edfb4c44b8
Add the building blocks the provisioning CLI renders per site. Base images (site-templates/images): - php-fpm: non-root (www-data) php:<ver>-fpm-alpine with pdo_mysql, mysqli, gd, intl, zip, opcache, exif; tuned php.ini + pool; built per PHP version. - nginx: hardened nginx:1.27-alpine with shared security + fastcgi snippets; per-site server block mounted at runtime. - build.sh: build + Trivy-scan (+ optional push) for both images. Profile templates (site-templates/profiles), Jinja2 rendered: - static, redirect (tiny nginx 301/302), custom-php (nginx + our php-fpm, optional DB), wordpress (nginx + official wordpress-fpm, DB required, upload-exec denied). Only nginx carries Traefik labels and joins proxy; php-fpm uses the private <slug>_net and joins platform only when a DB is needed. Secrets stay in a git-ignored .env, not the compose. CI: .forgejo/workflows/images.yml builds/scans images (gitleaks + Trivy). README documents the render context and the Phase 4 web-root ownership item. Templates validated: all profiles render to valid compose YAML across the database on/off branches and single/multi-domain host rules. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
22 lines
629 B
INI
22 lines
629 B
INI
; heleos php defaults. Sites may override via a mounted conf.d snippet.
|
|
expose_php = Off
|
|
memory_limit = 256M
|
|
upload_max_filesize = 64M
|
|
post_max_size = 66M
|
|
max_execution_time = 60
|
|
max_input_vars = 3000
|
|
date.timezone = UTC
|
|
|
|
; OPcache — tuned for typical PHP/WordPress workloads.
|
|
opcache.enable = 1
|
|
opcache.enable_cli = 0
|
|
opcache.memory_consumption = 128
|
|
opcache.interned_strings_buffer = 16
|
|
opcache.max_accelerated_files = 10000
|
|
opcache.revalidate_freq = 2
|
|
opcache.validate_timestamps = 1
|
|
|
|
; Do not leak errors to visitors (log to stderr → container logs → Loki).
|
|
display_errors = Off
|
|
log_errors = On
|
|
error_log = /dev/stderr
|