edfb4c44b8
Add the building blocks the provisioning CLI renders per site. Base images (site-templates/images): - php-fpm: non-root (www-data) php:<ver>-fpm-alpine with pdo_mysql, mysqli, gd, intl, zip, opcache, exif; tuned php.ini + pool; built per PHP version. - nginx: hardened nginx:1.27-alpine with shared security + fastcgi snippets; per-site server block mounted at runtime. - build.sh: build + Trivy-scan (+ optional push) for both images. Profile templates (site-templates/profiles), Jinja2 rendered: - static, redirect (tiny nginx 301/302), custom-php (nginx + our php-fpm, optional DB), wordpress (nginx + official wordpress-fpm, DB required, upload-exec denied). Only nginx carries Traefik labels and joins proxy; php-fpm uses the private <slug>_net and joins platform only when a DB is needed. Secrets stay in a git-ignored .env, not the compose. CI: .forgejo/workflows/images.yml builds/scans images (gitleaks + Trivy). README documents the render context and the Phase 4 web-root ownership item. Templates validated: all profiles render to valid compose YAML across the database on/off branches and single/multi-domain host rules. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
600 B
Text
21 lines
600 B
Text
; heleos php-fpm pool. The container already runs as www-data (see Dockerfile
|
|
; USER), so the pool does not set user/group (it can't setuid as non-root).
|
|
[www]
|
|
listen = 9000
|
|
|
|
; Process manager — dynamic, conservative defaults for a shared host.
|
|
pm = dynamic
|
|
pm.max_children = 10
|
|
pm.start_servers = 2
|
|
pm.min_spare_servers = 1
|
|
pm.max_spare_servers = 3
|
|
pm.max_requests = 500
|
|
|
|
; Send worker stdout/stderr to the container logs.
|
|
catch_workers_output = yes
|
|
decorate_workers_output = no
|
|
clear_env = no
|
|
|
|
; Health/status endpoints (used by monitoring in Phase 6).
|
|
pm.status_path = /status
|
|
ping.path = /ping
|