Skip to content

Commit e7eecf2

Browse files
azulazul
authored
Merge pull request #345 from nextcloud/add/shallow-server
Add shallow server using --depth 1 in git clone
2 parents 1539938 + a0bb49b commit e7eecf2

File tree

10 files changed

+226
-0
lines changed

10 files changed

+226
-0
lines changed

‎shallow-server/Dockerfile

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
FROM debian:stable
2+
3+
# Update repos install packages and cleanup
4+
# all in one step so we avoid large intermediate layers.
5+
RUN apt-get update && \
6+
apt-get install -y wget gnupg2 git libzip4 apt-transport-https lsb-release ca-certificates && \
7+
wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg && \
8+
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list && \
9+
apt-get update && \
10+
apt-get install -y php7.3-cli php7.3-common php7.3-mbstring \
11+
php7.3-gd php-imagick php7.3-intl php7.3-bz2 php7.3-xml \
12+
php7.3-mysql php7.3-zip php7.3-dev curl php7.3-curl \
13+
php-dompdf php-apcu redis-server php-redis php-smbclient \
14+
php7.3-ldap unzip php7.3-pgsql php7.3-sqlite make apache2 \
15+
php7.3-json php7.3-opcache libmagickcore-6.q16-2-extra \
16+
libapache2-mod-php7.3 && \
17+
apt-get autoremove -y && apt-get autoclean && apt-get clean && \
18+
rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/*
19+
20+
COPY opcache-recommended.ini /usr/local/etc/php/conf.d/
21+
22+
WORKDIR /var/www/html
23+
24+
RUN rm -rf /var/www/html
25+
RUN mkdir -p /var/www/html
26+
27+
RUN git clone --depth 1 https://github.com/nextcloud/server.git .
28+
RUN git submodule update --init
29+
30+
RUN chown -R www-data:www-data .
31+
RUN chsh -s /bin/bash www-data
32+
33+
ADD initnc.sh /usr/local/bin/
34+
ADD run.sh /usr/local/bin/
35+
ADD initAndRun.sh /usr/local/bin/
36+
37+
# self signed cert
38+
ADD ssl/dhparam.pem /etc/ssl/certs/
39+
ADD ssl/default-ssl.conf /etc/apache2/conf-available/ssl-params.conf
40+
ADD ssl/nextcloud.crt /etc/ssl/certs/nextcloud.crt
41+
ADD ssl/nextcloud.key /etc/ssl/private/nextcloud.key
42+
ADD ssl/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf
43+
44+
RUN chmod +x /usr/local/bin/*
45+
46+
EXPOSE 80
47+
ENTRYPOINT ["/usr/local/bin/initAndRun.sh"]

‎shallow-server/initAndRun.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/usr/bin/env bash
2+
/usr/local/bin/initnc.sh
3+
/usr/local/bin/run.sh

‎shallow-server/initnc.sh

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/sh
2+
3+
export BRANCH=${BRANCH:=master}
4+
5+
# Where we do all the work
6+
cd /var/www/html/
7+
8+
# Update code
9+
su www-data -c "
10+
git fetch origin ${BRANCH} --depth 1
11+
git checkout origin/$BRANCH -B $BRANCH
12+
git submodule update
13+
14+
# Creating data
15+
mkdir -p /var/www/html/data
16+
17+
# Init
18+
php occ maintenance:install --admin-user=admin --admin-pass=admin
19+
OC_PASS=test php occ user:add --password-from-env -- test
20+
21+
# Trusted domains
22+
php occ config:system:set trusted_domains 1 --value=*
23+
php occ config:system:set loglevel --value='0'
24+
"
25+
26+
# allow eval script for executing javascript in webview (LoginIT test for Android)
27+
# it needs EVAL set to true within environment in .drone.yml
28+
29+
if test -z "$EVAL"
30+
then
31+
echo "\$EVAL not set, ignoring..."
32+
else
33+
echo "\$EVAL is set, allowing eval script in ContentSecurityPolicy.php"
34+
sed -i s'/protected $evalScriptAllowed = false;/protected $evalScriptAllowed = true;/' lib/public/AppFramework/Http/ContentSecurityPolicy.php
35+
fi
36+
37+
38+
if test -z "$REDIS"
39+
then
40+
echo "\$REDIS not set, ignoring..."
41+
else
42+
su www-data -c "
43+
php occ config:system:set redis host --value=${REDIS}
44+
php occ config:system:set redis port --value=6379 --type=integer
45+
php occ config:system:set redis timeout --value=0 --type=integer
46+
php occ config:system:set --type string --value '\\OC\\Memcache\\Redis' memcache.local
47+
php occ config:system:set --type string --value '\\OC\\Memcache\\Redis' memcache.distributed
48+
"
49+
fi

‎shallow-server/opcache-recommended.ini

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
opcache.enable=1
2+
opcache.enable_cli=1
3+
opcache.interned_strings_buffer=8
4+
opcache.max_accelerated_files=10000
5+
opcache.memory_consumption=128
6+
opcache.save_comments=1
7+
opcache.revalidate_freq=1

