Skip to content

Commit 43fd098

Browse files
tspicertspicer
committed
cleanup up older and outdated code
Update to support alpine 3.18 and the latest nginx release
1 parent 6cc14a4 commit 43fd098

File tree

18 files changed

+226
-165
lines changed

18 files changed

+226
-165
lines changed

‎Dockerfile‎

Lines changed: 15 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
FROM alpine:3.12
2-
MAINTAINER Thomas Spicer (thomas@openbridge.com)
1+
FROM alpine:3.18
2+
LABEL maintainer="Thomas Spicer (thomas@openbridge.com)"
33

44
ARG NGINX_VERSION
55
ENV VAR_PREFIX=/var/run \
@@ -13,7 +13,6 @@ RUN set -x \
1313
&& CONFIG="\
1414
--prefix=/usr/share/nginx/ \
1515
--sbin-path=/usr/sbin/nginx \
16-
--add-module=/tmp/naxsi/naxsi_src \
1716
--modules-path=/usr/lib/nginx/modules \
1817
--conf-path=${CONF_PREFIX}/nginx.conf \
1918
--error-log-path=${LOG_PREFIX}/error.log \
@@ -43,32 +42,30 @@ RUN set -x \
4342
--with-http_auth_request_module \
4443
--with-http_xslt_module=dynamic \
4544
--with-http_image_filter_module=dynamic \
46-
--with-http_geoip_module=dynamic \
4745
--with-threads \
4846
--with-stream \
4947
--with-stream_ssl_module \
5048
--with-stream_ssl_preread_module \
5149
--with-stream_realip_module \
52-
--with-stream_geoip_module=dynamic \
5350
--with-http_slice_module \
5451
--with-mail \
5552
--with-mail_ssl_module \
5653
--with-compat \
5754
--with-file-aio \
5855
--with-http_v2_module \
5956
--add-module=/tmp/ngx_cache_purge-2.3 \
60-
--add-module=/tmp/ngx_http_redis-0.3.9 \
57+
--add-module=/tmp/ngx_http_redis-0.4.1-cmm \
6158
--add-module=/tmp/redis2-nginx-module-0.15 \
62-
--add-module=/tmp/srcache-nginx-module-0.31 \
59+
--add-module=/tmp/srcache-nginx-module-0.33 \
6360
--add-module=/tmp/echo-nginx-module \
64-
--add-module=/tmp/ngx_devel_kit-0.3.1 \
65-
--add-module=/tmp/set-misc-nginx-module-0.32 \
61+
--add-module=/tmp/ngx_devel_kit-0.3.2 \
62+
--add-module=/tmp/set-misc-nginx-module-0.33 \
6663
--add-module=/tmp/ngx_brotli \
6764
--with-ld-opt='-L/usr/lib' \
6865
--with-cc-opt=-Wno-error \
6966
" \
70-
&& addgroup -g 82 -S www-data \
71-
&& adduser -u 82 -D -S -h /var/cache/nginx -s /sbin/nologin -G www-data www-data \
67+
&& if [ -z "$(getent group www-data)" ]; then addgroup -g 82 -S www-data; fi \
68+
&& if [ -z "$(getent passwd www-data)" ]; then adduser -u 82 -D -S -h /var/cache/nginx -s /sbin/nologin -G www-data www-data; fi \
7269
&& apk add --no-cache --virtual .build-deps \
7370
alpine-sdk \
7471
autoconf \
@@ -81,7 +78,6 @@ RUN set -x \
8178
findutils \
8279
gcc \
8380
gd-dev \
84-
geoip-dev \
8581
gettext \
8682
git \
8783
gnupg \
@@ -108,7 +104,6 @@ RUN set -x \
108104
bash \
109105
bind-tools \
110106
rsync \
111-
geoip \
112107
openssl \
113108
pcre \
114109
tini \
@@ -118,29 +113,19 @@ RUN set -x \
118113
&& cd ngx_brotli && git submodule update --init \
119114
&& export NGX_BROTLI_STATIC_MODULE_ONLY=1 \
120115
&& cd /tmp \
121-
&& git clone https://github.com/nbs-system/naxsi.git \
122-
&& echo 'adding /usr/local/share/GeoIP/GeoIP.dat database' \
123-
&& wget -N https://raw.githubusercontent.com/openbridge/nginx/master/geoip/GeoLiteCity.dat.gz \
124-
&& wget -N https://raw.githubusercontent.com/openbridge/nginx/master/geoip/GeoIP.dat.gz \
125-
