Upgrade to panel v0.7.18

Add restart policy. Use Traefik

.gitignore

@@ -1 +0,0 @@
-docker-compose.yml

README.md

@@ -1,4 +1,4 @@
-# pterodactyl-panel-docker
+# Pterodactyl panel Docker container
 > Docker Compose configuration for the [Pterodactyl Panel](https://github.com/Pterodactyl/Panel).
 
 Pterodactyl is an open-source control panel used for hosting numerous game-related
@@ -6,37 +6,45 @@ services, such as Minecraft and Teamspeak servers. Setting it up, however, takes
 quite a few steps according to the [documentation](https://docs.pterodactyl.io/docs).
 
 This Docker Compose configuration is aimed at removing a majority of the steps so
-that the installation process is almost as simple as cloning this build script and
+that the installation process is *almost* as simple as cloning this build script and
 running `docker-compose up`.
 
 There are other Docker Compose setups available, including the [one](https://github.com/parkervcp/pterodactyl-panel-Dockerfile)
-created by one of the project's primary developers, parkervcp. However, I opted
-to create my own for a few reasons:
+created by one of the project's primary developers, parkervcp. This differs from
+those setups in various ways for a couple of different reasons:
 
-1. These setups detract from Docker's "one service per container" philosophy. While
-it might be impossible to completely narrow down such a complex setup to one container,
-there are services, such as PHP and Nginx, that can be separated.
-2. I wanted to add a few alternative services for use in the Panel, such as Nginx
-instead of caddy.
+1. This setup splits the HTTP and PHP services into two different containers. Doing
+so allows for separation of concerns (a central Docker principle) and easier management
+of containers and Dockerfiles.
+2. This setup uses Nginx instead of Caddy. Various [benchmarks](https://community.centminmod.com/threads/caddy-http-2-server-benchmarks.5170/#post-34367)
+[indicate](https://hackernoon.com/caddy-a-modern-web-server-vs-nginx-e9e4abc443e)
+that Nginx performs better than Caddy in handling requests. In addition to this,
+Nginx, while having a more complicated configuration file, doesn't enforce HTTPS,
+a feature of Caddy which only complicates the setup of the HTTP Docker container.
+3. Additionally, if the nginx receives a request from a reverse proxy, it will set the HSTS header
+and redirect to HTTPS automatically. If you do not want this behaviour, adjust the `nginx.conf`
+as you like.
 
