feat: switch to FrankenPHP (#460)

This commit is contained in:
Kévin Dunglas
2023-09-20 16:53:05 +02:00
committed by GitHub
parent b5710da39c
commit 88f5c19cac
17 changed files with 93 additions and 148 deletions

View File

@@ -85,16 +85,3 @@ docker compose -f docker-compose.yml -f docker-compose.prod.yml up --wait
If you want to deploy your app on a cluster of machines, you can use [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/),
which is compatible with the provided Compose files.
To deploy on Kubernetes, take a look at [the Helm chart provided with API Platform](https://api-platform.com/docs/deployment/kubernetes/), which can be easily adapted for use with Symfony Docker.
## Configuring a Load Balancer or a Reverse Proxy
Since Caddy 2.5, XFF values of incoming requests will be ignored to prevent spoofing.
So if Caddy is not the first server being connected to by your clients (for example when a CDN is in front of Caddy), you may configure `trusted_proxies` with a list of IP ranges (CIDRs) from which incoming requests are trusted to have sent good values for these headers.
As a shortcut, `private_ranges` may be configured to trust all private IP ranges.
```diff
-php_fastcgi unix//var/run/php/php-fpm.sock
+php_fastcgi unix//var/run/php/php-fpm.sock {
+ trusted_proxies private_ranges
+}
```

View File

@@ -7,11 +7,11 @@ You must add the authority to the trust store of the host :
```
# Mac
$ docker cp $(docker compose ps -q caddy):/data/caddy/pki/authorities/local/root.crt /tmp/root.crt && sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/root.crt
$ docker cp $(docker compose ps -q php):/data/caddy/pki/authorities/local/root.crt /tmp/root.crt && sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/root.crt
# Linux
$ docker cp $(docker compose ps -q caddy):/data/caddy/pki/authorities/local/root.crt /usr/local/share/ca-certificates/root.crt && sudo update-ca-certificates
$ docker cp $(docker compose ps -q php):/data/caddy/pki/authorities/local/root.crt /usr/local/share/ca-certificates/root.crt && sudo update-ca-certificates
# Windows
$ docker compose cp caddy:/data/caddy/pki/authorities/local/root.crt %TEMP%/root.crt && certutil -addstore -f "ROOT" %TEMP%/root.crt
$ docker compose cp php:/data/caddy/pki/authorities/local/root.crt %TEMP%/root.crt && certutil -addstore -f "ROOT" %TEMP%/root.crt
```
## Using Custom TLS Certificates
@@ -23,16 +23,17 @@ For instance, to use self-signed certificates created with [mkcert](https://gith
1. Locally install `mkcert`
2. Create the folder storing the certs:
`mkdir docker/caddy/certs -p`
`mkdir frankenphp/certs -p`
3. Generate the certificates for your local host (example: "server-name.localhost"):
`mkcert -cert-file docker/caddy/certs/tls.pem -key-file docker/caddy/certs/tls.key "server-name.localhost"`
4. Add these lines to the `./docker-compose.override.yml` file about `CADDY_EXTRA_CONFIG` environment and volume for the `caddy` service :
`mkcert -cert-file frankenphp/certs/tls.pem -key-file frankenphp/certs/tls.key "server-name.localhost"`
4. Add these lines to the `./docker-compose.override.yml` file about `CADDY_EXTRA_CONFIG` environment and volume for the `php` service :
```diff
caddy:
+ environment:
php:
environment:
+ CADDY_EXTRA_CONFIG: "tls /etc/caddy/certs/tls.pem /etc/caddy/certs/tls.key"
# ...
volumes:
+ - ./docker/caddy/certs:/etc/caddy/certs:ro
- ./public:/srv/app/public:ro
+ - ./frankenphp/certs:/etc/caddy/certs:ro
- ./public:/app/public:ro
```
5. Restart your `caddy` container
5. Restart your `php` service

View File

@@ -29,7 +29,7 @@ First, [create a PHP debug remote server configuration](https://www.jetbrains.co
* Port: `443`
* Debugger: `Xdebug`
* Check `Use path mappings`
* Absolute path on the server: `/srv/app`
* Absolute path on the server: `/app`
You can now use the debugger!