rilla
/
dockerfiles
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

initial commit

main
Ricard Illa 2020-04-08 13:05:07 +02:00
commit cbc20645ea
71 changed files with 4468 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored Normal file
View File

@ -0,0 +1,3 @@
gitolite/.env
ansible/.env
ansible/known_hosts

44
Makefile Normal file
View File

@ -0,0 +1,44 @@
images=backup buku ddclient gitolite gitolite-stagit git-daemon rss-bridge syncthing tasks tor vdirsyncer wallabag xandikos
.PHONY: all $(images)
all: $(images)
BUILD = make -C $@
backup:
$(BUILD)
buku:
$(BUILD)
ddclient:
$(BUILD)
gitolite:
$(BUILD)
gitolite-stagit:
$(BUILD)
git-daemon:
$(BUILD)
rss-bridge:
$(BUILD)
syncthing:
$(BUILD)
tasks:
$(BUILD)
tor:
$(BUILD)
vdirsyncer:
$(BUILD)
xandikos:
$(BUILD)
wallabag:
$(BUILD)

24
ansible/Dockerfile Normal file
View File

@ -0,0 +1,24 @@
FROM alpine:3.12
RUN apk add --no-cache openssh python3 py3-pip && \
apk add --no-cache --virtual .build-deps \
gcc \
libffi-dev \
musl-dev \
openssl-dev \
python3-dev && \
pip install \
ansible==2.9 \
cryptography \
mitogen && \
apk del .build-deps
RUN apk add --no-cache openssl
COPY get_password.sh /usr/local/bin/get_password
RUN chmod +x /usr/local/bin/get_password
COPY ansible.cfg /etc/ansible/ansible.cfg
RUN mkdir -p /srv
WORKDIR /srv

10
ansible/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = ansible
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

