add source code and readme
This commit is contained in:
50
build/bookwyrm/bookwyrm-web/Dockerfile
Normal file
50
build/bookwyrm/bookwyrm-web/Dockerfile
Normal file
@@ -0,0 +1,50 @@
|
||||
# BookWyrm Web Container - Production Optimized
|
||||
# Nginx + Django/Gunicorn web server
|
||||
|
||||
FROM bookwyrm-base AS bookwyrm-web
|
||||
|
||||
# Switch to root for system package installation
|
||||
USER root
|
||||
|
||||
# Install nginx and supervisor with minimal footprint
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
nginx-light \
|
||||
supervisor \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& apt-get clean \
|
||||
&& apt-get autoremove -y
|
||||
|
||||
# Install Gunicorn in virtual environment
|
||||
RUN /opt/venv/bin/pip install --no-cache-dir gunicorn
|
||||
|
||||
# Copy configuration files
|
||||
COPY nginx.conf /etc/nginx/nginx.conf
|
||||
COPY supervisord-web.conf /etc/supervisor/conf.d/supervisord.conf
|
||||
COPY entrypoint-web.sh /entrypoint.sh
|
||||
|
||||
# Create necessary directories and set permissions efficiently
|
||||
# Logs go to stdout/stderr, so only create cache and temp directories
|
||||
RUN chmod +x /entrypoint.sh \
|
||||
&& mkdir -p /var/cache/nginx /var/lib/nginx \
|
||||
&& mkdir -p /tmp/nginx_client_temp /tmp/nginx_proxy_temp /tmp/nginx_fastcgi_temp /tmp/nginx_uwsgi_temp /tmp/nginx_scgi_temp /tmp/nginx_cache \
|
||||
&& chown -R www-data:www-data /var/cache/nginx /var/lib/nginx \
|
||||
&& chown -R bookwyrm:bookwyrm /app \
|
||||
&& chmod 755 /tmp/nginx_*
|
||||
|
||||
# Clean up nginx default files to reduce image size
|
||||
RUN rm -rf /var/www/html \
|
||||
&& rm -f /etc/nginx/sites-enabled/default \
|
||||
&& rm -f /etc/nginx/sites-available/default
|
||||
|
||||
# Expose HTTP port
|
||||
EXPOSE 80
|
||||
|
||||
# Health check optimized for web container
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
|
||||
CMD curl -f http://localhost:80/health/ || curl -f http://localhost:80/ || exit 1
|
||||
|
||||
# Run as root to manage nginx and gunicorn via supervisor
|
||||
USER root
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
CMD ["supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
|
||||
52
build/bookwyrm/bookwyrm-web/entrypoint-web.sh
Normal file
52
build/bookwyrm/bookwyrm-web/entrypoint-web.sh
Normal file
@@ -0,0 +1,52 @@
|
||||
#!/bin/bash
|
||||
# BookWyrm Web Container Entrypoint
|
||||
# Simplified - init containers handle database/migrations
|
||||
|
||||
set -e
|
||||
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Starting BookWyrm Web Container..."
|
||||
|
||||
# Only handle web-specific tasks (database/migrations handled by init containers)
|
||||
|
||||
# Compile themes FIRST - must happen before static file collection
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Checking if theme compilation is needed..."
|
||||
if [ "${FORCE_COMPILE_THEMES:-false}" = "true" ] || [ ! -f "/tmp/.themes_compiled" ]; then
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Compiling themes..."
|
||||
if python manage.py compile_themes; then
|
||||
touch /tmp/.themes_compiled
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Theme compilation completed successfully"
|
||||
else
|
||||
echo "WARNING: Theme compilation failed"
|
||||
fi
|
||||
else
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Themes already compiled, skipping (set FORCE_COMPILE_THEMES=true to force)"
|
||||
fi
|
||||
|
||||
# Collect static files AFTER theme compilation - includes compiled CSS files
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Checking if static files collection is needed..."
|
||||
if [ "${FORCE_COLLECTSTATIC:-false}" = "true" ] || [ ! -f "/tmp/.collectstatic_done" ]; then
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Collecting static files to S3..."
|
||||
if python manage.py collectstatic --noinput --clear; then
|
||||
touch /tmp/.collectstatic_done
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Static files collection completed successfully"
|
||||
else
|
||||
echo "WARNING: Static files collection to S3 failed"
|
||||
fi
|
||||
else
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Static files already collected, skipping (set FORCE_COLLECTSTATIC=true to force)"
|
||||
fi
|
||||
|
||||
# Ensure nginx configuration is valid
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Validating Nginx configuration..."
|
||||
nginx -t
|
||||
|
||||
# Clean up any stale supervisor sockets and pid files
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Cleaning up stale supervisor files..."
|
||||
rm -f /tmp/bookwyrm-web-supervisor.sock
|
||||
rm -f /tmp/supervisord-web.pid
|
||||
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] BookWyrm web container initialization completed"
|
||||
echo "[$(date +'%Y-%m-%d %H:%M:%S')] Starting web services..."