 ## Usage
 The instructions are fairly self explanatory: clone the repository and launch the
-stack.
+project. Instructions on how to launch the project are listed below. All commands
+should be run from the repository directory.
+
+In your favorite text editor, open docker-compose.yml change the port that you want
+the panel binded to. See below for more details. Once that's done, build and start
+the project.
 ```
-git clone https://github.com/TehTotalPwnage/pterodactyl-panel-docker mypanel
-cd mypanel
+docker-compose -p <project_name> pull
+docker-compose -p <project_name> build
+docker-compose -p <project_name> up
 ```
-I'd recommend cloning the repository into a specific directory name unless you want
-all your containers to be named pterodactylpaneldocker_service_number.
+The panel is now online. If this is your first time booting the panel, you'll also
+need to run the install script, which will run all of the necessary configuration
+scripts and database migrations for you.
 ```
-vim docker-compose.yml
-```
-In your favorite text editor, change the port that you want the panel binded to.
-There are other settings you may need to modify that are documented below.
-```
-docker-compose pull
-docker-compose build
-docker-compose up
+docker exec -it <project name>_php_1 install
+# Restart the panel to load changes. The install script will remind you to do so.
+docker restart <project name>_php_1
 ```
 The panel should now be ready, and you can connect to it via localhost at the port
 you specified in the Docker Compose file.
@@ -47,22 +55,72 @@ ports:
 ```
 <host port number>:80
 ```
-For the Panel, there are different environment variables that you can configure:
-- `panel_url` - The FQDN that the Panel will be hosted on. Required. (https://mc.example.com)
-- `timezone` - The timezone that the Panel will be hosted on. A list is available at http://php.net/manual/en/timezones.php.
-- `email_driver` - The email driver for the Panel. Options are smtp, mail, mailgun, mandrill, or postmark.
-- `panel_email` - The email address the panel should use. Required for all drivers.
-- `email_name` - The display name emails sent should have. Required for all drivers.
-- `email_user` - A username for the email server. Required for smtp, mandrill, mailgun, and postmark.
-- `email_pass` - A password for the email server. Required for smtp.
-- `email_domain` - The domain the driver should connect to. Required for smtp and mailgun.
-- `email_port` - The port of the email server. Required for smtp.
-- `admin_email` - The email address for the admin user. Required.
-- `admin_first` - The first name for the admin user. Required.
-- `admin_last` - The last name for the admin user. Required.
-- `admin_pass` - The password for the admin user. Required.
-- `admin_username` - The username for the admin user. Required.
+Two scripts are provided in order to aid with installation and upgrades.
+```
+# Use these scripts with the following command:
+docker exec -it <project name>_php_1 <script name>
+- install: Runs all the installation scripts, including migrations and configuration.
+- upgrade: Runs all the steps needed to upgrade to the latest version of the panel.
+```
+Note that depending on how old your version of the panel is, the upgrade command
+may not work. Be sure to check the changelog for each release and make sure your
+version is not listed as not working.
+
+### Upgrading
+**Always remember to back up your data before upgrades! While I do my best to keep
+this Docker Compose configuration stable, there is always the chance that something
+can go horribly wrong! See the next section on how to run backups.**
+
+Upgrading the project is slightly more complex. See the second caveat for an explanation
+as to why.
+
+To upgrade, take down the project and wipe out the panel volume as it interferes
+with the upgrade process.
+```
+docker-compose -p <project name> down
+docker volume rm <project name>_panel
+```
+Rebuild and restart the project.
+```
+docker-compose -p <project name> pull
+docker-compose -p <project name> build
+docker-compose -p <project name> up
+```
+Finally, run the upgrade script.
+```
+docker exec -it <project name>_php_1 upgrade
+# Restart the panel to load changes. The upgrade script will remind you to do so.
+docker restart <project name>_php_1
+```
+
+### Backups
+The volumes that you will need to backup are `db` (database), `env` (configuration),
+and `storage` (stored eggs and other files). These commands only work when the project
+is up (a caveat of Docker).
+```
+# Use mysqldump to back up the database.
+docker exec -it <project name>_db_1 mysqldump -u pterodactyl -ppterodactyl pterodactyl > database.sql
+# You can copy the .env file from the mounted env volume.
+docker cp <project name>_php_1:/var/www/html/env/.env .env
+# You can copy the mounted storage volume.
+docker cp <project name>_php_1:/var/www/html/pterodactyl/storage storage
+```
 
 ## Caveats
-- Do not stop the Docker Compose stack on the first run until supervisor announces
-that the setup is complete! Errors may occur if you kill the process too early!
+- Due to the need for a .env file early on in the build process, it is impossible
+to automatically run an install script, which would depend on checking for the existence
+of a .env file. You will need to manually run the install and upgrade scripts as
+necessary. Their use has been covered in the previous section.
+- The panel volume is required to share data between the HTTP and PHP containers,
+but the existence of this volume interferes with upgrade files due to how Docker
+works. These containers are separated for reasons already outlined, but this does
+mean that this volume must manually be removed on each upgrade.
+- A symbolic link is used to maintain the state of the .env file rather than Docker
+configs because of issues with **Docker itself**. Configs exist, but because they
+are read-only filesystems, they cannot be modified in the container, making their
+maintenance much more complicated. They would also require the use of Docker Swarms
+and Docker Services.
+- This setup is for Docker Compose, **not** for Docker Swarm or Docker Service. These
+two Docker services take much more convoluted configuration, including the setup
+of a swarm and the use of a local image registry, which would only complicate this
+setup.

docker-compose.yml

@@ -1,42 +1,53 @@
-version: "3"
+version: "3.1"
+
 services:
+
     db:
+        image: mariadb
+        restart: unless-stopped
         environment:
             - "MYSQL_DATABASE=pterodactyl"
             - "MYSQL_PASSWORD=pterodactyl"
             - "MYSQL_RANDOM_ROOT_PASSWORD=yes"
             - "MYSQL_USER=pterodactyl"
-        image: mariadb:latest
         networks:
             - default
         volumes:
             - db:/var/lib/mysql
+
     http:
         build:
             context: services/http
             dockerfile: Dockerfile
+        restart: unless-stopped
         depends_on:
             - "php"
         ports:
-            - "80:80"
+            - 80:80
         networks:
             - default
         volumes:
+            - env:/var/www/html/env
             - panel:/var/www/html/pterodactyl
             - storage:/var/www/html/pterodactyl/storage
+
     php:
         build:
             context: services/php
             dockerfile: Dockerfile
+        restart: unless-stopped
         depends_on:
             - "db"
         networks:
             - default
         volumes:
+            - env:/var/www/html/env
             - panel:/var/www/html/pterodactyl
             - storage:/var/www/html/pterodactyl/storage
+
     redis:
         image: redis:alpine
+        restart: unless-stopped
         networks:
             - default
 
