Skip to content

Commit 39c0e96

Browse files
codeyourwebcodeyourweb
committed
application env (dev / prod) & 3rd party integration correction
1 parent 1fb6063 commit 39c0e96

File tree

13 files changed

+394
-28
lines changed

13 files changed

+394
-28
lines changed

‎.env‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
COMPOSE_PROFILES=sftp,phpmyadmin,kibana,internal-monitoring
2+
APP_ENV=prod
23
ELASTICSEARCH_CLUSTER_MODE=single-node
34
SENTINELKIT_FRONTEND_HOSTNAME=sentinel-kit.local
45
SENTINELKIT_BACKEND_HOSTNAME=backend.sentinel-kit.local

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
/.env.local.php
33
/.env.*.local
44
/config/caddy_server/certificates/*
5-
/config/yara_ruleset/*
6-
/config/sigma_ruleset/*
75
/config/elastalert_ruleset/*
86
/config/backend/*
97
/data/caddy_logs/*
108
/data/ftp_data/*
119
/data/grafana/*
1210
/data/kibana/*
11+
/data/rulesets/yara_ruleset/*
12+
/data/rulesets/sigma_ruleset/*
1313
/data/fluentbit_db/*
1414
/data/log_ingest_data/evtx/*
1515
/data/log_ingest_data/auditd/*
@@ -19,6 +19,7 @@
1919
/data/yara_triage_data/*
2020
/docs/graphs/*.bkp
2121
/sentinel-kit_server_frontend/node_modules/*
22+
/sentinel-kit_server_frontend/dist/*
2223
/sentinel-kit_server_frontend/package-lock.json
2324
/sentinel-kit_server_backend/composer.lock
2425
/sentinel-kit_server_backend/.initial_setup_done

‎config/docker-config/Dockerfile.backend‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
FROM php:8.2-fpm-alpine
1+
FROM php:8.5-fpm-alpine
22

33
RUN apk update && \
4-
apk add --no-cache icu-dev zip libzip-dev bash && \
4+
apk add --no-cache icu-dev zip libzip-dev bash nginx curl && \
55
docker-php-ext-install intl pdo pdo_mysql zip
66

77
RUN apk add --no-cache libpng-dev libjpeg-turbo-dev libwebp-dev libxpm-dev freetype-dev python3 pipx && \
@@ -22,8 +22,16 @@ RUN curl -1sLf 'https://dl.cloudsmith.io/public/symfony/stable/setup.alpine.sh'
2222

2323
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
2424

25+
COPY config/docker-config/nginx-backend.conf /etc/nginx/nginx.conf
26+
COPY config/docker-config/backend-php-fpm.conf /usr/local/etc/php-fpm.d/www.conf
27+
RUN mkdir -p /run/nginx /var/log/nginx && \
28+
chown -R nginx:nginx /var/log/nginx /run/nginx
29+
2530
RUN chown -R www-data:www-data /var/www/html && chown -R www-data:www-data /detection-rules
26-
# Note: We start as root to fix permissions of mounted volumes, then switch to www-data in entrypoint
31+
32+
COPY config/docker-config/backend-entrypoint.sh /opt/server-backend/backend-entrypoint.sh
33+
RUN chmod +x /opt/server-backend/backend-entrypoint.sh
34+
2735
WORKDIR /var/www/html
2836

2937
ENTRYPOINT ["/bin/sh", "-c", "/opt/server-backend/backend-entrypoint.sh"]

‎config/docker-config/Dockerfile.frontend‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
FROM node:24-alpine
2+
3+
RUN apk add --no-cache nginx curl && npm install -g npm
4+
5+
RUN mkdir -p /run/nginx /var/log/nginx && \
6+
chown -R nginx:nginx /var/log/nginx /run/nginx
7+
8+
COPY config/docker-config/frontend-nginx.conf /etc/nginx/nginx.conf
9+
10+
COPY config/docker-config/frontend-entrypoint.sh /usr/local/bin/frontend-entrypoint.sh
11+
RUN chmod +x /usr/local/bin/frontend-entrypoint.sh
12+
13+
WORKDIR /app
14+
15+
ENTRYPOINT ["/usr/local/bin/frontend-entrypoint.sh"]

