replace dockerized to docker-bundle

2026-05-19 20:25:15 +03:30
parent f302d605d2
commit cb62a0bae6
16 changed files with 56 additions and 56 deletions
--- a/docker-bundle/docker/app/Dockerfile
+++ b/docker-bundle/docker/app/Dockerfile
@@ -0,0 +1,121 @@
+# syntax=docker/dockerfile:1
+
+FROM php:8.4-apache-bookworm AS php-base
+
+ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
+    COMPOSER_ALLOW_SUPERUSER=1
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        gettext-base \
+        git \
+        gosu \
+        libicu-dev \
+        libcurl4-openssl-dev \
+        libonig-dev \
+        libpq-dev \
+        libsqlite3-dev \
+        libzip-dev \
+        netcat-openbsd \
+        unzip \
+    && docker-php-ext-install -j"$(nproc)" \
+        bcmath \
+        curl \
+        intl \
+        mbstring \
+        opcache \
+        pcntl \
+        pdo_pgsql \
+        pdo_sqlite \
+        pgsql \
+        zip \
+    && pecl install redis \
+    && docker-php-ext-enable redis \
+    && a2enmod headers proxy proxy_http rewrite setenvif \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+WORKDIR /var/www/html
+
+FROM php-base AS composer-deps
+
+COPY runtime/source/composer.json runtime/source/composer.lock ./
+RUN composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader --no-scripts
+
+FROM php-base AS assets
+
+ENV APP_NAME=Nyone \
+    APP_ENV=production \
+    APP_DEBUG=false \
+    APP_KEY=base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
+    APP_URL=http://localhost \
+    LOG_CHANNEL=stderr \
+    DB_CONNECTION=sqlite \
+    DB_DATABASE=:memory: \
+    CACHE_STORE=array \
+    SESSION_DRIVER=array \
+    QUEUE_CONNECTION=sync \
+    MAIL_MAILER=log \
+    BROADCAST_CONNECTION=log \
+    FILESYSTEM_DISK=local \
+    VITE_APP_NAME=Nyone \
+    STREAMING_VIEWER_COUNT_CACHE_STORE=array \
+    MEDIAMTX_SHARED_SECRET=build-time-secret
+
+COPY --from=node:22-bookworm-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22-bookworm-slim /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+COPY runtime/source/composer.json runtime/source/composer.lock ./
+COPY --from=composer-deps /var/www/html/vendor ./vendor
+
+COPY runtime/source/package.json runtime/source/package-lock.json ./
+RUN npm ci
+
+COPY runtime/source/ ./
+RUN mkdir -p \
+        storage/app/private/recordings \
+        storage/app/public \
+        storage/framework/cache/data \
+        storage/framework/sessions \
+        storage/framework/views \
+        storage/logs \
+        bootstrap/cache \
+    && composer dump-autoload --optimize --no-dev \
+    && php artisan package:discover --ansi \
+    && php artisan route:clear \
+    && php artisan wayfinder:generate --with-form --no-interaction \
+    && npm run build
+
+FROM php-base AS app
+
+COPY runtime/source/composer.json runtime/source/composer.lock ./
+COPY --from=composer-deps /var/www/html/vendor ./vendor
+
+COPY runtime/source/ ./
+COPY --from=assets /var/www/html/public/build ./public/build
+
