Upgrade to panel v0.7.18

Add restart policy. Use Traefik

.gitignore

@@ -1 +0,0 @@
-docker-compose.yml

README.md

@@ -1,5 +1,4 @@
-# pterodactyl-panel-docker
-[![GitHub release](https://img.shields.io/github/release/TehTotalPwnage/pterodactyl-panel-docker.svg?style=for-the-badge)](https://github.com/TehTotalPwnage/pterodactyl-panel-docker/releases)
+# Pterodactyl panel Docker container
 > Docker Compose configuration for the [Pterodactyl Panel](https://github.com/Pterodactyl/Panel).
 
 Pterodactyl is an open-source control panel used for hosting numerous game-related
@@ -22,6 +21,9 @@ of containers and Dockerfiles.
 that Nginx performs better than Caddy in handling requests. In addition to this,
 Nginx, while having a more complicated configuration file, doesn't enforce HTTPS,
 a feature of Caddy which only complicates the setup of the HTTP Docker container.
+3. Additionally, if the nginx receives a request from a reverse proxy, it will set the HSTS header
+and redirect to HTTPS automatically. If you do not want this behaviour, adjust the `nginx.conf`
+as you like.
 
 ## Usage
 The instructions are fairly self explanatory: clone the repository and launch the

docker-compose.yml

@@ -1,34 +1,41 @@
-version: "3"
+version: "3.1"
+
 services:
+
     db:
+        image: mariadb
+        restart: unless-stopped
         environment:
             - "MYSQL_DATABASE=pterodactyl"
             - "MYSQL_PASSWORD=pterodactyl"
             - "MYSQL_RANDOM_ROOT_PASSWORD=yes"
             - "MYSQL_USER=pterodactyl"
-        image: mariadb:latest
         networks:
             - default
         volumes:
             - db:/var/lib/mysql
+
     http:
         build:
             context: services/http
             dockerfile: Dockerfile
+        restart: unless-stopped
         depends_on:
             - "php"
         ports:
-            - "80:80"
+            - 80:80
         networks:
             - default
         volumes:
             - env:/var/www/html/env
             - panel:/var/www/html/pterodactyl
             - storage:/var/www/html/pterodactyl/storage
+
     php:
         build:
             context: services/php
             dockerfile: Dockerfile
+        restart: unless-stopped
         depends_on:
             - "db"
         networks:
@@ -37,8 +44,10 @@ services:
             - env:/var/www/html/env
             - panel:/var/www/html/pterodactyl
             - storage:/var/www/html/pterodactyl/storage
+
     redis:
         image: redis:alpine
+        restart: unless-stopped
         networks:
             - default
 

services/http/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:alpine
+FROM docker.io/library/nginx:alpine
 
 LABEL maintainer="tehtotalpwnage@gmail.com"
 

services/http/nginx.conf

@@ -26,6 +26,12 @@ http {
     keepalive_timeout  65;
 
     #gzip  on;
+    
+    # Set HSTS if forwarded proto is https
+    map $http_x_forwarded_proto $hsts_header {
+      default "";
+      https "max-age=31536000; includeSubDomains;";
+    }
 
     server {
         listen       80 default_server;
@@ -36,6 +42,17 @@ http {
 
         access_log off;
         error_log  /var/log/nginx/pterodactyl.app-error.log error;
+        
+        # Redirect to https
+        if ($http_x_forwarded_proto != "https") {
+            set $shouldRedirectToHTTPS 1;
+        }
+        if ($http_x_forwarded_proto = false) {
+            set $shouldRedirectToHTTPS 0;
+        }
+        if ($shouldRedirectToHTTPS = 1) {
+            return 301 https://$host$request_uri;
+        }
 
         location / {
             try_files $uri $uri/ /index.php?$query_string;
@@ -48,7 +65,8 @@ http {
         location = /robots.txt  { access_log off; log_not_found off; }
 
         sendfile off;
-
+        
+        add_header Strict-Transport-Security $hsts_header;
         add_header X-Content-Type-Options nosniff;
         add_header X-XSS-Protection "1; mode=block";
         add_header X-Robots-Tag none;

services/php/Dockerfile

@@ -1,52 +1,50 @@
-FROM php:7.2-fpm-alpine
+FROM docker.io/library/php:7.3-fpm-alpine
 
-ENV PANEL_VERSION=v0.7.7
+ENV PANEL_VERSION=v0.7.18
 
 # Set up all the dependencies for the PHP container.
-RUN apk add --no-cache curl git supervisor tar unzip
-RUN docker-php-ext-install bcmath
-# https://github.com/docker-library/php/issues/483
-# RUN docker-php-ext-install curl
-# https://stackoverflow.com/questions/39657058/installing-gd-in-docker#39658592
-RUN apk add --no-cache libpng-dev
-RUN docker-php-ext-install gd
-RUN docker-php-ext-install mbstring
-RUN docker-php-ext-install pdo
-RUN docker-php-ext-install pdo_mysql
-RUN docker-php-ext-install tokenizer
-# https://lists.alpinelinux.org/alpine-aports/2526.html
-RUN apk add --no-cache libxml2-dev
-RUN docker-php-ext-install xml
-RUN docker-php-ext-install zip
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+RUN apk add --no-cache curl git supervisor tar unzip; \
+    docker-php-ext-install bcmath; \
+    apk add --no-cache libpng-dev; \
+    docker-php-ext-install gd; \
+    docker-php-ext-install mbstring; \
+    docker-php-ext-install pdo; \
+    docker-php-ext-install pdo_mysql; \
+    docker-php-ext-install tokenizer; \
+    apk add --no-cache libxml2-dev; \
+    docker-php-ext-install xml; \
+    docker-php-ext-install zip; \
+    curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 
 # Set up the server working directories.
-RUN adduser -g '' -D -u 9999 pterodactyl
-RUN mkdir -p /var/www/html/env
-RUN mkdir -p /var/www/html/pterodactyl
+RUN adduser -g '' -D -u 9999 pterodactyl; \
+    mkdir -p /var/www/html/env; \
+    mkdir -p /var/www/html/pterodactyl
+
 WORKDIR /var/www/html/pterodactyl
 RUN chown -R pterodactyl:pterodactyl /var/www/html/pterodactyl /var/www/html/env
 
