feat(shared-ols): shared OpenLiteSpeed tier image (webserver-only, fronts cac-lsphp sidecars)
One OLS container fronting many tenants' detached cac-lsphp sidecars — the
OLS analogue of shared-httpd. Runs NO PHP locally; every site's PHP goes to
its own sidecar over LSAPI (extProcessor type lsapi, address <sidecar>:9000).
Key design fact (established by PoC): OLS has NO top-level 'include' directive,
so render-shared-ols-config.sh assembles httpd_config.conf from the panel's
per-site files (vhconf.conf + site.meta) at boot and on every change — the
'include' OLS lacks. Per-site detail uses the OLS-native configFile +
vhost-scoped extprocessor model. LSCache is module-level (a configFile-loaded
vhost rejects a bare cache{} block); the WP LiteSpeed plugin controls
cacheability via X-LiteSpeed-Cache-Control headers.
- Dockerfile.shared-ols: litespeed base + inotify-tools/envsubst/openssl,
admin bound to loopback, :80/:443 self-signed, healthz HEALTHCHECK.
- entrypoint-shared-ols.sh: cert + health vhost + render + watcher, then
daemon-mode OLS supervision (reused from cac-litespeed so self-restarts
don't kill PID 1).
- render-shared-ols-config.sh: strip stock (incl local lsphp) + append base +
per-site stanzas + listeners with all maps + catch-all health vhost.
- ols-htaccess-watcher.sh: inotify debounce+floor -> lswsctrl restart (spec 5.3).
- configs/shared-ols/{httpd_config_base,vhconf}.tpl.
- CI: Build-Shared-OLS job.
Verified locally end-to-end: zero-site boot healthy on :443; add site via the
panel contract -> Host-routed to the right sidecar (SAPI=litespeed); real
client IP + HTTPS behind X-Forwarded headers; LSCache miss->hit; .htaccess
change triggers graceful restart; unknown Host hits health catch-all (200).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
125
scripts/render-shared-ols-config.sh
Normal file
125
scripts/render-shared-ols-config.sh
Normal file
@@ -0,0 +1,125 @@
|
||||
#!/usr/bin/env bash
|
||||
## render-shared-ols-config.sh — assemble httpd_config.conf for the shared-ols
|
||||
## tier from the per-site files the WHP panel drops into $SITES_ROOT.
|
||||
##
|
||||
## WHY THIS EXISTS: OpenLiteSpeed has NO top-level `include` directive (unlike
|
||||
## Apache's IncludeOptional that shared-httpd relies on). So we cannot just drop
|
||||
## per-vhost files in a dir and have OLS pick them up — the listener `map` lines
|
||||
## and the vhost stanzas must live IN httpd_config.conf. This script is the
|
||||
## "include" OLS lacks: it concatenates the panel's per-site pieces into one
|
||||
## valid httpd_config.conf, then the caller issues `lswsctrl restart`.
|
||||
## (Empirically established 2026-06-10 — see the OLS-tier PoC.)
|
||||
##
|
||||
## Per-site contract — the panel writes, for each site, a directory:
|
||||
## $SITES_ROOT/<vhname>/vhconf.conf (rendered from configs/shared-ols/vhconf.tpl)
|
||||
## $SITES_ROOT/<vhname>/site.meta (shell: VHNAME, VHROOT, DOMAINS="a.com,www.a.com")
|
||||
## This script turns each into a `virtualhost {configFile}` stanza + a listener
|
||||
## `map` line. A site dir missing either file is skipped (logged).
|
||||
##
|
||||
## Idempotent: always rebuilds from the stock config, so re-runs never compound.
|
||||
set -euo pipefail
|
||||
|
||||
LSWS_CONF=/usr/local/lsws/conf
|
||||
TPL_DIR=${TPL_DIR:-/etc/shared-ols-templates}
|
||||
SITES_ROOT=${SITES_ROOT:-$LSWS_CONF/shared-sites}
|
||||
LSCACHE_ROOT=${LSCACHE_ROOT:-/var/lscache}
|
||||
CERT_FILE=${CERT_FILE:-$LSWS_CONF/cert/shared-ols.crt}
|
||||
KEY_FILE=${KEY_FILE:-$LSWS_CONF/cert/shared-ols.key}
|
||||
export LSCACHE_ROOT
|
||||
|
||||
OUT="$LSWS_CONF/httpd_config.conf"
|
||||
STOCK="/usr/local/lsws/.conf/httpd_config.conf"
|
||||
|
||||
mkdir -p "$SITES_ROOT" "$LSCACHE_ROOT"
