Docker

.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+tests
+.dockerignore
+.editorconfig
+.env.example
+.env.testing
+.gitattributes
+.gitignore
+.styleci.yml
+.travis.yml
+changelog.md
+Dockerfile
+LICENSE
+README.md
+webpack.mix.js

.github/workflows/ci.yml

@@ -0,0 +1,111 @@
+name: CI
+on:
+  push:
+    paths:
+      - .github/workflows/ci.yml
+      - app/**
+      - bootstrap/**
+      - config/**
+      - database/**
+      - docker/**
+      - public/**
+      - resources/**
+      - routes/**
+      - storage/**
+      - tests/**
+      - .dockerignore
+      - .env.travis
+      - artisan
+      - composer.json
+      - composer.lock
+      - Dockerfile
+      - phpunit.xml
+      - server.php
+  pull_request:
+    paths:
+      - .github/workflows/ci.yml
+      - app/**
+      - bootstrap/**
+      - config/**
+      - database/**
+      - docker/**
+      - public/**
+      - resources/**
+      - routes/**
+      - storage/**
+      - tests/**
+      - .dockerignore
+      - .env.travis
+      - artisan
+      - composer.json
+      - composer.lock
+      - Dockerfile
+      - phpunit.xml
+      - server.php
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/[email protected]
+
+      - name: Build test image
+        run: docker build --target test -t test-container .
+
+      - name: Run tests in test container
+        run: |
+          touch coverage.txt
+          docker run --rm \
+          test-container
+
+      - name: Build final image
+        run: docker build .
+
+  publish:
+    needs: [verify]
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+
+      - uses: docker/setup-qemu-action@v1
+      - uses: docker/setup-buildx-action@v1
+
+      - uses: docker/login-action@v1
+        with:
+          username: 2fauth
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Set variables
+        id: vars
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          BRANCH=${GITHUB_REF#refs/heads/}
+          TAG=${GITHUB_REF#refs/tags/}
+          echo ::set-output name=commit::$(git rev-parse --short HEAD)
+          echo ::set-output name=created::$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          if [ "$TAG" != "$GITHUB_REF" ]; then
+            echo ::set-output name=version::$TAG
+            echo ::set-output name=platforms::linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7
+          elif [ "$BRANCH" = "master" ]; then
+            echo ::set-output name=version::latest
+            echo ::set-output name=platforms::linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7
+          else
+            echo ::set-output name=version::$BRANCH
+            echo ::set-output name=platforms::linux/amd64
+          fi
+
+      - name: Build and push final image
+        uses: docker/[email protected]
+        with:
+          platforms: ${{ steps.vars.outputs.platforms }}
+          build-args: |
+            CREATED=${{ steps.vars.outputs.created }}
+            COMMIT=${{ steps.vars.outputs.commit }}
+            VERSION=${{ steps.vars.outputs.version }}
+          tags: |
+            2fauth/2fauth:${{ steps.vars.outputs.version }}
+          push: true

.github/workflows/dockerhub-readme.yml

@@ -0,0 +1,21 @@
+name: Docker Hub description
+on:
+  push:
+    branches: [master]
+    paths:
+      - docker/README.md
+      - .github/workflows/dockerhub-readme.yml
+jobs:
+  dockerHubDescription:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+      - name: Docker Hub Description
+        uses: peter-evans/[email protected]
+        with:
+          username: 2fauth
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: 2fauth/2fauth
+          short-description: A web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes
+          readme-filepath: docker/README.md