@@ -46,5 +57,6 @@ networks:
 
 volumes:
     db:
+    env:
     panel:
     storage:

services/http/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:alpine
+FROM docker.io/library/nginx:alpine
 
 LABEL maintainer="tehtotalpwnage@gmail.com"
 

services/http/nginx.conf

@@ -26,6 +26,12 @@ http {
     keepalive_timeout  65;
 
     #gzip  on;
+    
+    # Set HSTS if forwarded proto is https
+    map $http_x_forwarded_proto $hsts_header {
+      default "";
+      https "max-age=31536000; includeSubDomains;";
+    }
 
     server {
         listen       80 default_server;
@@ -36,6 +42,17 @@ http {
 
         access_log off;
         error_log  /var/log/nginx/pterodactyl.app-error.log error;
+        
+        # Redirect to https
+        if ($http_x_forwarded_proto != "https") {
+            set $shouldRedirectToHTTPS 1;
+        }
+        if ($http_x_forwarded_proto = false) {
+            set $shouldRedirectToHTTPS 0;
+        }
+        if ($shouldRedirectToHTTPS = 1) {
+            return 301 https://$host$request_uri;
+        }
 
         location / {
             try_files $uri $uri/ /index.php?$query_string;
@@ -48,7 +65,8 @@ http {
         location = /robots.txt  { access_log off; log_not_found off; }
 
         sendfile off;
-
+        
+        add_header Strict-Transport-Security $hsts_header;
         add_header X-Content-Type-Options nosniff;
         add_header X-XSS-Protection "1; mode=block";
         add_header X-Robots-Tag none;

services/php/Dockerfile

@@ -1,46 +1,50 @@
-FROM php:7.2-fpm-alpine
+FROM docker.io/library/php:7.3-fpm-alpine
+
+ENV PANEL_VERSION=v0.7.18
 
 # Set up all the dependencies for the PHP container.
-RUN apk add --no-cache curl git supervisor tar unzip
-RUN docker-php-ext-install bcmath
-# https://github.com/docker-library/php/issues/483
-# RUN docker-php-ext-install curl
-# https://stackoverflow.com/questions/39657058/installing-gd-in-docker#39658592
-RUN apk add --no-cache libpng-dev
-RUN docker-php-ext-install gd
-RUN docker-php-ext-install mbstring
-RUN docker-php-ext-install pdo
-RUN docker-php-ext-install pdo_mysql
-RUN docker-php-ext-install tokenizer
-# https://lists.alpinelinux.org/alpine-aports/2526.html
-RUN apk add --no-cache libxml2-dev
-RUN docker-php-ext-install xml
-RUN docker-php-ext-install zip
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+RUN apk add --no-cache curl git supervisor tar unzip; \
+    docker-php-ext-install bcmath; \
+    apk add --no-cache libpng-dev; \
+    docker-php-ext-install gd; \
+    docker-php-ext-install mbstring; \
+    docker-php-ext-install pdo; \
+    docker-php-ext-install pdo_mysql; \
+    docker-php-ext-install tokenizer; \
+    apk add --no-cache libxml2-dev; \
+    docker-php-ext-install xml; \
+    docker-php-ext-install zip; \
+    curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+
+# Set up the server working directories.
+RUN adduser -g '' -D -u 9999 pterodactyl; \
+    mkdir -p /var/www/html/env; \
+    mkdir -p /var/www/html/pterodactyl
 
-# Set up the server working directory.
-RUN adduser -g '' -D -u 9999 pterodactyl
-RUN mkdir -p /var/www/html/pterodactyl
 WORKDIR /var/www/html/pterodactyl
-RUN chown -R pterodactyl:pterodactyl /var/www/html/pterodactyl
+RUN chown -R pterodactyl:pterodactyl /var/www/html/pterodactyl /var/www/html/env
 
