first init
This commit is contained in:
ISMAIL MASSERAN
@@ -0,0 +1,175 @@
|
||||
# Stage 0: Build Vue frontend assets with Node.js
|
||||
FROM node:22 AS frontend-builder
|
||||
|
||||
WORKDIR /app/frontend
|
||||
|
||||
# Copy frontend package files
|
||||
COPY SUTERA-frontend/package*.json ./
|
||||
COPY SUTERA-frontend/pnpm-lock.yaml* ./
|
||||
|
||||
# Install pnpm and frontend dependencies (including dev dependencies for build)
|
||||
RUN npm install -g pnpm
|
||||
RUN pnpm install --frozen-lockfile
|
||||
|
||||
# Copy frontend source code
|
||||
COPY SUTERA-frontend/ ./
|
||||
|
||||
# Build TWO frontend bundles (path-based):
|
||||
# - Production: served at /
|
||||
# - Training: served at /training/
|
||||
#
|
||||
# This avoids runtime JS injection and allows training/prod UI differences
|
||||
# while keeping a single backend image.
|
||||
RUN pnpm run typecheck \
|
||||
&& pnpm exec vite build --mode=production --base=/ --outDir dist-prod \
|
||||
&& pnpm exec vite build --mode=training --base=/training/ --outDir dist-training
|
||||
|
||||
# Clean up dev dependencies to reduce image size
|
||||
ENV CI=true
|
||||
RUN pnpm prune --prod
|
||||
|
||||
# Stage 1: Build environment and Composer dependencies
|
||||
FROM php:8.4-fpm AS builder
|
||||
|
||||
LABEL maintainer="Topaz"
|
||||
|
||||
# Install system dependencies and PHP extensions for Laravel with MySQL/PostgreSQL support.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
curl \
|
||||
unzip \
|
||||
libpq-dev \
|
||||
libonig-dev \
|
||||
libssl-dev \
|
||||
libxml2-dev \
|
||||
libcurl4-openssl-dev \
|
||||
libicu-dev \
|
||||
libzip-dev \
|
||||
libjpeg-dev \
|
||||
libpng-dev \
|
||||
libfreetype6-dev \
|
||||
&& docker-php-ext-configure gd --with-freetype --with-jpeg \
|
||||
&& docker-php-ext-install -j$(nproc) \
|
||||
pdo_mysql \
|
||||
pdo_pgsql \
|
||||
pgsql \
|
||||
opcache \
|
||||
intl \
|
||||
zip \
|
||||
bcmath \
|
||||
soap \
|
||||
gd \
|
||||
pcntl \
|
||||
&& pecl install redis \
|
||||
&& docker-php-ext-enable redis \
|
||||
&& apt-get autoremove -y && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
||||
|
||||
# Set the working directory inside the container
|
||||
WORKDIR /var/www
|
||||
|
||||
# Copy the entire Laravel application code into the container
|
||||
COPY SUTERA-backend/ /var/www
|
||||
|
||||
# Copy Composer from official image (avoids flaky getcomposer.org in CI)
|
||||
COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
|
||||
|
||||
# Install PHP dependencies
|
||||
RUN composer install --no-dev --optimize-autoloader --no-interaction --no-progress --prefer-dist --no-scripts \
|
||||
&& rm -rf bootstrap/cache/services.php bootstrap/cache/packages.php
|
||||
|
||||
# Stage 2: Unified production image with PHP-FPM + Nginx
|
||||
FROM php:8.4-fpm AS base
|
||||
|
||||
LABEL maintainer="Topaz"
|
||||
|
||||
# Set system timezone to Asia/Kuala_Lumpur
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends tzdata \
|
||||
&& ln -snf /usr/share/zoneinfo/Asia/Kuala_Lumpur /etc/localtime \
|
||||
&& echo "Asia/Kuala_Lumpur" > /etc/timezone \
|
||||
&& dpkg-reconfigure -f noninteractive tzdata \
|
||||
&& apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
||||
|
||||
# Install Nginx and all runtime dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
nginx \
|
||||
libpq-dev \
|
||||
libicu-dev \
|
||||
libzip-dev \
|
||||
libpng-dev \
|
||||
libjpeg-dev \
|
||||
libfreetype6-dev \
|
||||
libfcgi-bin \
|
||||
procps \
|
||||
netcat-openbsd \
|
||||
supervisor \
|
||||
nano \
|
||||
curl \
|
||||
&& docker-php-ext-configure gd --with-freetype --with-jpeg \
|
||||
