jknapp
19db8f170a
One OLS container fronting many tenants' detached cac-lsphp sidecars — the
OLS analogue of shared-httpd. Runs NO PHP locally; every site's PHP goes to
its own sidecar over LSAPI (extProcessor type lsapi, address <sidecar>:9000).
Key design fact (established by PoC): OLS has NO top-level 'include' directive,
so render-shared-ols-config.sh assembles httpd_config.conf from the panel's
per-site files (vhconf.conf + site.meta) at boot and on every change — the
'include' OLS lacks. Per-site detail uses the OLS-native configFile +
vhost-scoped extprocessor model. LSCache is module-level (a configFile-loaded
vhost rejects a bare cache{} block); the WP LiteSpeed plugin controls
cacheability via X-LiteSpeed-Cache-Control headers.
- Dockerfile.shared-ols: litespeed base + inotify-tools/envsubst/openssl,
admin bound to loopback, :80/:443 self-signed, healthz HEALTHCHECK.
- entrypoint-shared-ols.sh: cert + health vhost + render + watcher, then
daemon-mode OLS supervision (reused from cac-litespeed so self-restarts
don't kill PID 1).
- render-shared-ols-config.sh: strip stock (incl local lsphp) + append base +
per-site stanzas + listeners with all maps + catch-all health vhost.
- ols-htaccess-watcher.sh: inotify debounce+floor -> lswsctrl restart (spec 5.3).
- configs/shared-ols/{httpd_config_base,vhconf}.tpl.
- CI: Build-Shared-OLS job.
Verified locally end-to-end: zero-site boot healthy on :443; add site via the
panel contract -> Host-routed to the right sidecar (SAPI=litespeed); real
client IP + HTTPS behind X-Forwarded headers; LSCache miss->hit; .htaccess
change triggers graceful restart; unknown Host hits health catch-all (200).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
2.8 KiB
Docker
58 lines
2.8 KiB
Docker
## shared-ols — the shared OpenLiteSpeed webserver tier.
|
|
##
|
|
## One OLS container fronting MANY tenants' detached cac-lsphp sidecars — the
|
|
## OLS analogue of the shared-httpd container. Runs NO PHP locally: every site's
|
|
## PHP goes to its own cac-lsphp:phpNN sidecar over LSAPI (extProcessor type
|
|
## lsapi, address <sidecar>:9000). HAProxy stays the TLS/WAF/SNI edge and routes
|
|
## OLS-type hostnames here on :443.
|
|
##
|
|
## Built on the SAME litespeedtech prebuilt base as cac-litespeed / cac-lsphp so
|
|
## the OLS build + plumbing (lscgid, cgid socket — see feedback_ols_packaging_landmines)
|
|
## are the proven ones. The base is lsphp-tagged but we never run that lsphp;
|
|
## the tag just selects the OLS build. Pinned to lsphp83 / OLS 1.8.4.
|
|
##
|
|
## Config model (established by PoC 2026-06-10): OLS has NO top-level `include`,
|
|
## so render-shared-ols-config.sh assembles httpd_config.conf from the panel's
|
|
## per-site files at boot + on every change. See that script + the plan.
|
|
|
|
ARG OLS_VERSION=1.8.4
|
|
ARG PHPVER=83
|
|
FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
|
|
|
|
## Tooling the shared tier needs on top of the base:
|
|
## - inotify-tools: the .htaccess watcher (spec 5.3)
|
|
## - gettext-base: envsubst for render-shared-ols-config.sh
|
|
## - openssl: self-signed cert for the :443 listener (HAProxy verifies none)
|
|
## - curl/ca-certificates: HEALTHCHECK
|
|
RUN apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
inotify-tools gettext-base openssl ca-certificates curl && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
|
|
|
|
## Snapshot the stock httpd_config.conf so render-shared-ols-config.sh always has
|
|
## a pristine base to strip-and-rebuild from (the base image keeps it at conf/).
|
|
RUN mkdir -p /usr/local/lsws/.conf && \
|
|
cp /usr/local/lsws/conf/httpd_config.conf /usr/local/lsws/.conf/httpd_config.conf
|
|
|
|
COPY ./scripts/entrypoint-shared-ols.sh \
|
|
./scripts/render-shared-ols-config.sh \
|
|
./scripts/ols-htaccess-watcher.sh \
|
|
/scripts/
|
|
RUN chmod +x /scripts/entrypoint-shared-ols.sh /scripts/render-shared-ols-config.sh /scripts/ols-htaccess-watcher.sh
|
|
COPY ./configs/shared-ols/ /etc/shared-ols-templates/
|
|
|
|
## Admin console unreachable from tenant/edge networks (spec 5.2): bind the
|
|
## WebAdmin listener to loopback. Same sed as Dockerfile.litespeed.
|
|
RUN sed -i 's|^[[:space:]]*address[[:space:]]\+\*:| address 127.0.0.1:|' \
|
|
/usr/local/lsws/admin/conf/admin_config.conf 2>/dev/null || true
|
|
|
|
EXPOSE 80 443
|
|
|
|
## Health: the entrypoint renders a catch-all _health vhost serving /healthz, so
|
|
## this passes from boot (zero customer sites) onward. Self-signed :443.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsSk https://127.0.0.1/healthz || exit 1
|
|
|
|
ENTRYPOINT ["/scripts/entrypoint-shared-ols.sh"]
|