Skip to content

Commit ba81594

Browse files
authored
Bugfixes package docker upgrades sep2023 (#39)
* Merge develop to main (#18) * package dependencies, docker-compose file, deployment scripts and nginx configurations updates - Change default branch from master to main - Upgraded package dependencies - Updated docker-compose file - Updated nginx configurations - Updated deployment scripts - Added more nginx configurations - Added volumes to the react service * Updated README.md issues page link * Bugfixes package docker upgrades jan2023 (#37) * Dependency upgrades to latest stable version * Remove unnecessary docker compose version declaration * Added more nginx configurations * Upgraded nginx and debian docker images to latest stable release * Package dependency updates
1 parent d92da70 commit ba81594

File tree

7 files changed

+5958
-7748
lines changed

7 files changed

+5958
-7748
lines changed

docker-compose.yml

-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
version: "3.9"
2-
31
services:
42
reactapp_svc:
53
container_name: reactapp_svc

docker/Dockerfile

+13-18
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# base image
2-
FROM node:16.2.0-alpine as builder
3-
2+
FROM node:19.4.0-alpine as builder
43
# send signal to containers to stop them
54
STOPSIGNAL SIGTERM
65
# create working directory
@@ -13,31 +12,27 @@ COPY package*.json ./
1312
RUN yarn install --silent --non-interactive --frozen-lockfile --ignore-optional
1413
COPY . .
1514
RUN PUBLIC_URL=/ yarn run build
16-
17-
FROM nginx:1.21.0-alpine as reactapp
18-
19-
# Add bash
20-
RUN apk add --no-cache bash
21-
22-
FROM debian:10.10-slim
23-
24-
RUN apt-get update \
25-
&& apt-get install -y nginx openssl \
15+
FROM nginx:1.23.3-alpine as reactapp
16+
# Install a self signed SSL certificate with no locally cached packages
17+
FROM debian:11.6-slim
18+
# Open SSL Version pinning - https://debian.pkgs.org/11/debian-main-amd64/openssl_1.1.1n-0+deb11u3_amd64.deb.html
19+
RUN apt-get update && apt-get install -y --no-install-recommends nginx openssl=1.1.1n-0+deb11u3 \
20+
&& apt-get clean \
21+
&& rm -rf /var/lib/apt/lists/* \
2622
&& openssl req \
2723
-x509 \
28-
-subj "/C=US/ST=TX/L=Austin/O=Home/CN=samwanekeya.com" \
24+
-subj "/C=KE/ST=Nairobi/L=Nairobi/O=Company Name Ltd/OU=Portfolio website/CN=samwanekeya.com" \
2925
-nodes \
3026
-days 365 \
27+
-new \
3128
-newkey rsa:2048 \
3229
-keyout /etc/ssl/private/nginx-selfsigned.key \
3330
-out /etc/ssl/certs/nginx-selfsigned.crt
3431

3532
RUN rm -rf /usr/share/nginx/html/*
36-
COPY --from=builder /usr/src/reactapp/docker/nginx.conf /etc/nginx/nginx.conf
37-
COPY --from=builder /usr/src/reactapp/docker/nginxconfig/general.conf /etc/nginx/general.conf
38-
COPY --from=builder /usr/src/reactapp/docker/nginxconfig/security.conf /etc/nginx/security.conf
33+
COPY --from=builder /usr/src/reactapp/nginx/nginx.conf /etc/nginx/nginx.conf
34+
COPY --from=builder /usr/src/reactapp/nginx/nginxconfig/general.conf /etc/nginx/general.conf
35+
COPY --from=builder /usr/src/reactapp/nginx/nginxconfig/security.conf /etc/nginx/security.conf
3936
COPY --from=builder /usr/src/reactapp/build /usr/share/nginx/html
40-
COPY --from=builder /usr/src/reactapp/.env /usr/share/nginx/html/.env
41-
4237
EXPOSE 80 443
4338
CMD ["/bin/bash", "-c", "nginx -g \"daemon off;\""]

docker/nginx.conf

+148-173
Large diffs are not rendered by default.

