Fix CI

.gitea/workflows/upload-helm.yml

@@ -0,0 +1,25 @@
+name: Upload Helm Chart
+run-name: Uploading helm chart
+on:
+  push:
+    tags: ['*']
+
+jobs:
+  Explore-Gitea-Actions:
+    runs-on: shell
+    env:
+      HELM_CHART_VERSION: "${{ github.ref_name }}"
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: 'v3.0.0'
+      - run: 'sed -i "s/version:.*/version: \"${HELM_CHART_VERSION}\"/" ./Chart/Chart.yaml'
+      - run: helm package ./Chart
+      - name: Upload Helm Chart
+        run: |
+          curl --request POST \
+          --user ${{ secrets.HELM_PKG_UPLOAD_USER }}:${{ secrets.HELM_PKG_UPLOAD_PASS }} \
+          --form "chart=@cloudypress-${HELM_CHART_VERSION}.tgz" \
+          https://git.cloudyne.io/api/packages/helm/helm/api/charts   

.gitlab-ci.yml

@@ -1,5 +1,5 @@
 variables:
-  HELM_CHART_VERSION: "0.8.12"
+  HELM_CHART_VERSION: "0.7.1"
 
 stages:
   - deploy

Chart/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: cloudypress
-description: Helm chart to deploy Wordpress backed by PHP-CLI and Nginx Unit
+description: A helm chart for deploying Wordpress on Cloudyne Hosting
 type: application
-version: "0.8.12"
+version: "0.7.0"
-appVersion: "6.2.2"
+appVersion: "6.1.1"

Chart/templates/configmap.yaml

@@ -28,12 +28,7 @@ data:
     SMTP_FROM_NAME: "V3 Customer Mailer"
     {{- end }}
     
-    {{- if and .Values.site .Values.site.overrideEnvironment }}
-    WP_ENV: "{{ .Values.site.overrideEnvironment }}"
-    {{- else  }}
     WP_ENV: "production"
-    {{- end }}
-
     {{- if .Values.site.overrideMainUrl }}
     WP_HOME: "https://{{ .Values.site.overrideMainUrl }}"
     {{- else }}
@@ -44,16 +39,13 @@ data:
     RUN_COMPOSER: 'true'
     INSTALL_SITE: {{ .Values.site.init.composerPackage }}
     SET_THEME: {{ .Values.site.init.themeName | default "" }}
-    {{- if .Values.site.forceThemeName }}
-    FORCE_THEME_NAME: {{ .Values.site.forceThemeName }}
-    {{- end }}
     {{- end }}
     
     {{- if and .Values.site.init  .Values.site.init.content .Values.site.init.content.import }}
     RUN_IMPORTS: 'true'
     IMPORT_CONTENT: {{ .Values.site.init.content.url }}
     {{- end }}
-
+       
     {{- if and .Values.site.init  .Values.site.init.database .Values.site.init.database.import }}
     RUN_DATABASEIMPORTS: 'true'
     IMPORT_DATABASE: {{ .Values.site.init.database.url }}
@@ -72,143 +64,226 @@ metadata:
     labels:
         {{- include "..labels" . | nindent 8 }}
 data:
-    unit.json: |-
+    www.conf: |-
-        {
+        [www]
-            "settings": {
+        
-                "http": {
-                    "header_read_timeout": 60,
-                    "body_read_timeout": 60,
-                    "idle_timeout": 60,
-                    "max_body_size": 512111110
-                }
-            },
-            "listeners": {
-                "*:8080": {
-                    "pass": "routes"
-                }
-            },
-            "routes": [
-                {
-                    "action": {
-                        "return": 200
-                    },
-                    "match": {
-                        "uri": [
-                            "/unit-ping",
-                            "/fpm-ping"
-                        ]
-                    }
-                },
-                {
-                    "action": {
-                        "return": 404
-                    },
-                    "match": {
-                        "uri": [
-                            "/app/uploads/*.php",
-                            "/app/uploads/*.php/*"
-                        ]
-                    }
-                },
-                {
-                    "action": {
-                        "pass": "applications/php/direct"
-                    },
-                    "match": {
-                        "uri": [
-                            "*.php",
-                            "*.php/*",
-                            "/wp/wp-admin/"
-                        ]
-                    }
-                },
-                {
-                    "action": {
-                        "return": 302,
-                        "location": "/wp/wp-admin"
-                    },
-                    "match": {
-                        "uri": [
-                            "/wp-admin",
-                            "/wp-admin/*"
-                        ]
-                    }
-                },
-                {{- if eq .Values.site.enableWebpRoute "true" }}
-                {
-                    "match": {
-                        "uri": [
-                            "*.jpg",
-                            "*.jpeg",
-                            "*.gif",
-                            "*.png"
-                        ]
-                    },
-                    "action": {
-                        "share": [
-                            "/app/web$uri.webp",
-                            "/app/web$uri"
-                        ],
-                        "fallback": {
-                            "pass": "applications/php/index"
-                        }
 