528
ansible/ansible.cfg Normal file
View File

@ -0,0 +1,528 @@
# Example config file for ansible -- https://ansible.com/
# =======================================================
# Nearly all parameters can be overridden in ansible-playbook
# or with command line flags. Ansible will read ANSIBLE_CONFIG,
# ansible.cfg in the current working directory, .ansible.cfg in
# the home directory, or /etc/ansible/ansible.cfg, whichever it
# finds first
# For a full list of available options, run ansible-config list or see the
# documentation: https://docs.ansible.com/ansible/latest/reference_appendices/config.html.
[defaults]
inventory = /etc/ansible/hosts.yml
interpreter_python = auto_silent
#library = ~/.ansible/plugins/modules:/usr/share/ansible/plugins/modules
#module_utils = ~/.ansible/plugins/module_utils:/usr/share/ansible/plugins/module_utils
#remote_tmp = ~/.ansible/tmp
#local_tmp = ~/.ansible/tmp
#forks = 5
#poll_interval = 0.001
#ask_pass = False
#transport = smart
strategy_plugins = /usr/lib/python3.8/site-packages/ansible_mitogen/plugins/strategy
strategy = mitogen_linear
# Plays will gather facts by default, which contain information about
# the remote system.
#
# smart - gather by default, but don't regather if already gathered
# implicit - gather by default, turn off with gather_facts: False
# explicit - do not gather by default, must say gather_facts: True
#gathering = implicit
# This only affects the gathering done by a play's gather_facts directive,
# by default gathering retrieves all facts subsets
# all - gather all subsets
# network - gather min and network facts
# hardware - gather hardware facts (longest facts to retrieve)
# virtual - gather min and virtual facts
# facter - import facts from facter
# ohai - import facts from ohai
# You can combine them using comma (ex: network,virtual)
# You can negate them using ! (ex: !hardware,!facter,!ohai)
# A minimal set of facts is always gathered.
#
#gather_subset = all
# some hardware related facts are collected
# with a maximum timeout of 10 seconds. This
# option lets you increase or decrease that
# timeout to something more suitable for the
# environment.
#
#gather_timeout = 10
# Ansible facts are available inside the ansible_facts.* dictionary
# namespace. This setting maintains the behaviour which was the default prior
# to 2.5, duplicating these variables into the main namespace, each with a
# prefix of 'ansible_'.
# This variable is set to True by default for backwards compatibility. It
# will be changed to a default of 'False' in a future release.
#
#inject_facts_as_vars = True
# Paths to search for collections, colon separated
# collections_paths = ~/.ansible/collections:/usr/share/ansible/collections
# Paths to search for roles, colon separated
#roles_path = ~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
# Host key checking is enabled by default
#host_key_checking = True
# You can only have one 'stdout' callback type enabled at a time. The default
# is 'default'. The 'yaml' or 'debug' stdout callback plugins are easier to read.
#
#stdout_callback = default
#stdout_callback = yaml
#stdout_callback = debug
# Ansible ships with some plugins that require whitelisting,
# this is done to avoid running all of a type by default.
# These setting lists those that you want enabled for your system.
# Custom plugins should not need this unless plugin author disables them
# by default.
#
# Enable callback plugins, they can output to stdout but cannot be 'stdout' type.
#callback_whitelist = timer, mail
# Determine whether includes in tasks and handlers are "static" by
# default. As of 2.0, includes are dynamic by default. Setting these
# values to True will make includes behave more like they did in the
# 1.x versions.
#
#task_includes_static = False
#handler_includes_static = False
# Controls if a missing handler for a notification event is an error or a warning
#error_on_missing_handler = True
# Default timeout for connection plugins
#timeout = 10
# Default user to use for playbooks if user is not specified
# Uses the connection plugin's default, normally the user currently executing Ansible,
# unless a different user is specified here.
#
#remote_user = root
# Logging is off by default unless this path is defined.
#log_path = /var/log/ansible.log
# Default module to use when running ad-hoc commands
#module_name = command
# Use this shell for commands executed under sudo.
# you may need to change this to /bin/bash in rare instances
# if sudo is constrained.
#
#executable = /bin/sh
# By default, variables from roles will be visible in the global variable
# scope. To prevent this, set the following option to True, and only
# tasks and handlers within the role will see the variables there
#
#private_role_vars = False
# List any Jinja2 extensions to enable here.
#jinja2_extensions = jinja2.ext.do,jinja2.ext.i18n
# If set, always use this private key file for authentication, same as
# if passing --private-key to ansible or ansible-playbook
#
#private_key_file = /path/to/file
# If set, configures the path to the Vault password file as an alternative to
# specifying --vault-password-file on the command line. This can also be
# an executable script that returns the vault password to stdout.
#
vault_password_file = /usr/local/bin/get_password
# Format of string {{ ansible_managed }} available within Jinja2
# templates indicates to users editing templates files will be replaced.
# replacing {file}, {host} and {uid} and strftime codes with proper values.
#
#ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}
# {file}, {host}, {uid}, and the timestamp can all interfere with idempotence
# in some situations so the default is a static string:
#
#ansible_managed = Ansible managed
# By default, ansible-playbook will display "Skipping [host]" if it determines a task
# should not be run on a host. Set this to "False" if you don't want to see these "Skipping"
# messages. NOTE: the task header will still be shown regardless of whether or not the
# task is skipped.
#
#display_skipped_hosts = True
# By default, if a task in a playbook does not include a name: field then
# ansible-playbook will construct a header that includes the task's action but
# not the task's args. This is a security feature because ansible cannot know
# if the *module* considers an argument to be no_log at the time that the
# header is printed. If your environment doesn't have a problem securing
# stdout from ansible-playbook (or you have manually specified no_log in your
# playbook on all of the tasks where you have secret information) then you can
# safely set this to True to get more informative messages.
#
#display_args_to_stdout = False
# Ansible will raise errors when attempting to dereference
# Jinja2 variables that are not set in templates or action lines. Uncomment this line
# to change this behavior.
#
#error_on_undefined_vars = False
# Ansible may display warnings based on the configuration of the
# system running ansible itself. This may include warnings about 3rd party packages or
# other conditions that should be resolved if possible.
# To disable these warnings, set the following value to False:
#
#system_warnings = True
# Ansible may display deprecation warnings for language
# features that should no longer be used and will be removed in future versions.
# To disable these warnings, set the following value to False:
#
#deprecation_warnings = True
# Ansible can optionally warn when usage of the shell and
# command module appear to be simplified by using a default Ansible module
# instead. These warnings can be silenced by adjusting the following
# setting or adding warn=yes or warn=no to the end of the command line
# parameter string. This will for example suggest using the git module
# instead of shelling out to the git command.
#
#command_warnings = False
# set plugin path directories here, separate with colons
#action_plugins = /usr/share/ansible/plugins/action
#become_plugins = /usr/share/ansible/plugins/become
#cache_plugins = /usr/share/ansible/plugins/cache
#callback_plugins = /usr/share/ansible/plugins/callback
#connection_plugins = /usr/share/ansible/plugins/connection
#lookup_plugins = /usr/share/ansible/plugins/lookup
#inventory_plugins = /usr/share/ansible/plugins/inventory
#vars_plugins = /usr/share/ansible/plugins/vars
#filter_plugins = /usr/share/ansible/plugins/filter
#test_plugins = /usr/share/ansible/plugins/test
#terminal_plugins = /usr/share/ansible/plugins/terminal
#strategy_plugins = /usr/share/ansible/plugins/strategy
# Ansible will use the 'linear' strategy but you may want to try another one.
#strategy = linear
# By default, callbacks are not loaded for /bin/ansible. Enable this if you
# want, for example, a notification or logging callback to also apply to
# /bin/ansible runs
#
#bin_ansible_callbacks = False
# Don't like cows? that's unfortunate.
# set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1
#nocows = 1
# Set which cowsay stencil you'd like to use by default. When set to 'random',
# a random stencil will be selected for each task. The selection will be filtered
# against the `cow_whitelist` option below.
#
#cow_selection = default
#cow_selection = random
# When using the 'random' option for cowsay, stencils will be restricted to this list.
# it should be formatted as a comma-separated list with no spaces between names.
# NOTE: line continuations here are for formatting purposes only, as the INI parser
# in python does not support them.
#
#cow_whitelist=bud-frogs,bunny,cheese,daemon,default,dragon,elephant-in-snake,elephant,eyes,\
# hellokitty,kitty,luke-koala,meow,milk,moofasa,moose,ren,sheep,small,stegosaurus,\
# stimpy,supermilker,three-eyes,turkey,turtle,tux,udder,vader-koala,vader,www
# Don't like colors either?
# set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1
#
#nocolor = 1
# If set to a persistent type (not 'memory', for example 'redis') fact values
# from previous runs in Ansible will be stored. This may be useful when
# wanting to use, for example, IP information from one group of servers
# without having to talk to them in the same playbook run to get their
# current IP information.
#
#fact_caching = memory
# This option tells Ansible where to cache facts. The value is plugin dependent.
# For the jsonfile plugin, it should be a path to a local directory.
# For the redis plugin, the value is a host:port:database triplet: fact_caching_connection = localhost:6379:0
#
#fact_caching_connection=/tmp
# retry files
# When a playbook fails a .retry file can be created that will be placed in ~/
# You can enable this feature by setting retry_files_enabled to True
# and you can change the location of the files by setting retry_files_save_path
#
#retry_files_enabled = False
#retry_files_save_path = ~/.ansible-retry
# prevents logging of task data, off by default
#no_log = False
# prevents logging of tasks, but only on the targets, data is still logged on the master/controller
#no_target_syslog = False
# Controls whether Ansible will raise an error or warning if a task has no
# choice but to create world readable temporary files to execute a module on
# the remote machine. This option is False by default for security. Users may
# turn this on to have behaviour more like Ansible prior to 2.1.x. See
# https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user
# for more secure ways to fix this than enabling this option.
#
#allow_world_readable_tmpfiles = False
# Controls what compression method is used for new-style ansible modules when
# they are sent to the remote system. The compression types depend on having
# support compiled into both the controller's python and the client's python.
# The names should match with the python Zipfile compression types:
# * ZIP_STORED (no compression. available everywhere)
# * ZIP_DEFLATED (uses zlib, the default)
# These values may be set per host via the ansible_module_compression inventory variable.
#
#module_compression = 'ZIP_DEFLATED'
# This controls the cutoff point (in bytes) on --diff for files
# set to 0 for unlimited (RAM may suffer!).
#
#max_diff_size = 104448
# Controls showing custom stats at the end, off by default
#show_custom_stats = False
# Controls which files to ignore when using a directory as inventory with
# possibly multiple sources (both static and dynamic)
#
#inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo
# This family of modules use an alternative execution path optimized for network appliances
# only update this setting if you know how this works, otherwise it can break module execution
#
#network_group_modules=eos, nxos, ios, iosxr, junos, vyos
# When enabled, this option allows lookups (via variables like {{lookup('foo')}} or when used as
# a loop with `with_foo`) to return data that is not marked "unsafe". This means the data may contain
# jinja2 templating language which will be run through the templating engine.
# ENABLING THIS COULD BE A SECURITY RISK
#
#allow_unsafe_lookups = False
# set default errors for all plays
#any_errors_fatal = False
[inventory]
# List of enabled inventory plugins and the order in which they are used.
#enable_plugins = host_list, script, auto, yaml, ini, toml
# Ignore these extensions when parsing a directory as inventory source
#ignore_extensions = .pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, ~, .orig, .ini, .cfg, .retry
# ignore files matching these patterns when parsing a directory as inventory source
#ignore_patterns=
# If 'True' unparsed inventory sources become fatal errors, otherwise they are warnings.
#unparsed_is_failed = False
[privilege_escalation]
#become = False
#become_method = sudo
#become_ask_pass = False
## Connection Plugins ##
# Settings for each connection plugin go under a section titled '[[plugin_name]_connection]'
# To view available connection plugins, run ansible-doc -t connection -l
# To view available options for a connection plugin, run ansible-doc -t connection [plugin_name]
# https://docs.ansible.com/ansible/latest/plugins/connection.html
[paramiko_connection]
# uncomment this line to cause the paramiko connection plugin to not record new host
# keys encountered. Increases performance on new host additions. Setting works independently of the
# host key checking setting above.
#record_host_keys=False
# by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this
# line to disable this behaviour.
#pty = False
# paramiko will default to looking for SSH keys initially when trying to
# authenticate to remote devices. This is a problem for some network devices
# that close the connection after a key failure. Uncomment this line to
# disable the Paramiko look for keys function
#look_for_keys = False
# When using persistent connections with Paramiko, the connection runs in a
# background process. If the host doesn't already have a valid SSH key, by
# default Ansible will prompt to add the host key. This will cause connections
# running in background processes to fail. Uncomment this line to have
# Paramiko automatically add host keys.
#host_key_auto_add = True
[ssh_connection]
# ssh arguments to use
# Leaving off ControlPersist will result in poor performance, so use
# paramiko on older platforms rather than removing it, -C controls compression use
ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes
# The base directory for the ControlPath sockets.
# This is the "%(directory)s" in the control_path option
#
# Example:
# control_path_dir = /tmp/.ansible/cp
#control_path_dir = ~/.ansible/cp
# The path to use for the ControlPath sockets. This defaults to a hashed string of the hostname,
# port and username (empty string in the config). The hash mitigates a common problem users
# found with long hostnames and the conventional %(directory)s/ansible-ssh-%%h-%%p-%%r format.
# In those cases, a "too long for Unix domain socket" ssh error would occur.
#
# Example:
# control_path = %(directory)s/%%C
#control_path =
# Enabling pipelining reduces the number of SSH operations required to
# execute a module on the remote server. This can result in a significant
# performance improvement when enabled, however when using "sudo:" you must
# first disable 'requiretty' in /etc/sudoers
#
# By default, this option is disabled to preserve compatibility with
# sudoers configurations that have requiretty (the default on many distros).
#
pipelining = True
# Control the mechanism for transferring files (old)
# * smart = try sftp and then try scp [default]
# * True = use scp only
# * False = use sftp only
#scp_if_ssh = smart
# Control the mechanism for transferring files (new)
# If set, this will override the scp_if_ssh option
# * sftp = use sftp to transfer files
# * scp = use scp to transfer files
# * piped = use 'dd' over SSH to transfer files
# * smart = try sftp, scp, and piped, in that order [default]
#transfer_method = smart
# If False, sftp will not use batch mode to transfer files. This may cause some
# types of file transfer failures impossible to catch however, and should
# only be disabled if your sftp version has problems with batch mode
#sftp_batch_mode = False
# The -tt argument is passed to ssh when pipelining is not enabled because sudo
# requires a tty by default.
#usetty = True
# Number of times to retry an SSH connection to a host, in case of UNREACHABLE.
# For each retry attempt, there is an exponential backoff,
# so after the first attempt there is 1s wait, then 2s, 4s etc. up to 30s (max).
#retries = 3
[persistent_connection]
# Configures the persistent connection timeout value in seconds. This value is
# how long the persistent connection will remain idle before it is destroyed.
# If the connection doesn't receive a request before the timeout value
# expires, the connection is shutdown. The default value is 30 seconds.
#connect_timeout = 30
# The command timeout value defines the amount of time to wait for a command
# or RPC call before timing out. The value for the command timeout must
# be less than the value of the persistent connection idle timeout (connect_timeout)
# The default value is 30 second.
#command_timeout = 30
## Become Plugins ##
# Settings for become plugins go under a section named '[[plugin_name]_become_plugin]'
# To view available become plugins, run ansible-doc -t become -l
# To view available options for a specific plugin, run ansible-doc -t become [plugin_name]
# https://docs.ansible.com/ansible/latest/plugins/become.html
[sudo_become_plugin]
#flags = -H -S -n
#user = root
[selinux]
# file systems that require special treatment when dealing with security context
# the default behaviour that copies the existing context or uses the user default
# needs to be changed to use the file system dependent context.
#special_context_filesystems=fuse,nfs,vboxsf,ramfs,9p,vfat
# Set this to True to allow libvirt_lxc connections to work without SELinux.
#libvirt_lxc_noseclabel = False
[colors]
#highlight = white
#verbose = blue
#warn = bright purple
#error = red
#debug = dark gray
#deprecate = purple
#skip = cyan
#unreachable = red
#ok = green
#changed = yellow
#diff_add = green
#diff_remove = red
#diff_lines = cyan
[diff]
# Always print diff when running ( same as always running with -D/--diff )
#always = False
# Set how many context lines to show in diff
#context = 3
[galaxy]
# Controls whether the display wheel is shown or not
#display_progress=
# Validate TLS certificates for Galaxy server
#ignore_certs = False
# Role or collection skeleton directory to use as a template for
# the init action in ansible-galaxy command
#role_skeleton=
# Patterns of files to ignore inside a Galaxy role or collection
# skeleton directory
#role_skeleton_ignore="^.git$", "^.*/.git_keep$"
# Galaxy Server URL
#server=https://galaxy.ansible.com
# A list of Galaxy servers to use when installing a collection.
#server_list=automation_hub, release_galaxy
# Server specific details which are mentioned in server_list
#[galaxy_server.automation_hub]
#url=https://cloud.redhat.com/api/automation-hub/
#auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
#token=my_ah_token
#
#[galaxy_server.release_galaxy]
#url=https://galaxy.ansible.com/
#token=my_token

3
ansible/get_password.sh Normal file
View File

@ -0,0 +1,3 @@
#!/bin/sh
[ -n "$VAULT_PASSWORD" ] && echo "$VAULT_PASSWORD"

