Use Nginx & gunicorn to run Kipa in container

.dockerignore

@@ -0,0 +1 @@
+web/settings/local.py

.github/workflows/continuous-integration.yml

@@ -50,7 +50,7 @@ jobs:
           pip install robotframework
           pip install robotframework-seleniumlibrary
       - name: start SUT
-        run: docker run -d -p 3000:3000 kipa
+        run: docker run -d -p 3000:80 kipa
       - name: wait SUT to start
         run: while ! curl -s -f 'http://localhost:3000/kipa' ; do sleep 2; docker ps; done
         shell: bash

Dockerfile

@@ -1,11 +1,26 @@
-FROM python:3.12
+FROM ubuntu/nginx:1.24-24.04_beta
 
-WORKDIR /app/web
+RUN apt-get update \
+    && apt-get install -y python3.12 python3.12-venv \
+    && apt-get clean
 
-ENTRYPOINT ["/app/docker-entrypoint.sh"]
-EXPOSE 3000
-CMD ["python", "./manage.py", "runserver", "0.0.0.0:3000"]
+COPY web /app/
+COPY --chown=nobody:nogroup web/media /media
+COPY web/settings/docker.py.example /app/settings/docker.py
+COPY requirements.txt /
+COPY nginx.conf /etc/nginx/
 
-COPY . /app/
-COPY web/settings/docker.py.example /app/web/settings/docker.py
-RUN pip install -r /app/requirements.txt
+RUN python3.12 -m venv venv
+ENV PATH="/venv/bin:$PATH"
+
+WORKDIR /app
+
+RUN rm -rf /app/media \
+    && mkdir /db \
+    && pip install -r /requirements.txt \
+    && tr -dc A-Za-z0-9 < /dev/urandom | head -c 40 > /secret.txt \
+    && python manage.py makemigrations tupa \
+    && python manage.py migrate \
+    && nginx -t \
+    && echo "gunicorn --daemon --bind unix:/tmp/kipa.sock wsgi --error-logfile /tmp/errors " > /docker-entrypoint.d/gunicorn.sh \
+    && chmod +x /docker-entrypoint.d/gunicorn.sh \

docs/installation.md

@@ -26,7 +26,7 @@ riittävän hyvää verkkoyhteyttä.
    token [täältä](https://github.com/settings/tokens) jakirjaudu
    Docker-clientillä sisään GitHubin pakettivarantoon esimerkiksi
    komennolla `docker login ghcr.io`
-2. Aja komento `docker run -d -p 3000:3000 -v kipa_db:/app/db --name kipa -d ghcr.io/partio-scout/kipa:latest`
+2. Aja komento `docker run -d -p 3000:80 -v kipa_db:/app/db --name kipa -d ghcr.io/partio-scout/kipa:latest`
     * Halutessasi voit myös käyttää kehitysversiota vaihtamalla `latest`-tagin sijaan `develop`in.
 3. Mene selaimella osoitteeseen http://localhost:3000/kipa/ – voilá!
 

nginx.conf

@@ -0,0 +1,42 @@
+worker_processes 1;
+
+user nobody nogroup;
+error_log  /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+  worker_connections 1024;
+  accept_mutex off; # set to 'on' if nginx worker_processes > 1
+}
+
+http {
+  include mime.types;
+  # fallback in case we can't determine a type
+  default_type application/octet-stream;
+  access_log /var/log/nginx/access.log combined;
+  sendfile on;
+
+  upstream app_server {
+    server unix:/tmp/kipa.sock fail_timeout=0;
+  }
+
+  server {
+    listen 80 deferred;
+    client_max_body_size 4G;
+    server_name kipa;
+    keepalive_timeout 5;
+
+    location /kipamedia {
+      alias /media;
+    }
+    location / {
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header Host $http_host;
+      # we don't want nginx trying to do something clever with
+      # redirects, we set the Host: header above already.
+      proxy_redirect off;
+      proxy_pass http://app_server;
+    }
+  }
+}

web/settings/docker.py.example

@@ -1,12 +1,9 @@
-with open("/app/db/secret.txt", "r") as f:
+with open("/secret.txt", "r") as f:
     SECRET_KEY = f.readline()
 
 DATABASES = {
     "default": {
         "ENGINE": "django.db.backends.sqlite3",
-        "NAME": "/app/db/kipa.db",
+        "NAME": "/db/kipa.db",
     }
 }
-
-# Should we serve the media files through Python?
-SERVE_MEDIA = True