&& docker-php-ext-install gd \
|
||||
&& pecl install redis \
|
||||
&& docker-php-ext-enable redis \
|
||||
&& apt-get autoremove -y && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
||||
|
||||
# Download and install php-fpm health check script
|
||||
RUN curl -o /usr/local/bin/php-fpm-healthcheck \
|
||||
https://raw.githubusercontent.com/renatomefi/php-fpm-healthcheck/master/php-fpm-healthcheck \
|
||||
&& chmod +x /usr/local/bin/php-fpm-healthcheck
|
||||
|
||||
# Copy the initialization script
|
||||
COPY SUTERA-backend/docker/common/unified/entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/entrypoint.sh
|
||||
|
||||
# Copy supervisor configuration files
|
||||
COPY SUTERA-backend/docker/common/unified/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
|
||||
|
||||
# Create supervisor conf.d directory
|
||||
RUN mkdir -p /etc/supervisor/conf.d
|
||||
|
||||
# Use common supervisor and nginx config inside the image.
|
||||
# If you need environment-specific behavior (training vs production), override at runtime
|
||||
# by mounting files into:
|
||||
# - /etc/nginx/nginx.conf
|
||||
# - /etc/supervisor/conf.d/
|
||||
COPY SUTERA-backend/docker/common/unified/supervisor/unified.conf /etc/supervisor/conf.d/unified.conf
|
||||
COPY SUTERA-backend/docker/common/unified/nginx/nginx.conf /etc/nginx/nginx.conf
|
||||
|
||||
# Copy the initial storage structure
|
||||
COPY SUTERA-backend/storage /var/www/storage-init
|
||||
|
||||
# Copy PHP extensions and libraries from the builder stage
|
||||
COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
|
||||
COPY --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
|
||||
COPY --from=builder /usr/local/bin/docker-php-ext-* /usr/local/bin/
|
||||
|
||||
# Use the recommended production PHP configuration
|
||||
RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
|
||||
|
||||
# Enable PHP-FPM status page via separate config file (avoid modifying zz-docker.conf)
|
||||
RUN echo '[www]' > /usr/local/etc/php-fpm.d/zzz-status.conf && \
|
||||
echo 'pm.status_path = /status' >> /usr/local/etc/php-fpm.d/zzz-status.conf
|
||||
|
||||
# Copy the application code and dependencies from the build stage first
|
||||
COPY --from=builder /var/www /var/www
|
||||
|
||||
# Copy the built Vue frontends from frontend-builder stage
|
||||
# - Production frontend at /
|
||||
COPY --from=frontend-builder /app/frontend/dist-prod /var/www/public/
|
||||
# - Training frontend at /training/
|
||||
COPY --from=frontend-builder /app/frontend/dist-training /var/www/public/training/
|
||||
|
||||
# Set working directory
|
||||
WORKDIR /var/www
|
||||
|
||||
# Ensure correct permissions
|
||||
RUN chown -R www-data:www-data /var/www
|
||||
|
||||
# Create Nginx log directory
|
||||
RUN mkdir -p /var/log/nginx && chown -R www-data:www-data /var/log/nginx
|
||||
|
||||
# Run the entrypoint script
|
||||
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||||
|
||||
# Expose port 80 (Nginx) and 9000 (PHP-FPM for health checks)
|
||||
EXPOSE 80 9000
|
||||
|
||||
# Start supervisor which manages both Nginx and PHP-FPM
|
||||
CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
|
||||
@@ -0,0 +1,69 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
echo "Starting Laravel entrypoint (Unified)..."
|
||||
|
||||
# Step 0: Wait for DB if configured
|
||||
if [ -n "${DB_HOST:-}" ]; then
|
||||
echo "Waiting for DB at ${DB_HOST}:${DB_PORT:-5432}..."
|
||||
# Wait up to ~60s (60 * 1s)
|
||||
i=0
|
||||
while ! nc -z "$DB_HOST" "${DB_PORT:-5432}"; do
|
||||
i=$((i + 1))
|
||||
if [ "$i" -ge 60 ]; then
|
||||
echo "DB not reachable after 60s. Continuing anyway."
