Skip to content

Commit 3ea6016

Browse files
author
lillian
committed
stuff
0 parents  commit 3ea6016

File tree

6 files changed

+260
-0
lines changed

6 files changed

+260
-0
lines changed

‎.github/workflows/wordpress.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Build debug Docker image
2+
3+
on:
4+
- push
5+
- pull_request
6+
7+
jobs:
8+
deploy:
9+
runs-on: ubuntu-latest
10+
if: github.repository == 'hacklabto/web-infra'
11+
steps:
12+
- uses: docker/login-action@v1
13+
with:
14+
registry: ghcr.io
15+
username: ${{ github.actor }}
16+
password: ${{ secrets.GITHUB_TOKEN }}
17+
- uses: actions/checkout@v3
18+
- run: echo "BRANCH_NAME=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
19+
- uses: docker/build-push-action@v2
20+
with:
21+
# https://github.com/docker/build-push-action/issues/378
22+
context: wordpress/
23+
file: Dockerfile
24+
push: true
25+
tags: |
26+
ghcr.io/hacklabto/wordpress:${{ github.sha }}
27+
cache-from: type=registry,ref=ghcr.io/hacklabto/wordpress:${{ env.BRANCH_NAME }}
28+
cache-to: type=inline

‎hosts/www.hacklab.to/lighttpd.conf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
auth.backend = "ldap"
2+
auth.backend.ldap.hostname = "localhost"
3+
auth.backend.ldap.base-dn = "ou=people,dc=hacklab,dc=to"
4+
auth.backend.ldap.filter = "(uid=$)"
5+
6+
var.log_root = "/var/log/lighttpd"
7+
var.server_root = "/var/www"
8+
var.state_dir = "/run/lighttpd"
9+
var.home_dir = "/var/lib/lighttpd"
10+
var.conf_dir = "/etc/lighttpd"
11+
var.vhosts_dir = server_root + "/vhosts"
12+
var.cache_dir = "/var/cache/lighttpd"
13+
var.socket_dir = home_dir + "/sockets"
14+
15+
server.port = 8008
16+
server.use-ipv6 = "enable"
17+
server.bind = "[::1]"
18+
19+
server.username = "lighttpd"
20+
server.groupname = "lighttpd"
21+
22+
server.pid-file = state_dir + "/lighttpd.pid"
23+
server.errorlog = log_root + "/error.log"
24+
25+
server.modules = (
26+
"mod_access",
27+
"mod_auth",
28+
"mod_proxy",
29+
"mod_openssl",
30+
"mod_authn_ldap",
31+
"mod_accesslog"
32+
)
33+
34+
accesslog.filename = log_root + "/access.log"
35+
36+
$HTTP["host"] =~ "^wiki\.hacklab\.to$" {
37+
server.modules += ( "mod_proxy" )
38+
proxy.server = ( "" => (( "host" => "::1", "port" => 18881 )))
39+
auth.require = ( "/" => ( "method" => "basic", "realm" => "Hacklab.to", "require" => "valid-user" ))
40+
}

‎hosts/www.hacklab.to/nginx-tls-deploy.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/sh
2+
3+
nginx-tls-deploy.sh_deploy() {
4+
cp -r /root/.acme.sh/hacklab.to_ecc/ /etc/nginx/tls/hacklab.to/
5+
chown -R nginx:nginx /etc/nginx/tls/
6+
nginx -s reload
7+
}

