54 lines
2.3 KiB
Docker
54 lines
2.3 KiB
Docker
FROM debian:bookworm-20250224
|
|
|
|
WORKDIR /data
|
|
|
|
# Install necessary packages and configure PHP repository
|
|
RUN apt-get update && apt-get install -y \
|
|
lsb-release ca-certificates curl apt-transport-https logrotate ssl-cert apache2 && \
|
|
echo "ServerName localhost" >> /etc/apache2/apache2.conf && \
|
|
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb && \
|
|
dpkg -i /tmp/debsuryorg-archive-keyring.deb && \
|
|
sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list' && \
|
|
apt-get update && \
|
|
apt-get install -y \
|
|
php8.4 php8.4-cli php8.4-fpm php8.4-mysql php8.4-xml php8.4-mbstring php8.4-curl php8.4-zip php8.4-redis libapache2-mod-php8.4 && \
|
|
apt-get autoremove -y && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /tmp/*
|
|
|
|
# log management
|
|
RUN cat <<EOF > /etc/logrotate.d/apache2
|
|
/var/log/apache2/*.log {
|
|
weekly
|
|
missingok
|
|
rotate 4
|
|
compress
|
|
delaycompress
|
|
notifempty
|
|
create 640 root adm
|
|
}
|
|
EOF
|
|
|
|
RUN echo 'RemoteIPHeader X-Forwarded-For' > /etc/apache2/conf-available/remoteip.conf && \
|
|
echo 'RemoteIPTrustedProxy 127.0.0.1' >> /etc/apache2/conf-available/remoteip.conf && \
|
|
a2enconf remoteip && \
|
|
sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' /etc/apache2/*.conf
|
|
|
|
RUN mkdir -p /php && echo "PHP_INI_SCAN_DIR=/php" > /etc/environment
|
|
COPY php.ini /php/php.ini
|
|
COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
|
|
|
|
# Security headers for Apache
|
|
RUN echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' >> /etc/apache2/conf-available/security.conf && \
|
|
echo 'Header always set X-Content-Type-Options "nosniff"' >> /etc/apache2/conf-available/security.conf && \
|
|
echo 'Header always set X-XSS-Protection "1; mode=block"' >> /etc/apache2/conf-available/security.conf && \
|
|
echo 'Header always set X-Frame-Options "SAMEORIGIN"' >> /etc/apache2/conf-available/security.conf
|
|
|
|
RUN a2enmod expires headers rewrite remoteip socache_shmcb ssl
|
|
|
|
EXPOSE 80
|
|
CMD ["apachectl", "-D", "FOREGROUND"]
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
|
|
CMD curl --silent --fail localhost:80 || exit 1
|