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
echo "DB check finished."
|
||||
fi
|
||||
|
||||
# Step 1: Initialize persistent storage if needed
|
||||
if [ ! "$(ls -A /var/www/storage 2>/dev/null)" ]; then
|
||||
echo "Initializing /var/www/storage..."
|
||||
cp -R /var/www/storage-init/. /var/www/storage
|
||||
chown -R www-data:www-data /var/www/storage
|
||||
else
|
||||
echo "/var/www/storage already initialized."
|
||||
fi
|
||||
|
||||
rm -rf /var/www/storage-init
|
||||
|
||||
# Step 2: Ensure environment is ready
|
||||
if [ ! -f .env ]; then
|
||||
echo ".env file is missing!"
|
||||
echo "Provide it at runtime (bind mount, env_file, or secret) to /var/www/.env."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Ensure bootstrap/cache directory exists and writable BEFORE artisan
|
||||
if [ ! -d bootstrap/cache ]; then
|
||||
echo "Creating bootstrap/cache directory..."
|
||||
mkdir -p bootstrap/cache
|
||||
fi
|
||||
chown -R www-data:www-data bootstrap/cache
|
||||
|
||||
# Step 3: Laravel setup and optimization
|
||||
php artisan storage:link || true
|
||||
php artisan config:clear
|
||||
php artisan config:cache
|
||||
php artisan route:cache
|
||||
php artisan event:cache
|
||||
php artisan package:discover --ansi
|
||||
|
||||
# Step 4: Set permissions
|
||||
chown -R www-data:www-data /var/www/storage
|
||||
chown -R www-data:www-data /var/www/bootstrap/cache
|
||||
|
||||
# Step 5: Ensure Laravel log directory exists
|
||||
mkdir -p /var/www/storage/logs
|
||||
chown -R www-data:www-data /var/www/storage/logs
|
||||
|
||||
# Step 6: Create supervisor log directories
|
||||
mkdir -p /var/log/supervisor
|
||||
chown -R root:root /var/log/supervisor
|
||||
|
||||
echo "Laravel setup complete. Starting Supervisor..."
|
||||
exec supervisord -c /etc/supervisor/supervisord.conf
|
||||
|
||||
@@ -0,0 +1,108 @@
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
# Logging
|
||||
access_log /var/log/nginx/access.log;
|
||||
error_log /var/log/nginx/error.log;
|
||||
|
||||
# HTTP server (default - works for training/dev)
|
||||
# For production with HTTPS, mount a custom nginx.conf that includes SSL config
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /var/www/public;
|
||||
index index.php index.html;
|
||||
|
||||
# Security headers
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||
|
||||
# API routes - pass directly to Laravel with original REQUEST_URI
|
||||
# (try_files would redirect to /index.php and lose the path, causing 502/bad routing)
|
||||
location /api/ {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
|
||||
include fastcgi_params;
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
fastcgi_param HTTPS $https if_not_empty;
|
||||
fastcgi_read_timeout 300;
|
||||
fastcgi_send_timeout 300;
|
||||
}
|
||||
|
||||
# Training SPA (built with base=/training/)
|
||||
# Serve training frontend routes from /var/www/public/training
|
||||
location ^~ /training/ {
|
||||
try_files $uri $uri/ /training/index.html;
|
||||
}
|
||||
|
||||
# Serve frontend assets
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
# Handle all other routes - serve Vue app or Laravel
|
||||
location / {
|
||||
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
||||
try_files $uri $uri/ /index.html /index.php?$query_string;
|
||||
}
|
||||
|
||||
# Handle PHP files - connect to localhost PHP-FPM
|