-                    }
+        {{- if and .Values.global .Values.global.php }}
-                },
+        listen = {{ .Values.global.php.listenAddress | default "127.0.0.1:8123" }}
-                {{- end }}
+        listen.backlog = {{ .Values.global.php.listenBacklog | default "511" }}
-                {
+        
-                    "action": {
+        pm = {{ .Values.global.php.pmMode | default "ondemand" }}
-                        "share": "/app/web$uri",
+        pm.max_children = {{ .Values.global.php.pmMaxChildren | default "100" }}
-                        "fallback": {
+        pm.process_idle_timeout = {{ .Values.global.php.pmProcessIdle | default "30s" }}
-                            "pass": "applications/php/index"
+        pm.max_requests = {{ .Values.global.php.pmMaxRequests | default "1000" }}                
-                        }
+        security.limit_extensions = {{ .Values.global.php.limitExtensions | default ".php" }}
-                    }
+        php_admin_value[expose_php] = {{ .Values.global.php.exposePHP | default "Off" }}
-                }
+        php_admin_value[short_open_tag] = {{ .Values.global.php.shortOpenTag | default "Off" }}
-            ],
+        php_admin_value[disable_functions] = {{ .Values.global.php.disableFunctions | default "exec,passthru,shell_exec,system,proc_open,popen" }}
+        php_value[log_errors] = {{ .Values.global.php.logErrors | default "On" }}
+        php_admin_value[date.timezone] = {{ .Values.customer.timezone | default "Europe/Stockholm" }}
 
