Skip to content

Commit 56c2b40

Browse files
Add secrets example (#64)
1 parent 0a84c5f commit 56c2b40

27 files changed

+2190
-0
lines changed

examples/docker-compose.common.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
version: "3"
2+
services:
3+
placement:
4+
image: daprio/dapr:1.0.1
5+
command: ["./placement","-port","50006"]

examples/images/Caddyfile

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
:80
2+
3+
root * /app
4+
uri replace /assets/ /services/ui/src/assets/
5+
file_server * {
6+
hide .git
7+
}
8+
php_fastcgi localhost:9000
9+
encode gzip

examples/images/caddy.Dockerfile

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
FROM caddy AS base
2+
ARG SERVICE
3+
COPY services/$SERVICE /app/services/$SERVICE
4+
COPY index.php /app/index.php
5+
COPY global-config.php /app/global-config.php
6+
COPY images/Caddyfile /etc/caddy/Caddyfile

examples/images/fpm.conf

Lines changed: 455 additions & 0 deletions
Large diffs are not rendered by default.

examples/images/opcache.ini

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
[opcache]
2+
; Determines if Zend OPCache is enabled
3+
opcache.enable=1
4+
5+
; Determines if Zend OPCache is enabled for the CLI version of PHP
6+
opcache.enable_cli=1
7+
8+
; The OPcache shared memory storage size.
9+
opcache.memory_consumption=128
10+
11+
; The amount of memory for interned strings in Mbytes.
12+
opcache.interned_strings_buffer=8
13+
14+
; The maximum number of keys (scripts) in the OPcache hash table.
15+
; Only numbers between 200 and 1000000 are allowed.
16+
opcache.max_accelerated_files=10000
17+
18+
; The maximum percentage of "wasted" memory until a restart is scheduled.
19+
;opcache.max_wasted_percentage=5
20+
21+
; When this directive is enabled, the OPcache appends the current working
22+
; directory to the script key, thus eliminating possible collisions between
23+
; files with the same name (basename). Disabling the directive improves
24+
; performance, but may break existing applications.
25+
;opcache.use_cwd=1
26+
27+
; When disabled, you must reset the OPcache manually or restart the
28+
; webserver for changes to the filesystem to take effect.
29+
;opcache.validate_timestamps=1
30+
31+
; How often (in seconds) to check file timestamps for changes to the shared
32+
; memory storage allocation. ("1" means validate once per second, but only
33+
; once per request. "0" means always validate)
34+
;opcache.revalidate_freq=2
35+
36+
; Enables or disables file search in include_path optimization
37+
;opcache.revalidate_path=0
38+
39+
; If disabled, all PHPDoc comments are dropped from the code to reduce the
40+
; size of the optimized code.
41+
;opcache.save_comments=1
42+
43+
; If enabled, compilation warnings (including notices and deprecations) will
44+
; be recorded and replayed each time a file is included. Otherwise, compilation
45+
; warnings will only be emitted when the file is first cached.
46+
opcache.record_warnings=1
47+
48+
; Allow file existence override (file_exists, etc.) performance feature.
49+
;opcache.enable_file_override=0
50+
51+
; A bitmask, where each bit enables or disables the appropriate OPcache
52+
; passes
53+
;opcache.optimization_level=0x7FFFBFFF
54+
55+
;opcache.dups_fix=0
56+
57+
; The location of the OPcache blacklist file (wildcards allowed).
58+
; Each OPcache blacklist file is a text file that holds the names of files
59+
; that should not be accelerated. The file format is to add each filename
60+
; to a new line. The filename may be a full path or just a file prefix
61+
; (i.e., /var/www/x blacklists all the files and directories in /var/www
62+
; that start with 'x'). Line starting with a ; are ignored (comments).
63+
;opcache.blacklist_filename=
64+
65+
; Allows exclusion of large files from being cached. By default all files
66+
; are cached.
67+
;opcache.max_file_size=0
68+
69+
; Check the cache checksum each N requests.
70+
; The default value of "0" means that the checks are disabled.
71+
;opcache.consistency_checks=100
72+
73+
; How long to wait (in seconds) for a scheduled restart to begin if the cache
74+
; is not being accessed.
75+
;opcache.force_restart_timeout=180
76+
77+
; OPcache error_log file name. Empty string assumes "stderr".
78+
;opcache.error_log=
79+
80+
; All OPcache errors go to the Web server log.
81+
; By default, only fatal errors (level 0) or errors (level 1) are logged.
82+
; You can also enable warnings (level 2), info messages (level 3) or
83+
; debug messages (level 4).
84+
;opcache.log_verbosity_level=1
85+
86+
; Preferred Shared Memory back-end. Leave empty and let the system decide.
87+
;opcache.preferred_memory_model=
88+
89+
; Protect the shared memory from unexpected writing during script execution.
90+
; Useful for internal debugging only.
91+
;opcache.protect_memory=0
92+
93+
; Allows calling OPcache API functions only from PHP scripts which path is
94+
; started from specified string. The default "" means no restriction
95+
;opcache.restrict_api=
96+
97+
; Mapping base of shared memory segments (for Windows only). All the PHP
98+
; processes have to map shared memory into the same address space. This
99+
; directive allows to manually fix the "Unable to reattach to base address"
100+
; errors.
101+
;opcache.mmap_base=
102+
103+
; Facilitates multiple OPcache instances per user (for Windows only). All PHP
104+
; processes with the same cache ID and user share an OPcache instance.
105+
;opcache.cache_id=
106+
107+
; Enables and sets the second level cache directory.
108+
; It should improve performance when SHM memory is full, at server restart or
109+
; SHM reset. The default "" disables file based caching.
110+
opcache.file_cache=/var/www/tmp/.opcache
111+
112+
; Enables or disables opcode caching in shared memory.
113+
;opcache.file_cache_only=0
114+
115+
; Enables or disables checksum validation when script loaded from file cache.
116+
opcache.file_cache_consistency_checks=1
117+
118+
; Implies opcache.file_cache_only=1 for a certain process that failed to
119+
; reattach to the shared memory (for Windows only). Explicitly enabled file
120+
; cache is required.
121+
;opcache.file_cache_fallback=1
122+
123+
; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
124+
; This should improve performance, but requires appropriate OS configuration.
125+
;opcache.huge_code_pages=1
126+
127+
; Validate cached file permissions.
128+
;opcache.validate_permission=0
129+
130+
; Prevent name collisions in chroot'ed environment.
131+
;opcache.validate_root=0
132+
133+
; If specified, it produces opcode dumps for debugging different stages of
134+
; optimizations.
135+
;opcache.opt_debug_level=0
136+
137+
; Specifies a PHP script that is going to be compiled and executed at server
138+
; start-up.
139+
; http://php.net/opcache.preload
140+
;opcache.preload=
141+
142+
; Preloading code as root is not allowed for security reasons. This directive
143+
; facilitates to let the preloading to be run as another user.
144+
; http://php.net/opcache.preload_user
145+
;opcache.preload_user=
146+
147+
; Prevents caching files that are less than this number of seconds old. It
148+
; protects from caching of incompletely updated files. In case all file updates
149+
; on your site are atomic, you may increase performance by setting it to "0".
150+
opcache.file_update_protection=0
151+
152+
; Absolute path used to store shared lockfiles (for *nix only).
153+
;opcache.lockfile_path=/tmp
154+
155+
opcache.jit_buffer_size=256M
156+
157+
opcache.jit=tracing

