diff --git a/DOCKER.md b/DOCKER.md index 21538f1ba..d1f44ee44 100644 --- a/DOCKER.md +++ b/DOCKER.md @@ -251,3 +251,22 @@ docker compose up -d | CI / scripted teardown | `make fresh FORCE=1` or `make nuke FORCE=1` to skip prompts | | supervisorctl not connecting | `make root-shell` then `supervisorctl status` to verify socket path | +## Nginx (GetPageSpeed + Brotli) + +The app container's nginx is installed from the [GetPageSpeed apt repo](https://extras.getpagespeed.com/ubuntu/) +(stable branch) instead of the Ubuntu archive. This gives us a current nginx +build with ABI-matched dynamic modules. The `nginx-module-brotli` package is +installed and the brotli directives in `docker/8.5/nginx.conf` are enabled by +default (gzip is kept as a fallback for clients without `br` support). + +The repo is apt-pinned at priority `1001` via +`/etc/apt/preferences.d/getpagespeed-nginx.pref` so `nginx` and module +packages always resolve from GetPageSpeed even if Ubuntu publishes a newer +version. A `nginx -t` is run during `docker build` to fail fast on any config +drift. + +To revert to stock Ubuntu nginx, remove the GetPageSpeed apt key, list, and +preferences entries from `docker/8.5/Dockerfile`, drop `nginx-module-brotli` +from the install line, re-comment the brotli block in `docker/8.5/nginx.conf`, +and run `make rebuild`. + diff --git a/config/manticore.conf b/config/manticore.conf index cfc25658a..df15227fa 100644 --- a/config/manticore.conf +++ b/config/manticore.conf @@ -37,7 +37,6 @@ searchd listen = 9312:sphinx listen = 9306:mysql listen = 9308:http - listen = 9443:https # data directory, where all tables and binlog files are stored # https://manual.manticoresearch.com/Server_settings/Searchd#data_dir diff --git a/docker/8.5/Dockerfile b/docker/8.5/Dockerfile index 5d4ed9a96..dfa4cb82f 100644 --- a/docker/8.5/Dockerfile +++ b/docker/8.5/Dockerfile @@ -26,6 +26,9 @@ RUN apt-get update \ && echo "deb [signed-by=/etc/apt/keyrings/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list \ && curl -sS https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | tee /etc/apt/keyrings/pgdg.gpg >/dev/null \ && echo "deb [signed-by=/etc/apt/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt noble-pgdg main" > /etc/apt/sources.list.d/pgdg.list \ + && curl -fsSL https://extras.getpagespeed.com/deb-archive-keyring.gpg -o /etc/apt/keyrings/getpagespeed.gpg \ + && echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/ubuntu noble main" > /etc/apt/sources.list.d/getpagespeed.list \ + && printf 'Package: *\nPin: origin extras.getpagespeed.com\nPin-Priority: 1001\n' > /etc/apt/preferences.d/getpagespeed-nginx.pref \ && apt-get update # Install core PHP packages @@ -48,7 +51,12 @@ RUN apt-get install -y --no-install-recommends \ RUN apt-get install -y \ tmux iputils-ping net-tools ffmpeg \ sudo jq htop fonts-powerline nano bash-completion time wget cron \ - nginx jpegoptim webp optipng pngquant libavif-bin + jpegoptim webp optipng pngquant libavif-bin + +# Install nginx + brotli module from GetPageSpeed (apt-pinned, stable branch) +RUN apt-get install -y nginx nginx-module-brotli \ + && rm -f /etc/nginx/conf.d/default.conf \ + && nginx -t # Install mediainfo RUN wget https://mediaarea.net/repo/deb/repo-mediaarea_1.0-25_all.deb \ @@ -90,7 +98,8 @@ COPY nginx.conf /etc/nginx/sites-available/default COPY supervisord.conf /etc/supervisor/supervisord.conf COPY php.ini /etc/php/8.5/cli/conf.d/99-sail.ini -RUN chmod +x /usr/local/bin/start-container +RUN chmod +x /usr/local/bin/start-container \ + && nginx -t EXPOSE 80 diff --git a/docker/8.5/nginx.conf b/docker/8.5/nginx.conf index 3f97b9427..42b80a069 100644 --- a/docker/8.5/nginx.conf +++ b/docker/8.5/nginx.conf @@ -12,16 +12,15 @@ server { gzip_proxied any; gzip_comp_level 6; - # Brotli compression (requires libnginx-mod-http-brotli-filter and libnginx-mod-http-brotli-static) - # Uncomment these lines after installing the brotli module - #brotli on; - #brotli_comp_level 6; - #brotli_static on; - #brotli_types application/atom+xml application/javascript application/json application/rss+xml - #application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype - #application/x-font-ttf application/x-javascript application/xhtml+xml application/xml - #font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon - #image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml text/html; + # Brotli compression (provided by GetPageSpeed nginx-module-brotli package) + brotli on; + brotli_comp_level 6; + brotli_static on; + brotli_types application/atom+xml application/javascript application/json application/rss+xml + application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype + application/x-font-ttf application/x-javascript application/xhtml+xml application/xml + font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon + image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml text/html; location / { try_files $uri $uri/ /index.php?$query_string; diff --git a/docker/8.5/start-container b/docker/8.5/start-container index ef73da83b..474e2e64c 100644 --- a/docker/8.5/start-container +++ b/docker/8.5/start-container @@ -12,6 +12,21 @@ chmod -R ugo+rw /.composer addgroup supervisor > /dev/null 2>&1 usermod -a -G supervisor sail > /dev/null 2>&1 +# Run PHP-FPM as `sail` so its uid/gid match files written via the bind mount +# (host user = sail's primary group). Avoids "chmod(): Operation not permitted" +# on storage/logs when files were created by the host user or other processes. +# The FPM unix socket stays owned by www-data so nginx (running as www-data) +# can connect to it. +SAIL_GROUP="$(id -gn sail)" +cat > /etc/php/8.5/fpm/pool.d/zz-sail.conf < /etc/timezone