Dockerfile

@@ -0,0 +1,181 @@
+ARG BUILDPLATFORM=linux/amd64
+ARG TARGETPLATFORM
+ARG DEBIAN_VERSION=buster-slim
+ARG PHP_VERSION=7.3-buster
+ARG COMPOSER_VERSION=2.1
+ARG SUPERVISORD_VERSION=v0.7.3
+
+FROM --platform=${BUILDPLATFORM} composer:${COMPOSER_VERSION} AS build-composer
+FROM composer:${COMPOSER_VERSION} AS composer
+FROM qmcgaw/binpot:supervisord-${SUPERVISORD_VERSION} AS supervisord
+
+FROM --platform=${BUILDPLATFORM} php:${PHP_VERSION} AS vendor
+ENV DEBIAN_FRONTEND=noninteractive
+COPY --from=build-composer --chown=www-data /usr/bin/composer /usr/bin/composer
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends unzip && \
+    rm -rf /var/cache/* /var/lib/apt/lists/*
+WORKDIR /srv
+COPY artisan composer.json composer.lock ./
+COPY database ./database
+RUN composer install --prefer-dist --no-scripts --no-dev --no-autoloader
+
+FROM --platform=${BUILDPLATFORM} vendor AS test
+COPY . .
+RUN mv .env.travis .env
+RUN composer install
+RUN php artisan key:generate
+ENTRYPOINT [ "/srv/vendor/bin/phpunit" ]
+
+FROM debian:${DEBIAN_VERSION}
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Composer 2
+COPY --from=composer --chown=www-data /usr/bin/composer /usr/bin/composer
+# Supervisord from https://github.com/ochinchina/supervisord
+COPY --from=supervisord --chown=www-data /bin /usr/local/bin/supervisord
+
+# Install PHP and PHP system dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    # PHP
+    php7.3 \
+    # PHP SQL drivers
+    php7.3-sqlite3 php7.3-mysql \
+    # PHP extensions
+    php-xml php7.3-gd php7.3-mbstring \
+    # Nginx and PHP FPM to serve over HTTP
+    php7.3-fpm nginx \
+    && \
+    # Clean up
+    apt-get clean && \
+    rm -rf /var/cache/* /var/lib/apt/lists/* /etc/nginx/nginx.conf && \
+    # Fix ownership to www-data
+    chown -R www-data /var/log/nginx /var/lib/nginx/
+
+# PHP FPM configuration
+# Pre-create files with the correct permissions
+RUN mkdir /run/php && \
+    touch /var/log/php7.3-fpm.log && \
+    chown www-data /run/php /var/log/php7.3-fpm.log && \
+    chmod 700 /run/php /var/log/php7.3-fpm.log
+
+# Nginx configuration
+EXPOSE 8000/tcp
+RUN touch /run/nginx.pid && \
+    chown www-data /run/nginx.pid
+COPY --chown=www-data docker/nginx.conf /etc/nginx/nginx.conf
+RUN nginx -t
+
+# Supervisord configuration
+COPY --chown=www-data docker/supervisord.conf /etc/supervisor/supervisord.conf
+
+# Create end user directory
+RUN mkdir -p /2fauth && \
+    chown -R www-data /2fauth && \
+    chmod 700 /2fauth
+
+# Create /srv internal directory
+WORKDIR /srv
+RUN chown -R www-data /srv && \
+    chmod 700 /srv
+
+# Run without root
+USER www-data
+
+# Dependencies
+COPY --from=vendor --chown=www-data /srv/vendor /srv/vendor
+
+# Copy the rest of the code
+COPY --chown=www-data . .
+RUN composer dump-autoload --no-scripts --no-dev --optimize
+
+# Entrypoint
+ENTRYPOINT [ "/usr/local/bin/entrypoint.sh" ]
+COPY --chown=www-data docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod 500 /usr/local/bin/entrypoint.sh
+
+ENV \
+  # You can change the name of the app
+  APP_NAME=2FAuth \
+  # You can leave this on "local". If you change it to production most console commands will ask for extra confirmation.
+  # Never set it to "testing".
+  APP_ENV=local \
+  # Set to true if you want to see debug information in error screens.
+  APP_DEBUG=false \
+  # This should be your email address
+  [email protected]  \
+  # The encryption key for  our database and sessions. Keep this very secure.
+  # If you generate a new one all existing data must be considered LOST.
+  # Change it to a string of exactly 32 chars or use command `php artisan key:generate` to generate it
+  APP_KEY=SomeRandomStringOf32CharsExactly \