&& gzip -d GeoIP.dat.gz \
126-
&& gzip -d GeoLiteCity.dat.gz \
127-
&& mkdir /usr/local/share/GeoIP/ \
128-
&& mv GeoIP.dat /usr/local/share/GeoIP/ \
129-
&& mv GeoLiteCity.dat /usr/local/share/GeoIP/ \
130-
&& chown -R www-data:www-data /usr/local/share/GeoIP/ \
131116
&& curl -fSL http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
132117
&& mkdir -p /usr/src \
133118
&& tar -zxC /usr/src -f nginx.tar.gz \
134119
&& rm nginx.tar.gz \
135120
&& cd /tmp \
136121
&& git clone https://github.com/openresty/echo-nginx-module.git \
137-
&& wget https://github.com/simpl/ngx_devel_kit/archive/v0.3.1.zip -O dev.zip \
138-
&& wget https://github.com/openresty/set-misc-nginx-module/archive/v0.32.zip -O setmisc.zip \
139-
&& wget https://people.freebsd.org/~osa/ngx_http_redis-0.3.9.tar.gz \
140-
&& wget https://github.com/openresty/redis2-nginx-module/archive/v0.15.zip -O redis.zip \
141-
&& wget https://github.com/openresty/srcache-nginx-module/archive/v0.31.zip -O cache.zip \
142-
&& wget https://github.com/FRiCKLE/ngx_cache_purge/archive/2.3.zip -O purge.zip \
143-
&& tar -zx -f ngx_http_redis-0.3.9.tar.gz \
122+
&& wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/v0.3.2.zip -O dev.zip \
123+
&& wget https://github.com/openresty/set-misc-nginx-module/archive/refs/tags/v0.33.zip -O setmisc.zip \
124+
&& wget https://github.com/centminmod/ngx_http_redis/archive/refs/tags/0.4.1-cmm.zip -O ngx.zip \
125+
&& wget https://github.com/openresty/redis2-nginx-module/archive/refs/tags/v0.15.zip -O redis.zip \
126+
&& wget https://github.com/openresty/srcache-nginx-module/archive/refs/tags/v0.33.zip -O cache.zip \
127+
&& wget https://github.com/FRiCKLE/ngx_cache_purge/archive/refs/tags/2.3.zip -O purge.zip \
128+
&& unzip ngx.zip \
144129
&& unzip dev.zip \
145130
&& unzip setmisc.zip \
146131
&& unzip redis.zip \
@@ -152,7 +137,6 @@ RUN set -x \
152137
&& mv objs/nginx objs/nginx-debug \
153138
&& mv objs/ngx_http_xslt_filter_module.so objs/ngx_http_xslt_filter_module-debug.so \
154139
&& mv objs/ngx_http_image_filter_module.so objs/ngx_http_image_filter_module-debug.so \
155-
&& mv objs/ngx_stream_geoip_module.so objs/ngx_stream_geoip_module-debug.so \
156140
&& ./configure $CONFIG \
157141
&& make -j$(getconf _NPROCESSORS_ONLN) \
158142
&& make install \
@@ -164,7 +148,6 @@ RUN set -x \
164148
&& install -m755 objs/nginx-debug /usr/sbin/nginx-debug \
165149
&& install -m755 objs/ngx_http_xslt_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so \
166150
&& install -m755 objs/ngx_http_image_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so \
167-
&& install -m755 objs/ngx_stream_geoip_module-debug.so /usr/lib/nginx/modules/ngx_stream_geoip_module-debug.so \
168151
&& ln -s ../../usr/lib/nginx/modules /etc/nginx/modules \
169152
&& strip /usr/sbin/nginx* \
170153
&& strip /usr/lib/nginx/modules/*.so \
@@ -185,8 +168,6 @@ RUN set -x \
185168
&& nice -n +5 openssl dhparam -out /etc/pki/tls/dhparam.pem.default 2048 \
186169
&& apk add --no-cache $runDeps \
187170
&& apk del .build-deps \
188-
&& cd /tmp/naxsi \
189-
&& mv naxsi_config/naxsi_core.rules /etc/nginx/naxsi_core.rules \
190171
&& rm -rf /tmp/* \
191172
&& rm -rf /usr/src/* \
192173
&& ln -sf /dev/stdout ${LOG_PREFIX}/access.log \