‎config/docker-config/Dockerfile.scanner‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ RUN apk update \
88
build-base \
99
mysql-client \
1010
mysql-dev \
11+
curl \
1112
&& rm -rf /var/cache/apk/*
1213

1314
WORKDIR /app

‎config/docker-config/backend-entrypoint.sh‎

Lines changed: 56 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,62 @@
11
#!/bin/sh
2+
3+
echo "=== Sentinel Kit Backend Entrypoint ==="
4+
echo "Environment: $APP_ENV"
5+
26
chown -R www-data:www-data /var/www/html
37
chown -R www-data:www-data /detection-rules
48

9+
setup_symfony() {
10+
MARKER_FILE="/var/www/html/.initial_setup_done"
11+
rm -rf /var/www/html/var/cache
12+
rm -rf /var/www/html/public/bundles
13+
rm -rf /detection-rules/elastalert/*
14+
15+
echo "Installing Composer dependencies..."
16+
composer install
17+
18+
if [ ! -f "$MARKER_FILE" ]; then
19+
echo "Running initial setup..."
20+
sleep 10
21+
rm -rf /var/www/html/migrations/*.php
22+
php /var/www/html/bin/console doctrine:schema:drop --force --full-database
23+
php /var/www/html/bin/console make:migration -n
24+
php /var/www/html/bin/console doctrine:migrations:migrate -n
25+
php /var/www/html/bin/console lexik:jwt:generate-keypair
26+
php /var/www/html/bin/console lexik:jwt:check-config
27+
touch "$MARKER_FILE"
28+
echo "Initial setup completed."
29+
fi
30+
31+
if [ "$APP_ENV" = "prod" ]; then
32+
echo "Warming up production cache..."
33+
php /var/www/html/bin/console cache:clear --env=prod --no-debug
34+
php /var/www/html/bin/console cache:warmup --env=prod --no-debug
35+
else
36+
echo "Clearing development cache..."
37+
php /var/www/html/bin/console cache:clear
38+
fi
39+
}
40+
541
su -s /bin/sh www-data << 'EOF'
6-
MARKER_FILE="/var/www/html/.initial_setup_done"
7-
rm -rf /var/www/html/var/cache
8-
rm -rf /var/www/html/public/bundles
9-
rm -rf /detection-rules/elastalert/*
10-
composer install
11-
if [ ! -f "$MARKER_FILE" ]; then
12-
echo "Running initial setup..."
13-
sleep 10
14-
rm -rf /var/www/html/migrations/*.php
15-
php /var/www/html/bin/console doctrine:schema:drop --force --full-database
16-
php /var/www/html/bin/console make:migration -n
17-
php /var/www/html/bin/console doctrine:migrations:migrate -n
18-
php /var/www/html/bin/console lexik:jwt:generate-keypair
19-
php /var/www/html/bin/console lexik:jwt:check-config
20-
touch "$MARKER_FILE"
21-
fi
22-
echo "Starting Symfony server..."
42+
$(declare -f setup_symfony)
43+
setup_symfony
44+
EOF
45+
46+
if [ "$APP_ENV" = "prod" ]; then
47+
echo "Starting PRODUCTION mode with Nginx + PHP-FPM..."
48+
49+
echo "Starting PHP-FPM..."
50+
php-fpm -D
51+
52+
echo "Starting Nginx on port 8000..."
53+
nginx -g 'daemon off;'
54+
55+
else
56+
echo "Starting DEVELOPMENT mode with Symfony server..."
57+
58+
su -s /bin/sh www-data << 'EOF'
59+
echo "Starting Symfony development server on port 8000..."
2360
symfony server:start --allow-http --port=8000 --listen-ip='0.0.0.0'
24-
EOF
61+
EOF
62+
fi