+  # This variable must match your installation's external address but keep in mind that
+  # it's only used on the command line as a fallback value.
+  APP_URL=http://localhost \
+  # Turn this to true if you want your app to react like a demo.
+  # The Demo mode reset the app content every hours and set a generic demo user.
+  IS_DEMO_APP=false \
+  # The log channel defines where your log entries go to.
+  # 'daily' is the default logging mode giving you 5 daily rotated log files in /storage/logs/.
+  # Several other options exist. You can use 'single' for one big fat error log (not recommended).
+  # Also available are 'syslog', 'errorlog' and 'stdout' which will log to the system itself.
+  LOG_CHANNEL=daily \
+  # Log level. You can set this from least severe to most severe:
+  # debug, info, notice, warning, error, critical, alert, emergency
+  # If you set it to debug your logs will grow large, and fast. If you set it to emergency probably
+  # nothing will get logged, ever.
+  APP_LOG_LEVEL=notice \
+  # Database config & credentials
+  # DB_CONNECTION can be mysql
+  DB_CONNECTION=sqlite \
+  DB_DATABASE="/srv/database/database.sqlite" \
+  # if you want to use MySQL:
+  DB_HOST=127.0.0.1 \
+  DB_PORT=3306 \
+  DB_USERNAME=homestead \
+  DB_PASSWORD=secret \
+  # If you're looking for performance improvements, you could install memcached.
+  CACHE_DRIVER=file \
+  SESSION_DRIVER=file \
+  # Mail settings
+  # Refer your email provider documentation to configure your mail settings
+  # Set a value for every available setting to avoid issue
+  MAIL_DRIVER=log \
+  MAIL_HOST=smtp.mailtrap.io \
+  MAIL_PORT=2525 \
+  [email protected] \
+  MAIL_USERNAME=null \
+  MAIL_PASSWORD=null \
+  MAIL_ENCRYPTION=null \
+  MAIL_FROM_NAME=null \
+  MAIL_FROM_ADDRESS=null \
+  # Leave the following configuration vars as is.
+  # Unless you like to tinker and know what you're doing.
+  BROADCAST_DRIVER=log \
+  QUEUE_DRIVER=sync \
+  SESSION_LIFETIME=12 \
+  REDIS_HOST=127.0.0.1 \
+  REDIS_PASSWORD=null \
+  REDIS_PORT=6379 \
+  PUSHER_APP_ID= \
+  PUSHER_APP_KEY= \
+  PUSHER_APP_SECRET= \
+  PUSHER_APP_CLUSTER=mt1 \
+  MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}" \
+  MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}" \
+  MIX_ENV=local
+
+ARG VERSION=unknown
+ARG CREATED="an unknown date"
+ARG COMMIT=unknown
+ENV COMMIT=${COMMIT}
+LABEL \
+    org.opencontainers.image.authors="https://github.com/Bubka" \
+    org.opencontainers.image.version=$VERSION \
+    org.opencontainers.image.created=$CREATED \
+    org.opencontainers.image.revision=$COMMIT \
+    org.opencontainers.image.url="https://github.com/Bubka/2FAuth" \
+    org.opencontainers.image.documentation="https://hub.docker.com/r/2fauth/2fauth" \
+    org.opencontainers.image.source="https://github.com/Bubka/2FAuth" \
+    org.opencontainers.image.title="2fauth" \
+    org.opencontainers.image.description="A web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes"

README.md

@@ -1,6 +1,7 @@
 # 2FAuth
 
 ![https://travis-ci.com/github/Bubka/2FAuth](https://img.shields.io/travis/com/bubka/2fauth?style=flat-square)
+[![Docker build status](https://github.com/Bubka/2fauth/actions/workflows/ci.yml/badge.svg)](https://github.com/Bubka/2fauth/actions/workflows/ci.yml)
 ![https://codecov.io/gh/Bubka/2FAuth](https://img.shields.io/codecov/c/github/Bubka/2FAuth?style=flat-square)
 ![https://github.com/Bubka/2FAuth/blob/master/LICENSE](https://img.shields.io/github/license/Bubka/2FAuth.svg?style=flat-square)
 
@@ -10,6 +11,8 @@ A web app to manage your Two-Factor Authentication (2FA) accounts and generate t
 
 [**2FAuth Demo**](https://demo.2fauth.app/)
 
+[**Use it with Docker**](docker)
+
 Credentials (login - password) : *[email protected]* - *demo*
 
 ## Purpose