6
backup/Dockerfile Normal file
View File

@ -0,0 +1,6 @@
FROM alpine:3.11
RUN apk --no-cache add squashfs-tools
COPY make_backup.sh /bin/make_backup
RUN chmod +x /bin/make_backup
CMD "/bin/make_backup"

10
backup/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = backup
.PHONY: build build-nc
build: Dockerfile make_backup.sh
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile make_backup.sh
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

32
backup/make_backup.sh Normal file
View File

@ -0,0 +1,32 @@
#!/bin/sh
if [ -n "$EXCLUDE" ]; then
dirs=$( \
echo "${EXCLUDE}" | \
tr " " "\n" | \
awk -F' ' '{print "/src/"$0}' | \
tr "\n" " " \
)
exclude_opt="-e ${dirs}"
else
exclude_opt=""
fi
echo running:
echo mksquashfs \
/src \
"/dest/$(date +%F).sfs" \
-comp gzip \
-xattrs \
-progress \
-mem 512M \
${exclude_opt}
mksquashfs \
/src \
"/dest/$(date +%F).sfs" \
-comp gzip \
-xattrs \
-progress \
-mem 512M \
${exclude_opt}

34
buku/Dockerfile Normal file
View File

@ -0,0 +1,34 @@
# buku
FROM python:3.8-alpine3.11
ENV BUKUSERVER_PORT=5001
RUN apk add --no-cache --virtual .build-deps \
gcc \
openssl-dev \
musl-dev \
libffi-dev \
git && \
mkdir -p /usr/local/src && \
git clone https://github.com/jarun/buku /usr/local/src/buku && \
pip install -U --no-cache-dir \
pip \
gunicorn \
"/usr/local/src/buku[server]" && \
apk del .build-deps && \
rm -r /usr/local/src
RUN adduser -u 1006 -h /var/lib/buku -D buku && \
adduser -u 1001 -D syncthing && addgroup syncthing buku && \
mkdir -p /var/lib/buku/.local/share/buku && \
chown -R buku:buku /var/lib/buku && \
chown -R syncthing:buku /var/lib/buku/.local/share/buku && \
chmod '2775' /var/lib/buku/.local/share/buku && \
touch /var/lib/buku/.local/share/buku/bookmarks.db && chmod '664' /var/lib/buku/.local/share/buku/bookmarks.db
VOLUME /var/lib/buku/.local/share/buku
EXPOSE ${BUKUSERVER_PORT}
USER buku
ENTRYPOINT gunicorn --bind "0.0.0.0:${BUKUSERVER_PORT}" "bukuserver.server:create_app()"

10
buku/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = buku
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

19
ddclient/Dockerfile Normal file
View File

@ -0,0 +1,19 @@
FROM alpine:3.12
ENV VERSION 3.9.1
ENV DL_URL https://github.com/ddclient/ddclient/archive/v${VERSION}.tar.gz
#ENV PERL_MM_USE_DEFAULT 1
RUN apk add --no-cache \
curl make wget \
perl perl-utils perl-test-taint perl-netaddr-ip perl-net-ip \
perl-yaml perl-log-log4perl perl-io-socket-ssl && \
curl -L http://cpanmin.us | perl - Data::Validate::IP && \
tmp=$(mktemp -d) && \
curl -L "${DL_URL}" --output "${tmp}/ddclient.tar.gz" && \
tar -xzf "${tmp}/ddclient.tar.gz" -C "${tmp}" && \
cp "${tmp}/ddclient-${VERSION}/ddclient" /usr/bin/ddclient && \
rm -r "${tmp}" && \
mkdir -p /etc/ddclient /var/cache/ddclient
CMD ["/usr/bin/ddclient", "-foreground"]

10
ddclient/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = ddclient
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

12
git-daemon/Dockerfile Normal file
View File

@ -0,0 +1,12 @@
FROM alpine:3.12
RUN apk --no-cache add \
fcgiwrap \
spawn-fcgi \
git-daemon
COPY entrypoint /usr/local/bin/entrypoint
RUN chmod +x /usr/local/bin/entrypoint
ENTRYPOINT ["/usr/local/bin/entrypoint"]
CMD "daemon"

10
git-daemon/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = git-daemon
.PHONY: build build-nc
build: Dockerfile entrypoint
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile entrypoint
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

17
git-daemon/entrypoint Normal file
View File

@ -0,0 +1,17 @@
#!/bin/sh
case $1 in
daemon)
[ -n "$REPOS_DIR" ] && [ -d "$REPOS_DIR" ] && \
exec git daemon \
--reuseaddr \
--base-path=/var/lib/git/repositories \
/var/lib/git/repositories
;;
fcgi)
FCGI_PORT=${FCGI_PORT:-9000}
exec spawn-fcgi -p "${FCGI_PORT}" -n /usr/bin/fcgiwrap
;;
*)
exec "$@"
esac

46
gitolite-stagit/Dockerfile Normal file
View File

@ -0,0 +1,46 @@
FROM alpine:3.12
RUN apk add --no-cache \
gitolite \
openssh-server \
su-exec \
libgit2 && \
apk add --no-cache --virtual .build-deps \
gcc \
make \
musl-dev \
libgit2-dev && \
git clone git://git.codemadness.org/stagit /tmp/stagit && \
make -C /tmp/stagit && \
make -C /tmp/stagit install && \
rm -r /tmp/stagit && \
apk del .build-deps && \
passwd -u git && \
mkdir -p /opt/gitolite-local/hooks/common
COPY sshd_config /etc/ssh/sshd_config
COPY gitolite.rc /var/lib/git/.gitolite.rc
COPY bin/. /usr/local/bin/
COPY local_code/. /opt/gitolite-local/
RUN chown -R git:git /var/lib/git && \
chmod +x \
/usr/local/bin/entrypoint \
/usr/local/bin/build-stagit-index \
/usr/local/bin/build-stagit-repo \
/usr/local/bin/build-stagit-repos \
/usr/local/bin/set-url \
/usr/local/bin/set-urls \
/usr/local/bin/set-owner \
/usr/local/bin/set-owners \
/opt/gitolite-local/hooks/common/post-receive \
/opt/gitolite-local/triggers/build-stagit-index \
/opt/gitolite-local/triggers/build-stagit-repos \
/opt/gitolite-local/triggers/set-url \
/opt/gitolite-local/triggers/set-urls \
/opt/gitolite-local/triggers/set-owners \
/opt/gitolite-local/triggers/set-owner
ENTRYPOINT ["/usr/local/bin/entrypoint"]
CMD ["/usr/sbin/sshd", "-D", "-e"]

16
gitolite-stagit/Makefile Normal file
View File

@ -0,0 +1,16 @@
USERNAME = rilla
IMG_NAME = gitolite-stagit
.PHONY: build build-nc
BIN=$(wildcard bin/*)
HOOKS=$(wildcard local_code/hooks/*)
TRIGGERS=$(wildcard local_code/triggers/*)
DEPS=Dockerfile $(BIN) $(HOOKS) $(TRIGGERS) gitolite.rc sshd_config
build: $(DEPS)
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: $(DEPS)
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

16
gitolite-stagit/bin/build-stagit-index Normal file
View File

@ -0,0 +1,16 @@
#!/bin/sh
set -e
STAGIT_DIR="${STAGIT_DIR:-/var/lib/git/stagit}"
GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
gitolite list-phy-repos | \
gitolite access % stagit R any | \
awk \
-F'\t' \
-v d="${GL_REPO_BASE}" \
'{if ($3 !~ "DENIED") print d"/"$1".git"}' | \
xargs -r /usr/local/bin/stagit-index | \
sed 's|\(<a href=".*\)/log.html\(">\)|\1\2|' > \
"${STAGIT_DIR}/index.html"

22
gitolite-stagit/bin/build-stagit-repo Normal file
View File

@ -0,0 +1,22 @@
#!/bin/sh
set -e
[ -z "${1}" ] && exit
STAGIT_DIR="${STAGIT_DIR:-/var/lib/git/stagit}"
GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
out_dir="${STAGIT_DIR}/${1}"
repo_dir="${GL_REPO_BASE}/${1}.git"
echo "running stagit for '${1}'"
if gitolite access "${1}" stagit R any; then
mkdir -p "${out_dir}" && \
cd "${out_dir}" && \
/usr/local/bin/stagit "${repo_dir}" &&
ln -sf files.html index.html
else
rm -rf "${out_dir}"
fi

7
gitolite-stagit/bin/build-stagit-repos Normal file
View File

@ -0,0 +1,7 @@
#!/bin/sh
set -e
for repo in $(gitolite list-phy-repos); do
/usr/local/bin/build-stagit-repo "${repo}"
done

51
gitolite-stagit/bin/entrypoint Normal file
View File

@ -0,0 +1,51 @@
#!/bin/sh
set -e
env | awk -F"=" '{ print $1"=\""$2"\"" }' > /etc/env
for algorithm in rsa dsa ecdsa ed25519; do
keyfile="/etc/ssh/keys/ssh_host_${algorithm}_key"
[ -f "$keyfile" ] || \
ssh-keygen -q -N '' -f "$keyfile" -t "$algorithm"
done
BASE_DIR=/var/lib/git
echo "fixing permissions..."
mkdir -p \
"${BASE_DIR}/.gitolite/conf" \
"${BASE_DIR}/.gitolite/hooks" \
"${BASE_DIR}/.gitolite/keydir" \
"${BASE_DIR}/.gitolite/logs"
chown -R git:git \
"${BASE_DIR}/.gitolite" \
"${BASE_DIR}/.ssh" \
"${BASE_DIR}/stagit" \
"${BASE_DIR}/repositories"
if [ ! -f "${BASE_DIR}/.ssh/authorized_keys" ]; then
if [ -z "$SSH_KEY" ]; then
echo "SSH_KEY needs to be set"
exit 1
fi
SSH_KEY_NAME=${SSH_KEY_NAME:-admin}
echo "$SSH_KEY" > "/tmp/${SSH_KEY_NAME}.pub"
echo "gitolite's initial setup"
su-exec git gitolite setup -pk "/tmp/${SSH_KEY_NAME}.pub"
rm "/tmp/${SSH_KEY_NAME}.pub"
else
# stuff is already set up, but check the setup anyway
echo "gitolite's sanity setup"
su-exec git gitolite setup
fi
echo "building static site"
su-exec git set-urls
su-exec git set-owners
su-exec git build-stagit-repos
su-exec git build-stagit-index
echo "gitolite is ready,starting sshd"
exec "$@"

