templates/web.template.yml

   1 env:
   2   # You can have redis on a different box
   3   RAILS_ENV: 'production'
   4   UNICORN_WORKERS: 3
   5   UNICORN_SIDEKIQS: 1
   6   # this gives us very good cache coverage, 96 -> 99
   7   # in practice it is 1-2% perf improvement
   8   RUBY_GLOBAL_METHOD_CACHE_SIZE: 131072
   9   # stop heap doubling in size so aggressively, this conserves memory
  10   RUBY_GC_HEAP_GROWTH_MAX_SLOTS: 40000
  11   RUBY_GC_HEAP_INIT_SLOTS: 400000
  12   RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR: 1.5
  13
  14   DISCOURSE_DB_SOCKET: /var/run/postgresql
  15   DISCOURSE_DB_HOST:
  16   DISCOURSE_DB_PORT:
  17
  18
  19 params:
  20   # SSH key is required for remote access into the container
  21   version: tests-passed
  22
  23   home: /var/www/discourse
  24   upload_size: 10m
  25
  26 run:
  27   # see: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
  28   - replace:
  29       filename: /usr/local/etc/ImageMagick-6/policy.xml
  30       from: "<policymap>"
  31       to: |
  32         <policymap>
  33           <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  34           <policy domain="coder" rights="none" pattern="URL" />
  35           <policy domain="coder" rights="none" pattern="HTTPS" />
  36           <policy domain="coder" rights="none" pattern="MVG" />
  37           <policy domain="coder" rights="none" pattern="MSL" />
  38           <policy domain="coder" rights="none" pattern="TEXT" />
  39           <policy domain="coder" rights="none" pattern="SHOW" />
  40           <policy domain="coder" rights="none" pattern="WIN" />
  41           <policy domain="coder" rights="none" pattern="PLT" />
  42
  43   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_SMTP_ADDRESS"] == "smtp.example.com"; puts "Aborting! Mail is not configured!"; exit 1; end'
  44   - exec: /usr/local/bin/ruby -e 'if ENV["DISCOURSE_HOSTNAME"] == "discourse.example.com"; puts "Aborting! Domain is not configured!"; exit 1; end'
  45   - exec: chown -R discourse /home/discourse
  46   # TODO: move to base image (anacron can not be fired up using rc.d)
  47   - exec: rm -f /etc/cron.d/anacron
  48   - file:
  49      path: /etc/cron.d/anacron
  50      contents: |
  51         SHELL=/bin/sh
  52         PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
  53
  54         30 7    * * *   root    /usr/sbin/anacron -s >/dev/null
  55   - file:
  56      path: /etc/runit/1.d/copy-env
  57      chmod: "+x"
  58      contents: |
  59         #!/bin/bash
  60         env > ~/boot_env
  61         conf=/var/www/discourse/config/discourse.conf
  62
  63         # find DISCOURSE_ env vars, strip the leader, lowercase the key
  64         /usr/local/bin/ruby -e 'ENV.each{|k,v| puts "#{$1.downcase} = #{v}" if k =~ /^DISCOURSE_(.*)/}' > $conf
  65
  66   - file:
  67      path: /etc/runit/1.d/enable-brotli
  68      chmod: "+x"
  69      contents: |
  70         #!/bin/bash
  71         [ ! -z "$COMPRESS_BROTLI" ] && sed -i "s/. brotli/  brotli/" /etc/nginx/conf.d/discourse.conf || sed -i "s/. brotli/# brotli/" /etc/nginx/conf.d/discourse.conf
  72
  73   - file:
  74      path: /etc/service/unicorn/run
  75      chmod: "+x"
  76      contents: |
  77         #!/bin/bash
  78         exec 2>&1
  79         # redis
  80         # postgres
  81         cd $home
  82         chown -R discourse:www-data /shared/log/rails
  83         LD_PRELOAD=$RUBY_ALLOCATOR HOME=/home/discourse USER=discourse exec chpst -u discourse:www-data -U discourse:www-data bundle exec config/unicorn_launcher -E production -c config/unicorn.conf.rb
  84
  85   - file:
  86      path: /etc/service/nginx/run
  87      chmod: "+x"
  88      contents: |
  89         #!/bin/sh
  90         exec 2>&1
  91         exec /usr/sbin/nginx
  92
  93   - file:
  94      path: /etc/runit/3.d/01-nginx
  95      chmod: "+x"
  96      contents: |
  97        #!/bin/bash
  98        sv stop nginx
  99
 100   - file:
 101      path: /etc/runit/3.d/02-unicorn
 102      chmod: "+x"
 103      contents: |
 104        #!/bin/bash
 105        sv stop unicorn
 106
 107   - exec:
 108       cd: $home
 109       hook: code
 110       cmd:
 111         - git reset --hard
 112         - git clean -f
 113         - git remote set-branches --add origin master
 114         - git pull
 115         - git fetch origin $version
 116         - git checkout $version
 117         - mkdir -p tmp/pids
 118         - mkdir -p tmp/sockets
 119         - touch tmp/.gitkeep
 120         - mkdir -p                    /shared/log/rails
 121         - bash -c "touch -a           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log"
 122         - bash -c "ln    -s           /shared/log/rails/{production,production_errors,unicorn.stdout,unicorn.stderr}.log $home/log"
 123         - bash -c "mkdir -p           /shared/{uploads,backups}"
 124         - bash -c "ln    -s           /shared/{uploads,backups} $home/public"
 125         - chown -R discourse:www-data /shared/log/rails /shared/uploads /shared/backups
 126
 127   - exec:
 128       cmd:
 129         - "cp $home/config/nginx.sample.conf /etc/nginx/conf.d/discourse.conf"