‎conf/html/nginx/header.d/proxy.conf‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,4 @@ proxy_set_header Range $slice_range;
2222

2323
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
2424

25-
proxy_set_header GEOIP-COUNTRY-CODE $geoip_country_code;
26-
proxy_set_header GEOIP-COUNTRY-CODE3 $geoip_country_code3;
27-
proxy_set_header GEOIP-COUNTRY-NAME $geoip_country_name;
28-
29-
proxy_set_header GEOIP-CITY-COUNTRY-CODE $geoip_city_country_code;
30-
proxy_set_header GEOIP-CITY-COUNTRY-CODE3 $geoip_city_country_code3;
31-
proxy_set_header GEOIP-CITY-COUNTRY-NAME $geoip_city_country_name;
32-
proxy_set_header GEOIP-REGION $geoip_region;
33-
proxy_set_header GEOIP-CITY $geoip_city;
34-
proxy_set_header GEOIP-POSTAL-CODE $geoip_postal_code;
35-
proxy_set_header GEOIP-CITY-CONTINENT-CODE $geoip_city_continent_code;
36-
proxy_set_header GEOIP-LATITUDE $geoip_latitude;
37-
proxy_set_header GEOIP-LONGITUDE $geoip_longitude;
25+

‎conf/html/nginx/nginx.conf‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
load_module /etc/nginx/modules/ngx_http_geoip_module.so;
2-
31
user www-data;
42
worker_processes auto;
53
worker_rlimit_nofile 65535;
@@ -15,7 +13,6 @@ events {
1513

1614
http {
1715
include /etc/nginx/mime.type;
18-
include /etc/nginx/naxsi_core.rules;
1916

2017
default_type application/octet-stream;
2118
charset UTF-8;
@@ -48,20 +45,16 @@ http {
4845

4946
ignore_invalid_headers on;
5047

51-
geoip_country /usr/local/share/GeoIP/GeoIP.dat;
52-
geoip_city /usr/local/share/GeoIP/GeoLiteCity.dat;
53-
5448
map_hash_bucket_size 256;
5549
map_hash_max_size 4096;
5650
types_hash_max_size 2048;
5751
variables_hash_max_size 2048;
5852

59-
geo $rate_limit {include /etc/nginx/geo.d/ratelimit.conf;}
60-
map $rate_limit $rate_limit_key {include /etc/nginx/map.d/access/*.map;}
53+
#limit_req_zone $rate_limit_key zone=req_zone:10m rate=200r/s;
54+
55+
#map $rate_limit $rate_limit_key {include /etc/nginx/map.d/access/*.map;}
6156
map $http_user_agent $no_logs {include /etc/nginx/map.d/logs/ua.map;}
6257

63-
limit_req_zone $rate_limit_key zone=req_zone:10m rate=200r/s;
64-
6558
upstream proxy {include /etc/nginx/upstream.d/proxy.conf;}
6659
upstream redis {include /etc/nginx/upstream.d/redis.conf;}
6760

@@ -81,8 +74,6 @@ http {
8174
'"http_forward": "$http_x_forwarded_for", '
8275
'"http_header": "$http_x_header", '
8376
'"body_bytes_sent": "$body_bytes_sent", '
84-
'"geo_country": "$geoip_country_code", '
85-
'"geo_city": "$geoip_city", '
8677
'"server_name": "$server_name", '
8778
'"upstream_addr": "$upstream_addr", '
8879
'"upstream_status": "$upstream_status", '
@@ -113,9 +104,7 @@ http {
113104
proxy_cache_key $scheme$request_method$http_host$request_uri$slice_range;
114105

115106
map $request_method $purge_method {include /etc/nginx/map.d/purge/*.map;}
116-
geo $purge_allowed {include /etc/nginx/geo.d/purge.conf;}
117107