||||
location ~ \.php$ {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
|
||||
# Additional FastCGI parameters
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
fastcgi_param HTTPS $https if_not_empty;
|
||||
fastcgi_read_timeout 300;
|
||||
fastcgi_send_timeout 300;
|
||||
}
|
||||
|
||||
# Deny access to hidden files
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Cache static assets
|
||||
location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location ^~ /horizon {
|
||||
add_header Content-Security-Policy "default-src 'self' http: https: data: blob 'unsafe-inline' 'unsafe-eval'" always;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
|
||||
include fastcgi_params;
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
fastcgi_param HTTPS $https if_not_empty;
|
||||
fastcgi_read_timeout 300;
|
||||
fastcgi_send_timeout 300;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS server block removed from default config
|
||||
# To enable HTTPS in production:
|
||||
# 1. Mount SSL certificates to /etc/nginx/ssl/
|
||||
# 2. Mount a custom nginx.conf that includes HTTPS server block
|
||||
# Example: - ./production-nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
port 6379
|
||||
bind 0.0.0.0
|
||||
requirepass sutera_redis@2025
|
||||
@@ -0,0 +1,19 @@
|
||||
[unix_http_server]
|
||||
file=/var/run/supervisor.sock
|
||||
chmod=0700
|
||||
|
||||
[supervisord]
|
||||
nodaemon=true
|
||||
logfile=/var/log/supervisor/supervisord.log
|
||||
pidfile=/var/run/supervisord.pid
|
||||
childlogdir=/var/log/supervisor
|
||||
user=root
|
||||
|
||||
[rpcinterface:supervisor]
|
||||
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
|
||||
|
||||
[supervisorctl]
|
||||
serverurl=unix:///var/run/supervisor.sock
|
||||
|
||||
[include]
|
||||
files = /etc/supervisor/conf.d/*.conf
|
||||
@@ -0,0 +1,48 @@
|
||||
[program:php-fpm]
|
||||
command=php-fpm -F
|
||||
autostart=true
|
||||
autorestart=true
|
||||
stderr_logfile=/var/log/supervisor/php-fpm.err.log
|
||||
stdout_logfile=/var/log/supervisor/php-fpm.out.log
|
||||
user=root
|
||||
priority=100
|
||||
|
||||
[program:nginx]
|
||||
command=nginx -g "daemon off;"
|
||||
autostart=true
|
||||
autorestart=true
|
||||
stderr_logfile=/var/log/supervisor/nginx.err.log
|
||||
stdout_logfile=/var/log/supervisor/nginx.out.log
|
||||
user=root
|
||||
priority=200
|
||||
|
||||
[program:laravel-horizon]
|
||||
process_name=%(program_name)s_%(process_num)02d
|
||||
command=php /var/www/artisan horizon
|
||||
autostart=true
|
||||
autorestart=true
|
||||
user=www-data
|
||||
redirect_stderr=true
|
||||
stdout_logfile=/var/www/storage/logs/horizon.log
|
||||
stopwaitsecs=3600
|
||||
priority=300
|
||||
|
||||
[program:laravel-worker]
|
||||
process_name=%(program_name)s_%(process_num)02d
|
||||
command=php /var/www/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600
|
||||
autostart=true
|
||||
autorestart=true
|
||||
user=www-data
|
||||
redirect_stderr=true
|
||||
stdout_logfile=/var/www/storage/logs/worker.log
|
||||
stopwaitsecs=3600
|
||||
priority=400
|
||||
|
||||
[program:laravel-scheduler]
|
||||
command=php /var/www/artisan schedule:work
|
||||
autostart=true
|
||||
autorestart=true
|
||||
user=www-data
|
||||
redirect_stderr=true
|
||||
stdout_logfile=/var/www/storage/logs/scheduler.log
|
||||
priority=500
|
||||
Reference in New Issue
Block a user