‎config/docker-config/backend-php-fpm.conf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
; Performance optimizations for production
2+
[global]
3+
daemonize = no
4+
error_log = /proc/self/fd/2
5+
6+
[www]
7+
user = www-data
8+
group = www-data
9+
listen = 127.0.0.1:8000
10+
listen.owner = www-data
11+
listen.group = www-data
12+
13+
; Process management
14+
pm = dynamic
15+
pm.max_children = 50
16+
pm.start_servers = 5
17+
pm.min_spare_servers = 5
18+
pm.max_spare_servers = 35
19+
pm.max_requests = 1000
20+
21+
; Logging
22+
access.log = /proc/self/fd/2
23+
catch_workers_output = yes
24+
25+
; Security
26+
security.limit_extensions = .php
27+
28+
; Performance
29+
request_slowlog_timeout = 10s
30+
slowlog = /proc/self/fd/2
31+
32+
; Environment variables
33+
env[PATH] = /usr/local/bin:/usr/bin:/bin
34+
env[TMP] = /tmp
35+
env[TMPDIR] = /tmp
36+
env[TEMP] = /tmp

‎config/docker-config/frontend-entrypoint.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/sh
2+
3+
echo "=== Sentinel Kit Frontend Entrypoint ==="
4+
echo "Environment: $APP_ENV"
5+
6+
echo "Installing npm dependencies..."
7+
npm install
8+
9+
if [ "$APP_ENV" = "prod" ]; then
10+
echo "Starting frontend in PRODUCTION mode"
11+
12+
if [ ! -d "/app/dist" ]; then
13+
echo "Building application for production..."
14+
npm run build
15+
fi
16+
17+
if [ ! -d "/app/dist" ]; then
18+
echo "ERROR: Build failed - dist directory not found!"
19+
exit 1
20+
fi
21+
22+
echo "Starting nginx on port 3000..."
23+
nginx -g 'daemon off;'
24+
25+
else
26+
echo "Starting in DEVELOPMENT mode"
27+
echo "Starting Vite dev server on port 3000..."
28+
npm run dev -- --host '0.0.0.0' --port 3000
29+
fi

‎config/docker-config/frontend-nginx.conf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
events {
2+
worker_connections 1024;
3+
}
4+
5+
http {
6+
include /etc/nginx/mime.types;
7+
default_type application/octet-stream;
8+
9+
# Logging
10+
access_log /var/log/nginx/access.log;
11+
error_log /var/log/nginx/error.log;
12+
13+
# Performance
14+
sendfile on;
15+
tcp_nopush on;
16+
tcp_nodelay on;
17+
keepalive_timeout 65;
18+
types_hash_max_size 2048;
19+
20+
# Gzip compression
21+
gzip on;
22+
gzip_vary on;
23+
gzip_min_length 1024;
24+
gzip_proxied any;
25+
gzip_comp_level 6;
26+
gzip_types
27+
text/plain
28+
text/css
29+
text/xml
30+
text/javascript
31+
application/javascript
32+
application/xml+rss
33+
application/json;
34+
35+
server {
36+
listen 3000;
37+
server_name localhost;
38+
root /app/dist;
39+
index index.html;
40+
41+
# Security headers
42+
add_header X-Frame-Options "SAMEORIGIN" always;
43+
add_header X-XSS-Protection "1; mode=block" always;
44+
add_header X-Content-Type-Options "nosniff" always;
45+
add_header Referrer-Policy "no-referrer-when-downgrade" always;
46+
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
47+
48+
# Handle client-side routing
49+
location / {
50+
try_files $uri $uri/ /index.html;
51+
}
52+
53+
# Cache static assets
54+
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
55+
expires 1y;
56+
add_header Cache-Control "public, immutable";
57+
}
58+
59+
# Security: deny access to sensitive files
60+
location ~ /\. {
61+
deny all;
62+
}
63+
}
64+
}

0 commit comments

Comments
 (0)