commit fa7083c7c4d8856e110ead1a7462b3e1ebdeb5b1 Author: db1234719 Date: Mon Nov 24 14:48:11 2025 +0330 i copied the nginx image and made it build the php instead and added some ai recommended conf and ini files which i have to change later diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml new file mode 100644 index 0000000..6ba12e5 --- /dev/null +++ b/.gitea/workflows/build.yml @@ -0,0 +1,58 @@ +name: Build and Publish Docker Image + +on: + push: + branches: + - main + tags: + - 'v*' + +env: + REGISTRY: git.home.db123.ir + NAMESPACE: db1234719 + IMAGE_NAME: nginx-alpine + +jobs: + build-and-push: + runs-on: ubuntu-24.04 + + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + fetch-tags: true + + - name: Determine version + id: version + shell: bash + run: | + if [[ "${GITHUB_REF}" =~ ^refs/tags/v(.+) ]]; then + VERSION="${BASH_REMATCH[1]}" + else + VERSION="latest" + fi + echo "VERSION=$VERSION" >> $GITHUB_OUTPUT + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ env.NAMESPACE }} + password: ${{ secrets.CICD_PASSWORD }} + + - name: Build & push Docker image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + push: true + platforms: linux/amd64 + tags: | + ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:latest + ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} + cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache + cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache,mode=max diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..a7fbe28 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,82 @@ +# --- Stage 1: Build PHP --- +FROM alpine:3.22 AS builder + +ENV PHP_VERSION=8.5.0 + +# Build dependencies +RUN apk add \ + build-base autoconf bison re2c \ + curl tar \ + libxml2-dev openssl-dev sqlite-dev zlib-dev pcre2-dev libzip-dev oniguruma-dev \ + postgresql-dev \ + freetype-dev libpng-dev libjpeg-turbo-dev webp-dev \ + imap-dev krb5-dev + +WORKDIR /tmp + +# Download + extract +RUN curl -fSL https://www.php.net/distributions/php-$PHP_VERSION.tar.gz -o php.tar.gz \ + && tar -zxf php.tar.gz + +WORKDIR /tmp/php-$PHP_VERSION + +# Configure static PHP build +RUN ./configure \ + --prefix=/usr/local/php \ + --with-config-file-path=/usr/local/php \ + --with-config-file-scan-dir=/usr/local/php/conf.d \ + --enable-fpm \ + --with-fpm-user=php \ + --with-fpm-group=php \ + --enable-mbstring \ + --enable-opcache \ + --with-pcre2 \ + --with-zlib \ + --with-openssl \ + --with-curl \ + --with-zip \ + --with-xml \ + --with-sqlite3 \ + --with-pdo-sqlite \ + --with-pdo-pgsql \ + --with-pgsql \ + --with-gd \ + --with-jpeg \ + --with-webp \ + --with-freetype \ + --with-imap \ + --with-imap-ssl + +RUN make -j$(nproc) && make install + +# PHP production config +RUN cp php.ini-production /usr/local/php/php.ini + +# Cleanup +RUN rm -rf /tmp/* /var/cache/apk/* + +# --- Stage 2: Runtime --- +FROM alpine:3.22 + +# Runtime libraries only +RUN apk add \ + libxml2 openssl sqlite-libs zlib libzip pcre2 oniguruma \ + postgresql-libs \ + freetype libpng libjpeg-turbo libwebp \ + imap krb5-libs + +RUN addgroup -S php && adduser -S -D -H -G php php +RUN mkdir -p /usr/local/php/conf.d /var/run/php + +# Copy compiled PHP +COPY --from=builder /usr/local/php /usr/local/php + +EXPOSE 9000 + +USER php + +CMD ["/usr/local/php/sbin/php-fpm", "--nodaemonize"] + +# Healthcheck +HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD /usr/local/php/bin/php-fpm -t >/dev/null 2>&1 || exit 1 + diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..cd37210 --- /dev/null +++ b/LICENSE @@ -0,0 +1 @@ +Copyright (c) 22025 db1234719. All rights reserved. diff --git a/README.md b/README.md new file mode 100644 index 0000000..4163d32 --- /dev/null +++ b/README.md @@ -0,0 +1,4 @@ +# nginx-alpine + +this image will be used in production and configs are all tailored to the needs of db123 team. +it's based on alpine 3.22 and builds the nginx from source with necessary modules. \ No newline at end of file diff --git a/conf.d/security.ini b/conf.d/security.ini new file mode 100644 index 0000000..fdf1ce3 --- /dev/null +++ b/conf.d/security.ini @@ -0,0 +1,50 @@ +; disable exposure +expose_php = Off + +; disable dangerous functions (minimal safe set) +disable_functions = exec,passthru,shell_exec,proc_open,popen,system,show_source,phpinfo + +; logging +display_errors = Off +display_startup_errors = Off +log_errors = On +error_reporting = E_ALL + +; file limits +upload_max_filesize = 8M +post_max_size = 8M + +max_execution_time = 30 +max_input_time = 60 + +memory_limit = 256M + +; force strict session settings +session.use_strict_mode = 1 +session.cookie_httponly = 1 +session.cookie_secure = 1 +session.use_only_cookies = 1 + +; opcache +opcache.enable = 1 +opcache.enable_cli = 0 +opcache.validate_timestamps = 0 +opcache.memory_consumption = 128 +opcache.interned_strings_buffer = 16 +opcache.max_accelerated_files = 12000 +opcache.save_comments = 1 +opcache.jit = 0 + +; timezone (override manually) +date.timezone = UTC + +; forbid URL file wrappers unless needed +allow_url_fopen = Off +allow_url_include = Off + +; security hardening +cgi.fix_pathinfo = 0 + +; hard unbreakable srcurity +session.cookie_samesite = Strict +opcache.restrict_api = /usr/local/php/opcache diff --git a/php-fpm.conf b/php-fpm.conf new file mode 100644 index 0000000..fbec9fe --- /dev/null +++ b/php-fpm.conf @@ -0,0 +1,9 @@ +[global] +pid = /var/run/php/php-fpm.pid +error_log = /var/log/php/fpm-error.log + +daemonize = no + +log_level = notice + +include=/usr/local/php/php-fpm.d/*.conf diff --git a/php-fpm.d/www.conf b/php-fpm.d/www.conf new file mode 100644 index 0000000..87e7816 --- /dev/null +++ b/php-fpm.d/www.conf @@ -0,0 +1,33 @@ +[www] + +user = php +group = php + +listen = /var/run/php/php-fpm.sock +listen.mode = 0660 + +pm = dynamic +pm.max_children = 20 +pm.start_servers = 4 +pm.min_spare_servers = 2 +pm.max_spare_servers = 6 + +pm.max_requests = 500 + +request_terminate_timeout = 30s +request_slowlog_timeout = 5s +slowlog = /var/log/php/slow.log + +catch_workers_output = yes + +php_admin_value[expose_php] = Off +php_admin_value[display_errors] = Off +php_admin_value[log_errors] = On +php_admin_value[memory_limit] = 256M +php_admin_value[upload_max_filesize] = 8M +php_admin_value[post_max_size] = 8M +php_admin_value[max_execution_time] = 30 + +clear_env = yes + +security.limit_extensions = .php