templates/web.template.yml

   1 env:
   2   # You can have redis on a different box
   3   RAILS_ENV: 'production'
   4   UNICORN_WORKERS: 3
   5   UNICORN_SIDEKIQS: 1
   6   # this gives us very good cache coverage, 96 -> 99
   7   # in practice it is 1-2% perf improvement
   8   RUBY_GLOBAL_METHOD_CACHE_SIZE: 131072
   9
  10   DISCOURSE_DB_SOCKET: /var/run/postgresql
  11   DISCOURSE_DB_HOST:
  12   DISCOURSE_DB_PORT:
  13
  14
  15 params:
  16   # SSH key is required for remote access into the container
  17   version: tests-passed
  18
  19   home: /var/www/discourse
  20   upload_size: 10m
  21
  22 run:
  23   # see: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
  24   - replace:
  25       filename: /usr/local/etc/ImageMagick-6/policy.xml
  26       from: "<policymap>"
  27       to: |
  28         <policymap>
  29           <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  30           <policy domain="coder" rights="none" pattern="URL" />
  31           <policy domain="coder" rights="none" pattern="HTTPS" />
  32           <policy domain="coder" rights="none" pattern="MVG" />
  33           <policy domain="coder" rights="none" pattern="MSL" />
  34           <policy domain="coder" rights="none" pattern="TEXT" />
  35           <policy domain="coder" rights="none" pattern="SHOW" />
  36           <policy domain="coder" rights="none" pattern="WIN" />
  37           <policy domain="coder" rights="none" pattern="PLT" />
  38
  39   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_SMTP_ADDRESS"] == "smtp.example.com"; puts "Aborting! Mail is not configured!"; exit 1; end'
  40   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_HOSTNAME"] == "discourse.example.com"; puts "Aborting! Domain is not configured!"; exit 1; end'
  41   - exec: chown -R discourse /home/discourse
  42   - file:
  43      path: /etc/runit/1.d/copy-env
  44      chmod: "+x"
  45      contents: |
  46         #!/bin/bash
  47         env > ~/boot_env
  48         conf=/var/www/discourse/config/discourse.conf
  49
  50         # find DISCOURSE_ env vars, strip the leader, lowercase the key
  51         /usr/local/bin/ruby -e 'ENV.each{|k,v| puts "#{$1.downcase} = #{v}" if k =~ /^DISCOURSE_(.*)/}' > $conf
  52   - file:
  53      path: /etc/runit/1.d/fix-log-permissions
  54      chmod: "+x"
  55      contents: |
  56        #!/bin/bash
  57        # TODO this should be moved into the base image
  58        chown -fR www-data:adm /var/log/nginx
  59        chown -f syslog:adm /var/log/syslog*
  60        chown -f syslog:adm /var/log/auth.log*
  61        chown -f syslog:adm /var/log/kern.log*
  62
  63   - file:
  64      path: /etc/runit/1.d/enable-brotli
  65      chmod: "+x"
  66      contents: |
  67         #!/bin/bash
  68         [ ! -z "$COMPRESS_BROTLI" ] && sed -i "s/. brotli/  brotli/" /etc/nginx/conf.d/discourse.conf || sed -i "s/. brotli/# brotli/" /etc/nginx/conf.d/discourse.conf
  69
  70   - file:
  71      path: /etc/runit/1.d/ensure-web-nginx-read
  72      chmod: "+x"
  73      contents: |
  74         #!/bin/bash
  75         mkdir -p /var/log/nginx
  76         chgrp -R www-data /var/log/nginx
  77         chgrp www-data /var/log/nginx
  78
  79   - file:
  80      path: /etc/service/unicorn/run
  81      chmod: "+x"
  82      contents: |
  83         #!/bin/bash
  84         exec 2>&1
  85         # redis
  86         # postgres
  87         cd $home
  88         chown -R discourse:www-data /shared/log/rails
  89         LD_PRELOAD=/usr/lib/libjemalloc.so.1 HOME=/home/discourse USER=discourse exec chpst -u discourse:www-data -U discourse:www-data bundle exec config/unicorn_launcher -E production -c config/unicorn.conf.rb
  90
  91   - file:
  92      path: /etc/service/nginx/run
  93      chmod: "+x"
  94      contents: |
  95         #!/bin/sh
  96         exec 2>&1
  97         exec /usr/sbin/nginx
  98
  99   - file:
 100      path: /etc/runit/3.d/01-nginx
 101      chmod: "+x"
 102      contents: |
 103        #!/bin/bash
 104        sv stop nginx
 105
 106   - file:
 107      path: /etc/runit/3.d/02-unicorn
 108      chmod: "+x"
 109      contents: |
 110        #!/bin/bash
 111        sv stop unicorn
 112
 113   - exec:
 114       cd: $home
 115       hook: code
 116       cmd:
 117         - git reset --hard
 118         - git clean -f
 119         - git remote set-branches --add origin master
 120         - git pull
 121         - git fetch origin $version
 122         - git checkout $version
 123         - mkdir -p tmp/pids
 124         - mkdir -p tmp/sockets
 125         - touch tmp/.gitkeep
 126         - mkdir -p                    /shared/log/rails
 127         - bash -c "touch -a           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log"
 128         - bash -c "ln    -s           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log $home/log"
 129         - bash -c "mkdir -p           /shared/{uploads,backups}"
 130         - bash -c "ln    -s           /shared/{uploads,backups} $home/public"
 131         - chown -R discourse:www-data /shared/log/rails /shared/uploads /shared/backups
 132
 133   - exec:
 134       cmd:
