performance tuning

.dockerignore

@@ -1,6 +0,0 @@
-db/
-glpi/
-docker-compose.yaml
-.drone.yaml
-.env
-.gitignore

.drone.star

@@ -1,19 +1,20 @@
 def main(ctx):
     archs = ["amd64", "arm64"]   ## arm
-    glpi_version = "10.0.9"
+    glpi_version = "10.0.11"
+    alpine_version = "3.19"
 
     out = []
     for arch in archs:
-        out += onpush(ctx, glpi_version, arch)
+        out += onpush(ctx, glpi_version, alpine_version, arch)
 
     for arch in archs:
-        out += build_publish(ctx, glpi_version, arch)
+        out += build_publish(ctx, glpi_version, alpine_version, arch)
 
     out += manifest_publish(ctx, glpi_version, archs)
 
     return out
 
-def onpush(ctx, glpi_version, arch):
+def onpush(ctx, glpi_version, alpine_version, arch):
     return [{
         "kind": "pipeline",
         "type": "docker",
@@ -26,12 +27,13 @@ def onpush(ctx, glpi_version, arch):
             "name": "build_on_push",
             "image": "plugins/docker:linux-%s" % (arch),
             "settings": {
-                "context": ".",
+                "context": "src",
-                "dockerfile": "./Dockerfile",
+                "dockerfile": "src/Dockerfile",
                 "dry_run": True,
                 "repo": "docker.asperti.com/paspo/glpi", 
                 "build_args": [
-                    "GLPI_VERSION=%s" % (glpi_version)
+                    "GLPI_VERSION=%s" % (glpi_version),
+                    "ALPINE_VERSION=%s" % (alpine_version)
                 ],
             },
         }],
@@ -40,7 +42,7 @@ def onpush(ctx, glpi_version, arch):
         }
     }]
 
-def build_publish(ctx, glpi_version, arch):
+def build_publish(ctx, glpi_version, alpine_version, arch):
     major = glpi_version.partition(".")[0];	
     return [{
         "kind": "pipeline",
@@ -54,10 +56,11 @@ def build_publish(ctx, glpi_version, arch):
             "name": "build_on_push",
             "image": "plugins/docker:linux-%s" % (arch),
             "settings": {
-                "context": ".",
+                "context": "src",
-                "dockerfile": "./Dockerfile",
+                "dockerfile": "src/Dockerfile",
                 "build_args": [
-                    "GLPI_VERSION=%s" % (glpi_version)
+                    "GLPI_VERSION=%s" % (glpi_version),
+                    "ALPINE_VERSION=%s" % (alpine_version)
                 ],
                 "username": {
                     "from_secret": "docker_username",

.gitea/workflows/vulnscan.yaml

@@ -0,0 +1,29 @@
+name: Vulnerability Scan
+
+on:
+  schedule:
+    - cron: "0 14 * * *"
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: Daily Vulnerability Scan
+    runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    steps:
+      - name: Pull docker image
+        run: docker pull docker.asperti.com/paspo/glpi:latest
+
+      - name: Run Trivy vulnerability scanner
+        id: scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "docker.asperti.com/paspo/glpi:latest"
+          format: "json"
+          output: "trivy-results.json"
+
+      # if some vulnerability is found, we fail
+      - name: check output
+        run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi

README.md

@@ -7,8 +7,8 @@ Web server for GLPI deployment
 ## build
 
 ```bash
-git submodule update --init --remote
+cd src
-docker build -t docker.asperti.com/paspo/glpi .
+docker build -t docker.asperti.com/paspo/glpi --build-arg "ALPINE_VERSION=3.19" --build-arg "GLPI_VERSION=10.0.11" .
 ```
 
 ## run
@@ -20,3 +20,9 @@ see [docker-compose.yaml](docker-compose.yaml)
 ```sh
 drone starlark --format --stdout 
 ```
+
+## run vulnscan locally
+
+```bash
+act -W .gitea/workflows/vulnscan.yaml -j scan
+```

docker-compose.yaml

@@ -10,9 +10,16 @@ services:
       - MARIADB_DATABASE=${MARIADB_DATABASE}
       - MARIADB_USER=${MARIADB_USER}
       - MARIADB_PASSWORD=${MARIADB_PASSWORD}
+      - MARIADB_AUTO_UPGRADE=1
+    logging:
+      options:
+        max-size: 10m
 
   redis:
-    image: redis:latest
+    image: redis:alpine
+    logging:
+      options:
+        max-size: 10m
 
   glpi:
     build: .
@@ -29,3 +36,6 @@ services:
       - ./glpi/files:/files
       - ./glpi/marketplace:/marketplace
       - ./glpi/plugins:/var/www/glpi/plugins
+    logging:
+      options:
+        max-size: 10m      

src/Dockerfile

@@ -1,16 +1,16 @@
-FROM alpine:3.18
+ARG ALPINE_VERSION
+FROM alpine:${ALPINE_VERSION}
 ARG GLPI_VERSION
 
 RUN \
   mkdir -p /logs /config /files /marketplace && \
   apk -U upgrade && \
-  apk add curl nginx php82 php82-bz2 php82-ctype php82-curl php82-dom php82-exif \
+  apk add --no-cache curl nginx php82 php82-bz2 php82-ctype php82-curl php82-dom php82-exif \
     php82-fileinfo php82-fpm php82-gd php82-iconv php82-intl php82-ldap php82-mysqli \
     php82-opcache php82-openssl php82-pecl-apcu php82-pecl-redis php82-phar php82-session \
     php82-simplexml php82-sodium php82-tokenizer php82-xml php82-zip php82-xmlreader php82-xmlwriter && \
   wget -O /usr/local/bin/composer https://getcomposer.org/download/2.5.8/composer.phar && \
   chmod +x /usr/local/bin/composer && \
-  ln -s /usr/bin/php82 /usr/bin/php && \ 
   wget -O - https://github.com/glpi-project/glpi/releases/download/${GLPI_VERSION}/glpi-${GLPI_VERSION}.tgz | tar xz -C /var/www
 
 # this are needed if you want to manually install GLPI from git

src/rootfs/etc/crontabs/nginx

@@ -0,0 +1,2 @@
+# min	hour	day	month	weekday	command
+*	*	*	*	*	/usr/bin/php /var/www/glpi/front/cron.php 

src/rootfs/etc/php82/conf.d/php.ini

@@ -1,6 +1,8 @@
 session.cookie_httponly = on
-memory_limit = 256M
+memory_limit = 512M
 file_uploads = on
 max_execution_time = 600
 session.auto_start = off
 session.use_trans_sid = 0
+expose_php = Off
+opcache.memory_consumption = 256

src/rootfs/start.sh

@@ -9,5 +9,6 @@ if [ "$INSTALL_OK" = "1" ] ; then
   fi
 fi
 
+/usr/sbin/crond -b
 /usr/sbin/php-fpm*
 /usr/sbin/nginx