+COPY docker/app/apache/nyone.conf.template /etc/apache2/sites-available/nyone.conf.template
+COPY docker/app/php/production.ini /usr/local/etc/php/conf.d/production.ini
+COPY docker/app/entrypoint.sh /usr/local/bin/nyone-entrypoint
+
+RUN composer dump-autoload --optimize --no-dev \
+    && php artisan package:discover --ansi \
+    && mkdir -p \
+        storage/app/private/recordings \
+        storage/app/public \
+        storage/framework/cache/data \
+        storage/framework/sessions \
+        storage/framework/views \
+        storage/logs \
+        bootstrap/cache \
+    && if [ ! -e public/storage ]; then ln -s ../storage/app/public public/storage; fi \
+    && chown -R www-data:www-data storage bootstrap/cache \
+    && chmod +x /usr/local/bin/nyone-entrypoint
+
+ENTRYPOINT ["nyone-entrypoint"]
+CMD ["app"]
--- a/docker-bundle/docker/app/apache/nyone.conf.template
+++ b/docker-bundle/docker/app/apache/nyone.conf.template
@@ -0,0 +1,43 @@
+ServerName ${APP_DOMAIN}
+
+<VirtualHost *:80>
+    ServerName ${APP_DOMAIN}
+
+    DocumentRoot /var/www/html/public
+    DirectoryIndex index.php
+
+    SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
+    SetEnvIf X-Forwarded-Ssl "^on$" HTTPS=on
+
+    <Directory /var/www/html/public>
+        Options -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    <FilesMatch "\.php$">
+        SetHandler application/x-httpd-php
+    </FilesMatch>
+
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 combined
+</VirtualHost>
+
+<VirtualHost *:80>
+    ServerName ${HLS_DOMAIN}
+
+    ProxyRequests Off
+    ProxyPreserveHost On
+
+    ProxyPass "/" "http://mediamtx:${HLS_INTERNAL_PORT}/" retry=0
+    ProxyPassReverse "/" "http://mediamtx:${HLS_INTERNAL_PORT}/"
+
+    Header always set Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate"
+    Header always set Access-Control-Allow-Origin "${APP_URL}"
+    Header always set Access-Control-Allow-Methods "GET, HEAD, OPTIONS"
+    Header always set Access-Control-Allow-Headers "Range, Origin, Accept, Content-Type"
+
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 combined
+</VirtualHost>
+
--- a/docker-bundle/docker/app/entrypoint.sh
+++ b/docker-bundle/docker/app/entrypoint.sh
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /var/www/html
+
+role="${CONTAINER_ROLE:-${1:-app}}"
+
+fail() {
+    echo "nyone-entrypoint: $*" >&2
+    exit 1
+}
+
+require_env() {
+    local key="$1"
+    local value="${!key:-}"
+
+    if [[ -z "$value" || "$value" == "change-me"* || "$value" == "base64:change-me"* ]]; then
+        fail "$key is required. Run docker-bundle/scripts/deploy.sh or set it in docker-bundle/.env."
+    fi
+}
+
+wait_for() {
+    local host="$1"
+    local port="$2"
+    local label="$3"
+    local attempts="${4:-60}"
+
+    for ((i = 1; i <= attempts; i++)); do
+        if nc -z "$host" "$port" >/dev/null 2>&1; then
+            return 0
+        fi
+
+        sleep 2
+    done
+
+    fail "Timed out waiting for $label at $host:$port."