‎hosts/www.hacklab.to/nginx.conf

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
user nginx;
2+
worker_processes auto;
3+
error_log /var/log/nginx/error.log;
4+
pid /run/nginx.pid;
5+
6+
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
7+
include /usr/share/nginx/modules/*.conf;
8+
9+
events {
10+
worker_connections 1024;
11+
}
12+
13+
http {
14+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
15+
'$status $body_bytes_sent "$http_referer" '
16+
'"$http_user_agent" "$http_x_forwarded_for"';
17+
18+
access_log /var/log/nginx/access.log main;
19+
20+
sendfile on;
21+
tcp_nopush on;
22+
tcp_nodelay on;
23+
keepalive_timeout 65;
24+
types_hash_max_size 4096;
25+
26+
include /etc/nginx/mime.types;
27+
default_type application/octet-stream;
28+
29+
server {
30+
listen 204.225.106.9:80;
31+
# we don't have ipv6 on www right now
32+
# listen [::]:80;
33+
server_name _;
34+
35+
return 301 https://$host$request_uri;
36+
}
37+
38+
server {
39+
listen 204.225.106.9:443 ssl;
40+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
41+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
42+
43+
server_name _;
44+
return 444;
45+
}
46+
47+
server {
48+
listen 204.225.106.9:443 ssl;
49+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
50+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
51+
52+
server_name hacklab.to;
53+
location / {
54+
proxy_set_header X-Forwarded-Proto $scheme;
55+
proxy_set_header Host hacklab.to;
56+
proxy_pass http://[::1]:18883;
57+
}
58+
}
59+
60+
server {
61+
listen 204.225.106.9:443 ssl;
62+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
63+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
64+
65+
server_name www.hacklab.to;
66+
location / {
67+
proxy_set_header X-Forwarded-Proto $scheme;
68+
proxy_set_header Host hacklab.to;
69+
proxy_pass http://[::1]:18883;
70+
}
71+
}
72+
73+
server {
74+
listen 204.225.106.9:443 ssl;
75+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
76+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
77+
78+
server_name wiki.hacklab.to;
79+
location / {
80+
proxy_set_header X-Forwarded-Proto $scheme;
81+
proxy_set_header Host wiki.hacklab.to;
82+
proxy_pass http://[::1]:8008;
83+
}
84+
}
85+
86+
server {
87+
listen 204.225.106.9:443 ssl;
88+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
89+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
90+
91+
server_name knowledge.hacklab.to;
92+
location / {
93+
proxy_set_header X-Forwarded-Proto $scheme;
94+
proxy_set_header Host knowledge.hacklab.to;
95+
proxy_pass http://[::1]:18882;
96+
}
97+
}
98+
99+
server {
100+
listen 204.225.106.9:443 ssl;
101+
ssl_certificate /etc/nginx/tls/hacklab.to/fullchain.cer;
102+
ssl_certificate_key /etc/nginx/tls/hacklab.to/hacklab.to.key;
103+
104+
server_name members.hacklab.to;
105+
return 503;
106+
}
107+
}

‎wordpress/Dockerfile

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
FROM alpine:latest
2+
3+
RUN apk add unit-php82 php82-ldap php82-mysqli zip curl
4+
5+
WORKDIR /app
6+
7+
# Unit entrypoint, but config is in /app/config instead of /docker-entrypoint.d
8+
RUN wget https://raw.githubusercontent.com/nginx/unit/d48180190752201865f41b2cf1e0a6740fa2ea59/pkg/docker/docker-entrypoint.sh
9+
RUN sed -i 's/docker-entrypoint\.d/app\/config/g' docker-entrypoint.sh
10+
RUN chmod +x docker-entrypoint.sh
11+
12+
RUN wget -O - https://wordpress.org/wordpress-6.4.2.tar.gz | tar xz
13+
14+
# akismet is preinstalled, although maybe we will want to download a specific version of it at some point
15+
RUN (cd wordpress/wp-content/plugins && wget -O - https://downloads.wordpress.org/plugin/contact-form-7.5.8.5.zip | zip -r)
16+
RUN (cd wordpress/wp-content/plugins && wget -O - https://downloads.wordpress.org/plugin/flamingo.2.4.zip | zip -r)
17+
RUN (cd wordpress/wp-content/plugins && wget -O - https://downloads.wordpress.org/plugin/wp-security-audit-log.zip | zip -r)
18+
RUN (cd wordpress/wp-content/plugins && wget -O - https://downloads.wordpress.org/plugin/wpdirauth.1.10.7.zip | zip -r)
19+
20+
# add
21+
22+
WORKDIR /app/config
23+
COPY config.json .
24+
25+
# mount /app/wordpress/wp-config.php:ro
26+
# mount /app/wordpress/wp-content/uploads/:rw
27+
28+
CMD [ "/app/docker-entrypoint.sh", "unitd", "--no-daemon", "--user", "nobody", "--group", "nobody" ]

‎wordpress/config.json

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"listeners": {
3+
"0.0.0.0:8080": {
4+
"pass": "routes/wordpress"
5+
}
6+
},
7+
8+
"routes": {
9+
"wordpress": [
10+
{
11+
"match": {
12+
"uri": [
13+
"*.php",
14+
"*.php/*",
15+
"/wp-admin/",
16+
"/wp-content/"
17+
]
18+
},
19+
20+
"action": {
21+
"pass": "applications/wordpress/direct"
22+
}
23+
},
24+
{
25+
"action": {
26+
"share": "/app/wordpress$uri",
27+
"fallback": {
28+
"pass": "applications/wordpress/index"
29+
}
30+
}
31+
}
32+
]
33+
},
34+
35+
"applications": {
36+
"wordpress": {
37+
"type": "php",
38+
"targets": {
39+
"direct": {
40+
"root": "/app/wordpress/"
41+
},
42+
43+
"index": {
44+
"root": "/app/wordpress/",
45+
"script": "index.php"
46+
}
47+
}
48+
}
49+
}
50+
}

0 commit comments

Comments
 (0)