From 4826a10de1f33f376e9c2982c161f3eceb2f3f3b Mon Sep 17 00:00:00 2001 From: Bram Date: Wed, 1 Apr 2026 12:16:50 +0200 Subject: [PATCH] remote php container --- Dockers/remote-php-container/Dockerfile | 77 ++++++++ Dockers/remote-php-container/crontab | 1 + Dockers/remote-php-container/entrypoint.sh | 182 +++++++++++++++++++ Dockers/remote-php-container/nohup.out | 202 +++++++++++++++++++++ Dockers/remote-php-container/version | 1 + 5 files changed, 463 insertions(+) create mode 100644 Dockers/remote-php-container/Dockerfile create mode 100644 Dockers/remote-php-container/crontab create mode 100644 Dockers/remote-php-container/entrypoint.sh create mode 100644 Dockers/remote-php-container/nohup.out create mode 100644 Dockers/remote-php-container/version diff --git a/Dockers/remote-php-container/Dockerfile b/Dockers/remote-php-container/Dockerfile new file mode 100644 index 0000000..39442bc --- /dev/null +++ b/Dockers/remote-php-container/Dockerfile @@ -0,0 +1,77 @@ +# Use an official PHP runtime as a parent image +FROM php:8.1-fpm + +# Set the working directory +WORKDIR /workspace + +# Install dependencies +RUN apt-get update && apt-get install -y \ + git \ + openssh-client \ + unzip \ + iputils-ping \ + libpng-dev \ + libjpeg-dev \ + libfreetype6-dev \ + libonig-dev \ + libzip-dev \ + libpq5 \ + libpq-dev \ + zip \ + fish \ + cron \ + sudo \ + && docker-php-ext-configure gd --with-freetype --with-jpeg \ + && docker-php-ext-install gd mbstring zip pdo pdo_mysql pdo_pgsql pgsql + +# Install Redis PHP extension via PECL +RUN apt-get update && apt-get install -y --no-install-recommends $PHPIZE_DEPS libssl-dev \ + && pecl install redis \ + && docker-php-ext-enable redis \ + && apt-get purge -y --auto-remove $PHPIZE_DEPS libssl-dev \ + && rm -rf /var/lib/apt/lists/* + +# Install Composer +COPY --from=composer:latest /usr/bin/composer /usr/bin/composer + +RUN git clone https://gitea.bramkelchtermans.be/Bram/linux-presets.git && \ + cd linux-presets && \ + chmod +x setup.sh && \ + ./setup.sh --terminal-icon 󰎙 && \ + cd .. && \ + rm -rf linux-presets + + +RUN usermod -aG sudo root + +# Install Node.js and npm +RUN curl -sL https://deb.nodesource.com/setup_16.x | bash - && \ + apt-get install -y nodejs + +# Install PM2 globally +RUN npm install -g pm2 + +# # Switch to Fish shell +# SHELL [ "fish", "--command" ] +# RUN chsh -s /usr/bin/fish +# ENV SHELL /usr/bin/fish +# ENV LANG=C.UTF-8 LANGUAGE=C.UTF-8 LC_ALL=C.UTF-8 + + +# Create a directory for the SSH keys +RUN mkdir -p /root/.ssh + +# Copy the entrypoint script into the container +COPY entrypoint.sh /usr/local/bin/entrypoint.sh +RUN chmod +x /usr/local/bin/entrypoint.sh + +# Copy the crontab file into the container +COPY crontab /etc/cron.d/laravel-cron +RUN chmod 0644 /etc/cron.d/laravel-cron +RUN crontab /etc/cron.d/laravel-cron + +# Expose ports +EXPOSE 8000 + +# Set the entrypoint +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/Dockers/remote-php-container/crontab b/Dockers/remote-php-container/crontab new file mode 100644 index 0000000..b40fc90 --- /dev/null +++ b/Dockers/remote-php-container/crontab @@ -0,0 +1 @@ +* * * * * root /usr/local/bin/php /workspace/artisan schedule:run >> /var/log/cron.log 2>&1 diff --git a/Dockers/remote-php-container/entrypoint.sh b/Dockers/remote-php-container/entrypoint.sh new file mode 100644 index 0000000..b2016ad --- /dev/null +++ b/Dockers/remote-php-container/entrypoint.sh @@ -0,0 +1,182 @@ +#!/bin/bash +set -e + +# Check if the SSH key exists +if [ ! -f /root/.ssh/id_rsa ]; then + echo "Error: SSH private key not found at /root/.ssh/id_rsa" + exit 1 +fi + +# Check if the required environment variables are set +if [ -z "$REPO_URL" ]; then + echo "Error: REPO_URL environment variable must be set." + exit 1 +fi + +if [ -z "$GIT_USER" ]; then + echo "Error: GIT_USER environment variable must be set." + exit 1 +fi + +if [ -z "$GIT_EMAIL" ]; then + echo "Error: GIT_EMAIL environment variable must be set." + exit 1 +fi + +# Set the git user and email +git config --global user.name $GIT_USER +git config --global user.email $GIT_EMAIL + +# Ensure the SSH key has the correct permissions +chmod 600 /root/.ssh/id_rsa + +# Extract the