 # Deploy panel files.
 USER pterodactyl:pterodactyl
-RUN curl -Lo panel.tar.gz https://github.com/Pterodactyl/Panel/releases/download/v0.7.0/panel.tar.gz
-RUN tar --strip-components=1 -xzvf panel.tar.gz
-RUN cp .env.example .env
-RUN composer install --no-dev
-RUN chmod -R 755 storage/* bootstrap/cache
+RUN curl -Lo panel.tar.gz https://github.com/Pterodactyl/Panel/releases/download/${PANEL_VERSION}/panel.tar.gz; \
+    tar --strip-components=1 -xzvf panel.tar.gz; \
+    cp .env.example /var/www/html/env/.env; \
+    ln -s /var/www/html/env/.env /var/www/html/pterodactyl/.env; \
+    composer install --no-dev --optimize-autoloader; \
+    chmod -R 755 storage/* bootstrap/cache
 
 # Copy the remaining configuration files.
 USER root:root
 RUN mkdir -p /var/log/pterodactyl
+
 COPY install.sh /usr/local/bin/install
-RUN chmod +x /usr/local/bin/install
 COPY upgrade.sh /usr/local/bin/upgrade
-RUN chmod +x /usr/local/bin/upgrade
-COPY schedule /var/spoon/cron/crontabs/schedule
+COPY schedule .
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY www.conf /usr/local/etc/php-fpm.d/www.conf
 
+RUN cat schedule >> /var/spool/cron/crontabs/root; \
+    chmod +x /usr/local/bin/install; \
+    chmod +x /usr/local/bin/upgrade
+
 ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]

services/php/install.sh

@@ -12,13 +12,21 @@ fi
 echo "Are you sure you want to continue the install script? (Y/n)"
 read -n1 run
 
-if [ "$run" = "Y" ]; then
+if [ "$run" = "y" ] || [ "$run" = "Y" ]; then
     echo "Running install script."
     echo "Waiting 15 seconds for MariaDB to be ready."
     sleep 15
 
-    echo "Adding additional parameters to .env file."
-    printf "\n\nTRUSTED_PROXIES=*" >> .env
+    echo "Configure trusted proxies (this will enable reverse proxy functionality)? (Y/n)"
+    read -n1 configureTP
+    if [ "$configureTP" = "y" ] || [ "$configureTP" = "Y" ] || [ "$run" = "" ]; then
+        echo "Please enter a value (comma separated list of allowed IPs, * to allow all) for TRUSTED_PROXIES: [*]"
+        read -n1 configureTPval
+        if [ "$configureTPval" = "" ]; then
+            configureTPval="*" 
+        fi
+        grep -q 'TRUSTED_PROXIES.*' .env && sed -i .env -e 's/TRUSTED_PROXIES.*/TRUSTED_PROXIES='$configureTPval'/' || printf "\nTRUSTED_PROXIES=$configureTPval\n" >> .env
+    fi
     php artisan key:generate --force
 
     echo "Running configuration scripts."

services/php/supervisord.conf

@@ -1,5 +1,6 @@
 [supervisord]
 nodaemon=true
+user=root
 
 [program:cron]
 process_name=%(program_name)s
@@ -10,7 +11,7 @@ user=root
 
 [program:laravel-worker]
 process_name=%(program_name)s_%(process_num)02d
-command=php /var/www/html/pterodactyl/artisan queue:work database --queue=high,standard,low --sleep=3 --tries=3
+command=php /var/www/html/pterodactyl/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3
 autostart=true
 autorestart=true
 user=pterodactyl

services/php/upgrade.sh

@@ -1,18 +1,15 @@
 #!/bin/ash
 
-##
-# This is an install script to quickly upgrade Pterodactyl Panel. Before running,
-# please BACK UP any important data!
-##
 if [ "$(whoami)" != "pterodactyl" ]; then
     echo "Rerunning script as webserver user."
     exec su -c /usr/local/bin/upgrade pterodactyl
 fi
 
+echo "!!! PLEASE BACKUP ANY IMPORTANT DATA BEFORE UPGRADING !!!"
 echo "Are you sure you want to continue the upgrade script? (Y/n)"
 read -n1 run
 
-if [ "$run" = "Y" ]; then
+if [ "$run" = "y" ] || [ "$run" = "Y" ]; then
     echo "Running upgrade script."
     php artisan down