 130         - "rm /etc/nginx/sites-enabled/default"
 131         - "mkdir -p /var/nginx/cache"
 132
 133   - replace:
 134       filename: /etc/nginx/nginx.conf
 135       from: pid /run/nginx.pid;
 136       to: daemon off;
 137
 138   - replace:
 139       filename: "/etc/nginx/conf.d/discourse.conf"
 140       from: /upstream[^\}]+\}/m
 141       to: "upstream discourse {
 142         server 127.0.0.1:3000;
 143       }"
 144
 145   - replace:
 146       filename: "/etc/nginx/conf.d/discourse.conf"
 147       from: /server_name.+$/
 148       to: server_name _ ;
 149
 150   - replace:
 151       filename: "/etc/nginx/conf.d/discourse.conf"
 152       from: /client_max_body_size.+$/
 153       to: client_max_body_size $upload_size ;
 154
 155   - exec:
 156       cmd: echo "done configuring web"
 157       hook: web_config
 158
 159   - exec:
 160       cd: $home
 161       hook: web
 162       cmd:
 163         # ensure we are on latest bundler
 164         - gem update bundler
 165         - chown -R discourse $home
 166
 167   - exec:
 168       cd: $home
 169       hook: bundle_exec
 170       cmd:
 171         - su discourse -c 'bundle install --deployment --verbose --without test --without development --retry 3 --jobs 4'
 172         - su discourse -c 'bundle exec rake db:migrate'
 173         - su discourse -c 'bundle exec rake assets:precompile'
 174
 175   - file:
 176      path: /usr/local/bin/discourse
 177      chmod: +x
 178      contents: |
 179        #!/bin/bash
 180        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/discourse "$@")
 181
 182   - file:
 183      path: /usr/local/bin/rails
 184      chmod: +x
 185      contents: |
 186        #!/bin/bash
 187        # If they requested a console, load pry instead
 188        if [ "$*" == "c" -o "$*" == "console" ]
 189        then
 190         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec pry -r ./config/environment)
 191        else
 192         (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec script/rails "$@")
 193        fi
 194
 195   - file:
 196      path: /usr/local/bin/rake
 197      chmod: +x
 198      contents: |
 199        #!/bin/bash
 200        (cd /var/www/discourse && RAILS_ENV=production sudo -H -E -u discourse bundle exec bin/rake "$@")
 201
 202   - file:
 203      path: /etc/update-motd.d/10-web
 204      chmod: +x
 205      contents: |
 206        #!/bin/bash
 207        echo
 208        echo Use: rails, rake or discourse to execute commands in production
 209        echo
 210
 211   - file:
 212      path: /etc/logrotate.d/rails
 213      contents: |
 214         /shared/log/rails/*.log
 215         {
 216                 rotate 14
 217                 dateext
 218                 daily
 219                 missingok
 220                 notifempty
 221                 delaycompress
 222                 compress
 223                 postrotate
 224                 sv 1 unicorn
 225                 endscript
 226         }
 227
 228   - file:
 229      path: /etc/logrotate.d/nginx
 230      contents: |
 231         /var/log/nginx/*.log {
 232           daily
 233           missingok
 234           rotate 14
 235           compress
 236           delaycompress
 237           notifempty
 238           create 0640 www-data www-data
 239           sharedscripts
 240           postrotate
 241             sv 1 nginx
 242           endscript
 243         }
 244
 245   # move state out of the container this fancy is done to support rapid rebuilds of containers,
 246   # we store anacron and logrotate state outside the container to ensure its maintained across builds
 247   # later move this snipped into an intialization script
 248   # we also ensure all the symlinks we need to /shared are in place in the correct structure
 249   # this allows us to bootstrap on one machine and then run on another
 250   - file:
 251       path: /etc/runit/1.d/00-ensure-links
 252       chmod: +x
 253       contents: |
 254         #!/bin/bash
 255         if [[ ! -L /var/lib/logrotate ]]; then
 256           rm -fr /var/lib/logrotate
 257           mkdir -p /shared/state/logrotate
 258           ln -s /shared/state/logrotate /var/lib/logrotate
 259         fi
 260         if [[ ! -L /var/spool/anacron ]]; then
 261           rm -fr /var/spool/anacron
 262           mkdir -p /shared/state/anacron-spool
 263           ln -s /shared/state/anacron-spool /var/spool/anacron
 264         fi
 265         if [[ ! -d /shared/log/rails ]]; then
 266           mkdir -p /shared/log/rails
 267           chown -R discourse:www-data /shared/log/rails
 268         fi
 269         if [[ ! -d /shared/uploads ]]; then
 270           mkdir -p /shared/uploads
 271           chown -R discourse:www-data /shared/uploads
 272         fi
 273         if [[ ! -d /shared/backups ]]; then
 274           mkdir -p /shared/backups
 275           chown -R discourse:www-data /shared/backups
 276         fi
 277
 278   # change login directory to Discourse home
 279   - file:
 280      path: /root/.bash_profile
 281      chmod: 644
 282      contents: |
 283         cd $home