16
gitolite-stagit/bin/set-owner Normal file
View File

@ -0,0 +1,16 @@
#!/bin/sh
set -e
[ -z "$1" ] && exit 0
GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
owner_file="${GL_REPO_BASE}/${1}.git/owner"
if owner=$(gitolite git-config "${1}" gitweb.owner); then
echo "setting owner for '${1}'"
echo "${owner}" > "${owner_file}"
else
echo "usetting owner for '${1}'"
rm -f "${owner_file}"
fi

7
gitolite-stagit/bin/set-owners Normal file
View File

@ -0,0 +1,7 @@
#!/bin/sh
set -e
for repo in $(gitolite list-phy-repos); do
/usr/local/bin/set-owner "${repo}"
done

18
gitolite-stagit/bin/set-url Normal file
View File

@ -0,0 +1,18 @@
#!/bin/sh
set -e
[ -z "$1" ] && exit 0
GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
repo_dir="${GL_REPO_BASE}/${1}.git"
# shellcheck disable=SC1091
[ -z "${REPOS_URL}" ] && [ -f /etc/env ] && . /etc/env
echo "setting url for '${1}'"
if [ -z "$REPOS_URL" ]; then
echo "REPOS_URL not set"
exit 0
fi
[ -d "$repo_dir" ] && echo "${REPOS_URL}/${1}" > "${repo_dir}/url"

7
gitolite-stagit/bin/set-urls Normal file
View File

@ -0,0 +1,7 @@
#!/bin/sh
set -e
for repo in $(gitolite list-phy-repos); do
/usr/local/bin/set-url "${repo}"
done

216
gitolite-stagit/gitolite.rc Normal file
View File

@ -0,0 +1,216 @@
# configuration variables for gitolite
# This file is in perl syntax. But you do NOT need to know perl to edit it --
# just mind the commas, use single quotes unless you know what you're doing,
# and make sure the brackets and braces stay matched up!
# (Tip: perl allows a comma after the last item in a list also!)
# HELP for commands can be had by running the command with "-h".
# HELP for all the other FEATURES can be found in the documentation (look for
# "list of non-core programs shipped with gitolite" in the master index) or
# directly in the corresponding source file.
%RC = (
# ------------------------------------------------------------------
# default umask gives you perms of '0700'; see the rc file docs for
# how/why you might change this
UMASK => 0077,
# look for "git-config" in the documentation
GIT_CONFIG_KEYS => 'gitweb.description gitweb.owner',
# comment out if you don't need all the extra detail in the logfile
LOG_EXTRA => 1,
# logging options
# 1. leave this section as is for 'normal' gitolite logging (default)
# 2. uncomment this line to log ONLY to syslog:
# LOG_DEST => 'syslog',
# 3. uncomment this line to log to syslog and the normal gitolite log:
# LOG_DEST => 'syslog,normal',
# 4. prefixing "repo-log," to any of the above will **also** log just the
# update records to "gl-log" in the bare repo directory:
# LOG_DEST => 'repo-log,normal',
# LOG_DEST => 'repo-log,syslog',
# LOG_DEST => 'repo-log,syslog,normal',
# syslog 'facility': defaults to 'local0', uncomment if needed. For example:
# LOG_FACILITY => 'local4',
# roles. add more roles (like MANAGER, TESTER, ...) here.
# WARNING: if you make changes to this hash, you MUST run 'gitolite
# compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'
ROLES => {
READERS => 1,
WRITERS => 1,
},
# enable caching (currently only Redis). PLEASE RTFM BEFORE USING!!!
# CACHE => 'Redis',
# ------------------------------------------------------------------
# rc variables used by various features
# the 'info' command prints this as additional info, if it is set
# SITE_INFO => 'Please see http://blahblah/gitolite for more help',
# the CpuTime feature uses these
# display user, system, and elapsed times to user after each git operation
# DISPLAY_CPU_TIME => 1,
# display a warning if total CPU times (u, s, cu, cs) crosses this limit
# CPU_TIME_WARN_LIMIT => 0.1,
# the Mirroring feature needs this
# HOSTNAME => "foo",
# TTL for redis cache; PLEASE SEE DOCUMENTATION BEFORE UNCOMMENTING!
# CACHE_TTL => 600,
# ------------------------------------------------------------------
# suggested locations for site-local gitolite code (see cust.html)
# this one is managed directly on the server
LOCAL_CODE => "/opt/gitolite-local",
#LOCAL_CODE => "$ENV{HOME}/local",
# or you can use this, which lets you put everything in a subdirectory
# called "local" in your gitolite-admin repo. For a SECURITY WARNING
# on this, see http://gitolite.com/gitolite/non-core.html#pushcode
# LOCAL_CODE => "$rc{GL_ADMIN_BASE}/local",
# ------------------------------------------------------------------
#POST_COMPILE => [],
POST_COMPILE => [
'set-urls',
'set-owners',
'build-stagit-repos',
'build-stagit-index'
],
POST_CREATE => [
'set-url',
'set-owner'
],
# List of commands and features to enable
ENABLE => [
# COMMANDS
# These are the commands enabled by default
'help',
'desc',
'info',
'perms',
'writable',
# Uncomment or add new commands here.
# 'create',
# 'fork',
# 'mirror',
# 'readme',
# 'sskm',
# 'D',
# These FEATURES are enabled by default.
# essential (unless you're using smart-http mode)
'ssh-authkeys',
# creates git-config entries from gitolite.conf file entries like 'config foo.bar = baz'
'git-config',
# creates git-daemon-export-ok files; if you don't use git-daemon, comment this out
'daemon',
# creates projects.list file; if you don't use gitweb, comment this out
#'gitweb',
# These FEATURES are disabled by default; uncomment to enable. If you
# need to add new ones, ask on the mailing list :-)
# user-visible behaviour
# prevent wild repos auto-create on fetch/clone
# 'no-create-on-read',
# no auto-create at all (don't forget to enable the 'create' command!)
# 'no-auto-create',
# access a repo by another (possibly legacy) name
# 'Alias',
# give some users direct shell access. See documentation in
# sts.html for details on the following two choices.
# "Shell $ENV{HOME}/.gitolite.shell-users",
# 'Shell alice bob',
# set default roles from lines like 'option default.roles-1 = ...', etc.
# 'set-default-roles',
# show more detailed messages on deny
# 'expand-deny-messages',
# show a message of the day
# 'Motd',
# system admin stuff
# enable mirroring (don't forget to set the HOSTNAME too!)
# 'Mirroring',
# allow people to submit pub files with more than one key in them
# 'ssh-authkeys-split',
# selective read control hack
# 'partial-copy',
# manage local, gitolite-controlled, copies of read-only upstream repos
# 'upstream',
# updates 'description' file instead of 'gitweb.description' config item
'cgit',
# allow repo-specific hooks to be added
#'repo-specific-hooks',
# performance, logging, monitoring...
# be nice
# 'renice 10',
# log CPU times (user, system, cumulative user, cumulative system)
# 'CpuTime',
# syntactic_sugar for gitolite.conf and included files
# allow backslash-escaped continuation lines in gitolite.conf
# 'continuation-lines',
# create implicit user groups from directory names in keydir/
# 'keysubdirs-as-groups',
# allow simple line-oriented macros
'macros',
# Kindergarten mode
# disallow various things that sensible people shouldn't be doing anyway
# 'Kindergarten',
],
);
# ------------------------------------------------------------------------------
# per perl rules, this should be the last line in such a file:
1;
# Local variables:
# mode: perl
# End:
# vi: ft=perl

8
gitolite-stagit/local_code/hooks/common/post-receive Normal file
View File

@ -0,0 +1,8 @@
#!/bin/sh
set -e
[ -n "${GL_REPO}" ] && \
/usr/local/bin/set-url "${GL_REPO}" && \
/usr/local/bin/set-owner "${GL_REPO}" && \
/usr/local/bin/build-stagit-repo "${GL_REPO}"

3
gitolite-stagit/local_code/triggers/build-stagit-index Normal file
View File

@ -0,0 +1,3 @@
#!/bin/sh
/usr/local/bin/build-stagit-index

3
gitolite-stagit/local_code/triggers/build-stagit-repos Normal file
View File

@ -0,0 +1,3 @@
#!/bin/sh
/usr/local/bin/build-stagit-repos

5
gitolite-stagit/local_code/triggers/set-owner Normal file
View File

@ -0,0 +1,5 @@
#!/bin/sh
set -e
[ -n "$2" ] && /usr/local/bin/set-owner "$2"

5
gitolite-stagit/local_code/triggers/set-owners Normal file
View File

@ -0,0 +1,5 @@
#!/bin/sh
set -e
/usr/local/bin/set-owners

5
gitolite-stagit/local_code/triggers/set-url Normal file
View File

@ -0,0 +1,5 @@
#!/bin/sh
set -e
[ -n "$2" ] && /usr/local/bin/set-url "$2"