docker/nginxconfig/general.conf

+43-45
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,56 @@
1-
# favicon.ico
2-
location = /public/favicon.ico {
3-
log_not_found off;
4-
access_log off;
5-
error_log off;
1+
# assets, media, and static File Caching while allowing safe files
2+
location ~* \.(?:css(\.map)?|js(\.map)?|ttf|ttc|otf|eot|woff2?|svgz?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv|pdf|docx?|dotx?|docm|dotm|xlsx?|xltx?|xlsm|xltm|pptx?|potx?|pptm|potm|ppsx?)$
3+
{
4+
add_header Access-Control-Allow-Origin "*";
5+
add_header Cache-Control "public";
6+
expires 30d;
7+
# Nginx logs every request that hits the server to a log file. If you use analytics to monitor this, you may want to turn this functionality off. Simply edit the access_log directive:
8+
access_log off;
69
}
7-
8-
# assets, media, and Static File Caching while allowing safe files
9-
location ~* \.(?:css(\.map)?|js(\.map)?|ttf|ttc|otf|eot|woff2?|svgz?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv|pdf|docx?|dotx?|docm|dotm|xlsx?|xltx?|xlsm|xltm|pptx?|potx?|pptm|potm|ppsx?)$ {
10-
add_header Access-Control-Allow-Origin "*";
11-
add_header Cache-Control "public";
12-
expires 365d;
13-
# Nginx logs every request that hits the server to a log file. If you use analytics to monitor this, you may want to turn this functionality off. Simply edit the access_log directive:
14-
access_log on;
10+
location /video/
11+
{
12+
# To utilize operating system resources, set the value of this directive to on. sendfile transfers data between file descriptors within the OS kernel space without sending it to the application buffers. This directive will be used to serve small files.
13+
sendfile on;
14+
# This directive enables multi-threading when set to on for write and read operation. Multi-threading is an execution model that allows multiple threads to execute separately from each other whilst sharing their hosting process resources.
15+
aio threads;
16+
# This directive improves cache effectiveness by allowing read and write to be sent directly to the application. directio is a filesystem feature of every modern operating system. This directive will be used to serve larger files like videos.
17+
directio 8m;
18+
# This directive assigns a block size value to the data transfer. It related to the directio directive.
19+
directio_alignment 1024;
1520
}
16-
17-
location /video/ {
18-
# To utilize operating system resources, set the value of this directive to on. sendfile transfers data between file descriptors within the OS kernel space without sending it to the application buffers. This directive will be used to serve small files.
19-
sendfile on;
20-
# This directive enables multi-threading when set to on for write and read operation. Multi-threading is an execution model that allows multiple threads to execute separately from each other whilst sharing their hosting process resources.
21-
aio threads;
22-
# This directive improves cache effectiveness by allowing read and write to be sent directly to the application. directio is a filesystem feature of every modern operating system. This directive will be used to serve larger files like videos.
23-
directio 8m;
24-
# This directive assigns a block size value to the data transfer. It related to the directio directive.
25-
directio_alignment 1024;
26-
}
27-
2821
# define error pages
29-
error_page 401 403 404 /index.html;
30-
location = /index.html {
31-
root /usr/share/nginx/html;
32-
internal;
22+
error_page 401 403 404 /index.html;
23+
location = /index.html
24+
{
25+
root /usr/share/nginx/html;
26+
internal;
27+
}
28+
# Redirect server error pages
29+
error_page 500 502 503 504 /index.html;
30+
location = /
31+
{
32+
root /usr/share/nginx/html;
33+
internal;
3334
}
34-
35-
# redirect server error pages
36-
error_page 500 502 503 504 /index.html;
37-
location = / {
38-
root /usr/share/nginx/html;
39-
internal;
35+
# Log all not found errors for robots.txt but not found notifications
36+
location = /robots.txt
37+
{
38+
log_not_found on;
39+
access_log off;
4040
}
41-
4241
## Only GET, POST, PUT are allowed##
43-
if ($request_method !~ ^(GET|PUT|POST)$ ) {
44-
return 444;
42+
if ($request_method !~ ^(GET|PUT|POST)$ )
43+
{
44+
return 444;
4545
}
4646
## In this case, it does not accept other HTTP method such as HEAD, DELETE, SEARCH, TRACE ##
47-
48-
## Only allow access to these domains/sub-domains samwanekeya.com and localhost
49-
if ($host !~ ^(samwanekeya.com|localhost)$ ) {
50-
return 444;
51-
}
52-
47+
## Only allow access to these domains/sub-domains kakbima.com and localhost
48+
#if ($host !~ ^(accounts.kakbima.com|accounts.kakbima.dev|mua.kakbima.co.ke)$ )
49+
#{
50+
# return 444;
51+
#}
5352
#Gzip can help reduce the amount of network transfer Nginx deals with. However, be careful increasing the gzip_comp_level too high as the server will begin wasting cpu cycles.
5453
#For those using Cloudflare as their CDN this is already taken care of - https://support.cloudflare.com/hc/en-us/articles/200168086-Does-Cloudflare-compress-resources-
55-
5654
#If you want to enable compression, set the value of this directive to on. By default, it is disabled.
5755
#gzip on;
5856
# You can make use of this directive to set the compression level. In order not to waste CPU resources, you need not set the compression level too high. Between 1 and 9, you can set the compression level to 2 or 3.

