hamedandClaude Opus 4.8
5150365d2c
Coolify-doc-driven production hardening of the deploy stack: - run the whole stack as non-root www-data; nginx on 8080 (non-privileged), pid in /tmp, user directive dropped (Coolify routes to any port) - docker/healthcheck.sh: hit real /health route via PHP (not just port probe) - split OPcache config into docker/php/opcache.ini - graceful shutdown: supervisord stopsignal/stopwaitsecs + worker stop_grace_period - APCu intentionally not added (Symfony cache uses redis) - DEPLOY.md: 8080 port, non-root, resource-limit guidance Verified on linux/amd64: non-root uid=82, /health 200, migrations run, worker process healthcheck OK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.0 KiB
Plaintext
34 lines
1.0 KiB
Plaintext
server {
|
|
# Non-privileged port so the whole stack can run as www-data (non-root).
|
|
# Coolify/Traefik routes to whatever port the service exposes — assign 8080
|
|
# as the service port in Coolify.
|
|
listen 8080 default_server;
|
|
server_name _;
|
|
root /app/public;
|
|
|
|
# Symfony front controller
|
|
location / {
|
|
try_files $uri /index.php$is_args$args;
|
|
}
|
|
|
|
location ~ ^/index\.php(/|$) {
|
|
fastcgi_pass 127.0.0.1:9000;
|
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
|
|
fastcgi_param DOCUMENT_ROOT $realpath_root;
|
|
# Forwarded headers from Traefik (Coolify) are trusted via Symfony trusted_proxies
|
|
internal;
|
|
}
|
|
|
|
# Block direct access to any other .php file
|
|
location ~ \.php$ {
|
|
return 404;
|
|
}
|
|
|
|
client_max_body_size 16m; # keep in sync with MAX_FILE_SIZE_BYTES / php.ini
|
|
|
|
error_log /dev/stderr warn;
|
|
access_log /dev/stdout;
|
|
}
|