#382: Updated ITK docker templates

.docker/data/README.md

@@ -0,0 +1,26 @@
+# .docker/data
+
+Please map persistent volumes to this directory on the servers.
+
+If a container needs to persist data between restarts you can map the relevant files in the container to ``docker/data/<container-name>`.
+
+## RabbitMQ example
+If you are using RabbitMQ running in a container as a message broker you need to configure a persistent volume for RabbitMQs data directory to avoid losing message on container restarts.
+
+```yaml
+# docker-compose.server.override.yml
+
+services:
+  rabbit:
+    image: rabbitmq:3.9-management-alpine
+    hostname: "${COMPOSE_PROJECT_NAME}"
+    networks:
+      - app
+      - frontend
+    environment:
+      - "RABBITMQ_DEFAULT_USER=${RABBITMQ_USER}"
+      - "RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD}"
+      - "RABBITMQ_ERLANG_COOKIE=${RABBITMQ_ERLANG_COOKIE}"
+    volumes:
+      - ".docker/data/rabbitmq:/var/lib/rabbitmq/mnesia/"
+```

.docker/nginx.conf

@@ -1,6 +1,6 @@
 worker_processes  auto;
 
-error_log  /var/log/nginx/error.log notice;
+error_log  /dev/stderr notice;
 pid        /tmp/nginx.pid;
 
 events {
@@ -26,11 +26,9 @@ http {
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
 
-    access_log  /var/log/nginx/access.log main;
+    access_log  /dev/stdout main;
 
     sendfile        on;
-    #tcp_nopush     on;
-
     keepalive_timeout  65;
 
     gzip  on;

.docker/vhost.conf → .docker/templates/default.conf.template

@@ -1,19 +1,26 @@
 server {
-    listen 8080;
+    listen ${NGINX_PORT};
     server_name localhost;
-    root /app/public;
+
+    root ${NGINX_WEB_ROOT};
 
     location / {
         # try to serve file directly, fallback to index.php
         try_files $uri /index.php$is_args$args;
     }
 
+    # Protect files and directories from prying eyes.
+    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.tar|.gz|.bz2|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
+        deny all;
+        return 404;
+    }
+
     location ~ ^/index\.php(/|$) {
         fastcgi_buffers 16 32k;
         fastcgi_buffer_size 64k;
         fastcgi_busy_buffers_size 64k;
 
-        fastcgi_pass phpfpm:9000;
+        fastcgi_pass ${NGINX_FPM_SERVICE};
         fastcgi_split_path_info ^(.+\.php)(/.*)$;
         include fastcgi_params;
 

CHANGELOG.md

@@ -36,6 +36,7 @@ See [keep a changelog] for information about writing changes to this log.
 - Added event subscriber to index content created in the UI
 - Added command to dump index to json for API fixture generation
 - Added "roles" to user create and edit forms
+- Updated ITK docker templates
 
 [keep a changelog]: https://keepachangelog.com/en/1.1.0/
 [unreleased]: https://github.com/itk-dev/event-database-imports/compare/main...develop

docker-compose.dev.yml

@@ -1,28 +1,28 @@
-# itk-version: 3.1.0
-version: "3"
-
+# itk-version: 3.2.0
+version: "3.8"
 services:
   phpfpm:
     environment:
-      - PHP_SENDMAIL_PATH=/usr/local/bin/mhsendmail --smtp-addr="mailhog:1025"
+      - PHP_SENDMAIL_PATH=/usr/sbin/sendmail -S mail:1025
 
   nginx:
     labels:
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.middlewares=ITKBasicAuth@file"
 
-  mailhog:
-    image: itkdev/mailhog
+  mail:
+    image: axllent/mailpit
+    restart: unless-stopped
     networks:
       - app
       - frontend
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}-http.rule=Host(`mailhog.${COMPOSE_SERVER_DOMAIN}`)"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}-http.entrypoints=web"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}-http.rule=Host(`mail.${COMPOSE_SERVER_DOMAIN}`)"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}-http.entrypoints=web"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}-http.middlewares=redirect-to-https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}.rule=Host(`mailhog.${COMPOSE_SERVER_DOMAIN}`)"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}.entrypoints=websecure"
-      - "traefik.http.services.mailhog_${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=8025"
-      - "traefik.http.routers.mailhog_${COMPOSE_PROJECT_NAME}.middlewares=ITKMailhogAuth@file"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}.rule=Host(`mail.${COMPOSE_SERVER_DOMAIN}`)"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}.entrypoints=websecure"
+      - "traefik.http.services.mail_${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=8025"
+      - "traefik.http.routers.mail_${COMPOSE_PROJECT_NAME}.middlewares=ITKMailhogAuth@file"

docker-compose.redirect.yml

@@ -1,5 +1,5 @@
-# itk-version: 3.1.0
-version: "3"
+# itk-version: 3.2.0
+version: "3.8"
 
 services:
   nginx:

docker-compose.server.yml

@@ -1,5 +1,5 @@
-# itk-version: 3.1.0
-version: "3"
+# itk-version: 3.2.0
+version: "3.8"
 
 networks:
   frontend:
@@ -31,12 +31,14 @@ services:
       - frontend
     depends_on:
       - phpfpm
-    ports:
-      - '8080'
     volumes:
-      - ./.docker/vhost.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./.docker/templates:/etc/nginx/templates:ro
       - ./.docker/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./:/app:rw
+      - .:/app
+    environment:
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_WEB_ROOT: /app/public
+      NGINX_PORT: 8080
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"

docker-compose.yml

@@ -1,5 +1,5 @@
-# itk-version: 3.1.0
-version: "3"
+# itk-version: 3.2.0
+version: "3.8"
 
 networks:
   frontend:
@@ -32,8 +32,8 @@ services:
       - PHP_XDEBUG_MODE=${PHP_XDEBUG_MODE:-off}
       - PHP_MAX_EXECUTION_TIME=30
       - PHP_MEMORY_LIMIT=256M
-      # Uncomment below to enable mailhog.
-      # - PHP_SENDMAIL_PATH=/usr/local/bin/mhsendmail --smtp-addr="mailhog:1025"
+      # Depending on the setup, you may have to remove --read-envelope-from from msmtp (cf. https://marlam.de/msmtp/msmtp.html) or use SMTP to send mail
+      - PHP_SENDMAIL_PATH=/usr/bin/msmtp --host=mail --port=1025 --read-recipients --read-envelope-from
       - DOCKER_HOST_DOMAIN=${COMPOSE_DOMAIN}
       - COMPOSER_VERSION=2
       - PHP_IDE_CONFIG=serverName=localhost
@@ -52,8 +52,12 @@ services:
     ports:
       - '8080'
     volumes:
-      - ./.docker/vhost.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./.docker/templates:/etc/nginx/templates:ro
       - .:/app
+    environment:
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_WEB_ROOT: /app/public
+      NGINX_PORT: 8080
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"
@@ -62,8 +66,8 @@ services:
 #      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.middlewares=redirect-to-https"
 #      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
-  mailhog:
-    image: itkdev/mailhog
+  mail:
+    image: axllent/mailpit
     networks:
       - app
       - frontend
@@ -73,5 +77,5 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"
-      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}Mailhog.rule=Host(`mailhog-${COMPOSE_DOMAIN}`)"
-      - "traefik.http.services.${COMPOSE_PROJECT_NAME}Mailhog.loadbalancer.server.port=8025"
+      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}mail.rule=Host(`mail-${COMPOSE_DOMAIN}`)"
+      - "traefik.http.services.${COMPOSE_PROJECT_NAME}mail.loadbalancer.server.port=8025"