 # Deploy panel files.
 USER pterodactyl:pterodactyl
-RUN curl -Lo panel.tar.gz https://github.com/Pterodactyl/Panel/releases/download/${PANEL_VERSION}/panel.tar.gz
-RUN tar --strip-components=1 -xzvf panel.tar.gz
-# Since Docker's configuration mounting feature sucks, we're going to use a cheap
-# workaround involving symbolic links.
-RUN cp .env.example /var/www/html/env/.env
-RUN ln -s /var/www/html/env/.env /var/www/html/pterodactyl/.env
-RUN composer install --no-dev
-RUN chmod -R 755 storage/* bootstrap/cache
+RUN curl -Lo panel.tar.gz https://github.com/Pterodactyl/Panel/releases/download/${PANEL_VERSION}/panel.tar.gz; \
+    tar --strip-components=1 -xzvf panel.tar.gz; \
+    cp .env.example /var/www/html/env/.env; \
+    ln -s /var/www/html/env/.env /var/www/html/pterodactyl/.env; \
+    composer install --no-dev --optimize-autoloader; \
+    chmod -R 755 storage/* bootstrap/cache
 
 # Copy the remaining configuration files.
 USER root:root
 RUN mkdir -p /var/log/pterodactyl
+
 COPY install.sh /usr/local/bin/install
-RUN chmod +x /usr/local/bin/install
 COPY upgrade.sh /usr/local/bin/upgrade
-RUN chmod +x /usr/local/bin/upgrade
-COPY schedule /var/spoon/cron/crontabs/schedule
+COPY schedule .
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY www.conf /usr/local/etc/php-fpm.d/www.conf
 
+RUN cat schedule >> /var/spool/cron/crontabs/root; \
+    chmod +x /usr/local/bin/install; \
+    chmod +x /usr/local/bin/upgrade
+
 ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]

services/php/install.sh

@@ -12,13 +12,21 @@ fi
 echo "Are you sure you want to continue the install script? (Y/n)"
 read -n1 run
 
-if [ "$run" = "Y" ]; then
+if [ "$run" = "y" ] || [ "$run" = "Y" ]; then
     echo "Running install script."
     echo "Waiting 15 seconds for MariaDB to be ready."
     sleep 15
 
-    echo "Adding additional parameters to .env file."
-    printf "\n\nTRUSTED_PROXIES=*" >> .env
+    echo "Configure trusted proxies (this will enable reverse proxy functionality)? (Y/n)"
+    read -n1 configureTP
+    if [ "$configureTP" = "y" ] || [ "$configureTP" = "Y" ] || [ "$run" = "" ]; then
+        echo "Please enter a value (comma separated list of allowed IPs, * to allow all) for TRUSTED_PROXIES: [*]"
+        read -n1 configureTPval
+        if [ "$configureTPval" = "" ]; then
+            configureTPval="*" 
+        fi
+        grep -q 'TRUSTED_PROXIES.*' .env && sed -i .env -e 's/TRUSTED_PROXIES.*/TRUSTED_PROXIES='$configureTPval'/' || printf "\nTRUSTED_PROXIES=$configureTPval\n" >> .env
+    fi
     php artisan key:generate --force
 
     echo "Running configuration scripts."

services/php/supervisord.conf

@@ -1,5 +1,6 @@
 [supervisord]
 nodaemon=true
+user=root
 
 [program:cron]
 process_name=%(program_name)s
@@ -10,7 +11,7 @@ user=root
 
 [program:laravel-worker]
 process_name=%(program_name)s_%(process_num)02d
-command=php /var/www/html/pterodactyl/artisan queue:work database --queue=high,standard,low --sleep=3 --tries=3
+command=php /var/www/html/pterodactyl/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3
 autostart=true
 autorestart=true
 user=pterodactyl

services/php/upgrade.sh

@@ -1,18 +1,15 @@
 #!/bin/ash
 
-##
-# This is an install script to quickly upgrade Pterodactyl Panel. Before running,
-# please BACK UP any important data!
-##
 if [ "$(whoami)" != "pterodactyl" ]; then
     echo "Rerunning script as webserver user."
     exec su -c /usr/local/bin/upgrade pterodactyl
 fi
 
+echo "!!! PLEASE BACKUP ANY IMPORTANT DATA BEFORE UPGRADING !!!"
 echo "Are you sure you want to continue the upgrade script? (Y/n)"
 read -n1 run
 
-if [ "$run" = "Y" ]; then
+if [ "$run" = "y" ] || [ "$run" = "Y" ]; then
     echo "Running upgrade script."
     php artisan down