5
gitolite-stagit/local_code/triggers/set-urls Normal file
View File

@ -0,0 +1,5 @@
#!/bin/sh
set -e
/usr/local/bin/set-urls

23
gitolite-stagit/sshd_config Normal file
View File

@ -0,0 +1,23 @@
Port 22
Protocol 2
PermitRootLogin no
AllowUsers git
PasswordAuthentication no
PermitEmptyPasswords no
PubkeyAuthentication yes
HostKey /etc/ssh/keys/ssh_host_rsa_key
HostKey /etc/ssh/keys/ssh_host_dsa_key
HostKey /etc/ssh/keys/ssh_host_ecdsa_key
HostKey /etc/ssh/keys/ssh_host_ed25519_key
X11Forwarding no
PrintMotd no
ClientAliveInterval 300
ClientAliveCountMax 2
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512
MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
HostKeyAlgorithms ssh-rsa,rsa-sha2-256,rsa-sha2-512

36
gitolite/Dockerfile Normal file
View File

@ -0,0 +1,36 @@
FROM alpine:3.12
RUN apk add --update --no-cache \
docker-compose \
docker \
git \
openssh-server \
perl \
shadow \
su-exec
RUN adduser -h /var/lib/git -D git && \
adduser git docker && \
mkdir -p /var/lib/git/local/hooks && \
chown -R git:git /var/lib/git && \
usermod -p '*' git && \
passwd -u git
RUN mkdir -p /usr/local/src && \
git clone https://github.com/sitaramc/gitolite /usr/local/src/gitolite && \
/usr/local/src/gitolite/install -ln /usr/local/bin
RUN mkdir -p /opt/docker-services
COPY sshd_config /etc/ssh/sshd_config
VOLUME /etc/ssh/keys
VOLUME /var/lib/git
COPY docker-entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
ENTRYPOINT ["/entrypoint"]
EXPOSE 22
CMD ["/usr/sbin/sshd", "-D", "-e"]

10
gitolite/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = gitolite
.PHONY: build build-nc
build: Dockerfile docker-entrypoint.sh sshd_config
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile docker-entrypoint.sh sshd_config
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

41
gitolite/docker-entrypoint.sh Normal file
View File

@ -0,0 +1,41 @@
#!/bin/sh
set -xe
[ -n "$DOCKER_GID" ] && groupmod -g "${DOCKER_GID}" docker
for algorithm in rsa dsa ecdsa ed25519
do
keyfile="/etc/ssh/keys/ssh_host_${algorithm}_key"
[ -f "$keyfile" ] || ssh-keygen -q -N '' -f "$keyfile" -t "$algorithm"
done
BASE_DIR=/var/lib/git
echo "fixing gitolite's permissions..."
find "${BASE_DIR}" \
-not -path "${BASE_DIR}/.gitolite.rc" \
-and -not -path "${BASE_DIR}/local/hooks/repo-specific*" \
-exec chown git:git {} \;
if [ ! -f "${BASE_DIR}/.ssh/authorized_keys" ]
then
if [ -n "$SSH_KEY" ]
then
[ -n "$SSH_KEY_NAME" ] || SSH_KEY_NAME="admin"
echo "$SSH_KEY" > "/tmp/${SSH_KEY_NAME}.pub"
echo "gitolite's initial setup"
su-exec git gitolite setup -pk "/tmp/${SSH_KEY_NAME}.pub"
rm "/tmp/${SSH_KEY_NAME}.pub"
else
echo "SSH_KEY needs to be set"
exit 1
fi
else
# stuff is already set up, but check the setup anyway
echo "gitolite's sanity setup"
su-exec git gitolite setup
fi
echo "gitolite is ready,starting sshd"
exec "$@"

23
gitolite/sshd_config Normal file
View File

@ -0,0 +1,23 @@
Port 22
Protocol 2
PermitRootLogin no
AllowUsers git
PasswordAuthentication no
PermitEmptyPasswords no
PubkeyAuthentication yes
HostKey /etc/ssh/keys/ssh_host_rsa_key
HostKey /etc/ssh/keys/ssh_host_dsa_key
HostKey /etc/ssh/keys/ssh_host_ecdsa_key
HostKey /etc/ssh/keys/ssh_host_ed25519_key
X11Forwarding no
PrintMotd no
ClientAliveInterval 300
ClientAliveCountMax 2
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512
MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
HostKeyAlgorithms ssh-rsa,rsa-sha2-256,rsa-sha2-512

24
ledger-web/Dockerfile Normal file
View File

@ -0,0 +1,24 @@
# ledger-web
FROM python:3.8-slim-buster
RUN apt-get update && \
apt-get install -y git g++ gosu && \
rm -rf /var/lib/apt/lists/*
RUN useradd -m ledger
RUN git clone https://github.com/vifon/ledger-web /home/ledger/ledger-web
RUN pip install -r /home/ledger/ledger-web/requirements.txt
RUN mkdir -p /home/ledger/db
VOLUME /home/ledger/db
COPY docker-entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
WORKDIR /home/ledger/ledger-web
ENTRYPOINT ["/entrypoint"]

10
ledger-web/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = ledger-web
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

BIN
ledger-web/db/db.sqlite3 Normal file
View File

Binary file not shown.

6
ledger-web/docker-entrypoint.sh Normal file
View File

@ -0,0 +1,6 @@
#!/bin/sh
gosu ledger /home/ledger/ledger-web/manage.py makemigrations && \
gosu ledger /home/ledger/ledger-web/manage.py migrate
exec gosu ledger "$@"

136
ledger-web/settings.py Normal file
View File

@ -0,0 +1,136 @@
"""
Django settings for ledger project.
Generated by 'django-admin startproject' using Django 2.1.7.
For more information on this file, see
https://docs.djangoproject.com/en/2.1/topics/settings/
For the full list of settings and their values, see
https://docs.djangoproject.com/en/2.1/ref/settings/
"""
import os
# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'km&+&g_pcaj03g9dqhzg+qcg2)5bvu_rc*_n17!ol3571a8%u8'
# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True
ALLOWED_HOSTS = []
# Application definition
INSTALLED_APPS = [
'ledger_ui.apps.LedgerUiConfig',
'ledger_query.apps.LedgerQueryConfig',
'ledger_submit.apps.LedgerSubmitConfig',
'accounts.apps.AccountsConfig',
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
]
MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'ledger_ui.middleware.HandleExceptionsMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
]
ROOT_URLCONF = 'ledger.urls'
TEMPLATES = [
{
'BACKEND': 'django.template.backends.django.DjangoTemplates',
'DIRS': [],
'APP_DIRS': True,
'OPTIONS': {
'context_processors': [
'django.template.context_processors.debug',
'django.template.context_processors.request',
'django.contrib.auth.context_processors.auth',
'django.contrib.messages.context_processors.messages',
],
},
},
]
WSGI_APPLICATION = 'ledger.wsgi.application'
# Database
# https://docs.djangoproject.com/en/2.1/ref/settings/#databases
DATABASES = {
'default': {
'ENGINE': 'django.db.backends.sqlite3',
'NAME': '/home/ledger/db/db.sqlite3',
}
}
# Password validation
# https://docs.djangoproject.com/en/2.1/ref/settings/#auth-password-validators
AUTH_PASSWORD_VALIDATORS = [
{
'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
},
{
'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
},
{
'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
},
{
'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
},
]
# Internationalization
# https://docs.djangoproject.com/en/2.1/topics/i18n/
LANGUAGE_CODE = 'en-us'
TIME_ZONE = 'Europe/Warsaw'
USE_I18N = True
USE_L10N = True
USE_TZ = True
# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.1/howto/static-files/
STATIC_URL = '/static/'
STATICFILES_DIRS = [
os.path.join(BASE_DIR, "static"),
]
LOGIN_REDIRECT_URL = 'ledger_ui:index'
LEDGER_ENTRY_COUNT = 20
LEDGER_DEFAULT_CURRENCY = '$'
LEDGER_DEFAULT_FROM = 'Liabilities:Credit Card'
LEDGER_DEFAULT_TO = 'Expenses:Uncategorized'

8
ledger-web/test.sh Normal file
View File

@ -0,0 +1,8 @@
#!/bin/sh
make && \
docker run -it \
-v $(pwd)/settings.py:/home/ledger/ledger-web/ledger/settings.py:ro \
-v $(pwd)/db:/home/ledger/db \
rilla/ledger-web \
bash

20
rss-bridge/Dockerfile Normal file
View File

@ -0,0 +1,20 @@
FROM alpine:3.12
RUN apk add --no-cache \
git su-exec nginx php7 php7-fpm \
php7-curl php7-json php7-mbstring php7-openssl php7-pecl-memcached \
php7-simplexml php7-sqlite3 php7-xml && \
sed -i.bak 's/^listen = 127.0.0.1:9000/listen = 9000/' /etc/php7/php-fpm.d/www.conf && \
mkdir -p /var/www && \
git clone https://github.com/RSS-Bridge/rss-bridge /var/www/rss-bridge && \
adduser -D -h /var/www/rss-bridge rssbridge && \
chown -R rssbridge:rssbridge \
/var/www/rss-bridge \
/var/log/php7
WORKDIR /var/www/rss-bridge
COPY entrypoint.sh /entrypoint
RUN chmod 700 /entrypoint
ENTRYPOINT ["/entrypoint"]
CMD ["rss-bridge"]

10
rss-bridge/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = rss-bridge
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

14
rss-bridge/entrypoint.sh Normal file
View File

@ -0,0 +1,14 @@
#!/bin/sh
set -ex
case $1 in
rss-bridge)
exec su-exec rssbridge php-fpm7 -F
;;
nginx)
exec nginx -g 'daemon off;'
;;
*)
exec su-exec rssbridge "$@"
esac

