add conf

Dockerfile

@@ -5,5 +5,4 @@ ENTRYPOINT ["/run/entrypoint.sh"]
 
 EXPOSE 80 443
 
-# CMD ["cat", "/etc/store.debug"]
 CMD ["nginx"]

dev/BASE

@@ -47,17 +47,18 @@ RUN \
         --with-http_v2_module && \
     make -j"$(nproc)" && make install
 
+RUN curl -fsSL https://get.acme.sh | sh -s [email protected]
+
 FROM alpine:3.19
 ENV XUSER nginx
 
 RUN apk --no-cache add ca-certificates openssl pcre zlib tzdata git
 
 COPY --from=NGINX /usr/sbin/nginx /usr/sbin/nginx
+COPY --from=NGINX /root/acme.sh /root/acme.sh
 
 # RUN du -sh / >> /etc/store.debug
 
-RUN curl -fsSL https://get.acme.sh | sh -s [email protected]
-
 RUN addgroup -S ${XUSER} && \
     adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G ${XUSER} ${XUSER}
 

entrypoint.sh

@@ -4,43 +4,67 @@ set -e
 
 sleep 3
 
+# _default_domain="localhost"
+# _default_name="AIII"
+# _default_port="9100"
+# _default_token="0XFF23333333333FFFFFF"
+
+# _domain="${DOMAIN:-$_default_domain}"
+# _name="${AI_SERVICE_NAME:-$_default_name}"
+# _port="${AI_SERVICE_PORT:-$_default_port}"
+# _token="${CLOUDFLARE_DNS_API_TOKEN:-$_default_token}"
+
+NG_CONF=/etc/nginx/nginx.conf
+
 mkdir -p /var/log/nginx
+mkdir -p /etc/nginx/conf.d
 mkdir -p /etc/nginx/html
 mkdir -p /etc/nginx/ssl
 
-cat <<EOF | tee /etc/nginx/nginx.conf
-
-daemon off;
-worker_processes auto;
-error_log stderr notice;
-pid /run/nginx.pid;
-include /etc/nginx/modules-enabled/*.conf;
+cat <<'EOF' | tee /etc/nginx/conf.d/gzip.conf
+types_hash_max_size 2048;
+server_names_hash_bucket_size 256;
+
+gzip on;
+gzip_vary on;
+gzip_proxied any;
+gzip_comp_level 6;
+gzip_buffers 16 8k;
+gzip_http_version 1.1;
+gzip_types text/plain text/css text/xml text/javascript application/json application/javascript  application/xml application/xml+rss application/sla application/vnd.ms-pki.stl;
+EOF
 
-events {
-    worker_connections 1024;
-    multi_accept on;
-    use epoll;
-}
+cat <<'EOF' | tee /etc/nginx/conf.d/log.conf
+access_log /var/log/nginx/access.log warn;
+error_log /var/log/nginx/error.log warn;
+log_format main '$remote_addr - $remote_user [$time_local] '
+                '"$request" $status $body_bytes_sent "$http_referer" '
+                '"$http_user_agent" "$http_x_forwarded_for"';
+EOF
 
-http {
-    charset utf-8;
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-    include /etc/nginx/conf.d/*.conf;
+cat <<'EOF' | tee /etc/nginx/conf.d/tcp.conf
+sendfile on;
+tcp_nopush on;
+tcp_nodelay on;
+port_in_redirect off;
+server_name_in_redirect on;
+keepalive_timeout 65;
+set_real_ip_from 127.0.0.1;
+real_ip_header proxy_protocol;
+EOF
 
-    server {
-        listen       80;
-        server_name  localhost;
-        location / {
-            root   html;
-            index  index.html index.htm;
-        }
-        error_page   500 502 503 504  /50x.html;
-        location = /50x.html {
-            root   html;
-        }
-    }
-}
+cat <<'EOF' | tee /etc/nginx/conf.d/ssl.conf
+server_tokens off;
+ssl_prefer_server_ciphers on;
+ssl_protocols TLSv1.3 TLSv1.2;
+ssl_ecdh_curve secp384r1;
+ssl_session_cache shared:SSL:40m;
+ssl_session_tickets off;
+ssl_session_timeout 21h;
+ssl_stapling on;
+ssl_stapling_verify on;
+ssl_buffer_size 4k;
+ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS:ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
 EOF
 
 cat <<EOF | tee /etc/nginx/mime.types
@@ -152,4 +176,41 @@ working. Further configuration is required.</p>
 </html>
 EOF
 
+
+if [ ! -e $NG_CONF ]; then
+cat <<EOF | tee $NG_CONF
+
+daemon off;
+worker_processes auto;
+error_log stderr notice;
+pid /run/nginx.pid;
+
+events {
+    worker_connections 1024;
+    multi_accept on;
+    use epoll;
+}
+
+http {
+    charset utf-8;
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    include /etc/nginx/conf.d/*.conf;
+
+    server {
+        listen       80;
+        server_name  localhost;
+        location / {
+            root   html;
+            index  index.html index.htm;
+        }
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   html;
+        }
+    }
+}
+EOF
+fi
+
 exec "$@"