github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

feat: add proper openresty support

Browse Source 
This change allows supporting the openresty package as installed on Ubuntu 18.04 from the official openresty package repository, while also returning general nginx support.

Closes #3675
This commit is contained in:
Jose Diaz-Gonzalez
2019-09-16 03:05:35 -04:00
parent dd2bbc7722
commit 6e3fddb544
8 changed files with 183 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
plugins/nginx-vhosts/install
View File

@@ -3,41 +3,58 @@ set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/config/functions"
source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
NGINX_BIN="$(fn-nginx-vhosts-nginx-location)"
NGINX_ROOT="/etc/nginx"
NGINX_LOG_ROOT="/var/log/nginx"
NGINX_INIT_NAME="nginx"
NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-nginx"
if fn-nginx-vhosts-uses-openresty; then
NGINX_ROOT="/usr/local/openresty/nginx/conf"
NGINX_LOG_ROOT="/var/log/openresty"
NGINX_INIT_NAME="openresty"
NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-openresty"
fi
case "$DOKKU_DISTRO" in
debian)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d $NGINX_INIT_NAME reload, $NGINX_BIN -t, ${NGINX_BIN} -t -c *" >"$NGINX_SUDOERS_FILE"
;;
ubuntu)
echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
if [[ -x /usr/bin/sv ]]; then
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/sv reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
else
echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/$NGINX_INIT_NAME reload, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
fi
;;
opensuse)
echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service $NGINX_INIT_NAME reload, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
;;
arch)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
;;
centos | rhel)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "Defaults:dokku !requiretty" >>/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
echo "Defaults:dokku !requiretty" >>"$NGINX_SUDOERS_FILE"
;;
esac
chmod 0440 /etc/sudoers.d/dokku-nginx
chmod 0440 "$NGINX_SUDOERS_FILE"
# if dhparam.pem has not been created, create it the first time
if [[ ! -f /etc/nginx/dhparam.pem ]]; then
openssl dhparam -out /etc/nginx/dhparam.pem 2048
if [[ ! -f "$NGINX_ROOT/dhparam.pem" ]]; then
openssl dhparam -out "$NGINX_ROOT/dhparam.pem" 2048
fi
mkdir -p /etc/nginx/conf.d
chown root:root /etc/nginx/dhparam.pem
chown root:root /etc/nginx/conf.d
cat <<EOF >/etc/nginx/conf.d/dokku.conf
mkdir -p "$NGINX_ROOT/conf.d"
chown root:root "$NGINX_ROOT/dhparam.pem"
chown root:root "$NGINX_ROOT/conf.d"
cat <<EOF >"$NGINX_ROOT/conf.d/dokku.conf"
include $DOKKU_ROOT/*/nginx.conf;
server_tokens off;
@@ -47,19 +64,20 @@ ssl_session_cache shared:SSL:20m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_dhparam $NGINX_ROOT/dhparam.pem;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
EOF
# allow users to override their server_names_hash_bucket_size
if [[ ! -f /etc/nginx/conf.d/server_names_hash_bucket_size.conf ]]; then
echo 'server_names_hash_bucket_size 512;' >|/etc/nginx/conf.d/server_names_hash_bucket_size.conf
if [[ ! -f "$NGINX_ROOT/conf.d/server_names_hash_bucket_size.conf" ]]; then
echo 'server_names_hash_bucket_size 512;' >|"$NGINX_ROOT/conf.d/server_names_hash_bucket_size.conf"
fi
# revert dokku group changes
mkdir -p "$NGINX_LOG_ROOT"
gpasswd -a dokku adm
chgrp --quiet -R adm /var/log/nginx
chgrp --quiet -R adm "$NGINX_LOG_ROOT"
gpasswd -M "$(egrep ^dokku: /etc/group | awk -F ":" '{ print $4 }')" dokku
[[ -f /etc/logrotate.d/nginx ]] && sed -i -e 's/create 0640 www-data dokku/create 0640 www-data adm/g' /etc/logrotate.d/nginx
@@ -93,24 +111,9 @@ for app in $(dokku_apps); do
fi
done
case "$DOKKU_DISTRO" in
debian)
NGINX_INIT="/usr/sbin/invoke-rc.d"
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
;;
ubuntu)
NGINX_INIT="/etc/init.d/nginx"
"$NGINX_INIT" start || "$NGINX_INIT" reload
;;
opensuse)
NGINX_INIT="/sbin/service"
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
;;
arch | centos | rhel)
NGINX_INIT="/usr/bin/systemctl"
"$NGINX_INIT" start nginx || "$NGINX_INIT" reload nginx
;;
esac
# avoid failing runit init calls on install
# the runit binaries are not yet available during dockerfile building
# and therefore both these calls will fail
if [[ ! -x /usr/bin/sv ]]; then
fn-nginx-vhosts-nginx-init-cmd start || fn-nginx-vhosts-nginx-init-cmd reload
fi