 135         - "cp $home/config/nginx.sample.conf /etc/nginx/conf.d/discourse.conf"
 136         - "rm /etc/nginx/sites-enabled/default"
 137         - "mkdir -p /var/nginx/cache"
 138
 139   - replace:
 140       filename: /etc/nginx/nginx.conf
 141       from: pid /run/nginx.pid;
 142       to: daemon off;
 143
 144   - replace:
 145       filename: "/etc/nginx/conf.d/discourse.conf"
 146       from: /upstream[^\}]+\}/m
 147       to: "upstream discourse {
 148         server 127.0.0.1:3000;
 149       }"
 150
 151   - replace:
 152       filename: "/etc/nginx/conf.d/discourse.conf"
 153       from: /server_name.+$/
 154       to: server_name _ ;
 155
 156   - replace:
 157       filename: "/etc/nginx/conf.d/discourse.conf"
 158       from: /client_max_body_size.+$/
 159       to: client_max_body_size $upload_size ;
 160
 161   - exec:
 162       cmd: echo "done configuring web"
 163       hook: web_config
 164
 165   - exec:
 166       cd: $home
 167       hook: web
 168       cmd:
 169         # ensure we are on latest bundler
 170         - gem update bundler
 171         - chown -R discourse $home
 172
 173   - exec:
 174       cd: $home
 175       hook: bundle_exec
 176       cmd:
 177         - su discourse -c 'bundle install --deployment --verbose --without test --without development'
 178         - su discourse -c 'bundle exec rake db:migrate'
 179         - su discourse -c 'bundle exec rake assets:precompile'
 180
 181   - file:
 182      path: /usr/local/bin/discourse
 183      chmod: +x
 184      contents: |
 185        #!/bin/bash
 186        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/discourse "$@")
 187
 188   - file:
 189      path: /usr/local/bin/rails
 190      chmod: +x
 191      contents: |
 192        #!/bin/bash
 193        # If they requested a console, load pry instead
 194        if [ "$*" == "c" -o "$*" == "console" ]
 195        then
 196         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec pry -r ./config/environment)
 197        else
 198         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/rails "$@")
 199        fi
 200
 201   - file:
 202      path: /usr/local/bin/rake
 203      chmod: +x
 204      contents: |
 205        #!/bin/bash
 206        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec bin/rake "$@")
 207
 208   - file:
 209      path: /etc/update-motd.d/10-web
 210      chmod: +x
 211      contents: |
 212        #!/bin/bash
 213        echo
 214        echo Use: rails, rake or discourse to execute commands in production
 215        echo
 216
 217   - file:
 218      path: /etc/logrotate.d/rails
 219      contents: |
 220         /shared/log/rails/*.log
 221         {
 222                 rotate 14
 223                 dateext
 224                 daily
 225                 missingok
 226                 notifempty
 227                 delaycompress
 228                 compress
 229                 postrotate
 230                 sv 1 unicorn
 231                 endscript
 232         }
 233
 234   - file:
 235      path: /etc/logrotate.d/nginx
 236      contents: |
 237         /var/log/nginx/*.log {
 238           daily
 239           missingok
 240           rotate 14
 241           compress
 242           delaycompress
 243           notifempty
 244           create 0640 www-data www-data
 245           sharedscripts
 246           postrotate
 247             sv 1 nginx
 248           endscript
 249         }
 250
 251   # move state out of the container this fancy is done to support rapid rebuilds of containers,
 252   # we store anacron and logrotate state outside the container to ensure its maintained across builds
 253   # later move this snipped into an intialization script
 254   # we also ensure all the symlinks we need to /shared are in place in the correct structure
 255   # this allows us to bootstrap on one machine and then run on another
 256   - file:
 257       path: /etc/runit/1.d/00-ensure-links
 258       chmod: +x
 259       contents: |
 260         #!/bin/bash
 261         if [[ ! -L /var/lib/logrotate ]]; then
 262           rm -fr /var/lib/logrotate
 263           mkdir -p /shared/state/logrotate
 264           ln -s /shared/state/logrotate /var/lib/logrotate
 265         fi
 266         if [[ ! -L /var/spool/anacron ]]; then
 267           rm -fr /var/spool/anacron
 268           mkdir -p /shared/state/anacron-spool
 269           ln -s /shared/state/anacron-spool /var/spool/anacron
 270         fi
 271         if [[ ! -d /shared/log/rails ]]; then
 272           mkdir -p /shared/log/rails
 273           chown -R discourse:www-data /shared/log/rails
 274         fi
 275         if [[ ! -d /shared/uploads ]]; then
 276           mkdir -p /shared/uploads
 277           chown -R discourse:www-data /shared/uploads
 278         fi
 279         if [[ ! -d /shared/backups ]]; then
 280           mkdir -p /shared/backups
 281           chown -R discourse:www-data /shared/backups
 282         fi
 283
 284   # change login directory to Discourse home
 285   - file:
 286      path: /root/.bash_profile
 287      chmod: 644
 288      contents: |
 289         cd $home