shadowdaoandClaude Opus 5.5
eaf616eb30
Graceful stop (cac, cac-fpm, shared-httpd, and form-sender which runs cac): entrypoint.sh, entrypoint-fpm.sh and entrypoint-shared-httpd.sh end with bash as PID 1 tailing logs. PID 1 only receives signals it has a handler for, so docker stop's SIGTERM was dropped; docker waited the full 10s and SIGKILLed apache / php-fpm mid-request (exit 137). The entrypoints now trap TERM/INT and stop each daemon they started via the new scripts/stop-services.sh: httpd graceful-stop (WINCH), php-fpm QUIT, crond TERM, each with a bounded wait and a TERM/KILL fallback, budgets summing to < 10s, then exit 0. The log tail is backgrounded + `wait`ed (and shared-httpd's 60s rescan sleep likewise) so the trap runs immediately. Log streaming to docker logs is unchanged. cac-fpm error_log: entrypoint-fpm.sh `touch`ed logs/php-fpm/error.log as root AFTER its chown -R, so on a site's first start the pool (customer uid) could not open it and PHP errors went out as FastCGI stderr to shared-httpd's log until the next restart. The file is now created and chowned to the customer right after the logs dir is made, before php-fpm starts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.5 KiB
Docker
42 lines
1.5 KiB
Docker
FROM almalinux/10-base
|
|
|
|
# Install Apache and minimal dependencies (no PHP at all)
|
|
RUN dnf install -y \
|
|
https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm && \
|
|
dnf update -y && \
|
|
dnf install -y httpd mod_ssl openssl iproute cronie procps curl && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*
|
|
|
|
# Copy scripts and set permissions
|
|
COPY ./scripts/detect-memory.sh /scripts/detect-memory.sh
|
|
COPY ./scripts/create-apache-mpm-config.sh /scripts/create-apache-mpm-config.sh
|
|
COPY ./scripts/log-rotate.sh /scripts/log-rotate.sh
|
|
COPY ./scripts/entrypoint-shared-httpd.sh /scripts/entrypoint-shared-httpd.sh
|
|
COPY ./scripts/stop-services.sh /scripts/stop-services.sh
|
|
COPY ./scripts/tune-mpm.sh /scripts/tune-mpm.sh
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Generate self-signed SSL cert (same as main CAC image)
|
|
RUN openssl req -newkey rsa:2048 -nodes \
|
|
-keyout /etc/pki/tls/private/localhost.key \
|
|
-x509 -days 3650 -subj "/CN=localhost" \
|
|
-out /etc/pki/tls/certs/localhost.crt
|
|
|
|
# Copy Apache configs
|
|
COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
|
|
COPY ./configs/default-index.conf /etc/httpd/conf.d/
|
|
|
|
# Create vhosts directory (will be volume-mounted from host)
|
|
RUN mkdir -p /etc/httpd/conf.d/vhosts
|
|
|
|
# Set up cron job for log rotation
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
EXPOSE 80 443
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD curl -sfk https://localhost/ping || exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint-shared-httpd.sh" ]
|