+}
+
+artisan() {
+    gosu www-data php artisan "$@"
+}
+
+render_apache_config() {
+    export APP_DOMAIN HLS_DOMAIN HLS_INTERNAL_PORT APP_URL
+
+    envsubst '${APP_DOMAIN} ${HLS_DOMAIN} ${HLS_INTERNAL_PORT} ${APP_URL}' \
+        < /etc/apache2/sites-available/nyone.conf.template \
+        > /etc/apache2/sites-available/000-default.conf
+}
+
+prepare_laravel_paths() {
+    mkdir -p \
+        storage/app/private/recordings \
+        storage/app/public \
+        storage/framework/cache/data \
+        storage/framework/sessions \
+        storage/framework/views \
+        storage/logs \
+        bootstrap/cache
+
+    chown -R www-data:www-data storage bootstrap/cache
+}
+
+ensure_public_storage_link() {
+    mkdir -p public storage/app/public
+
+    if [[ -L public/storage || -e public/storage ]]; then
+        return 0
+    fi
+
+    ln -s ../storage/app/public public/storage
+}
+
+cache_laravel_bootstrap() {
+    if [[ "${APP_OPTIMIZE_ON_BOOT:-true}" != "true" ]]; then
+        return 0
+    fi
+
+    artisan config:clear
+    artisan route:clear
+    artisan view:clear
+    artisan event:clear
+    artisan config:cache
+    artisan route:cache
+    artisan view:cache
+}
+
+require_env APP_KEY
+require_env APP_DOMAIN
+require_env HLS_DOMAIN
+require_env MEDIAMTX_SHARED_SECRET
+require_env DB_DATABASE
+require_env DB_USERNAME
+require_env DB_PASSWORD
+
+if [[ "${WAIT_FOR_SERVICES:-true}" == "true" ]]; then
+    wait_for "${DB_HOST:-db}" "${DB_PORT:-5432}" "PostgreSQL"
+    wait_for "${REDIS_HOST:-redis}" "${REDIS_PORT:-6379}" "Redis"
+
+    if [[ "$role" == "viewer-sync" ]]; then
+        wait_for "${MEDIAMTX_HOST:-mediamtx}" "${MEDIAMTX_API_PORT:-9997}" "MediaMTX API"
+    fi
+fi
+
+prepare_laravel_paths
+ensure_public_storage_link
+cache_laravel_bootstrap
+
+case "$role" in
+    app)
+        render_apache_config
+        exec apache2-foreground
+        ;;
+    migrate)
+        artisan migrate --force
+
+        if [[ "${SEED_DATABASE:-false}" == "true" ]]; then
+            artisan db:seed --force
+        fi
+        ;;
+    queue)
+        exec gosu www-data php artisan queue:work "${QUEUE_CONNECTION:-database}" \
+            --queue="${QUEUE_NAMES:-default}" \
+            --sleep="${QUEUE_SLEEP:-3}" \
+            --tries="${QUEUE_TRIES:-3}" \
+            --max-time="${QUEUE_MAX_TIME:-3600}" \
+            --timeout="${QUEUE_TIMEOUT:-90}"
+        ;;
+    scheduler)
+        exec gosu www-data php artisan schedule:work
+        ;;
+    viewer-sync)
+        exec gosu www-data php artisan streaming:sync-viewer-counts \
+            --interval="${STREAMING_VIEWER_SYNC_INTERVAL:-2}"
+        ;;
+    artisan)
+        shift || true
+        exec gosu www-data php artisan "$@"
+        ;;
+    *)
+        exec "$@"
+        ;;
+esac
--- a/docker-bundle/docker/app/php/production.ini
+++ b/docker-bundle/docker/app/php/production.ini
@@ -0,0 +1,17 @@
+expose_php=Off
+memory_limit=512M
+upload_max_filesize=100M
+post_max_size=100M
+max_execution_time=120
+max_input_vars=3000
+variables_order=EGPCS
+
+opcache.enable=1
+opcache.enable_cli=1
+opcache.memory_consumption=256
+opcache.interned_strings_buffer=32
+opcache.max_accelerated_files=20000
+opcache.validate_timestamps=0
+opcache.save_comments=1
+opcache.jit=0
+
--- a/docker-bundle/docker/mediamtx/Dockerfile
+++ b/docker-bundle/docker/mediamtx/Dockerfile
@@ -0,0 +1,17 @@
+FROM bluenviron/mediamtx:latest-ffmpeg
+
+USER root
+
+RUN (apk add --no-cache curl gettext >/dev/null 2>&1) \
+    || (apt-get update \
+        && apt-get install -y --no-install-recommends ca-certificates curl gettext-base \
+        && rm -rf /var/lib/apt/lists/*)
+
+COPY docker/mediamtx/entrypoint.sh /usr/local/bin/nyone-mediamtx-entrypoint
+COPY docker/mediamtx/mediamtx.yml.template /etc/mediamtx/mediamtx.yml.template
+
+RUN chmod +x /usr/local/bin/nyone-mediamtx-entrypoint \
+    && mkdir -p /config /var/www/html/storage/app/private/recordings
+
+ENTRYPOINT ["nyone-mediamtx-entrypoint"]
+
--- a/docker-bundle/docker/mediamtx/entrypoint.sh
+++ b/docker-bundle/docker/mediamtx/entrypoint.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env sh
+set -eu
+
+fail() {
+    echo "nyone-mediamtx-entrypoint: $*" >&2
+    exit 1
+}
+
+if [ -z "${MEDIAMTX_SHARED_SECRET:-}" ] || [ "${MEDIAMTX_SHARED_SECRET#change-me}" != "$MEDIAMTX_SHARED_SECRET" ]; then
+    fail "MEDIAMTX_SHARED_SECRET is required. Run docker-bundle/scripts/deploy.sh or set it in docker-bundle/.env."