32
syncthing/Dockerfile Normal file
View File

@ -0,0 +1,32 @@
# syncthing
FROM alpine:3.12
ARG ARCH
ENV VER v1.12.0
ENV REL syncthing-linux-${ARCH}-${VER}
ENV URI https://github.com/syncthing/syncthing/releases/download/${VER}/${REL}.tar.gz
RUN apk add --no-cache su-exec
RUN adduser -u 1001 -h /var/lib/syncthing -D syncthing && \
addgroup -S -g 1005 books && addgroup syncthing books && \
addgroup -S -g 1006 buku && addgroup syncthing buku
RUN mkdir -p /data && chown -R syncthing:syncthing /data && \
mkdir -p /data/books && chown -R syncthing:books /data/books && chmod '2775' /data/books && \
mkdir -p /data/buku && chown -R syncthing:buku /data/buku && chmod '2775' /data/buku
VOLUME /data /data/books /data/buku /var/lib/syncthing
RUN cd /tmp && \
wget ${URI} && \
tar -xzf ${REL}.tar.gz && \
cp /tmp/${REL}/syncthing /usr/local/bin/syncthing && \
rm -r /tmp/${REL} /tmp/${REL}.tar.gz
COPY docker-entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
ENTRYPOINT ["/entrypoint"]
CMD ["/usr/local/bin/syncthing", "-home=/var/lib/syncthing"]

19
syncthing/Makefile Normal file
View File

@ -0,0 +1,19 @@
USERNAME = rilla
IMG_NAME = syncthing
.PHONY: build build-nc
hw=$(shell uname -m)
ifeq ($(hw), x86_64)
ARCH=amd64
else ifeq ($(hw), aarch64)
ARCH=arm64
else
ARCH=$(hw)
endif
build: Dockerfile docker-entrypoint.sh
docker build -t $(USERNAME)/$(IMG_NAME) --build-arg ARCH=$(ARCH) .
build-nc: Dockerfile docker-entrypoint.sh
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) --build-arg ARCH=$(ARCH) .

9
syncthing/docker-entrypoint.sh Normal file
View File

@ -0,0 +1,9 @@
#!/bin/sh
chown -R syncthing:syncthing /data
chown -R syncthing:syncthing /var/lib/syncthing
chown -R syncthing:books /data/books
chown -R syncthing:buku /data/buku && touch /data/buku/bookmarks.db && chmod '664' /data/buku/bookmarks.db
chmod '2775' /data/books
exec su-exec syncthing "$@"

10
tasks/Dockerfile Normal file
View File

@ -0,0 +1,10 @@
FROM alpine:3.12
RUN apk add --update --no-cache \
docker-compose \
docker
COPY entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
ENTRYPOINT ["/entrypoint"]

10
tasks/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = tasks
.PHONY: build build-nc
build: Dockerfile entrypoint.sh
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile entrypoint.sh
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

11
tasks/entrypoint.sh Normal file
View File

@ -0,0 +1,11 @@
#!/bin/sh
set -e
[ -f /tasks/tasks.cron ] && crontab /tasks/tasks.cron
if [ -n "$*" ]; then
exec "$@"
else
exec crond -f -L /dev/stdout
fi

7
tor/Dockerfile Normal file
View File

@ -0,0 +1,7 @@
FROM alpine:3.12
RUN apk add --no-cache tor su-exec shadow
COPY entrypoint.sh /entrypoint
RUN chmod +x entrypoint
ENTRYPOINT ["/entrypoint"]
CMD ["tor"]

10
tor/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = tor
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

14
tor/entrypoint.sh Normal file
View File

@ -0,0 +1,14 @@
#!/bin/sh
set -xe
[ -n "${USER_ID}" ] && usermod -u "${USER_ID}" tor
for dir in $(awk '{if ($1 == "HiddenServiceDir") print $2}' /etc/tor/torrc)
do
mkdir -p "${dir}"
chown tor "${dir}"
chmod 700 "${dir}"
done
su-exec tor "$@"

21
vdirsyncer/Dockerfile Normal file
View File

@ -0,0 +1,21 @@
FROM alpine:3.11
RUN apk add --no-cache python3 su-exec && \
apk add --no-cache --virtual .build-deps py3-pip && \
pip3 install --upgrade pip && \
pip3 install vdirsyncer vdirsyncer[google] requests_oauthlib && \
apk del .build-deps && \
adduser -D -h /var/lib/vdirsyncer vdirsyncer && \
mkdir -p /var/lib/vdirsyncer/status /var/lib/vdirsyncer/tokens && \
touch /var/lib/vdirsyncer/config && \
chown -R vdirsyncer:vdirsyncer /var/lib/vdirsyncer
COPY crontab /crontab
COPY entrypoint.sh /entrypoint
COPY do_sync.sh /do_sync
RUN chmod +x /entrypoint /do_sync
ENTRYPOINT ["/entrypoint"]
CMD ["task"]
ENV VDIRSYNCER_CONFIG /var/lib/vdirsyncer/config

10
vdirsyncer/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = vdirsyncer
.PHONY: build build-nc
build: Dockerfile entrypoint.sh crontab do_sync.sh
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile entrypoint.sh crontab do_sync.sh
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

1
vdirsyncer/crontab Normal file
View File

@ -0,0 +1 @@
*/15 * * * * /do_sync

4
vdirsyncer/do_sync.sh Normal file
View File

@ -0,0 +1,4 @@
#!/bin/sh
export VDIRSYNCER_CONFIG=/var/lib/vdirsyncer/config
vdirsyncer discover && vdirsyncer sync

25
vdirsyncer/entrypoint.sh Normal file
View File

@ -0,0 +1,25 @@
#!/bin/sh
mkdir -p /var/lib/vdirsyncer/tokens /var/lib/vdirsyncer/status
chown -R vdirsyncer:vdirsyncer \
/var/lib/vdirsyncer/tokens \
/var/lib/vdirsyncer/status
export VDIRSYNCER_CONFIG=/var/lib/vdirsyncer/config
case $1 in
discover)
exec su-exec vdirsyncer vdirsyncer "$@"
;;
sync)
exec su-exec vdirsyncer vdirsyncer "$@"
;;
task)
su-exec vdirsyncer vdirsyncer discover && \
/usr/bin/crontab -u vdirsyncer /crontab && \
exec /usr/sbin/crond -f -L /dev/stdout
;;
*)
exec "$@"
;;
esac

43
wallabag/Dockerfile Normal file
View File

@ -0,0 +1,43 @@
FROM alpine:3.12
ARG WALLABAG_VERSION=2.4.0
RUN apk --no-cache add \
git su-exec make nginx curl php7 \
php7-bcmath php7-ctype php7-curl php7-dom php7-fpm php7-gd \
php7-gettext php7-iconv php7-intl php7-json php7-mbstring \
php7-openssl php7-pdo_sqlite php7-phar php7-session php7-simplexml \
php7-sockets php7-tidy php7-tokenizer php7-xml php7-xmlreader
RUN curl -s https://getcomposer.org/installer | php && \
mv composer.phar /usr/local/bin/composer
RUN mkdir -p /etc/nginx /etc/php7
COPY php-fpm.conf php.ini /etc/php7/
RUN mkdir -p /var/www && \
git clone \
--branch $WALLABAG_VERSION \
--depth 1 \
https://github.com/wallabag/wallabag.git \
/var/www/wallabag
COPY parameters.yml /var/www/wallabag/app/config/parameters.yml
WORKDIR /var/www/wallabag
RUN SYMFONY_ENV=prod composer install \
--no-dev \
-o \
--prefer-dist \
--no-progress
RUN addgroup -g 1000 wallabag && \
adduser -D -h /var/www -G wallabag -u 1000 wallabag && \
chown -R wallabag:wallabag /var/www/wallabag
COPY entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
ENTRYPOINT ["/entrypoint"]
CMD ["wallabag"]

10
wallabag/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = wallabag
.PHONY: build build-nc
build: Dockerfile
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

42
wallabag/entrypoint.sh Normal file
View File

@ -0,0 +1,42 @@
#!/bin/sh
set -ex
INSTALL_DIR=/var/www/wallabag
set_permissions () {
mkdir -p \
"${INSTALL_DIR}/data/assets" \
"${INSTALL_DIR}/data/db"
chown -R wallabag:wallabag "${INSTALL_DIR}/data"
}
db_install () {
[ -f "${INSTALL_DIR}/data/db/wallabag.sqlite" ] || \
su-exec wallabag php "${INSTALL_DIR}/bin/console" \
wallabag:install --env=prod -n
}
case $1 in
wallabag)
set_permissions
db_install
exec su-exec wallabag php-fpm7 -F
;;
nginx)
exec nginx -c /etc/nginx/nginx.conf -g "daemon off;"
;;
import)
set_permissions
exec su-exec wallabag "${INSTALL_DIR}/bin/console" \
wallabag:import:redis-worker -e=prod "$2" -vv
;;
migrate)
set_permissions
exec su-exec wallabag "${INSTALL_DIR}/bin/console" \
doctrine:migrations:migrate --env=prod --no-interaction
;;
*)
set_permissions
exec su-exec wallabag "$@"
esac