examples/images/service.Dockerfile

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
FROM php:8.0-fpm AS base
2+
ENV VERSION=1
3+
COPY --from=mlocati/php-extension-installer /usr/bin/install-php-extensions /usr/local/bin/
4+
RUN apt-get update && apt-get install -y wget git unzip && apt-get clean && rm -rf /var/cache/apt/lists
5+
RUN install-php-extensions curl intl zip sodium opcache xdebug @composer && mkdir -p /app && \
6+
cd $(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");') && \
7+
mkdir -p /php-disabled && mv xdebug.so /php-disabled && mv $PHP_INI_DIR/conf.d/docker-php-ext-xdebug.ini /php-disabled
8+
WORKDIR /app
9+
10+
FROM base AS vendor
11+
COPY composer.json composer.json
12+
COPY composer.lock composer.lock
13+
RUN composer install --no-dev -o -n
14+
15+
FROM base AS config
16+
ARG SERVICE
17+
ENV SERVICE=$SERVICE
18+
COPY services/$SERVICE services/$SERVICE
19+
COPY --from=vendor /app/vendor vendor
20+
COPY index.php index.php
21+
COPY global-config.php global-config.php
22+
23+
FROM config AS production
24+
RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
25+
ENV PHP_CLI_SERVER_WORKERS=100
26+
COPY images/opcache.ini /tmp/opcache.ini
27+
COPY images/fpm.conf /usr/local/etc/php-fpm.d/www.conf
28+
RUN cat /tmp/opcache.ini >> $PHP_INI_DIR/php.ini
29+
30+
FROM production AS development
31+
ARG SERVICE
32+
COPY images/xdebug.ini /tmp/xdebug.ini
33+
ENV DBGP_IDEKEY=$SERVICE
34+
RUN mv "$PHP_INI_DIR/php.ini-development" "$PHP_INI_DIR/php.ini" && \
35+
cd $(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");') && \
36+
mv /php-disabled/xdebug.so . && mv /php-disabled/docker-php-ext-xdebug.ini $PHP_INI_DIR/conf.d/docker-php-ext-xdebug.ini
37+
RUN cat /tmp/xdebug.ini >> $PHP_INI_DIR/php.ini
38+
COPY images/opcache.ini /tmp/opcache.ini
39+
RUN cat /tmp/opcache.ini >> $PHP_INI_DIR/php.ini

