diff --git a/Dockerfile b/Dockerfile index 5c5c428..c4c6c48 100644 --- a/Dockerfile +++ b/Dockerfile @@ -43,76 +43,76 @@ WORKDIR /app # Set up the app RUN set -x && \ - apt-get update && \ - # Install required distro packages - apt-get -y install nginx-light && \ - apt-get -y --no-install-recommends install \ - python3 \ - python3-setuptools \ - python3-pip \ - python3-dev \ - gcc \ - make \ - default-libmysqlclient-dev \ - libmariadb3 \ - postgresql-common \ - libpq-dev \ - libpq5 \ - libjpeg62-turbo \ - libwebp6 \ - libjpeg-dev \ - zlib1g-dev \ - libwebp-dev \ - ffmpeg \ - redis-server && \ - # Install pipenv - pip3 --disable-pip-version-check install wheel pipenv && \ - # Create a 'app' user which the application will run as - groupadd app && \ - useradd -M -d /app -s /bin/false -g app app && \ - # Install non-distro packages - pipenv install --system && \ - # Make absolutely sure we didn't accidentally bundle a SQLite dev database - rm -rf /app/db.sqlite3 && \ - # Run any required app commands - /usr/bin/python3 /app/manage.py compilescss && \ - /usr/bin/python3 /app/manage.py collectstatic --no-input --link && \ - # Create config, downloads and run dirs - mkdir -p /run/app && \ - mkdir -p /config/media && \ - mkdir -p /downloads/audio && \ - mkdir -p /downloads/video && \ - # Clean up - rm /app/Pipfile && \ - rm /app/Pipfile.lock && \ - pipenv --clear && \ - pip3 --disable-pip-version-check uninstall -y pipenv wheel virtualenv && \ - apt-get -y autoremove --purge \ - python3-pip \ - python3-dev \ - gcc \ - make \ - default-libmysqlclient-dev \ - postgresql-common \ - libpq-dev \ - libjpeg-dev \ - zlib1g-dev \ - libwebp-dev && \ - apt-get -y autoremove && \ - apt-get -y autoclean && \ - rm -rf /var/lib/apt/lists/* && \ - rm -rf /var/cache/apt/* && \ - rm -rf /tmp/* && \ - # Pipenv leaves a bunch of stuff in /root, as we're not using it recreate it - rm -rf /root && \ - mkdir -p /root && \ - chown root:root /root && \ - chmod 0700 /root + apt-get update && \ + # Install required distro packages + apt-get -y install nginx-light && \ + apt-get -y --no-install-recommends install \ + python3 \ + python3-setuptools \ + python3-pip \ + python3-dev \ + gcc \ + make \ + default-libmysqlclient-dev \ + libmariadb3 \ + postgresql-common \ + libpq-dev \ + libpq5 \ + libjpeg62-turbo \ + libwebp6 \ + libjpeg-dev \ + zlib1g-dev \ + libwebp-dev \ + ffmpeg \ + redis-server && \ + # Install pipenv + pip3 --disable-pip-version-check install wheel pipenv && \ + # Create a 'app' user which the application will run as + groupadd app && \ + useradd -M -d /app -s /bin/false -g app app && \ + # Install non-distro packages + pipenv install --system && \ + # Make absolutely sure we didn't accidentally bundle a SQLite dev database + rm -rf /app/db.sqlite3 && \ + # Run any required app commands + /usr/bin/python3 /app/manage.py compilescss && \ + /usr/bin/python3 /app/manage.py collectstatic --no-input --link && \ + # Create config, downloads and run dirs + mkdir -p /run/app && \ + mkdir -p /config/media && \ + mkdir -p /downloads/audio && \ + mkdir -p /downloads/video && \ + # Clean up + rm /app/Pipfile && \ + rm /app/Pipfile.lock && \ + pipenv --clear && \ + pip3 --disable-pip-version-check uninstall -y pipenv wheel virtualenv && \ + apt-get -y autoremove --purge \ + python3-pip \ + python3-dev \ + gcc \ + make \ + default-libmysqlclient-dev \ + postgresql-common \ + libpq-dev \ + libjpeg-dev \ + zlib1g-dev \ + libwebp-dev && \ + apt-get -y autoremove && \ + apt-get -y autoclean && \ + rm -rf /var/lib/apt/lists/* && \ + rm -rf /var/cache/apt/* && \ + rm -rf /tmp/* && \ + # Pipenv leaves a bunch of stuff in /root, as we're not using it recreate it + rm -rf /root && \ + mkdir -p /root && \ + chown root:root /root && \ + chmod 0700 /root # Append software versions RUN set -x && \ - FFMPEG_VERSION=$(/usr/bin/ffmpeg -version | head -n 1 | awk '{ print $3 }') && \ - echo "ffmpeg_version = '${FFMPEG_VERSION}'" >> /app/common/third_party_versions.py + FFMPEG_VERSION=$(/usr/bin/ffmpeg -version | head -n 1 | awk '{ print $3 }') && \ + echo "ffmpeg_version = '${FFMPEG_VERSION}'" >> /app/common/third_party_versions.py # Copy root COPY config/root / diff --git a/config/root/etc/nginx/nginx.conf b/config/root/etc/nginx/nginx.conf index 4cddd7b..407ade9 100644 --- a/config/root/etc/nginx/nginx.conf +++ b/config/root/etc/nginx/nginx.conf @@ -9,49 +9,47 @@ events { } http { + # Basic settings + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 300; + types_hash_max_size 2048; + server_tokens off; + server_names_hash_bucket_size 64; + server_name_in_redirect off; + client_body_in_file_only clean; + client_body_buffer_size 32K; + client_max_body_size 100M; + send_timeout 300s; + large_client_header_buffers 4 8k; - # Basic settings - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 300; - types_hash_max_size 2048; - server_tokens off; - server_names_hash_bucket_size 64; - server_name_in_redirect off; - client_body_in_file_only clean; - client_body_buffer_size 32K; - client_max_body_size 100M; - send_timeout 300s; - large_client_header_buffers 4 8k; + # Mime type handling + include /etc/nginx/mime.types; + default_type application/octet-stream; - # Mime type handling - include /etc/nginx/mime.types; - default_type application/octet-stream; + # Default security headers + add_header X-Frame-Options SAMEORIGIN; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; - # Default security headers - add_header X-Frame-Options SAMEORIGIN; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; + # Logging + log_format host '$remote_addr - $remote_user [$time_local] "[$host] $request" $status $bytes_sent "$http_referer" "$http_user_agent" "$gzip_ratio"'; + access_log /dev/stdout; + error_log stderr; - # Logging - log_format host '$remote_addr - $remote_user [$time_local] "[$host] $request" $status $bytes_sent "$http_referer" "$http_user_agent" "$gzip_ratio"'; - access_log /dev/stdout; - error_log stderr; - - # GZIP - gzip on; - gzip_disable "msie6"; - gzip_vary on; - gzip_proxied any; - gzip_comp_level 6; - gzip_buffers 16 8k; - gzip_http_version 1.1; - gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + # GZIP + gzip on; + gzip_disable "msie6"; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; # Site server { - # Ports listen 4848; listen [::]:4848; @@ -78,7 +76,5 @@ http { proxy_read_timeout 59; proxy_connect_timeout 10; } - } - }