-            "applications": {
+        {{- else }}
-                "php": {
+
-                    "type": "php",
+        listen = 127.0.0.1:8123
-                    "options": {
+        listen.backlog = 511
-                        "user": {
+        
-                            "display_errors": "0",
+        pm = ondemand
-                            "log_errors": "1",
+        pm.max_children = 100
-                        },
+        pm.process_idle_timeout = 30s
-                        "admin": {
+        pm.max_requests = 1000                
-                            {{- if and .Values.global .Values.global.php }}
+        security.limit_extensions = .php
-                                "expose_php": "{{ .Values.global.php.exposePHP | default "Off" }}",
+        php_admin_value[expose_php] = Off
-                                "short_open_tag": "{{ .Values.global.php.shortOpenTag | default "Off" }}",
+        php_admin_value[short_open_tag] = Off
-                                "disable_functions": "{{ .Values.global.php.disableFunctions | default "exec,passthru,shell_exec,system,proc_open,popen,show_source" }}",
+        php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,show_source
-                                "log_errors": "{{ .Values.global.php.logErrors | default "On" }}",
+        php_value[log_errors] = On
-                                "date.timezone": "{{ .Values.customer.timezone | default "Europe/Stockholm" }}",
+        
-                            {{- else }}
+        {{- end }}
-                                "expose_php": "Off",
+
-                                "short_open_tag": "Off",
+        ping.path = /fpm-ping
-                                "disable_functions": "exec,passthru,shell_exec,system,proc_open,popen,show_source",
+        listen.allowed_clients = 127.0.0.1
-                                "log_errors": "On",
+        catch_workers_output = yes
-                            {{- end }}
+        php_value[error_log] = /dev/stderr
-                            {{- if .Values.global.php.adminValues }}
+        
-                            {{- range $k, $v := .Values.global.php.adminValues }}
+
-                                "{{ $k }}": "{{ $v }}",
+        {{- if .Values.global.php.adminValues }}
-                            {{- end }}
+        {{- range $k, $v := .Values.global.php.adminValues }}
-                            {{- else }}
+        php_admin_value[{{ $k }}] = {{ $v }}
-                                "memory_limit": "512M",
+        {{- end }}
-                                "upload_max_filesize": "512M",
+        {{- end }}
-                                "post_max_size": "512M",
+
-                                "max_execution_time": "300",
+
-                                "max_input_time": "300"
+    nginx.conf: |
-                            {{- end }}
+        worker_processes auto;
-                        }
+        error_log stderr warn;
-                    },
+        pid /run/nginx/nginx.pid;
-                    "targets": {
+
-                        "direct": {
+        {{- if and .Values.global .Values.global.nginx }}
-                            "root": "/app/web"
+        {{ .Values.global.nginx.globalAdditions | default "" }}
-                        },
+        {{- end }}
-                        "index": {
+
-                            "root": "/app/web",
+        events {
-                            "script": "index.php"
+            {{- if and .Values.global .Values.global.nginx }}
-                        }
+            worker_connections {{ .Values.global.nginx.workerConnections | default "1024" }};
-                    }
+            {{ .Values.global.nginx.eventsAdditions | default "" }}
-                }
+            {{- else }}
-            }
+            worker_connections 1024;
+            {{- end }}
+        }
+
+        http {
+            include mime.types;
+            default_type application/octet-stream;
+
+            disable_symlinks off;
+
+            log_format main_timed '$remote_addr - $remote_user [$time_local] "$request" '
+                                '$status $body_bytes_sent "$http_referer" '
+                                '"$http_user_agent" "$http_x_forwarded_for" '
+                                '$request_time $upstream_response_time $pipe $upstream_cache_status';
+
+            access_log /dev/stdout main_timed;
+            error_log /dev/stderr notice;
+            {{- if and .Values.global .Values.global.nginx }}
+            keepalive_timeout {{ .Values.global.nginx.keepaliveTimeout | default "61" }};
+            {{- else }}
+            keepalive_timeout 61;
+            {{- end }}
+            
+            client_max_body_size 512m;
+            client_body_temp_path /tmp/client_temp;
+            proxy_temp_path /tmp/proxy_temp_path;
+            fastcgi_temp_path /tmp/fastcgi_temp;
+            uwsgi_temp_path /tmp/uwsgi_temp;
+            scgi_temp_path /tmp/scgi_temp;
+
+            server {
+                listen [::]:8080 default_server;
+                listen 8080 default_server;
+                server_name _;
+                {{- if and .Values.global .Values.global.nginx }}