examples/images/xdebug.ini

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[xdebug]
2+
;xdebug.discover_client_host = true
3+
xdebug.mode = develop,debug
4+
xdebug.log = /tmp/xdebug.log
5+
xdebug.log_level = 0
6+
xdebug.client_host = host.docker.internal
7+
xdebug.start_with_request = true

examples/secrets/.dockerignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
vendor/

examples/secrets/.env

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
DOCKER_USER=withinboredom

examples/secrets/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
images/
2+
vendor/

examples/secrets/Makefile

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
SHELL := /bin/bash
2+
3+
include .env
4+
export $(shell sed 's/=.*//' .env)
5+
6+
.PHONY: deps
7+
deps: images/fpm.conf images/opcache.ini images/xdebug.ini images/Caddyfile docker-compose.yml
8+
DOCKER_BUILDKIT=1 COMPOSE_DOCKER_CLI_BUILD=1 docker-compose build
9+
10+
.PHONY: start
11+
start:
12+
DOCKER_BUILDKIT=1 COMPOSE_DOCKER_CLI_BUILD=1 docker-compose -f docker-compose.yml -f ../docker-compose.common.yml up -d
13+
14+
.PHONY: push
15+
push: deps
16+
docker-compose push
17+
18+
.PHONY: deploy
19+
deploy:
20+
kubectl apply -f deployments/simple-secret.yml
21+
kubectl apply -f deployments/some-secrets.yml
22+
envsubst < deployments/secret-service.yml | kubectl apply -f -
23+
envsubst < deployments/client-service.yml | kubectl apply -f -
24+
25+
.PHONY: deploy-delete
26+
deploy-delete:
27+
kubectl delete -f deployments/simple-secret.yml
28+
kubectl delete -f deployments/some-secrets.yml
29+
envsubst < deployments/secret-service.yml | kubectl delete -f -
30+
envsubst < deployments/client-service.yml | kubectl delete -f -
31+
32+
images/fpm.conf: ../images/fpm.conf
33+
mkdir -p images
34+
cp ../images/fpm.conf images/fpm.conf
35+
touch images/fpm.conf
36+
37+
images/opcache.ini: ../images/opcache.ini
38+
mkdir -p images
39+
cp ../images/opcache.ini images/opcache.ini
40+
touch images/opcache.ini
41+
42+
images/xdebug.ini: ../images/xdebug.ini
43+
mkdir -p images
44+
cp ../images/xdebug.ini images/xdebug.ini
45+
touch images/xdebug.ini
46+
47+
images/Caddyfile: ../images/Caddyfile
48+
mkdir -p images
49+
cp ../images/Caddyfile images/Caddyfile
50+
touch images/Caddyfile
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: dapr.io/v1alpha1
2+
kind: Component
3+
metadata:
4+
name: file-secrets
5+
namespace: secret-example
6+
spec:
7+
type: secretstores.local.file
8+
version: v1
9+
metadata:
10+
- name: secretsFile
11+
value: /components/secrets.json
12+
- name: nestedSeparator
13+
value: "."
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"some-secret": {
3+
"nested": "got the nested secret!",
4+
"other": "some other secret"
5+
},
6+
"simple-secret": "got the simple secret!"
7+
}

examples/secrets/composer.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "dapr/secret-example",
3+
"license": "MIT",
4+
"description": "A basic example demonstrating secret access",
5+
"require": {
6+
"dapr/php-sdk": "^1.0"
7+
}
8+
}

0 commit comments

Comments
 (0)