64
wallabag/parameters.yml Normal file
View File

@ -0,0 +1,64 @@
parameters:
database_driver: pdo_sqlite
database_host: 127.0.0.1
database_port: ~
database_name: symfony
database_user: root
database_password: ~
database_path: "%kernel.root_dir%/../data/db/wallabag.sqlite"
database_table_prefix: wallabag_
database_socket: null
database_charset: utf8
database_driver_class: null
domain_name: https://your-wallabag-url-instance.com
test_database_driver: pdo_sqlite
test_database_host: 127.0.0.1
test_database_port: ~
test_database_name: ~
test_database_user: ~
test_database_password: ~
test_database_path: "%kernel.root_dir%/../data/db/wallabag_test.sqlite"
mailer_transport: smtp
mailer_user: ~
mailer_password: ~
mailer_host: 127.0.0.1
mailer_port: false
mailer_encryption: ~
mailer_auth_mode: ~
locale: en
# A secret key that's used to generate certain security-related tokens
secret: ovmpmAWXRCabNlMgzlzFXDYmCFfzGv
# two factor stuff
twofactor_auth: true
twofactor_sender: no-reply@wallabag.org
# fosuser stuff
fosuser_registration: true
fosuser_confirmation: true
from_email: no-reply@wallabag.org
rss_limit: 50
# RabbitMQ processing
rabbitmq_host: localhost
rabbitmq_port: 5672
rabbitmq_user: guest
rabbitmq_password: guest
rabbitmq_prefetch_count: 10
# Redis processing
redis_scheme: tcp
redis_host: localhost
redis_port: 6379
redis_path: null
redis_password: null
# Sentry
sentry_dsn: ~

539
wallabag/php-fpm.conf Normal file
View File

@ -0,0 +1,539 @@
;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
;;;;;;;;;;;;;;;;;;;;;
; All relative paths in this configuration file are relative to PHP's install
; prefix (/usr). This prefix can be dynamically changed by using the
; '-p' argument from the command line.
; Include one or more files. If glob(3) exists, it is used to include a bunch of
; files from a glob(3) pattern. This directive can be used everywhere in the
; file.
; Relative path can also be used. They will be prefixed by:
; - the global prefix if it's been set (-p argument)
; - /usr otherwise
;include=etc/fpm.d/*.conf
;;;;;;;;;;;;;;;;;;
; Global Options ;
;;;;;;;;;;;;;;;;;;
[global]
; Pid file
; Note: the default prefix is /var
; Default Value: none
;pid = run/php-fpm.pid
; Error log file
; If it's set to "syslog", log is sent to syslogd instead of being written
; in a local file.
; Note: the default prefix is /var
; Default Value: log/php-fpm.log
error_log = /dev/stdout
; syslog_facility is used to specify what type of program is logging the
; message. This lets syslogd specify that messages from different facilities
; will be handled differently.
; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)
; Default Value: daemon
;syslog.facility = daemon
; syslog_ident is prepended to every message. If you have multiple FPM
; instances running on the same server, you can change the default value
; which must suit common needs.
; Default Value: php-fpm
;syslog.ident = php-fpm
; Log level
; Possible Values: alert, error, warning, notice, debug
; Default Value: notice
;log_level = notice
; If this number of child processes exit with SIGSEGV or SIGBUS within the time
; interval set by emergency_restart_interval then FPM will restart. A value
; of '0' means 'Off'.
; Default Value: 0
;emergency_restart_threshold = 0
; Interval of time used by emergency_restart_interval to determine when
; a graceful restart will be initiated. This can be useful to work around
; accidental corruptions in an accelerator's shared memory.
; Available Units: s(econds), m(inutes), h(ours), or d(ays)
; Default Unit: seconds
; Default Value: 0
;emergency_restart_interval = 0
; Time limit for child processes to wait for a reaction on signals from master.
; Available units: s(econds), m(inutes), h(ours), or d(ays)
; Default Unit: seconds
; Default Value: 0
;process_control_timeout = 0
; The maximum number of processes FPM will fork. This has been design to control
; the global number of processes when using dynamic PM within a lot of pools.
; Use it with caution.
; Note: A value of 0 indicates no limit
; Default Value: 0
; process.max = 128
; Specify the nice(2) priority to apply to the master process (only if set)
; The value can vary from -19 (highest priority) to 20 (lower priority)
; Note: - It will only work if the FPM master process is launched as root
; - The pool process will inherit the master process priority
; unless it specified otherwise
; Default Value: no set
; process.priority = -19
; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.
; Default Value: yes
;daemonize = yes
; Set open file descriptor rlimit for the master process.
; Default Value: system defined value
;rlimit_files = 1024
; Set max core size rlimit for the master process.
; Possible Values: 'unlimited' or an integer greater or equal to 0
; Default Value: system defined value
;rlimit_core = 0
; Specify the event mechanism FPM will use. The following is available:
; - select (any POSIX os)
; - poll (any POSIX os)
; - epoll (linux >= 2.5.44)
; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)
; - /dev/poll (Solaris >= 7)
; - port (Solaris >= 10)
; Default Value: not set (auto detection)
;events.mechanism = epoll
; When FPM is build with systemd integration, specify the interval,
; in second, between health report notification to systemd.
; Set to 0 to disable.
; Available Units: s(econds), m(inutes), h(ours)
; Default Unit: seconds
; Default value: 10
;systemd_interval = 10
;;;;;;;;;;;;;;;;;;;;
; Pool Definitions ;
;;;;;;;;;;;;;;;;;;;;
; Multiple pools of child processes may be started with different listening
; ports and different management options. The name of the pool will be
; used in logs and stats. There is no limitation on the number of pools which
; FPM can handle. Your system will tell you anyway :)
; Start a new pool named 'www'.
; the variable $pool can we used in any directive and will be replaced by the
; pool name ('www' here)
[www]
; Per pool prefix
; It only applies on the following directives:
; - 'access.log'
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool
; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
; will be used.
user = nobody
group = nobody
; The address on which to accept FastCGI requests.
; Valid syntaxes are:
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
; a specific port;
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
; a specific port;
; 'port' - to listen on a TCP socket to all IPv4 addresses on a
; specific port;
; '[::]:port' - to listen on a TCP socket to all addresses
; (IPv6 and IPv4-mapped) on a specific port;
; '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
;listen = 127.0.0.1:9000
listen = 0.0.0.0:9000
; Set listen(2) backlog.
; Default Value: 65535 (-1 on FreeBSD and OpenBSD)
;listen.backlog = 65535
; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions.
; Default Values: user and group are set as the running user
; mode is set to 0660
;listen.owner = nobody
;listen.group = nobody
;listen.mode = 0660
; When POSIX Access Control Lists are supported you can set them using
; these options, value is a comma separated list of user/group names.
; When set, listen.owner and listen.group are ignored
;listen.acl_users =
;listen.acl_groups =
; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
; must be separated by a comma. If this value is left blank, connections will be
; accepted from any ip address.
; Default Value: any
;listen.allowed_clients = 127.0.0.1
; Specify the nice(2) priority to apply to the pool processes (only if set)
; The value can vary from -19 (highest priority) to 20 (lower priority)
; Note: - It will only work if the FPM master process is launched as root
; - The pool processes will inherit the master process priority
; unless it specified otherwise
; Default Value: no set
; process.priority = -19
; Choose how the process manager will control the number of child processes.
; Possible Values:
; static - a fixed number (pm.max_children) of child processes;
; dynamic - the number of child processes are set dynamically based on the
; following directives. With this process management, there will be
; always at least 1 children.
; pm.max_children - the maximum number of children that can
; be alive at the same time.
; pm.start_servers - the number of children created on startup.
; pm.min_spare_servers - the minimum number of children in 'idle'
; state (waiting to process). If the number
; of 'idle' processes is less than this
; number then some children will be created.
; pm.max_spare_servers - the maximum number of children in 'idle'
; state (waiting to process). If the number
; of 'idle' processes is greater than this
; number then some children will be killed.
; ondemand - no children are created at startup. Children will be forked when
; new requests will connect. The following parameter are used:
; pm.max_children - the maximum number of children that
; can be alive at the same time.
; pm.process_idle_timeout - The number of seconds after which
; an idle process will be killed.
; Note: This value is mandatory.
pm = dynamic
; The number of child processes to be created when pm is set to 'static' and the
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
; This value sets the limit on the number of simultaneous requests that will be
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
; CGI. The below defaults are based on a server without much resources. Don't
; forget to tweak pm.* to fit your needs.
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
; Note: This value is mandatory.
pm.max_children = 5
; The number of child processes created on startup.
; Note: Used only when pm is set to 'dynamic'
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
pm.start_servers = 2
; The desired minimum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.min_spare_servers = 1
; The desired maximum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.max_spare_servers = 3
; The number of seconds after which an idle process will be killed.
; Note: Used only when pm is set to 'ondemand'
; Default Value: 10s
;pm.process_idle_timeout = 10s;
; The number of requests each child process should execute before respawning.
; This can be useful to work around memory leaks in 3rd party libraries. For
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
; Default Value: 0
;pm.max_requests = 500
; The URI to view the FPM status page. If this value is not set, no URI will be
; recognized as a status page. It shows the following informations:
; pool - the name of the pool;
; process manager - static, dynamic or ondemand;
; start time - the date and time FPM has started;
; start since - number of seconds since FPM has started;
; accepted conn - the number of request accepted by the pool;
; listen queue - the number of request in the queue of pending
; connections (see backlog in listen(2));
; max listen queue - the maximum number of requests in the queue
; of pending connections since FPM has started;
; listen queue len - the size of the socket queue of pending connections;
; idle processes - the number of idle processes;
; active processes - the number of active processes;
; total processes - the number of idle + active processes;
; max active processes - the maximum number of active processes since FPM
; has started;
; max children reached - number of times, the process limit has been reached,
; when pm tries to start more children (works only for
; pm 'dynamic' and 'ondemand');
; Value are updated in real time.
; Example output:
; pool: www
; process manager: static
; start time: 01/Jul/2011:17:53:49 +0200
; start since: 62636
; accepted conn: 190460
; listen queue: 0
; max listen queue: 1
; listen queue len: 42
; idle processes: 4
; active processes: 11
; total processes: 15
; max active processes: 12
; max children reached: 0
;
; By default the status page output is formatted as text/plain. Passing either
; 'html', 'xml' or 'json' in the query string will return the corresponding
; output syntax. Example:
; http://www.foo.bar/status
; http://www.foo.bar/status?json
; http://www.foo.bar/status?html
; http://www.foo.bar/status?xml
;
; By default the status page only outputs short status. Passing 'full' in the
; query string will also return status for each pool process.
; Example:
; http://www.foo.bar/status?full
; http://www.foo.bar/status?json&full
; http://www.foo.bar/status?html&full
; http://www.foo.bar/status?xml&full
; The Full status returns for each process:
; pid - the PID of the process;
; state - the state of the process (Idle, Running, ...);
; start time - the date and time the process has started;
; start since - the number of seconds since the process has started;
; requests - the number of requests the process has served;
; request duration - the duration in µs of the requests;
; request method - the request method (GET, POST, ...);
; request URI - the request URI with the query string;
; content length - the content length of the request (only with POST);
; user - the user (PHP_AUTH_USER) (or '-' if not set);
; script - the main script called (or '-' if not set);
; last request cpu - the %cpu the last request consumed
; it's always 0 if the process is not in Idle state
; because CPU calculation is done when the request
; processing has terminated;
; last request memory - the max amount of memory the last request consumed
; it's always 0 if the process is not in Idle state
; because memory calculation is done when the request
; processing has terminated;
; If the process is in Idle state, then informations are related to the
; last request the process has served. Otherwise informations are related to
; the current request being served.
; Example output:
; ************************
; pid: 31330
; state: Running
; start time: 01/Jul/2011:17:53:49 +0200
; start since: 63087
; requests: 12808
; request duration: 1250261
; request method: GET
; request URI: /test_mem.php?N=10000
; content length: 0
; user: -
; script: /home/fat/web/docs/php/test_mem.php
; last request cpu: 0.00
; last request memory: 0
;
; Note: There is a real-time FPM status monitoring sample web page available
; It's available in: /usr/share/php/fpm/status.html
;
; Note: The value must start with a leading slash (/). The value can be
; anything, but it may not be a good idea to use the .php extension or it
; may conflict with a real PHP file.
; Default Value: not set
;pm.status_path = /status
; The ping URI to call the monitoring page of FPM. If this value is not set, no
; URI will be recognized as a ping page. This could be used to test from outside
; that FPM is alive and responding, or to
; - create a graph of FPM availability (rrd or such);
; - remove a server from a group if it is not responding (load balancing);
; - trigger alerts for the operating team (24/7).
; Note: The value must start with a leading slash (/). The value can be
; anything, but it may not be a good idea to use the .php extension or it
; may conflict with a real PHP file.
; Default Value: not set
;ping.path = /ping
; This directive may be used to customize the response of a ping request. The
; response is formatted as text/plain with a 200 response code.
; Default Value: pong
;ping.response = pong
; The access log file
; Default: not set
;access.log = log/$pool.access.log
access.log = /dev/stdout
; The access log format.
; The following syntax is allowed
; %%: the '%' character
; %C: %CPU used by the request
; it can accept the following format:
; - %{user}C for user CPU only
; - %{system}C for system CPU only
; - %{total}C for user + system CPU (default)
; %d: time taken to serve the request
; it can accept the following format:
; - %{seconds}d (default)
; - %{miliseconds}d
; - %{mili}d
; - %{microseconds}d
; - %{micro}d
; %e: an environment variable (same as $_ENV or $_SERVER)
; it must be associated with embraces to specify the name of the env
; variable. Some exemples:
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
; %f: script filename
; %l: content-length of the request (for POST request only)
; %m: request method
; %M: peak of memory allocated by PHP
; it can accept the following format:
; - %{bytes}M (default)
; - %{kilobytes}M
; - %{kilo}M
; - %{megabytes}M
; - %{mega}M
; %n: pool name
; %o: output header
; it must be associated with embraces to specify the name of the header:
; - %{Content-Type}o
; - %{X-Powered-By}o
; - %{Transfert-Encoding}o
; - ....
; %p: PID of the child that serviced the request
; %P: PID of the parent of the child that serviced the request
; %q: the query string
; %Q: the '?' character if query string exists
; %r: the request URI (without the query string, see %q and %Q)
; %R: remote IP address
; %s: status (response code)
; %t: server time the request was received
; it can accept a strftime(3) format:
; %d/%b/%Y:%H:%M:%S %z (default)
; %T: time the log has been written (the request has finished)
; it can accept a strftime(3) format:
; %d/%b/%Y:%H:%M:%S %z (default)
; %u: remote user
;
; Default: "%R - %u %t \"%m %r\" %s"
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
; The log file for slow requests
; Default Value: not set
; Note: slowlog is mandatory if request_slowlog_timeout is set
;slowlog = log/$pool.log.slow
; The timeout for serving a single request after which a PHP backtrace will be
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
; Default Value: 0
;request_slowlog_timeout = 0
; The timeout for serving a single request after which the worker process will
; be killed. This option should be used when the 'max_execution_time' ini option
; does not stop script execution for some reason. A value of '0' means 'off'.
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
; Default Value: 0
;request_terminate_timeout = 0
; Set open file descriptor rlimit.
; Default Value: system defined value
;rlimit_files = 1024
; Set max core size rlimit.
; Possible Values: 'unlimited' or an integer greater or equal to 0
; Default Value: system defined value
;rlimit_core = 0
; Chroot to this directory at the start. This value must be defined as an
; absolute path. When this value is not set, chroot is not used.
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
; of its subdirectories. If the pool prefix is not set, the global prefix
; will be used instead.
; Note: chrooting is a great security feature and should be used whenever
; possible. However, all PHP paths will be relative to the chroot
; (error_log, sessions.save_path, ...).
; Default Value: not set
;chroot =
; Chdir to this directory at the start.
; Note: relative path can be used.
; Default Value: current directory or / when chroot
;chdir = /var/www
; Redirect worker stdout and stderr into main error log. If not set, stdout and
; stderr will be redirected to /dev/null according to FastCGI specs.
; Note: on highloaded environement, this can cause some delay in the page
; process time (several ms).
; Default Value: no
;catch_workers_output = yes
; Clear environment in FPM workers
; Prevents arbitrary environment variables from reaching FPM worker processes
; by clearing the environment in workers before env vars specified in this
; pool configuration are added.
; Setting to "no" will make all environment variables available to PHP code
; via getenv(), $_ENV and $_SERVER.
; Default Value: yes
;clear_env = no
; Limits the extensions of the main script FPM will allow to parse. This can
; prevent configuration mistakes on the web server side. You should only limit
; FPM to .php extensions to prevent malicious users to use other extensions to
; exectute php code.
; Note: set an empty value to allow all extensions.
; Default Value: .php
;security.limit_extensions = .php .php3 .php4 .php5
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
; the current environment.
; Default Value: clean env
;env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
;env[TMP] = /tmp
;env[TMPDIR] = /tmp
;env[TEMP] = /tmp
; Additional php.ini defines, specific to this pool of workers. These settings
; overwrite the values previously defined in the php.ini. The directives are the
; same as the PHP SAPI:
; php_value/php_flag - you can set classic ini defines which can
; be overwritten from PHP call 'ini_set'.
; php_admin_value/php_admin_flag - these directives won't be overwritten by
; PHP call 'ini_set'
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
; Defining 'extension' will load the corresponding shared extension from
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
; overwrite previously defined php.ini values, but will append the new value
; instead.
; Note: path INI options can be relative and will be expanded with the prefix
; (pool, global or /usr)
; Default Value: nothing is defined by default except the values in php.ini and
; specified at startup with the -d argument
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
;php_flag[display_errors] = off
;php_admin_value[error_log] = /var/log/fpm-php.www.log
;php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 32M

