diff --git a/cluster/image/pro_seafile_7.1/Dockerfile b/cluster/image/pro_seafile_7.1/Dockerfile index e69de29..3a71516 100644 --- a/cluster/image/pro_seafile_7.1/Dockerfile +++ b/cluster/image/pro_seafile_7.1/Dockerfile @@ -0,0 +1,71 @@ +# See https://hub.docker.com/r/phusion/baseimage/tags/ +FROM phusion/baseimage:0.11 +ENV SEAFILE_SERVER=seafile-pro-server SEAFILE_VERSION= + +RUN apt-get update --fix-missing + +# Utility tools +RUN apt-get install -y vim htop net-tools psmisc wget curl git + +# For suport set local time zone. +RUN export DEBIAN_FRONTEND=noninteractive && apt-get install tzdata -y + +# Nginx +RUN apt-get install -y nginx + +# Java +RUN apt-get install -y openjdk-8-jre + +# Libreoffice +RUN apt-get install -y libreoffice libreoffice-script-provider-python libsm-dev +RUN apt-get install -y ttf-wqy-microhei ttf-wqy-zenhei xfonts-wqy + +# Tools +RUN apt-get install -y zlib1g-dev pwgen openssl poppler-utils + + +# Python3 +RUN apt-get install -y python3 python3-pip python3-setuptools python3-ldap python-rados +RUN python3.6 -m pip install --upgrade pip && rm -r /root/.cache/pip + +RUN pip3 install --timeout=3600 click termcolor colorlog pymysql \ + django==1.11.29 && rm -r /root/.cache/pip + +RUN pip3 install --timeout=3600 Pillow pylibmc captcha jinja2 \ + sqlalchemy django-pylibmc django-simple-captcha && \ + rm -r /root/.cache/pip + +RUN pip3 install --timeout=3600 boto oss2 pycryptodome twilio python-ldap configparser psd-tools && \ + rm -r /root/.cache/pip + + +# Scripts +COPY scripts_7.1 /scripts +COPY templates /templates +COPY services /services +RUN chmod u+x /scripts/* + +RUN mkdir -p /etc/my_init.d && \ + rm -f /etc/my_init.d/* && \ + cp /scripts/create_data_links.sh /etc/my_init.d/01_create_data_links.sh + +RUN mkdir -p /etc/service/nginx && \ + rm -f /etc/nginx/sites-enabled/* /etc/nginx/conf.d/* && \ + mv /services/nginx.conf /etc/nginx/nginx.conf && \ + mv /services/nginx.sh /etc/service/nginx/run + + +# Seafile +WORKDIR /opt/seafile + +RUN mkdir -p /opt/seafile/ && cd /opt/seafile/ && \ + wget -O seafile-pro-server_${SEAFILE_VERSION}_x86-64_Ubuntu.tar.gz \ + "https://download.seafile.com/d/6e5297246c/files/?p=/pro/seafile-pro-server_${SEAFILE_VERSION}_x86-64_Ubuntu.tar.gz&dl=1" && \ + tar -zxvf seafile-pro-server_${SEAFILE_VERSION}_x86-64_Ubuntu.tar.gz && \ + rm -f seafile-pro-server_${SEAFILE_VERSION}_x86-64_Ubuntu.tar.gz + + +EXPOSE 80 + + +CMD ["/sbin/my_init", "--", "/scripts/start.py"] diff --git a/cluster/image/pro_seafile_7.1/services/nginx.conf b/cluster/image/pro_seafile_7.1/services/nginx.conf new file mode 100644 index 0000000..c2a6b12 --- /dev/null +++ b/cluster/image/pro_seafile_7.1/services/nginx.conf @@ -0,0 +1,33 @@ +daemon off; +user www-data; +worker_processes auto; + +events { + worker_connections 768; +} + +http { + include /etc/nginx/mime.types; + server_names_hash_bucket_size 256; + server_names_hash_max_size 1024; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log info; + + gzip on; + gzip_types text/plain text/css application/javascript application/json text/javascript; + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; + + server { + listen 80; + location / { + return 444; + } + } +} diff --git a/cluster/image/pro_seafile_7.1/services/nginx.sh b/cluster/image/pro_seafile_7.1/services/nginx.sh new file mode 100755 index 0000000..21060ee --- /dev/null +++ b/cluster/image/pro_seafile_7.1/services/nginx.sh @@ -0,0 +1,3 @@ +#!/bin/bash +exec 2>&1 +exec /usr/sbin/nginx diff --git a/cluster/image/pro_seafile_7.1/templates/letsencrypt.cron.template b/cluster/image/pro_seafile_7.1/templates/letsencrypt.cron.template new file mode 100644 index 0000000..cd877b6 --- /dev/null +++ b/cluster/image/pro_seafile_7.1/templates/letsencrypt.cron.template @@ -0,0 +1,3 @@ +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin +# min hour dayofmonth month dayofweek command +0 0 1 * * root /scripts/ssl.sh {{ ssl_dir }} {{ domain }} diff --git a/cluster/image/pro_seafile_7.1/templates/seafile.nginx.conf.template b/cluster/image/pro_seafile_7.1/templates/seafile.nginx.conf.template new file mode 100644 index 0000000..cbbbf76 --- /dev/null +++ b/cluster/image/pro_seafile_7.1/templates/seafile.nginx.conf.template @@ -0,0 +1,82 @@ +# -*- mode: nginx -*- +# Auto generated at {{ current_timestr }} +{% if https -%} +server { + listen 80; + server_name _ default_server; + rewrite ^ https://{{ domain }}$request_uri? permanent; +} +{% endif -%} + +server { +{% if https -%} + listen 443; + ssl on; + ssl_certificate /shared/ssl/{{ domain }}.crt; + ssl_certificate_key /shared/ssl/{{ domain }}.key; + + ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS; + + # TODO: More SSL security hardening: ssl_session_tickets & ssl_dhparam + # ssl_session_tickets on; + # ssl_session_ticket_key /etc/nginx/sessionticket.key; + # ssl_session_cache shared:SSL:10m; + # ssl_session_timeout 10m; +{% else -%} + listen 80; +{% endif -%} + + server_name {{ domain }}; + + client_max_body_size 10m; + + location / { + proxy_pass http://127.0.0.1:8000/; + proxy_read_timeout 310s; + proxy_set_header Host $host; + proxy_set_header Forwarded "for=$remote_addr;proto=$scheme"; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Connection ""; + proxy_http_version 1.1; + } + + location /seafhttp { + rewrite ^/seafhttp(.*)$ $1 break; + proxy_pass http://127.0.0.1:8082; + client_max_body_size 0; + proxy_connect_timeout 36000s; + proxy_read_timeout 36000s; + proxy_request_buffering off; + } + + location /seafdav { + client_max_body_size 0; + fastcgi_pass 127.0.0.1:8080; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_script_name; + + fastcgi_param SERVER_PROTOCOL $server_protocol; + fastcgi_param QUERY_STRING $query_string; + fastcgi_param REQUEST_METHOD $request_method; + fastcgi_param CONTENT_TYPE $content_type; + fastcgi_param CONTENT_LENGTH $content_length; + fastcgi_param SERVER_ADDR $server_addr; + fastcgi_param SERVER_PORT $server_port; + fastcgi_param SERVER_NAME $server_name; + + access_log /var/log/nginx/seafdav.access.log; + error_log /var/log/nginx/seafdav.error.log; + } + + location /media { + root /opt/seafile/seafile-server-latest/seahub; + } + + # For letsencrypt + location /.well-known/acme-challenge/ { + alias /var/www/challenges/; + try_files $uri =404; + } +}