|
||||
|
||||
## --- 1. start from a pristine stock config (idempotent) ---
|
||||
if [ ! -f "$STOCK" ]; then
|
||||
## Some image builds keep the only copy at conf/; snapshot it once so future
|
||||
## renders have a clean base to strip.
|
||||
mkdir -p "$(dirname "$STOCK")"
|
||||
cp "$OUT" "$STOCK"
|
||||
fi
|
||||
|
||||
## --- 2. strip stock blocks that conflict or would run PHP LOCALLY ---
|
||||
## extProcessor lsphp (autoStart 1, uds) + the server scriptHandler are removed
|
||||
## so this server NEVER executes PHP itself — all PHP goes to remote sidecars.
|
||||
## listener HTTP/HTTPS + vhTemplate docker are removed (we add our own).
|
||||
awk '
|
||||
/^listener HTTP \{/ { skip=1; next }
|
||||
/^listener HTTPS \{/ { skip=1; next }
|
||||
/^vhTemplate docker ?\{/ { skip=1; next }
|
||||
/^extProcessor lsphp ?\{/{ skip=1; next }
|
||||
/^scriptHandler ?\{/ { skip=1; next }
|
||||
skip && /^\}/ { skip=0; next }
|
||||
!skip { print }
|
||||
' "$STOCK" > "$OUT"
|
||||
|
||||
## --- 3. append our server-level base (real-IP, cache module, no local PHP) ---
|
||||
{
|
||||
echo ""
|
||||
envsubst '${LSCACHE_ROOT}' < "$TPL_DIR/httpd_config_base.tpl"
|
||||
} >> "$OUT"
|
||||
|
||||
## --- 4. emit per-site vhost stanzas + collect listener map lines ---
|
||||
maps=""
|
||||
site_count=0
|
||||
for meta in "$SITES_ROOT"/*/site.meta; do
|
||||
[ -e "$meta" ] || continue
|
||||
sdir=$(dirname "$meta")
|
||||
VHNAME=""; VHROOT=""; DOMAINS=""
|
||||
# shellcheck source=/dev/null
|
||||
. "$meta"
|
||||
if [ -z "$VHNAME" ] || [ -z "$VHROOT" ] || [ -z "$DOMAINS" ] || [ ! -f "$sdir/vhconf.conf" ]; then
|
||||
echo "render-shared-ols: skipping $sdir (incomplete: VHNAME/VHROOT/DOMAINS/vhconf.conf)" >&2
|
||||
continue
|
||||
fi
|
||||
{
|
||||
echo ""
|
||||
echo "virtualhost ${VHNAME} {"
|
||||
echo " vhRoot ${VHROOT}"
|
||||
echo " configFile ${sdir}/vhconf.conf"
|
||||
echo " allowSymbolLink 1"
|
||||
echo " enableScript 1"
|
||||
echo " restrained 1"
|
||||
echo "}"
|
||||
} >> "$OUT"
|
||||
maps="${maps} map ${VHNAME} ${DOMAINS}"$'\n'
|
||||
site_count=$((site_count + 1))
|
||||
done
|
||||
|
||||
## --- 5. ALWAYS add a health vhost mapped to the catch-all so the server is
|
||||
## valid with zero customer sites and HAProxy health checks (which hit by IP /
|
||||
## unknown Host) get a 200. Exact-domain maps above win over this '*'. ---
|
||||
{
|
||||
echo ""
|
||||
echo "virtualhost _health {"
|
||||
echo " vhRoot /usr/local/lsws/shared-ols-health"
|
||||
echo " configFile /usr/local/lsws/shared-ols-health/vhconf.conf"
|
||||
echo " allowSymbolLink 1"
|
||||
echo " enableScript 0"
|
||||
echo "}"
|
||||
} >> "$OUT"
|
||||
maps="${maps} map _health *"$'\n'
|
||||
|
||||
## --- 6. listeners (HTTP :80 + HTTPS :443 self-signed) carrying ALL maps.
|
||||
## HAProxy terminates real TLS and connects to this tier on :443 ssl verify
|
||||
## none (same as shared-httpd), so :443 needs a cert — self-signed is fine. ---
|
||||
{
|
||||
echo ""
|
||||
echo "listener shared_http {"
|
||||
echo " address *:80"
|
||||
echo " secure 0"
|
||||
printf '%s' "$maps"
|
||||
echo "}"
|
||||
echo ""
|
||||
echo "listener shared_https {"
|
||||
echo " address *:443"
|
||||
echo " secure 1"
|
||||
echo " keyFile ${KEY_FILE}"
|
||||
echo " certFile ${CERT_FILE}"
|
||||
printf '%s' "$maps"
|
||||
echo "}"
|
||||
} >> "$OUT"
|
||||
|
||||
chown -R lsadm:nogroup "$LSWS_CONF" 2>/dev/null || true
|
||||
echo "render-shared-ols: wrote $OUT ($site_count customer vhost(s) + health)"
|
||||
Reference in New Issue
Block a user