118-
geo $whitelist {include /etc/nginx/geo.d/whitelist.conf;}
119108
map $whitelist $limit_access {include /etc/nginx/map.d/access/*.map;}
120109
expires $expires;
121110

‎conf/html/nginx/sites-available/default.vhost‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,10 @@ server {
22
server_name {{NGINX_SERVER_NAME}} www.{{NGINX_SERVER_NAME}} *.{{NGINX_SERVER_NAME}};
33
server_tokens off;
44
server_name_in_redirect off;
5+
http2 on;
56
listen *:80 default_server;
67
listen [::]:80 default_server reuseport;
78
access_log {{LOG_PREFIX}}/access.log main_ext if=$no_logs;
8-
include /etc/nginx/bots.d/blockbots.conf;
9-
include /etc/nginx/bots.d/ddos.conf;
109
include /etc/nginx/header.d/httpd.conf;
1110
return 301 https://$host$request_uri;
1211
}
@@ -15,18 +14,16 @@ server {
1514
server_name {{NGINX_SERVER_NAME}} www.{{NGINX_SERVER_NAME}} *.{{NGINX_SERVER_NAME}};
1615
server_tokens off;
1716
server_name_in_redirect off;
18-
root {{NGINX_DOCROOT}};
19-
listen *:443 default_server ssl http2;
20-
listen [::]:443 default_server ssl http2 reuseport;
21-
limit_req zone=req_zone burst=20 nodelay;
17+
root {{NGINX_SERVER_NAME}} www.{{NGINX_SERVER_NAME}} *.{{NGINX_SERVER_NAME}};
18+
http2 on;
19+
listen *:443 default_server ssl;
20+
listen [::]:443 default_server ssl reuseport;
21+
2222
set $naxsi_flag_enable 0;
2323

24-
http2_push_preload on;
2524
access_log {{LOG_PREFIX}}/access.log main_ext if=$no_logs;
2625

2726
include /etc/nginx/conf.d/ssl.conf;
28-
include /etc/nginx/bots.d/blockbots.conf;
29-
include /etc/nginx/bots.d/ddos.conf;
3027

3128
location / {
3229
include /etc/nginx/conf.d/secure.conf;
@@ -36,7 +33,7 @@ server {
3633
userid_name _uid;
3734
userid_path /;
3835
userid_expires max;
39-
userid_domain {{NGINX_SERVER_NAME}};
36+
userid_domain {{NGINX_SERVER_NAME}} www.{{NGINX_SERVER_NAME}} *.{{NGINX_SERVER_NAME}};
4037
expires $expires;
4138
proxy_pass http://proxy/;
4239
proxy_redirect / /;

‎conf/php/nginx/conf.d/brotli.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ brotli_types
1111
application/postscript
1212
application/font-woff
1313
application/font-woff2
14-
application/x-javascript
1514
application/vnd.ms-fontobject
1615
application/x-font-opentype
1716
application/x-font-truetype

‎conf/php/nginx/conf.d/proxy.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ proxy_busy_buffers_size 256k;
66
proxy_temp_file_write_size 256k;
77
proxy_headers_hash_bucket_size 256;
88
proxy_headers_hash_max_size 1024;
9-
proxy_read_timeout 30s;
10-
proxy_send_timeout 30s;
11-
proxy_connect_timeout 30s;
9+
proxy_read_timeout 60s;
10+
proxy_send_timeout 60s;
11+
proxy_connect_timeout 60s;
1212

1313
slice 1m;
1414
proxy_cache proxycache;

‎conf/php/nginx/conf.d/seo.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,5 @@ location ~ ([^/]*)sitemap(.*)\.x(m|s)l$
66
rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
77
rewrite ^/news_sitemap\.xml$ /index.php?sitemap=wpseo_news last;
88
rewrite ^/locations\.kml$ /index.php?sitemap=wpseo_local_kml last;
9-
rewrite ^/geo_sitemap\.xml$ /index.php?sitemap=wpseo_local last;
109
rewrite ^/video-sitemap\.xsl$ /index.php?xsl=video last;
1110
}