+                sendfile {{ .Values.global.nginx.sendfile | default "off" }};
+                tcp_nodelay {{ .Values.global.nginx.tcpNodelay | default "on" }};
+                absolute_redirect {{ .Values.global.nginx.absoluteRedirects | default "off" }};
+                {{- else }}
+                sendfile off;
+                tcp_nodelay on;
+                absolute_redirect off;
+                {{- end }}
+                
+                {{- if and .Values.site .Values.site.webroot }}
+                root {{ .Values.site.webroot.path | default "/app/web" }};
+                index {{ .Values.site.webroot.indexes | default "index.php index.html index.htm" }};
+                {{- else }}
+                root /app/web;
+                index index.php index.html;
+                {{- end }}
+            
+    
+                location / {
+                    try_files $uri $uri/ /index.php?q=$uri&$args;
+                    {{- if and .Values.global .Values.global.nginx }}
+                    {{ .Values.global.nginx.rootLocationAdditions | default "" }}
+                    {{- end }}
+            
+                }
+
+                location ~* /app/web/app/uploads/.*.php$ {
+                    deny all;
+                }
+
+                location ~* /wp-content/uploads/.*.php$ {
+                    deny all;
+                }
+
+                error_page 500 502 503 504 /50x.html;
+                location = /50x.html {
+                    root /var/lib/nginx/html;
+                }
+
+                location ~ \.php$ {
+                    {{- if and .Values.global .Values.global.nginx }}
+                    fastcgi_buffer_size {{ .Values.global.nginx.fcgiBufferSize | default "128k" }};
+                    fastcgi_buffers {{ .Values.global.nginx.fcgiBuffers | default "4 256k" }};
+                    fastcgi_busy_buffers_size {{ .Values.global.nginx.fcgiBusyBufferSize | default "256k" }};
+                    fastcgi_read_timeout {{ .Values.global.nginx.fcgiReadTimeout | default "300" }};
+                    {{- else }}
+                    fastcgi_buffer_size 128k;
+                    fastcgi_buffers 4 256k;
+                    fastcgi_busy_buffers_size 256k;
+                    fastcgi_read_timeout 300;
+                    {{- end }}
+                    
+                    include fastcgi_params;
+                    fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                    fastcgi_pass 127.0.0.1:8123;
+                    fastcgi_index index.php;
+                    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                    {{- if and .Values.global .Values.global.nginx }}
+                    {{ .Values.global.nginx.phpLocationAdditions | default "" }}
+                    {{- end }}                
+                }
+
+                location ~* \.(jpg|jpeg|webp|gif|png|css|svg|js|ico|xml)$ {
+                    expires 5d;
+                }
+
+                gzip_comp_level     5;
+                gzip_min_length     256;
+                gzip_types
+                    application/atom+xml
+                    application/javascript
+                    application/json
+                    application/rss+xml
+                    application/vnd.ms-fontobject
+                    application/x-font-ttf
+                    application/x-font-opentype
+                    application/x-font-truetype
+                    application/x-javascript
+                    application/x-web-app-manifest+json
+                    application/xhtml+xml
+                    application/xml
+                    font/eot
+                    font/opentype
+                    font/otf
+                    image/svg+xml
+                    image/x-icon
+                    image/vnd.microsoft.icon
+                    text/css
+                    text/plain
+                    text/javascript
+                    text/x-component;
+
+                gzip_disable  "MSIE [1-6]\.(?!.*SV1)";
+                location ~ /\. {
+                    log_not_found off;
+                    deny all;
+                }
+
+                location ~ ^/(fpm-status|fpm-ping)$ {
+                    access_log off;
+                    allow 127.0.0.1;
+                    deny all;
+                    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                    include fastcgi_params;
+                    fastcgi_pass 127.0.0.1:8123;
+                }
+                {{- if and .Values.global .Values.global.nginx }}
+                {{ .Values.global.nginx.serverAdditions | default "" }}
+                {{- end }}
+            
+            }
+
+            proxy_hide_header X-Powered-By;
+            fastcgi_hide_header X-Powered-By;
+            server_tokens off;
+            
+            add_header X-Content-Type-Options nosniff;
+            add_header X-Frame-Options SAMEORIGIN;
+            add_header X-XSS-Protection "1; mode=block";
+            {{- if and .Values.global .Values.global.nginx }}
+            {{ .Values.global.nginx.httpAdditions }}
+            {{- end }}
+            
+            include /etc/nginx/modules/*.conf;
         }

