shadowdaoandClaude Opus 5
e417a908f2
Base image moves from AlmaLinux 9 to 10, which forces two related changes: EPEL repo URL bumps to the el10 release RPM, and tini is replaced with dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the signal forwarding and zombie reaping the wedged-container fix relies on. Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so the server block now uses the separate `http2 on;` directive. Also fixes three issues that affected WebSocket apps (socket.io, ws): - `Connection: upgrade` was hardcoded on every proxied request, including ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade` so only genuine upgrade requests carry it. - No explicit proxy read/send timeout meant idle WebSockets were cut at nginx's 60s default. Set to 600s, which clears any sane heartbeat without pinning connection slots (worker_connections is 512, two per client). - `large_client_header_buffers 2 1k` returned 400 for any single header line over 1KB, which session cookies and bearer tokens routinely exceed. Raised to the nginx default of 4 8k; buffers are allocated on demand, so this only costs memory for requests that need it. Verified by rendering the generated config and running it under nginx with a Node backend: WebSocket handshakes return 101 and reach the upstream 'upgrade' event, polling requests arrive with `Connection: close`, and a 3KB cookie returns 200 where the old buffer setting returned 400. README gains a WebSocket Support section covering the PM2 cluster-mode trap, the concurrency ceiling, and reconnects on memory restarts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
107 lines
3.4 KiB
Bash
Executable File
107 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
if [ -z "$NODEVER" ]; then
|
|
NODEVER="20";
|
|
fi
|
|
|
|
if [ -z "$environment" ]; then
|
|
environment="PROD"
|
|
fi
|
|
|
|
# Create user with proper error handling
|
|
if ! id -u $user >/dev/null 2>&1; then
|
|
echo "Creating user $user with UID $uid"
|
|
adduser -u $uid -m -s /bin/bash $user || {
|
|
echo "Failed to create user $user with UID $uid"
|
|
exit 1
|
|
}
|
|
else
|
|
echo "User $user already exists"
|
|
fi
|
|
|
|
mkdir -p /home/$user/app
|
|
mkdir -p /home/$user/logs/{nginx,nodejs}
|
|
|
|
# Link log directories
|
|
rm -rf /var/log/nginx
|
|
ln -s /home/$user/logs/nginx /var/log/nginx
|
|
ln -s /home/$user/logs/nodejs /var/log/nodejs
|
|
|
|
# Configure nginx for reverse proxy
|
|
/scripts/create-nginx-config.sh
|
|
|
|
# Set ownership and permissions
|
|
chown -R $user:$user /home/$user
|
|
chmod -R 755 /home/$user
|
|
|
|
# Start nginx
|
|
nginx
|
|
|
|
if [[ $environment == 'DEV' ]]; then
|
|
echo "Starting Dev Deployment"
|
|
|
|
# Ensure microdnf is available for installing additional packages in DEV mode
|
|
if ! command -v microdnf &> /dev/null; then
|
|
echo "microdnf not found, installing with dnf..."
|
|
dnf install -y microdnf && dnf clean all
|
|
fi
|
|
|
|
# Install Memcached for session storage in DEV mode with memory limit
|
|
microdnf install -y memcached
|
|
# Start memcached with 32MB memory limit
|
|
nohup memcached -d -u $user -p 11211 -m 32
|
|
|
|
fi
|
|
|
|
# Start cron for log rotation and backups
|
|
/usr/sbin/crond
|
|
|
|
# Create app directory if it doesn't exist
|
|
if [ ! -d /home/$user/app ]; then
|
|
echo "Creating app directory at /home/$user/app"
|
|
mkdir -p /home/$user/app
|
|
chown -R $user:$user /home/$user/app
|
|
fi
|
|
|
|
# If app directory is empty, copy the simple-website example
|
|
if [ -z "$(ls -A /home/$user/app)" ]; then
|
|
echo "App directory is empty, copying simple-website example..."
|
|
cp -r /examples/simple-website/* /home/$user/app/
|
|
chown -R $user:$user /home/$user/app
|
|
echo "Copied simple-website example to provide a working application"
|
|
fi
|
|
|
|
# Now there's always an app in the user directory (either user's or example)
|
|
cd /home/$user/app
|
|
|
|
# Verify user exists and show info
|
|
echo "Verifying user setup:"
|
|
id $user || { echo "ERROR: User $user does not exist!"; exit 1; }
|
|
|
|
# Install dependencies as the user
|
|
echo "Installing npm dependencies as user $user..."
|
|
su -c "npm install" $user
|
|
|
|
# Check if ecosystem.config.js exists, if not generate it
|
|
if [ ! -f /home/$user/app/ecosystem.config.js ]; then
|
|
echo "No ecosystem.config.js found, generating from package.json..."
|
|
/scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
|
|
chown $user:$user /home/$user/app/ecosystem.config.js
|
|
fi
|
|
|
|
# Mirror logs to docker logs in the background.
|
|
# Use -F (capital) so logrotate-recreated files keep streaming.
|
|
tail -F /home/$user/logs/nginx/access.log \
|
|
/home/$user/logs/nginx/error.log \
|
|
/home/$user/logs/nodejs/app.log \
|
|
/home/$user/logs/nodejs/out.log \
|
|
/home/$user/logs/nodejs/error.log 2>/dev/null &
|
|
|
|
# Start PM2 under dumb-init so it becomes PID 1 (with proper signal forwarding
|
|
# and zombie reaping for nginx/crond/memcached children that reparent here).
|
|
# When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
|
|
# restart policy brings the container back.
|
|
# (dumb-init replaces tini, which is not packaged in EPEL 10.)
|
|
echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
|
|
cd /home/$user/app
|
|
exec dumb-init -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon" |