templates/web.template.yml

   1 env:
   2   # You can have redis on a different box
   3   RAILS_ENV: 'production'
   4   UNICORN_WORKERS: 3
   5   UNICORN_SIDEKIQS: 1
   6   # this gives us very good cache coverage, 96 -> 99
   7   # in practice it is 1-2% perf improvement
   8   RUBY_GLOBAL_METHOD_CACHE_SIZE: 131072
   9
  10   DISCOURSE_DB_SOCKET: /var/run/postgresql
  11   DISCOURSE_DB_HOST:
  12   DISCOURSE_DB_PORT:
  13
  14
  15 params:
  16   # SSH key is required for remote access into the container
  17   version: tests-passed
  18
  19   home: /var/www/discourse
  20   upload_size: 10m
  21
  22 run:
  23   # see: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
  24   - replace:
  25       filename: /usr/local/etc/ImageMagick-6/policy.xml
  26       from: "<policymap>"
  27       to: |
  28         <policymap>
  29           <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  30           <policy domain="coder" rights="none" pattern="URL" />
  31           <policy domain="coder" rights="none" pattern="HTTPS" />
  32           <policy domain="coder" rights="none" pattern="MVG" />
  33           <policy domain="coder" rights="none" pattern="MSL" />
  34           <policy domain="coder" rights="none" pattern="TEXT" />
  35           <policy domain="coder" rights="none" pattern="SHOW" />
  36           <policy domain="coder" rights="none" pattern="WIN" />
  37           <policy domain="coder" rights="none" pattern="PLT" />
  38
  39   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_SMTP_ADDRESS"] == "smtp.example.com"; puts "Aborting! Mail is not configured!"; exit 1; end'
  40   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_HOSTNAME"] == "discourse.example.com"; puts "Aborting! Domain is not configured!"; exit 1; end'
  41   - exec: chown -R discourse /home/discourse
  42   - file:
  43      path: /etc/runit/1.d/copy-env
  44      chmod: "+x"
  45      contents: |
  46         #!/bin/bash
  47         env > ~/boot_env
  48         conf=/var/www/discourse/config/discourse.conf
  49
  50         # find DISCOURSE_ env vars, strip the leader, lowercase the key
  51         /usr/local/bin/ruby -e 'ENV.each{|k,v| puts "#{$1.downcase} = #{v}" if k =~ /^DISCOURSE_(.*)/}' > $conf
  52
  53   - file:
  54      path: /etc/runit/1.d/ensure-web-nginx-read
  55      chmod: "+x"
  56      contents: |
  57         #!/bin/bash
  58         mkdir -p /var/log/nginx
  59         chgrp -R www-data /var/log/nginx
  60         chgrp www-data /var/log/nginx
  61
  62   - file:
  63      path: /etc/service/unicorn/run
  64      chmod: "+x"
  65      contents: |
  66         #!/bin/bash
  67         exec 2>&1
  68         # redis
  69         # postgres
  70         cd $home
  71         chown -R discourse:www-data /shared/log/rails
  72         LD_PRELOAD=/usr/lib/libjemalloc.so.1 HOME=/home/discourse USER=discourse exec chpst -u discourse:www-data -U discourse:www-data bundle exec config/unicorn_launcher -E production -c config/unicorn.conf.rb
  73
  74   - file:
  75      path: /etc/service/nginx/run
  76      chmod: "+x"
  77      contents: |
  78         #!/bin/sh
  79         exec 2>&1
  80         exec /usr/sbin/nginx
  81
  82   - file:
  83      path: /etc/runit/3.d/01-nginx
  84      chmod: "+x"
  85      contents: |
  86        #!/bin/bash
  87        sv stop nginx
  88
  89   - file:
  90      path: /etc/runit/3.d/02-unicorn
  91      chmod: "+x"
  92      contents: |
  93        #!/bin/bash
  94        sv stop unicorn
  95
  96   - exec:
  97       cd: $home
  98       hook: code
  99       cmd:
 100         - git reset --hard
 101         - git clean -f
 102         - git remote set-branches --add origin master
 103         - git pull
 104         - git fetch origin $version
 105         - git checkout $version
 106         - mkdir -p tmp/pids
 107         - mkdir -p tmp/sockets
 108         - touch tmp/.gitkeep
 109         - mkdir -p                    /shared/log/rails
 110         - bash -c "touch -a           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log"
 111         - bash -c "ln    -s           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log $home/log"
 112         - bash -c "mkdir -p           /shared/{uploads,backups}"
 113         - bash -c "ln    -s           /shared/{uploads,backups} $home/public"
 114         - chown -R discourse:www-data /shared/log/rails /shared/uploads /shared/backups
 115
 116   - exec:
 117       cmd:
 118         - "cp $home/config/nginx.sample.conf /etc/nginx/conf.d/discourse.conf"
 119         - "rm /etc/nginx/sites-enabled/default"
 120         - "mkdir -p /var/nginx/cache"
 121         - '[ ! -z "$COMPRESS_BROTLI"] && sed -i "s/# brotli/brotli/" /etc/nginx/conf.d/discourse.conf'
 122
 123   - replace:
 124       filename: /etc/nginx/nginx.conf
 125       from: pid /run/nginx.pid;
