begin

riabenkyi/.gitignore

@@ -0,0 +1,5 @@
+.env
+db/data/
+nginx/logs/
+php/logs/
+php/sessions/

riabenkyi/docker-compose.yml

@@ -0,0 +1,68 @@
+version: "3.9"
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: riabenkyi_nginx
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx/conf/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./src:/var/www/html:ro
+      - ./nginx/logs:/var/log/nginx
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    depends_on:
+      - php
+    networks:
+      - appnet
+      - proxy-net
+    restart: unless-stopped
+
+  php:
+    build: ./php
+    container_name: riabenkyi_php
+    volumes:
+      - /opt/apps/riabenkyi/src:/var/www/html
+      - /opt/apps/riabenkyi/php/sessions:/var/lib/php/sessions
+      - /opt/apps/riabenkyi/php/logs:/var/log/php
+    networks:
+      - appnet
+    restart: unless-stopped
+
+  empty:
+    image: alpine:3.20
+    container_name: riabenkyi_placeholder
+    command: ["sleep", "infinity"]
+    volumes:
+      - /opt/apps/riabenkyi/db/data:/data
+    networks:
+      - appnet
+    restart: unless-stopped
+
+  api:
+    build: ./python
+    container_name: riabenkyi_api
+    hostname: riabenkyi-api
+    volumes:
+      - ./python/app:/app
+    networks:
+      - appnet
+    restart: unless-stopped
+
+
+  certbot:
+    image: certbot/certbot
+    container_name: riabenkyi_certbot
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+
+networks:
+  appnet:
+    driver: bridge
+  proxy-net:
+    external: true  

riabenkyi/nginx/conf/default.conf

@@ -0,0 +1,95 @@
+server {
+    listen 80;
+    server_name riabenkyi.nl www.riabenkyi.nl;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name riabenkyi.nl www.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    root /var/www/html;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php$ {
+        fastcgi_pass php:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+    }
+}
+
+server {
+    listen 80;
+    server_name api.riabenkyi.nl;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name api.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    location / {
+        proxy_pass http://api:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 80;
+    server_name git.riabenkyi.nl;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        client_max_body_size 512M;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name git.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 512M;
+    }
+}

riabenkyi/php/Dockerfile

@@ -0,0 +1,5 @@
+FROM php:8.3-fpm-alpine
+
+WORKDIR /var/www/html
+
+# (docker-php-ext-install pdo_mysql)

riabenkyi/python/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app/ .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

riabenkyi/python/app/main.py

@@ -0,0 +1,11 @@
+from fastapi import FastAPI
+
+app = FastAPI()
+
+@app.get("/")
+def read_root():
+    return {"status": "ok", "service": "riabenkyi-api"}
+
+@app.get("/health")
+def health():
+    return {"health": "ok"}

riabenkyi/python/requirements.txt

@@ -0,0 +1,2 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6

riabenkyi/scripts/renew-and-reload.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+cd /opt/apps/riabenkyi
+docker compose run --rm --entrypoint "certbot" certbot renew --quiet
+docker compose exec nginx nginx -s reload

riabenkyi/src/index.php

@@ -0,0 +1,2 @@
+<?php
+echo "Hello from PHP container! Host: " . gethostname();