hoellen/dockerfiles
1
0
Fork 0
mirror of https://github.com/hoellen/dockerfiles.git synced 2025-04-20 04:19:18 +00:00
Code Issues Projects Releases Wiki Activity

boring-nginx: fix build, remove old patches

Browse Source
This commit is contained in:
Wonderfall 2016-10-11 18:59:35 +02:00
parent 08e28c83b0
commit c7d2b5d9c1
2 changed files with 16 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
boring-nginx/Dockerfile
View File

@ -1,4 +1,4 @@
FROM alpine:3.4 FROM alpine:edge
MAINTAINER Wonderfall <wonderfall@schrodinger.io> MAINTAINER Wonderfall <wonderfall@schrodinger.io>
ENV UID=991 GID=991 ENV UID=991 GID=991
@ -59,10 +59,6 @@ RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/a
&& if [ "${FINGERPRINT}" != "${GPG_NGINX}" ]; then echo "Warning! Wrong GPG fingerprint!" && exit 1; fi \ && if [ "${FINGERPRINT}" != "${GPG_NGINX}" ]; then echo "Warning! Wrong GPG fingerprint!" && exit 1; fi \
&& echo "All seems good, now unpacking ${NGINX_TARBALL}..." \ && echo "All seems good, now unpacking ${NGINX_TARBALL}..." \
&& tar xzf ${NGINX_TARBALL} && cd nginx-${NGINX_VERSION} \ && tar xzf ${NGINX_TARBALL} && cd nginx-${NGINX_VERSION} \
&& wget -q https://raw.githubusercontent.com/felixbuenemann/sslconfig/updated-nginx-1.9.15-spdy-patch/patches/nginx_1_9_15_http2_spdy.patch -O spdy.patch \
&& patch -p1 < spdy.patch \
&& wget -q https://raw.githubusercontent.com/cloudflare/sslconfig/master/patches/nginx__dynamic_tls_records.patch \
&& patch -p1 < nginx__dynamic_tls_records.patch \
&& patch -p1 < /tmp/boring.patch \ && patch -p1 < /tmp/boring.patch \
&& ./configure \ && ./configure \
--prefix=/etc/nginx \ --prefix=/etc/nginx \
@ -71,7 +67,6 @@ RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/a
--with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -L ../boringssl/.openssl/lib" \ --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -L ../boringssl/.openssl/lib" \
--with-http_ssl_module \ --with-http_ssl_module \
--with-http_v2_module \ --with-http_v2_module \
--with-http_spdy_module \
--with-http_gzip_static_module \ --with-http_gzip_static_module \
--with-http_stub_status_module \ --with-http_stub_status_module \
--with-file-aio \ --with-file-aio \
@ -112,8 +107,8 @@ EXPOSE 8000 4430
VOLUME /sites-enabled /www /conf.d /passwds /certs /var/log/nginx VOLUME /sites-enabled /www /conf.d /passwds /certs /var/log/nginx
LABEL description="nginx built from source." \ LABEL description="nginx built from source" \
openssl="BoringSSL" \ openssl="BoringSSL" \
nginx="nginx ${NGINX_VERSION}." nginx="nginx ${NGINX_VERSION}"
CMD ["run.sh"] CMD ["run.sh"]

25
boring-nginx/README.md
View File

@ -3,21 +3,22 @@
![](https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/115px-Nginx_logo.svg.png) ![](https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/115px-Nginx_logo.svg.png)
#### What is this? #### What is this?
It is nginx statically linked against BoringSSL, with embedded Brotli support. Secured by default (no root processes, even the master one), it should be safe to use... This is nginx statically linked against BoringSSL, with embedded Brotli support.
#### Features #### Features
- Based on Alpine Linux. - Based on Alpine Linux.
- nginx built against **BoringSSL**. - nginx built against **BoringSSL**.
- nginx : securely built using hardening gcc flags. - Built using hardening gcc flags.
- nginx : HTTP/2 (+NPN) support. - TTP/2 (+NPN) support.
- nginx : Brotli compression support (and configured). - Brotli compression support (and configured).
- nginx : no root master process. - No root master process.
- nginx : AIO Threads support. - AIO Threads support.
- nginx : no unnessary modules (except fastcgi). - No unnessary modules (except fastcgi).
- nginx : pcre jit enabled. - PCRE-jit enabled.
- nginx : optimized configuration. - Strong configurations included.
- ngxpasswd : generates a htpasswd file easily. - Anonymous webserver signature (headers-more).
- ngxproxy : generates a *proxy vhost* after asking you a few questions. - ngxpasswd : generates a htpasswd file.
- ngxproxy : generates a proxy virtual host file.
#### Notes #### Notes
- It is required to change the `listen` directive to 8000/4430 instead of 80/443. - It is required to change the `listen` directive to 8000/4430 instead of 80/443.
@ -36,7 +37,7 @@ It is nginx statically linked against BoringSSL, with embedded Brotli support. S
#### Build-time variables #### Build-time variables
- **NGINX_VERSION** : version of nginx - **NGINX_VERSION** : version of nginx
- **GPG_NGINX** : fingerprint of signing key package - **GPG_NGINX** : fingerprint of signing key package
- **SIGNATURE** : HTTP signature of nginx, default is *secret* - **
#### Environment variables #### Environment variables
- **GID** : nginx group id *(default : 991)* - **GID** : nginx group id *(default : 991)*