 126       to: daemon off;
 127
 128   - replace:
 129       filename: "/etc/nginx/conf.d/discourse.conf"
 130       from: /upstream[^\}]+\}/m
 131       to: "upstream discourse {
 132         server 127.0.0.1:3000;
 133       }"
 134
 135   - replace:
 136       filename: "/etc/nginx/conf.d/discourse.conf"
 137       from: /server_name.+$/
 138       to: server_name _ ;
 139
 140   - replace:
 141       filename: "/etc/nginx/conf.d/discourse.conf"
 142       from: /client_max_body_size.+$/
 143       to: client_max_body_size $upload_size ;
 144
 145   - exec:
 146       cmd: echo "done configuring web"
 147       hook: web_config
 148
 149   - exec:
 150       cd: $home
 151       hook: web
 152       cmd:
 153         # ensure we are on latest bundler
 154         - gem update bundler
 155         - chown -R discourse $home
 156
 157   - exec:
 158       cd: $home
 159       hook: bundle_exec
 160       cmd:
 161         - su discourse -c 'bundle install --deployment --verbose --without test --without development'
 162         - su discourse -c 'bundle exec rake db:migrate'
 163         - su discourse -c 'bundle exec rake assets:precompile'
 164
 165   - file:
 166      path: /usr/local/bin/discourse
 167      chmod: +x
 168      contents: |
 169        #!/bin/bash
 170        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/discourse "$@")
 171
 172   - file:
 173      path: /usr/local/bin/rails
 174      chmod: +x
 175      contents: |
 176        #!/bin/bash
 177        # If they requested a console, load pry instead
 178        if [ "$*" == "c" -o "$*" == "console" ]
 179        then
 180         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec pry -r ./config/environment)
 181        else
 182         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/rails "$@")
 183        fi
 184
 185   - file:
 186      path: /usr/local/bin/rake
 187      chmod: +x
 188      contents: |
 189        #!/bin/bash
 190        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec bin/rake "$@")
 191
 192   - file:
 193      path: /etc/update-motd.d/10-web
 194      chmod: +x
 195      contents: |
 196        #!/bin/bash
 197        echo
 198        echo Use: rails, rake or discourse to execute commands in production
 199        echo
 200
 201   - file:
 202      path: /etc/logrotate.d/rails
 203      contents: |
 204         /shared/log/rails/*.log
 205         {
 206                 rotate 14
 207                 dateext
 208                 daily
 209                 missingok
 210                 notifempty
 211                 delaycompress
 212                 compress
 213                 postrotate
 214                 sv 1 unicorn
 215                 endscript
 216         }
 217
 218   - file:
 219      path: /etc/logrotate.d/nginx
 220      contents: |
 221         /var/log/nginx/*.log {
 222           daily
 223           missingok
 224           rotate 14
 225           compress
 226           delaycompress
 227           notifempty
 228           create 0640 www-data www-data
 229           sharedscripts
 230           postrotate
 231             sv 1 nginx
 232           endscript
 233         }
 234
 235   # move state out of the container this fancy is done to support rapid rebuilds of containers,
 236   # we store anacron and logrotate state outside the container to ensure its maintained across builds
 237   # later move this snipped into an intialization script
 238   # we also ensure all the symlinks we need to /shared are in place in the correct structure
 239   # this allows us to bootstrap on one machine and then run on another
 240   - file:
 241       path: /etc/runit/1.d/00-ensure-links
 242       chmod: +x
 243       contents: |
 244         #!/bin/bash
 245         if [[ ! -L /var/lib/logrotate ]]; then
 246           rm -fr /var/lib/logrotate
 247           mkdir -p /shared/state/logrotate
 248           ln -s /shared/state/logrotate /var/lib/logrotate
 249         fi
 250         if [[ ! -L /var/spool/anacron ]]; then
 251           rm -fr /var/spool/anacron
 252           mkdir -p /shared/state/anacron-spool
 253           ln -s /shared/state/anacron-spool /var/spool/anacron
 254         fi
 255         if [[ ! -d /shared/log/rails ]]; then
 256           mkdir -p /shared/log/rails
 257           chown -R discourse:www-data /shared/log/rails
 258         fi
 259         if [[ ! -d /shared/uploads ]]; then
 260           mkdir -p /shared/uploads
 261           chown -R discourse:www-data /shared/uploads
 262         fi
 263         if [[ ! -d /shared/backups ]]; then
 264           mkdir -p /shared/backups
 265           chown -R discourse:www-data /shared/backups
 266         fi
 267
 268   # change login directory to Discourse home
 269   - file:
 270      path: /root/.bash_profile
 271      chmod: 644
 272      contents: |
 273         cd $home