|
||||
|
||||
# Execute the provided command (usually supervisord)
|
||||
exec "$@"
|
||||
123
build/bookwyrm/bookwyrm-web/nginx.conf
Normal file
123
build/bookwyrm/bookwyrm-web/nginx.conf
Normal file
@@ -0,0 +1,123 @@
|
||||
# BookWyrm Nginx Configuration
|
||||
# Optimized for Kubernetes deployment with internal service routing
|
||||
|
||||
# No user directive needed for non-root containers
|
||||
worker_processes auto;
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
# Basic Settings
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
client_max_body_size 10M; # Match official BookWyrm config
|
||||
|
||||
# Use /tmp for nginx temporary directories (non-root container)
|
||||
client_body_temp_path /tmp/nginx_client_temp;
|
||||
proxy_temp_path /tmp/nginx_proxy_temp;
|
||||
fastcgi_temp_path /tmp/nginx_fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/nginx_uwsgi_temp;
|
||||
scgi_temp_path /tmp/nginx_scgi_temp;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# BookWyrm-specific caching configuration
|
||||
proxy_cache_path /tmp/nginx_cache keys_zone=bookwyrm_cache:20m loader_threshold=400 loader_files=400 max_size=400m;
|
||||
proxy_cache_key $scheme$proxy_host$uri$is_args$args$http_accept;
|
||||
|
||||
# Logging - Send to stdout/stderr for Kubernetes
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /dev/stdout main;
|
||||
error_log /dev/stderr warn;
|
||||
|
||||
# Gzip Settings
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_types
|
||||
text/plain
|
||||
text/css
|
||||
text/xml
|
||||
text/javascript
|
||||
application/json
|
||||
application/javascript
|
||||
application/xml+rss
|
||||
application/atom+xml
|
||||
application/activity+json
|
||||
application/ld+json
|
||||
image/svg+xml;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
# Security headers
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
|
||||
# Health check endpoint
|
||||
location /health/ {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
|
||||
# ActivityPub and federation endpoints
|
||||
location ~ ^/(inbox|user/.*/inbox|api|\.well-known) {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https; # Force HTTPS scheme
|
||||
|
||||
# Increase timeouts for federation/API processing
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# Main application (simplified - no aggressive caching for user content)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https; # Force HTTPS scheme
|
||||
|
||||
# Standard timeouts
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_send_timeout 30s;
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
|
||||
# WebSocket support for real-time features
|
||||
location /ws/ {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
|
||||
# WebSocket timeouts
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
}
|
||||
}
|
||||
45
build/bookwyrm/bookwyrm-web/supervisord-web.conf
Normal file
45
build/bookwyrm/bookwyrm-web/supervisord-web.conf
Normal file
@@ -0,0 +1,45 @@
|
||||
[supervisord]
|
||||
nodaemon=true
|
||||
logfile=/dev/stdout
|
||||
logfile_maxbytes=0
|
||||
pidfile=/tmp/supervisord-web.pid
|
||||
silent=false
|
||||
|
||||
[unix_http_server]
|
||||
file=/tmp/bookwyrm-web-supervisor.sock
|
||||
chmod=0700
|
||||
|
||||
[supervisorctl]
|
||||
serverurl=unix:///tmp/bookwyrm-web-supervisor.sock
|
||||
|
||||
[rpcinterface:supervisor]
|
||||
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
|
||||
|
||||
# Nginx web server
|
||||
[program:nginx]
|
||||
command=nginx -g 'daemon off;'
|
||||
autostart=true
|
||||
autorestart=true
|
||||
startsecs=5
|
||||
stdout_logfile=/dev/stdout
|
||||
stdout_logfile_maxbytes=0
|
||||
stderr_logfile=/dev/stderr
|
||||
stderr_logfile_maxbytes=0
|
||||
|
||||
# BookWyrm Django application via Gunicorn
|
||||
[program:bookwyrm-web]
|
||||
command=gunicorn --bind 127.0.0.1:8000 --workers 4 --worker-class sync --timeout 120 --max-requests 1000 --max-requests-jitter 100 --access-logfile - --error-logfile - --log-level info bookwyrm.wsgi:application
|
||||
directory=/app
|
||||
user=bookwyrm
|
||||
autostart=true
|
||||
autorestart=true
|
||||
startsecs=10
|
||||
startretries=3
|
||||
stdout_logfile=/dev/stdout
|
||||
stdout_logfile_maxbytes=0
|
||||
stderr_logfile=/dev/stderr
|
||||
stderr_logfile_maxbytes=0
|
||||
environment=PATH="/opt/venv/bin:/usr/local/bin:/usr/bin:/bin",CONTAINER_TYPE="web"
|
||||
|
||||
# Log rotation no longer needed since logs go to stdout/stderr
|
||||
# Kubernetes handles log rotation automatically
|
||||
Reference in New Issue
Block a user