domain from the REPO_URL +DOMAIN=$(echo $REPO_URL | awk -F'[@:]' '{print $3}') + +# Check if the repository directory already exists +if [ ! -d "/workspace/.git" ]; then + # Add the SSH configuration for the domain + echo "Host $DOMAIN + HostName $DOMAIN + IdentityFile /root/.ssh/id_rsa + StrictHostKeyChecking no + " >>/root/.ssh/config + # Clone the repository if it doesn't exist + git clone $REPO_URL /workspace +fi + +# Add the public SSH key to authorized_keys +if [ -f /root/.ssh/hostkey.pub ]; then + cat /root/.ssh/hostkey.pub >>/root/.ssh/authorized_keys +fi + +# If no teleport edition is given, fallback to oss +if [ -z "$TELEPORT_EDITION" ]; then + TELEPORT_EDITION="oss" +fi + +# Install Teleport if the environment variables are set +if [ -n "$TELEPORT_VERSION" ] && [ -n "$TELEPORT_URL" ]; then + echo "Installing Teleport version $TELEPORT_VERSION, edition $TELEPORT_EDITION..." + echo "Executing: curl https://goteleport.com/static/install.sh | bash -s $TELEPORT_VERSION $TELEPORT_EDITION" + curl https://goteleport.com/static/install.sh | bash -s ${TELEPORT_VERSION} ${TELEPORT_EDITION} +else + echo "Error: TELEPORT_VERSION and TELEPORT_EDITION environment variables must be set." +fi + +# Change to the repository directory +cd /workspace + +# Install PHP dependencies +composer install + +# Copy the environment file to the repository's environments directory +if [ -f /environment/.env ]; then + cp /environment/.env /workspace/.env +fi + +## If teleport token is set and there is no teleport.yaml file, create one +if [ -n "$TELEPORT_TOKEN" ] && [ ! -f /etc/teleport.yaml ]; then + teleport configure --roles=node --token=$TELEPORT_TOKEN --proxy=$TELEPORT_URL --no-acme -o file + echo "Created teleport configuration file" +fi + +HOSTNAME=$(hostname) + +# File path +CONFIG_FILE="/etc/teleport.yaml" + +# Edit the teleport.yaml file to update the nodename +sed -i "s/^ nodename:.*/ nodename: $HOSTNAME/" "$CONFIG_FILE" + +# Function to add labels to teleport.yaml +# Function to add labels to teleport.yaml +add_teleport_labels() { + if [ -n "$TELEPORT_LABELS" ]; then + echo "Adding Teleport labels from TELEPORT_LABELS environment variable..." + + # Check if ssh_service section exists + if ! grep -q "ssh_service:" "$CONFIG_FILE"; then + echo "Error: ssh_service section not found in teleport.yaml" + return 1 + fi + + # Create a backup + cp "$CONFIG_FILE" "$CONFIG_FILE.backup" + + # Build the new ssh_service section + NEW_SSH_SECTION="ssh_service:" + NEW_SSH_SECTION="$NEW_SSH_SECTION"$'\n'" labels:" + + # Parse TELEPORT_LABELS and add each label + IFS=',' read -ra LABELS <<< "$TELEPORT_LABELS" + for label in "${LABELS[@]}"; do + # Trim whitespace + label=$(echo "$label" | xargs) + + # Check if label contains colon + if [[ "$label" == *":"* ]]; then + key=$(echo "$label" | cut -d':' -f1 | xargs) + value=$(echo "$label" | cut -d':' -f2- | xargs) + + if [ -n "$key" ] && [ -n "$value" ]; then + NEW_SSH_SECTION="$NEW_SSH_SECTION"$'\n'" $key: $value" + echo "Added label: $key = $value" + else + echo "Warning: Invalid label format '$label'. Expected format: key:value" + fi + else + echo "Warning: Label '$label' does not contain colon separator. Expected format: key:value" + fi + done + + NEW_SSH_SECTION="$NEW_SSH_SECTION"$'\n'" enabled: \"yes\"" + + # Replace the ssh_service section + awk -v new_section="$NEW_SSH_SECTION" ' + BEGIN { + in_ssh_service = 0 + section_replaced = 0 + } + /^ssh_service:/ { + in_ssh_service = 1 + if (!section_replaced) { + print new_section + section_replaced = 1 + } + next + } + in_ssh_service && /^[a-zA-Z_][a-zA-Z0-9_]*:/ { + in_ssh_service = 0 + } + in_ssh_service { + next + } + { + print $0 + } + ' "$CONFIG_FILE" > "$CONFIG_FILE.tmp" + + # Replace the original file + mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" + + echo "Teleport labels added successfully" + else + echo "No TELEPORT_LABELS environment variable set, skipping label configuration" + fi +} + +# Add labels to teleport configuration +add_teleport_labels + +# Start the cron service +service cron start +nohup teleport start & + +# If no custom app command is provided, use a simple PHP built-in server +if [ -z "$START_COMMAND" ]; then + START_COMMAND='php -S 0.0.0.0:8000' +fi + +# Always run the app under pm2-runtime +exec pm2-runtime "$START_COMMAND" diff --git a/Dockers/remote-php-container/nohup.out b/Dockers/remote-php-container/nohup.out new file mode 100644 index 0000000..4f3902a --- /dev/null +++ b/Dockers/remote-php-container/nohup.out @@ -0,0 +1,202 @@ +usage: teleport start [] + +Starts the Teleport service. + +Flags: + -d, --[no-]debug Enable verbose logging to stderr + --[no-]insecure-no-tls Disable TLS for the web socket + -r, --roles Comma-separated list of roles to start with + [proxy,node,auth,app,db] + --pid-file Full path to the PID file. By default no PID + file will be created + --advertise-ip IP to advertise to clients if running behind + NAT + -l, --listen-ip IP address to bind to [0.0.0.0] + --auth-server Address of the auth server [127.0.0.1:3025] + --token Invitation token or path to file with token + value. Used to register with an auth server + [none] + --ca-pin CA pin to validate the Auth Server (can be + repeated for multiple pins) + --nodename Name of this node, defaults to hostname + -c, --config Path to a configuration file + [/etc/teleport.yaml] + --apply-on-startup Path to a non-empty YAML file containing + resources to apply on startup. Works on + initialized clusters, unlike --bootstrap. + Only supports the following types: token. + --bootstrap Path to a non-empty YAML file containing + bootstrap resources (ignored if already + initialized) + --labels Comma-separated list of labels for this node, + for example env=dev,app=web + --diag-addr Start diagnostic prometheus and healthz + endpoint. + --[no-]permit-user-env Enables reading of ~/.tsh/environment when + creating a session + --[no-]insecure Insecure mode disables certificate validation + --[no-]fips Start Teleport in FedRAMP/FIPS 140-2 mode. + --[no-]skip-version-check Skip version checking between server and + client. + +Aliases: +Notes: + --roles=node,proxy,auth,app + + This flag tells Teleport which services to run. By default it runs auth, + proxy, and node. In a production environment you may want to separate them. + + --token=xyz or --token=/tmp/token + + This token is needed to connect a node or web app to an auth server. Get it + by running "tctl tokens add --type=node" or "tctl tokens add --type=app" to + join an SSH server or web app to your cluster respectively. It's used once + and ignored afterwards. + +Examples: + +> teleport start + By default without any configuration, teleport starts running as a single-node + cluster. It's the equivalent of running with --roles=node,proxy,auth + +> teleport start --roles=node --auth-server=10.1.0.1 --token=xyz --nodename=db + Starts a node named 'db' running in strictly SSH mode role, joining the cluster + serviced by the auth server running on 10.1.0.1 + +> teleport start --roles=node --auth-server=10.1.0.1 --labels=db=master + Same as the above, but the node runs with db=master label and can be connected + to using that label in addition to its name. + +> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-app" \ + --uri="http://localhost:8080" + Starts an app server that proxies the application "example-app" running at + http://localhost:8080. + +> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-app" \ + --uri="http://localhost:8080" \ + --labels=group=dev + Same as the above, but the app server runs with "group=dev" label which only + allows access to users with the role "group=dev". + +> teleport db start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-db" \ + --protocol="postgres" \ + --uri="localhost:5432" +Starts a database server that proxies PostgreSQL database "example-db" running +at localhost:5432. The database must be configured with Teleport CA and key +pair issued by "tctl auth sign --format=db". + +> teleport db start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="aurora-db" \ + --protocol="mysql" \ + --uri="example.cluster-abcdefghij.us-west-1.rds.amazonaws.com:3306" \ + --aws-region=us-west-1 \ + --labels=env=aws +Starts a database server that proxies Aurora MySQL database running in AWS +region us-west-1 which only allows access to users with the role "env=aws". + +ERROR: path '/etc/teleport.yaml' does not exist + +usage: teleport start [] + +Starts the Teleport service. + +Flags: + -d, --[no-]debug Enable verbose logging to stderr + --[no-]insecure-no-tls Disable TLS for the web socket + -r, --roles Comma-separated list of roles to start with + [proxy,node,auth,app,db] + --pid-file Full path to the PID file. By default no PID + file will be created + --advertise-ip IP to advertise to clients if running behind + NAT + -l, --listen-ip IP address to bind to [0.0.0.0] + --auth-server Address of the auth server [127.0.0.1:3025] + --token Invitation token or path to file with token + value. Used to register with an auth server + [none] + --ca-pin CA pin to validate the Auth Server (can be + repeated for multiple pins) + --nodename Name of this node, defaults to hostname + -c, --config Path to a configuration file + [/etc/teleport.yaml] + --apply-on-startup Path to a non-empty YAML file containing + resources to apply on startup. Works on + initialized clusters, unlike --bootstrap. + Only supports the following types: token. + --bootstrap Path to a non-empty YAML file containing + bootstrap resources (ignored if already + initialized) + --labels Comma-separated list of labels for this node, + for example env=dev,app=web + --diag-addr Start diagnostic prometheus and healthz + endpoint. + --[no-]permit-user-env Enables reading of ~/.tsh/environment when + creating a session + --[no-]insecure Insecure mode disables certificate validation + --[no-]fips Start Teleport in FedRAMP/FIPS 140-2 mode. + --[no-]skip-version-check Skip version checking between server and + client. + +Aliases: +Notes: + --roles=node,proxy,auth,app + + This flag tells Teleport which services to run. By default it runs auth, + proxy, and node. In a production environment you may want to separate them. + + --token=xyz or --token=/tmp/token + + This token is needed to connect a node or web app to an auth server. Get it + by running "tctl tokens add --type=node" or "tctl tokens add --type=app" to + join an SSH server or web app to your cluster respectively. It's used once + and ignored afterwards. + +Examples: + +> teleport start + By default without any configuration, teleport starts running as a single-node + cluster. It's the equivalent of running with --roles=node,proxy,auth + +> teleport start --roles=node --auth-server=10.1.0.1 --token=xyz --nodename=db + Starts a node named 'db' running in strictly SSH mode role, joining the cluster + serviced by the auth server running on 10.1.0.1 + +> teleport start --roles=node --auth-server=10.1.0.1 --labels=db=master + Same as the above, but the node runs with db=master label and can be connected + to using that label in addition to its name. + +> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-app" \ + --uri="http://localhost:8080" + Starts an app server that proxies the application "example-app" running at + http://localhost:8080. + +> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-app" \ + --uri="http://localhost:8080" \ + --labels=group=dev + Same as the above, but the app server runs with "group=dev" label which only + allows access to users with the role "group=dev". + +> teleport db start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="example-db" \ + --protocol="postgres" \ + --uri="localhost:5432" +Starts a database server that proxies PostgreSQL database "example-db" running +at localhost:5432. The database must be configured with Teleport CA and key +pair issued by "tctl auth sign --format=db". + +> teleport db start --token=xyz --auth-server=proxy.example.com:3080 \ + --name="aurora-db" \ + --protocol="mysql" \ + --uri="example.cluster-abcdefghij.us-west-1.rds.amazonaws.com:3306" \ + --aws-region=us-west-1 \ + --labels=env=aws +Starts a database server that proxies Aurora MySQL database running in AWS +region us-west-1 which only allows access to users with the role "env=aws". + +ERROR: path '/etc/teleport.yaml' does not exist + diff --git a/Dockers/remote-php-container/version b/Dockers/remote-php-container/version new file mode 100644 index 0000000..9f8e9b6 --- /dev/null +++ b/Dockers/remote-php-container/version @@ -0,0 +1 @@ +1.0 \ No newline at end of file