‎shallow-server/run.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/sh
2+
3+
set -e
4+
cd /var/www/html/
5+
6+
. /etc/apache2/envvars
7+
8+
# allow php and apache2 to create their run socket
9+
mkdir -p /run/php
10+
mkdir -p /var/run/apache2
11+
12+
tail -f data/nextcloud.log &
13+
14+
a2enmod ssl
15+
a2enmod headers
16+
a2ensite default-ssl
17+
a2enconf ssl-params
18+
apache2ctl configtest
19+
20+
apache2 -DFOREGROUND "$@"

‎shallow-server/ssl/default-ssl.conf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<IfModule mod_ssl.c>
2+
<VirtualHost _default_:443>
3+
ServerAdmin webmaster@localhost
4+
5+
DocumentRoot /var/www/html
6+
7+
ErrorLog ${APACHE_LOG_DIR}/error.log
8+
CustomLog ${APACHE_LOG_DIR}/access.log combined
9+
10+
SSLEngine on
11+
12+
SSLCertificateFile /etc/ssl/certs/nextcloud.crt
13+
SSLCertificateKeyFile /etc/ssl/private/nextcloud.key
14+
15+
<FilesMatch "\.(cgi|shtml|phtml|php)$">
16+
SSLOptions +StdEnvVars
17+
</FilesMatch>
18+
<Directory /usr/lib/cgi-bin>
19+
SSLOptions +StdEnvVars
20+
</Directory>
21+
22+
BrowserMatch "MSIE [2-6]" \
23+
nokeepalive ssl-unclean-shutdown \
24+
downgrade-1.0 force-response-1.0
25+
26+
</VirtualHost>
27+
</IfModule>

‎shallow-server/ssl/dhparam.pem

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN DH PARAMETERS-----
2+
MIIBCAKCAQEA26d/5lCEkFVOOHNm4BPAcT6XXjkTceBwk+XBBAJb95uUznJwknlu
3+
RaiH04o6gJb43sSdOzaXKkcehXlk+XFKC4OzSbzcVSatrrnvBbwsPG1t1kwZWWw6
4+
4HsNRVDFhPk+YGU3pViujS5KNRUU28XGJaGoEv6LkgvkoSDxW4n8w1W3xJgZwfH8
5+
oy4PiResVejsSpS50f6WmBDzGx1YqBKrQPezFzoOxb2WTASf3GBpW+VqkdcS2t2u
6+
ALh4r/CqSlQtLeOMVwvzc/shiW4ZJgpM9WIa7qoKJodt0CLn8/+FYjJab5PhfwKH
7+
Mm85wnMkkUpY4n3NqzTTZ9p9CI9rzAEUIwIBAg==
8+
-----END DH PARAMETERS-----

‎shallow-server/ssl/nextcloud.crt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDazCCAlOgAwIBAgIUX0P/knbu3gFXra20pX7t9NNcytIwDQYJKoZIhvcNAQEL
3+
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
4+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDAxMjcwODUyMjlaFw0zMDAx
5+
MjQwODUyMjlaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
6+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
7+
AQUAA4IBDwAwggEKAoIBAQC+UfZFIMu1yWLrdWxH71WusFt832LUi8c28hzfFB0y
8+
g9q6Lhm/8peCqvldXq0t3/zGpTIwoHpmyQ9niiJXtwZYoYAtN3kfyO9NxRyCBpaM
9+
Dz3F5uOD2a/Ut0LV/+/RJMHIvjoeZ0FA0dBEZCgP38gTiXZYx+/RuyZ2ZMx81uo3
10+
jchluojHRUpLNSiQkmbTNe86rqNztKuUkQZhqImj/M1XxbpIQqdRuugh/B2/um3n
11+
H7Sxj8LoYRvZDIYoCD8GHcDK2ybxjfnboJwyOvr258vazqVAj7yfWFuBjP0qfnON
12+
InoR1AparLl2vaapHm1NO77vTQkYITWPioWFjKuxfNQ7AgMBAAGjUzBRMB0GA1Ud
13+
DgQWBBQvlNeRfCuEm1mJeoQVX4oJ78JL3zAfBgNVHSMEGDAWgBQvlNeRfCuEm1mJ
14+
eoQVX4oJ78JL3zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA+
15+
MU+rJQH3cACCtHg9pIMfeNVpfix3VpiLBxjjsFvmKmsvZRre+hk2jhykVr2b5r4W
16+
RWhBhZeCa1s8QXq/YnY4I2oVeK3FTy417XI79okOUylzrqAgMJfvnigjQCz1N64I
17+
AbFpWqSwLGBezSFvxjkJtk7GuVEXBuD7REqZHfu6ksV9Axhv2pr6YFiGJMgsG3yC
18+
JI2hfkGjAIdqoguZc/qWJC7Vx8rYi/hoq+U+WHOsGD6C9/AMCGmlVQpdqYdw7g3+
19+
6+pwIqK1lSIhEP5WzJR3QawVqc9q4Wxnz7BYMo6/qpVpBSzhW4qPy0Gsx8Pa27OD
20+
4nAEqYAYpUMeLOzmpjyy
21+
-----END CERTIFICATE-----