+fi
+
+: "${APP_URL:?APP_URL is required.}"
+: "${HLS_PUBLIC_URL:?HLS_PUBLIC_URL is required.}"
+: "${RTMP_INTERNAL_PORT:=1935}"
+: "${HLS_INTERNAL_PORT:=8888}"
+
+mkdir -p /config /var/www/html/storage/app/private/recordings
+
+export APP_URL HLS_PUBLIC_URL MEDIAMTX_SHARED_SECRET RTMP_INTERNAL_PORT HLS_INTERNAL_PORT
+
+envsubst '${APP_URL} ${HLS_PUBLIC_URL} ${MEDIAMTX_SHARED_SECRET} ${RTMP_INTERNAL_PORT} ${HLS_INTERNAL_PORT}' \
+    < /etc/mediamtx/mediamtx.yml.template \
+    > /config/mediamtx.yml
+
+if command -v mediamtx >/dev/null 2>&1; then
+    exec mediamtx /config/mediamtx.yml
+fi
+
+if [ -x /mediamtx ]; then
+    exec /mediamtx /config/mediamtx.yml
+fi
+
+fail "MediaMTX binary was not found in the base image."
--- a/docker-bundle/docker/mediamtx/mediamtx.yml.template
+++ b/docker-bundle/docker/mediamtx/mediamtx.yml.template
@@ -0,0 +1,35 @@
+authMethod: http
+authHTTPAddress: http://app/internal/mediamtx/auth?secret=${MEDIAMTX_SHARED_SECRET}
+authHTTPExclude:
+  - action: read
+  - action: playback
+  - action: api
+  - action: metrics
+  - action: pprof
+
+api: yes
+apiAddress: :9997
+
+rtmp: yes
+rtmpAddress: :${RTMP_INTERNAL_PORT}
+
+hls: yes
+hlsAddress: :${HLS_INTERNAL_PORT}
+hlsVariant: mpegts
+hlsAllowOrigins:
+  - ${APP_URL}
+  - ${HLS_PUBLIC_URL}
+
+pathDefaults:
+  record: yes
+  recordPath: /var/www/html/storage/app/private/recordings/%path/%Y-%m-%d_%H-%M-%S-%f
+
+  runOnReady: curl -fsS -X POST "http://app/internal/mediamtx/ready?secret=${MEDIAMTX_SHARED_SECRET}" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID"
+  runOnReadyRestart: no
+  runOnNotReady: curl -fsS -X POST "http://app/internal/mediamtx/not-ready?secret=${MEDIAMTX_SHARED_SECRET}" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID"
+  runOnRecordSegmentComplete: curl -fsS -X POST "http://app/internal/mediamtx/recording-complete?secret=${MEDIAMTX_SHARED_SECRET}" --data-urlencode "path=$MTX_PATH" --data-urlencode "segment_path=$MTX_SEGMENT_PATH" --data-urlencode "duration=$MTX_SEGMENT_DURATION"
+
+paths:
+  all_others:
+    source: publisher
+