‎conf/php/nginx/conf.d/ssl.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
ssl_certificate /etc/letsencrypt/live/{{NGINX_SERVER_NAME}}/fullchain.pem;
22
ssl_certificate_key /etc/letsencrypt/live/{{NGINX_SERVER_NAME}}/privkey.pem;
33
ssl_trusted_certificate /etc/letsencrypt/live/{{NGINX_SERVER_NAME}}/chain.pem;
4-
ssl_protocols TLSv1.2;
4+
ssl_protocols TLSv1.2 TLSv1.3;
55
ssl_session_cache shared:SSL:50m;
66
ssl_session_timeout 30m;
77
ssl_dhparam /etc/pki/tls/dhparam.pem;
8-
ssl_ecdh_curve secp384r1;
9-
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
8+
ssl_ecdh_curve X25519:secp384r1;
9+
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
1010
ssl_prefer_server_ciphers on;
1111
ssl_buffer_size 1400;
1212
ssl_session_tickets off;

‎conf/php/nginx/fastcgi.d/fastcgi.conf‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
fastcgi_split_path_info ^(.+\.php)(/.+)$;
2-
fastcgi_connect_timeout 120s;
3-
fastcgi_send_timeout 120s;
4-
fastcgi_read_timeout 120s;
2+
fastcgi_connect_timeout 60s;
3+
fastcgi_send_timeout 60s;
4+
fastcgi_read_timeout 60s;
55

66
fastcgi_buffer_size 256k;
77
fastcgi_buffers 4 256k;
@@ -34,7 +34,6 @@ fastcgi_param REQUEST_METHOD $request_method;
3434
fastcgi_param CONTENT_TYPE $content_type;
3535
fastcgi_param CONTENT_LENGTH $content_length;
3636

37-
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
3837
fastcgi_param REQUEST_URI $request_uri;
3938
fastcgi_param DOCUMENT_URI $document_uri;
4039
fastcgi_param DOCUMENT_ROOT $document_root;
@@ -48,16 +47,6 @@ fastcgi_param SERVER_ADDR $server_addr;
4847
fastcgi_param SERVER_PORT $server_port;
4948
fastcgi_param SERVER_NAME $server_name;
5049

51-
fastcgi_param GEOIP_ADDR $remote_addr;
52-
fastcgi_param GEOIP_COUNTRY_CODE $geoip_country_code;
53-
fastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name;
54-
fastcgi_param GEOIP_REGION $geoip_region;
55-
fastcgi_param GEOIP_REGION_NAME $geoip_region_name;
56-
fastcgi_param GEOIP_CITY $geoip_city;
57-
fastcgi_param GEOIP_AREA_CODE $geoip_area_code;
58-
fastcgi_param GEOIP_LATITUDE $geoip_latitude;
59-
fastcgi_param GEOIP_LONGITUDE $geoip_longitude;
60-
fastcgi_param GEOIP_POSTAL_CODE $geoip_postal_code;
6150

6251
# PHP only, required if PHP was built with --enable-force-cgi-redirect
6352
fastcgi_param REDIRECT_STATUS 200;

‎conf/php/nginx/header.d/proxy.conf‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,4 @@ proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
2020

2121
proxy_set_header Range $slice_range;
2222

23-
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
24-
25-
proxy_set_header GEOIP-COUNTRY-CODE $geoip_country_code;
26-
proxy_set_header GEOIP-COUNTRY-CODE3 $geoip_country_code3;
27-
proxy_set_header GEOIP-COUNTRY-NAME $geoip_country_name;
28-
29-
proxy_set_header GEOIP-CITY-COUNTRY-CODE $geoip_city_country_code;
30-
proxy_set_header GEOIP-CITY-COUNTRY-CODE3 $geoip_city_country_code3;
31-
proxy_set_header GEOIP-CITY-COUNTRY-NAME $geoip_city_country_name;
32-
proxy_set_header GEOIP-REGION $geoip_region;
33-
proxy_set_header GEOIP-CITY $geoip_city;
34-
proxy_set_header GEOIP-POSTAL-CODE $geoip_postal_code;
35-
proxy_set_header GEOIP-CITY-CONTINENT-CODE $geoip_city_continent_code;
36-
proxy_set_header GEOIP-LATITUDE $geoip_latitude;
37-
proxy_set_header GEOIP-LONGITUDE $geoip_longitude;
23+
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;

0 commit comments

Comments
 (0)