‎shallow-server/ssl/nextcloud.key

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+UfZFIMu1yWLr
3+
dWxH71WusFt832LUi8c28hzfFB0yg9q6Lhm/8peCqvldXq0t3/zGpTIwoHpmyQ9n
4+
iiJXtwZYoYAtN3kfyO9NxRyCBpaMDz3F5uOD2a/Ut0LV/+/RJMHIvjoeZ0FA0dBE
5+
ZCgP38gTiXZYx+/RuyZ2ZMx81uo3jchluojHRUpLNSiQkmbTNe86rqNztKuUkQZh
6+
qImj/M1XxbpIQqdRuugh/B2/um3nH7Sxj8LoYRvZDIYoCD8GHcDK2ybxjfnboJwy
7+
Ovr258vazqVAj7yfWFuBjP0qfnONInoR1AparLl2vaapHm1NO77vTQkYITWPioWF
8+
jKuxfNQ7AgMBAAECggEBAKJyjTVWF+rzmVaHJMSF2enAqGZ+ufnX0VPp9pDGt2E9
9+
wH24CcyYAZDL5Qs4W7NTg4v+x0dQQwnmxhpHgqbCF02hlCmENwPVW8VS4NFvVCL6
10+
g2yfdkU9kuKLBiZpTcaDjFCPZkY7Nixgqlcl8jgSd9GNPJHtHpszFlJqGUzZmJOP
11+
HY0dSnhxfqIheHAgixuvcB/WT2RzqpAowpXDWaAXhFFtETgEpT/ckU2FIWsKS7qV
12+
l7A9vZk9k0WWQCNvVI/pkz2SZrg4R3q2nLk5gnuSz2/qDvt7pPUgK18MA7oK0Sj2
13+
Wij5z6VYN/rgdxFxsouZ6iF3j59muqEZ2ZKwb0uI8tkCgYEA5WV/aPwYkSZOGqKZ
14+
+6RbkcacG2R41B6YXW0+IlVwk5+nv6U1yURI8/LWJ2r5oVX0Z7XsNtoFfkArPT8j
15+
uHyPFZuHPLDcWoH89Y9xnq+mXdaX+/AYKMea2rebeDdnUFl9aFZcEUewZ4vKcPDq
16+
GYZ143THOJElpjD5OWpqUvIB8M0CgYEA1GRWDcAEfwaBazePJ9AFyqCHvwFI2jGZ
17+
JZYecnBwpWg04rheKV0+sVOyuCHbBeMfQRzNWnYp8zUZG/F+g0FDWETMIauUn4PT
18+
AEZcOTamqPPo+iwo18asmaDth5zfcjpvESijnYgNCBTb2iHXw8c6eYhO64mVxEhd
19+
fTxkE+jhuScCgYEAwpRTfJPJquVY/tLJ1l/VpFNZewrASv0gtK7DM5BRi4azXaYf
20+
d3dKglKLQKhG0oj8ZTQ1B1nrqul3Q95YyFYvcF6aWeqTHtp/3TMtZzMK5THvfS5s
21+
77pQKhHv+ArWwZsG+we11JqAkXRL5X0UtU4OlT8q9Vp5Gv0TiZYwVecdqkkCgYAb
22+
dL0LGf96zER+r7f51ZJqF0Z1Ep1wV2kMytM0yARH3ai4hkzl2//2vHMmCnpd0HaB
23+
3E9Pmmbh4cNVMWrBXPZvurUIxT15QXlNV8skOkRhIubDMGI3Qp+dXIhYN5dLFPK2
24+
rSI5gxTsLoYdNLLHxEFy5IQPPsH1lcVAI0ZsrHZBkQKBgEyW0iUdIdIZDGR2R+wX
25+
NOnRfIN8o8Y4YUTLA6bkV6NPSHkz6l5kO27W36CO0+xmQWS4AH/4hpIgZBZZ4J/t
26+
XRf8zYRVGuAVZnlXMl4N8D8HZigRwCoP2UgrIUuC7aXB2WEu0ZZ2nWngws8vBOFf
27+
a6aexBOQw4Qgl6Mh3Ecw+7hP
28+
-----END PRIVATE KEY-----

‎shallow-server/ssl/ssl-params.conf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# from https://cipherli.st/
2+
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html
3+
4+
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
5+
SSLProtocol All -SSLv2 -SSLv3
6+
SSLHonorCipherOrder On
7+
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
8+
Header always set X-Frame-Options DENY
9+
Header always set X-Content-Type-Options nosniff
10+
# Requires Apache >= 2.4
11+
SSLCompression off
12+
SSLSessionTickets Off
13+
SSLUseStapling on
14+
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
15+
16+
SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"

0 commit comments

Comments
 (0)