jknapp
55c28a0c11
New paid-tier per-customer image built on litespeedtech/openlitespeed:1.8.4-lsphpNN.
Matrix: 8.1-8.5. Native LSAPI suexec to customer uid, server-level LSCache,
all WP/WooCommerce extensions (memcached, redis, imagick, mbstring, etc.) baked in.
Files:
- Dockerfile.litespeed (FROM prebuilt LiteSpeed base, layers wp-cli/composer/mariadb)
- configs/litespeed/{httpd_config,site-template,lsphp-overrides}.tpl
- scripts/{entrypoint,create-vhost,detect-memory}-litespeed.sh + install-lscache-wp.sh
CI: new Build-LiteSpeed-Images matrix job. OLS_VERSION pinned to 1.8.4 (only
release with prebuilt images for all 5 PHP versions on Docker Hub).
Spec: whp/docs/superpowers/specs/2026-06-01-cac-litespeed-design.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
88 lines
2.7 KiB
Smarty
88 lines
2.7 KiB
Smarty
## OLS vhTemplate for the per-customer vhost. Mirrors the structure of the
|
|
## upstream docker.conf template but with our paths and LSCache wiring.
|
|
## Templated vars (envsubst): $user
|
|
##
|
|
## $VH_NAME, $VH_ROOT, $DOC_ROOT, $SERVER_ROOT are OLS macros — they MUST
|
|
## stay literal in the output (not in the envsubst allow-list).
|
|
|
|
allowSymbolLink 1
|
|
enableScript 1
|
|
restrained 1
|
|
## setUIDMode 2 = DocRoot UID — lsphp suexec's to the OWNER of vhRoot.
|
|
## We chown /home/${user} to ${user}:${user} in the entrypoint, so PHP
|
|
## runs as the customer per request. Container is still the privsep
|
|
## boundary; this is the clean "scripts run as user" model.
|
|
setUIDMode 2
|
|
vhRoot /home/${user}/public_html/
|
|
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
|
|
|
|
virtualHostConfig {
|
|
docRoot $VH_ROOT
|
|
|
|
errorlog /home/${user}/logs/litespeed/error.log {
|
|
useServer 0
|
|
logLevel WARN
|
|
rollingSize 10M
|
|
keepDays 14
|
|
compressArchive 1
|
|
}
|
|
|
|
accesslog /home/${user}/logs/litespeed/access.log {
|
|
useServer 0
|
|
rollingSize 10M
|
|
keepDays 7
|
|
compressArchive 1
|
|
}
|
|
|
|
index {
|
|
useServer 0
|
|
indexFiles index.php, index.html
|
|
autoIndex 0
|
|
}
|
|
|
|
## LSCache plugin owns Cache-Control / Expires entirely — server-level
|
|
## expires off so we don't double-emit headers.
|
|
expires {
|
|
enableExpires 0
|
|
}
|
|
|
|
accessControl {
|
|
allow *
|
|
}
|
|
|
|
context / {
|
|
location $DOC_ROOT/
|
|
allowBrowse 1
|
|
rewrite {
|
|
enable 1
|
|
inherit 0
|
|
autoLoadHtaccess 1
|
|
RewriteFile .htaccess
|
|
}
|
|
addDefaultCharset off
|
|
}
|
|
|
|
rewrite {
|
|
enable 1
|
|
autoLoadHtaccess 1
|
|
logLevel 0
|
|
## Force HTTPS — OLS 1.8 listener-level rewrites don't apply per-vhost,
|
|
## so the redirect lives here. The RewriteCond guards against an infinite
|
|
## loop (SERVER_PORT=80 means "this request came in on the HTTP listener,
|
|
## not HTTPS"). Per-customer .htaccess rules still apply (autoLoadHtaccess).
|
|
RewriteCond %{SERVER_PORT} 80
|
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [L,R=301]
|
|
}
|
|
|
|
## Per-vhost LSCache storage. The server-level `module cache` block in
|
|
## stock httpd_config.conf is already enabled (ls_enabled 1); the LSCWP
|
|
## plugin flips cache on/off per request via X-LiteSpeed-Cache-Control.
|
|
module cache {
|
|
storagePath /home/${user}/lscache
|
|
checkPrivateCache 1
|
|
checkPublicCache 1
|
|
enableCache 0
|
|
enablePrivateCache 0
|
|
}
|
|
}
|