABASE" - #mysql wordpress < wordpress.sql mysql -e "GRANT ALL PRIVILEGES ON $WORDPRESSDATABASE.* TO $WORDPRESSDATABASEUSER@172.20.30.30 IDENTIFIED BY '$WORDPRESSDATABASEPASSWD'" mysql -e "GRANT ALL PRIVILEGES ON $WORDPRESSDATABASE.* TO $WORDPRESSDATABASEUSER@172.20.30.40 IDENTIFIED BY '$WORDPRESSDATABASEPASSWD'" + mysql -e "CREATE DATABASE $NEXTCLOUDDATABASE" + mysql -e "GRANT ALL PRIVILEGES ON $NEXTCLOUDDATABASE.* TO $NEXTCLOUDDATABASEUSER@172.20.30.60 IDENTIFIED BY '$NEXTCLOUDDATABASEPASSWD'" + mysql -e "GRANT ALL PRIVILEGES ON $NEXTCLOUDDATABASE.* TO $NEXTCLOUDDATABASEUSER@172.20.30.40 IDENTIFIED BY '$NEXTCLOUDDATABASEPASSWD'" killall mysqld touch /var/lib/mysql/initialized fi diff --git a/srcs/requirements/nextcloud/Dockerfile b/srcs/requirements/nextcloud/Dockerfile new file mode 100644 index 0000000..a2d1e28 --- /dev/null +++ b/srcs/requirements/nextcloud/Dockerfile @@ -0,0 +1,29 @@ +FROM alpine +RUN sleep 10 +RUN apk update +RUN apk add sudo +RUN apk add php +RUN apk add php-fpm +RUN apk add php-mysqli +RUN apk add php-gd +RUN apk add php-mbstring +RUN apk add php-curl +RUN apk add php-json +RUN apk add php-xml +RUN apk add php-zip +RUN apk add php-pdo +RUN apk add php-dom +RUN apk add php-ctype +RUN apk add php-openssl +RUN apk add php-posix +RUN apk add php-session +RUN apk add php-simplexml +RUN apk add php-xmlreader +RUN apk add php-xmlwriter +RUN apk add php-zlib +RUN apk add php-pdo_mysql +COPY srcs/start.sh /root/start.sh +COPY srcs/www.conf /etc/php81/php-fpm.d/www.conf +WORKDIR /root/ +CMD sh start.sh +EXPOSE 9000/tcp diff --git a/srcs/requirements/nextcloud/srcs/nextcloud.conf b/srcs/requirements/nextcloud/srcs/nextcloud.conf new file mode 100644 index 0000000..cc6cb21 --- /dev/null +++ b/srcs/requirements/nextcloud/srcs/nextcloud.conf @@ -0,0 +1,95 @@ +[MB(,6o8c}ixu]o4<7:IfFm47YlZ}H.g' ); +define( 'SECURE_AUTH_KEY', 'VP]zWxYl9qI7UN&2Tpxfi19GVKVnL K{E<{eQk@%yGVAenVYI9=fMdWwQ8H#^=T}lYc-[<;_{GB>O1J<0hRB aS8' ); +define( 'NONCE_KEY', '~mc~SvOjEtecCl`LGO*gBSc+LSF(uJIn[*CYs>X?9_pLAI 2-I5L_MK@rsjGpi~l' ); +define( 'AUTH_SALT', 'W{pgvAJTq@!kWR2_e2K(,1QDh^t{(2nO@.n!M>bqpFI0J0kz[=)&K_X)qk|64H`m' ); +define( 'SECURE_AUTH_SALT', 'jjnbWeXgfySzHg&yal@!YSRcZr@G3}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %T: time the log has been written (the request has finished) +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsulated in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %u: remote user +; +; Default: "%R - %u %t \"%m %r\" %s" +;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%" + +; The log file for slow requests +; Default Value: not set +; Note: slowlog is mandatory if request_slowlog_timeout is set +;slowlog = log/php81/$pool.slow.log + +; The timeout for serving a single request after which a PHP backtrace will be +; dumped to the 'slowlog' file. A value of '0s' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_slowlog_timeout = 0 + +; Depth of slow log stack trace. +; Default Value: 20 +;request_slowlog_trace_depth = 20 + +; The timeout for serving a single request after which the worker process will +; be killed. This option should be used when the 'max_execution_time' ini option +; does not stop script execution for some reason. A value of '0' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_terminate_timeout = 0 + +; The timeout set by 'request_terminate_timeout' ini option is not engaged after +; application calls 'fastcgi_finish_request' or when application has finished and +; shutdown functions are being called (registered via register_shutdown_function). +; This option will enable timeout limit to be applied unconditionally +; even in such cases. +; Default Value: no +;request_terminate_timeout_track_finished = no + +; Set open file descriptor rlimit. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Chroot to this directory at the start. This value must be defined as an +; absolute path. When this value is not set, chroot is not used. +; Note: you can prefix with '$prefix' to chroot to the pool prefix or one +; of its subdirectories. If the pool prefix is not set, the global prefix +; will be used instead. +; Note: chrooting is a great security feature and should be used whenever +; possible. However, all PHP paths will be relative to the chroot +; (error_log, sessions.save_path, ...). +; Default Value: not set +;chroot = + +; Chdir to this directory at the start. +; Note: relative path can be used. +; Default Value: current directory or / when chroot +;chdir = /var/www + +; Redirect worker stdout and stderr into main error log. If not set, stdout and +; stderr will be redirected to /dev/null according to FastCGI specs. +; Note: on highloaded environment, this can cause some delay in the page +; process time (several ms). +; Default Value: no +;catch_workers_output = yes + +; Decorate worker output with prefix and suffix containing information about +; the child that writes to the log and if stdout or stderr is used as well as +; log level and time. This options is used only if catch_workers_output is yes. +; Settings to "no" will output data as written to the stdout or stderr. +; Default value: yes +;decorate_workers_output = no + +; Clear environment in FPM workers +; Prevents arbitrary environment variables from reaching FPM worker processes +; by clearing the environment in workers before env vars specified in this +; pool configuration are added. +; Setting to "no" will make all environment variables available to PHP code +; via getenv(), $_ENV and $_SERVER. +; Default Value: yes +;clear_env = no + +; Limits the extensions of the main script FPM will allow to parse. This can +; prevent configuration mistakes on the web server side. You should only limit +; FPM to .php extensions to prevent malicious users to use other extensions to +; execute php code. +; Note: set an empty value to allow all extensions. +; Default Value: .php +security.limit_extensions = + +; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from +; the current environment. +; Default Value: clean env +;env[HOSTNAME] = $HOSTNAME +;env[PATH] = /usr/local/bin:/usr/bin:/bin +;env[TMP] = /tmp +;env[TMPDIR] = /tmp +;env[TEMP] = /tmp + +; Additional php.ini defines, specific to this pool of workers. These settings +; overwrite the values previously defined in the php.ini. The directives are the +; same as the PHP SAPI: +; php_value/php_flag - you can set classic ini defines which can +; be overwritten from PHP call 'ini_set'. +; php_admin_value/php_admin_flag - these directives won't be overwritten by +; PHP call 'ini_set' +; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. + +; Defining 'extension' will load the corresponding shared extension from +; extension_dir. Defining 'disable_functions' or 'disable_classes' will not +; overwrite previously defined php.ini values, but will append the new value +; instead. + +; Note: path INI options can be relative and will be expanded with the prefix +; (pool, global or /usr) + +; Default Value: nothing is defined by default except the values in php.ini and +; specified at startup with the -d argument +;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com +;php_flag[display_errors] = off +;php_admin_value[error_log] = /var/log/php81/$pool.error.log +;php_admin_flag[log_errors] = on +;php_admin_value[memory_limit] = 32M diff --git a/srcs/requirements/nginx/srcs/nginx.conf b/srcs/requirements/nginx/srcs/nginx.conf index 517742e..f440ab2 100644 --- a/srcs/requirements/nginx/srcs/nginx.conf +++ b/srcs/requirements/nginx/srcs/nginx.conf @@ -80,6 +80,36 @@ http { } } + server { + listen 443 ssl; + ssl_certificate /etc/ssl/certs/nginx.crt; + ssl_certificate_key /etc/ssl/private/nginx.key; + server_name nextcloud.djonker.42.fr localhost; + root /var/www/nextcloud; + index index.php; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_timeout 10m; + keepalive_timeout 50; + + location / { + try_files $uri /index.php?$args; + add_header Last-Modified $date_gmt; + add_header Cache-Control 'no-store, no-cache'; + if_modified_since off; + expires off; + etag off; + } + + location ~ \.php$ { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass 172.20.30.60:9000; + fastcgi_index index.php; + include fastcgi_params; + fastcgi_param DOCUMENT_ROOT $document_root; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + } + } server { listen 443 ssl; ssl_certificate /etc/ssl/certs/nginx.crt; diff --git a/srcs/requirements/wordpress/Dockerfile b/srcs/requirements/wordpress/Dockerfile index f6ddaf5..d4263f2 100644 --- a/srcs/requirements/wordpress/Dockerfile +++ b/srcs/requirements/wordpress/Dockerfile @@ -1,10 +1,4 @@ FROM alpine -ARG WORDPRESSDATABASE=${WORDPRESSDATABASE} -ARG WORDPRESSDATABASEUSER=${WORDPRESSDATABASEUSER} -ARG WORDPRESSDATABASEPASSWD=${WORDPRESSDATABASEPASSWD} -ARG WPADMINUSER=${WPADMINUSER} -ARG WPADMINPASSWD=$(WPADMINPASSWD) -ARG WPADMINEMAIL=$(WPADMINEMAIL) RUN sleep 10 RUN apk update RUN apk add openssl