Chart/templates/deployment.yaml

@@ -22,7 +22,7 @@ spec:
         cloudyne.systems/site: {{ .Values.site.url }}
     spec:
       securityContext:
-        fsGroup: 101
+        fsGroup: 65534
       volumes:
         - name: cloud
           persistentVolumeClaim:
@@ -38,9 +38,9 @@ spec:
             allowPrivilegeEscalation: false
             runAsUser: 0
         {{- if .Values.global }}
-          image: {{ .Values.global.initImage | default "ghcr.io/cloudynes/php-cd" }}:{{ .Values.global.imageTag | default "latest" }}
+          image: {{ .Values.global.initImage | default "ghcr.io/cloudynes/php-init" }}:{{ .Values.global.imagetag | default "latest" }}
         {{- else }}
-          image: ghcr.io/cloudynes/php-cd:latest
+          image: ghcr.io/cloudynes/php-init:latest
         {{- end }}
           imagePullPolicy: Always
           volumeMounts:
@@ -65,19 +65,22 @@ spec:
       containers:
         - name: wordpress
           securityContext:
-            runAsUser: 101
+            runAsUser: 65534
         {{- if .Values.global }}
-          image: {{ .Values.global.serverImage | default "ghcr.io/cloudynes/php-unit" }}:{{ .Values.global.imageTag | default "latest" }}
+          image: {{ .Values.global.serverImage | default "ghcr.io/cloudynes/php-nginx" }}:{{ .Values.global.imagetag | default "latest" }}
         {{- else }}
-          image: ghcr.io/cloudynes/php-unit:latest
+          image: ghcr.io/cloudynes/php-nginx:latest
         {{- end }}
           imagePullPolicy: Always
           volumeMounts:
             - name: local
               mountPath: /app
             - name: serverconfig
-              mountPath: /docker-entrypoint.d/unit.json
+              mountPath: /etc/nginx/nginx.conf
-              subPath: unit.json
+              subPath: nginx.conf
+            - name: serverconfig
+              mountPath: /usr/local/etc/php-fpm.d/www.conf
+              subPath: www.conf
           {{- if and .Values.site .Values.site.storage .Values.site.storage.cloud .Values.site.storage.cloud.folders }}
             {{- range $v := .Values.site.storage.cloud.folders }}
             - name: cloud

Chart/templates/externalsecret.yaml

@@ -2,6 +2,7 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
     name: global-secrets-ext
+    namespace: {{ include "..fullname" . }}
     labels:
         {{- include "..labels" . | nindent 8 }}
 spec:

Chart/values.yaml

@@ -44,12 +44,6 @@ site:
   additional_env: {}
   #  MY_ENV_VAR: "value"
 
-  # Whether to enable the webp route
-  # enableWebpRoute: "false"
-
-  # Override the environment. Valid values are production, staging and development
-  # overrideEnvironment: "staging"
-
   # Create sites with another main domain for WP, 
   # but the rest of the components named according to site-tld 
   # overrideMainUrl: ""
@@ -80,9 +74,6 @@ site:
 
     # The name of the theme which the composer package refers to
     themeName: "mycustomer-app-theme"
-    
-    # If needed, force a change of the theme folder name to conform with site requirements
-    # forceThemeName: ""
 
     # Optional: Import content to wp-content directory from zip file
     content: {}
@@ -116,13 +107,13 @@ site:
 # Global configuration
 global:
   # Which image to use for the web server
-  serverImage: ghcr.io/cloudynes/php-unit
+  serverImage: ghcr.io/cloudynes/php-nginx
 
   # Which image to use for the initialization
-  initImage: ghcr.io/cloudynes/php-cd
+  initImage: ghcr.io/cloudynes/php-init
 
   # The tag to use for the above images
-  imageTag: "8.0"
+  imageTag: fpm8.0-alpine3.16
 
   # The database instance where the database will be provisioned
   dbInstance: "kincaid"
@@ -139,15 +130,12 @@ global:
     limitExtensions: ".php"
     exposePHP: "Off"
     shortOpenTag": "Off"
-    disableFunctions: "exec,passthru,shell_exec,system,proc_open,popen,show_source"
+    disableFunctions: "exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,show_source"
     logErrors: "On"
 
     adminValues:
-      memory_limit: "512M"
+      upload_max_filesize: "256M"
-      upload_max_filesize: "512M"
+      post_max_size: "256M"
-      post_max_size: "512M"
-      max_execution_time: "300"
-      max_input_time: "300"
 
   nginx:
     workerConnections: "1024"