docker/nginxconfig/security.conf

+17-24
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,35 @@
1-
# deny access to .htaccess files
2-
location ~ /\.ht {
3-
deny all;
4-
error_log off;
5-
log_not_found off;
6-
}
7-
8-
# Deny access to hidden files (beginning with a period)
9-
location ~ /\. {
10-
deny all;
11-
error_log off;
12-
log_not_found off;
13-
}
14-
15-
# Deny access to hidden files (beginning with a period)
16-
location ~ /\. {
1+
# Deny access to filenames starting with dot(.)
2+
location ~ /\.
3+
{
174
deny all;
185
error_log off;
196
log_not_found off;
207
}
21-
22-
# Deny access to . files
23-
location ~ /\.(?!well-known) {
24-
deny all;
8+
# Deny access to specific files/folders
9+
location ~ /(log|README\.md|README\.html|README\.txt|license\.txt|cdn-cgi|yarn\.lock|package\.json|jsconfig\.json|Dockerfile|docker-compose\.yml|craco.config\.js|scripts|nginx) {
10+
deny all;
11+
}
12+
# Allow access to .well-known folder
13+
# For more as to why this is necessary - https://www.rfc-editor.org/rfc/rfc8615
14+
location ~ /\.well-known {
15+
allow all;
2516
}
2617
# config to don't allow the browser to render the page inside an frame or iframe
2718
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
2819
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
2920
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
3021
add_header X-Frame-Options "SAMEORIGIN" always;
22+
# Enable the XSS filter provided by modern web browsers
3123
add_header X-XSS-Protection "1; mode=block";
3224
#Handled by CDN admin
3325
# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
3426
# to disable content-type sniffing on some browsers.
3527
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
36-
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
28+
# currently supported in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
3729
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
3830
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
39-
add_header X-Content-Type-Options "nosniff" always;
31+
# Enable the XSS filter provided by modern web browsers. Can be disabled when using Cloudflare CDN as it is already taken care of
32+
#add_header X-Content-Type-Options "nosniff" always;
4033
# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
4134
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
4235
# this particular website if it was disabled by the user.
@@ -52,6 +45,6 @@ add_header Referrer-Policy "no-referrer-when-downgrade";
5245
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
5346
# add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'";
5447
#Disable this when using Cloudflare CDN as it is already taken care of
55-
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
48+
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
5649
# Prevent search engine indexing
57-
#add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
50+
#add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";

package.json

+6-7
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
{
22
"name": "react-js-hello-world",
33
"description": "A simple example of a dockerized default create React app with Nginx and self signed SSL certificate",
4-
"version": "0.0.4",
54
"private": false,
65
"license": "MIT",
76
"dependencies": {
8-
"@testing-library/jest-dom": "^5.14.1",
9-
"@testing-library/react": "^12.0.0",
10-
"@testing-library/user-event": "^13.1.9",
11-
"react": "^17.0.2",
12-
"react-dom": "^17.0.2",
13-
"react-scripts": "4.0.3"
7+
"@testing-library/jest-dom": "^5.16.5",
8+
"@testing-library/react": "^13.4.0",
9+
"@testing-library/user-event": "^14.4.3",
10+
"react": "^18.2.0",
11+
"react-dom": "^18.2.0",
12+
"react-scripts": "5.0.1"
1413
},
1514
"scripts": {
1615
"start": "react-scripts start",

0 commit comments

Comments
 (0)