1930
wallabag/php.ini Normal file
View File

File diff suppressed because it is too large Load Diff

30
xandikos/Dockerfile Normal file
View File

@ -0,0 +1,30 @@
FROM alpine:3.11
RUN apk add --no-cache \
git \
python3 \
su-exec && \
apk add --no-cache --virtual .build-deps \
gcc \
musl-dev \
py3-pip \
python3-dev && \
pip3 install --upgrade pip && \
pip3 install \
aiohttp \
defusedxml \
dulwich \
icalendar \
jinja2 \
prometheus-client && \
apk del .build-deps && \
mkdir -p /opt && \
git clone https://github.com/jelmer/xandikos /opt/xandikos && \
adduser -D -h /var/lib/xandikos xandikos && \
mkdir -p /var/lib/xandikos/data && \
chown -R xandikos:xandikos /var/lib/xandikos
COPY entrypoint.sh /entrypoint
RUN chmod +x /entrypoint
ENTRYPOINT ["/entrypoint"]
CMD ["xandikos"]

10
xandikos/Makefile Normal file
View File

@ -0,0 +1,10 @@
USERNAME = rilla
IMG_NAME = xandikos
.PHONY: build build-nc
build: Dockerfile entrypoint.sh
docker build -t $(USERNAME)/$(IMG_NAME) .
build-nc: Dockerfile entrypoint.sh
docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

28
xandikos/entrypoint.sh Normal file
View File

@ -0,0 +1,28 @@
#!/bin/sh
set -xe
PORT=${PORT:-8000}
ROUTE_PREFIX=${ROUTE_PREFIX:-/}
current_user_principal="/user"
chown -R xandikos:xandikos /var/lib/xandikos
case $1 in
xandikos)
cd /opt/xandikos
exec su-exec xandikos python3 -m xandikos.web \
--port="${PORT}" \
--listen-address='0.0.0.0' \
-d /var/lib/xandikos/data \
--current-user-principal="${current_user_principal}" \
--route-prefix "${ROUTE_PREFIX}" \
--autocreate \
--defaults
;;
*)
exec "$@"
;;
esac