DevFW-CICD/ingress-nginx-helm
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Switch to nginx

Browse source
This commit is contained in:
Manuel Alejandro de Brito Fontes 2019-12-24 14:42:59 -03:00
parent aba58d67f2
commit 283536154d
3 changed files with 196 additions and 116 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
images/nginx/Makefile
View file

@ -13,7 +13,7 @@
# limitations under the License. # limitations under the License.
# 0.0.0 shouldn't clobber any released builds # 0.0.0 shouldn't clobber any released builds
TAG ?= 0.94 TAG ?= 0.95
REGISTRY ?= quay.io/kubernetes-ingress-controller REGISTRY ?= quay.io/kubernetes-ingress-controller
ARCH ?= $(shell go env GOARCH) ARCH ?= $(shell go env GOARCH)
DOCKER ?= docker DOCKER ?= docker
@ -26,7 +26,7 @@ ifeq ($(GOHOSTOS),darwin)
SED_I=sed -i '' SED_I=sed -i ''
endif endif
QEMUVERSION=v4.1.0-1 QEMUVERSION=v4.1.1-1
IMGNAME = nginx IMGNAME = nginx
IMAGE = $(REGISTRY)/$(IMGNAME) IMAGE = $(REGISTRY)/$(IMGNAME)

63
images/nginx/rootfs/Dockerfile
View file

@ -13,23 +13,68 @@
# limitations under the License. # limitations under the License.
FROM BASEIMAGE FROM BASEIMAGE as builder
CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/ CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/
ENV PATH=$PATH:/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin RUN clean-install bash
# Add LuaRocks paths
# see https://github.com/openresty/docker-openresty/blob/de05cd72594498b83e3a97e2f632da6aa75ec01d/bionic/Dockerfile#L168
ENV LUA_PATH="/usr/local/openresty/site/lualib/?.ljbc;/usr/local/openresty/site/lualib/?/init.ljbc;/usr/local/openresty/lualib/?.ljbc;/usr/local/openresty/lualib/?/init.ljbc;/usr/local/openresty/site/lualib/?.lua;/usr/local/openresty/site/lualib/?/init.lua;/usr/local/openresty/lualib/?.lua;/usr/local/openresty/lualib/?/init.lua;./?.lua;/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;/usr/local/openresty/luajit/share/lua/5.1/?.lua;/usr/local/openresty/luajit/share/lua/5.1/?/init.lua;/usr/local/lib/lua/?.lua"
ENV LUA_CPATH="/usr/local/openresty/site/lualib/?.so;/usr/local/openresty/lualib/?.so;./?.so;/usr/local/lib/lua/5.1/?.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/loadall.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so"
COPY . / COPY . /
RUN clean-install bash
RUN /build.sh RUN /build.sh
# Use a multi-stage build
FROM BASEIMAGE
ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin
ENV LUA_PATH="/usr/local/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/lib/lua/?.lua;;"
ENV LUA_CPATH="/usr/local/lib/lua/?/?.so;/usr/local/lib/lua/?.so;;"
COPY --from=builder /usr/local /usr/local
COPY --from=builder /opt /opt
COPY --chown=www-data:www-data --from=builder /etc/nginx /etc/nginx
RUN apt-get update && apt-get dist-upgrade -y \
&& clean-install \
bash \
curl ca-certificates \
libgeoip1 \
patch \
libpcre3 \
zlib1g \
libaio1 \
openssl \
util-linux \
lmdb-utils \
libcurl4 \
libprotobuf17 \
libz3-4 \
procps \
libxml2 libpcre++0v5 \
liblmdb0 \
libmaxminddb0 \
dumb-init \
nano \
libyaml-cpp0.6 \
libyajl2 \
&& ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \
&& ln -s /usr/local/lib/mimalloc-1.2/libmimalloc.so /usr/local/lib/libmimalloc.so \
&& bash -eu -c ' \
writeDirs=( \
/var/log/nginx \
/var/lib/nginx/body \
/var/lib/nginx/fastcgi \
/var/lib/nginx/proxy \
/var/lib/nginx/scgi \
/var/lib/nginx/uwsgi \
/var/log/audit \
); \
for dir in "${writeDirs[@]}"; do \
mkdir -p ${dir}; \
chown -R www-data.www-data ${dir}; \
done'
EXPOSE 80 443 EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"] CMD ["nginx", "-g", "daemon off;"]

245
images/nginx/rootfs/build.sh
View file

@ -21,7 +21,10 @@ set -o pipefail
export DEBIAN_FRONTEND=noninteractive export DEBIAN_FRONTEND=noninteractive
export OPENRESTY_VERSION=7508c1852265bd04fdb2dfd64989d4c490440f1a export NGINX_VERSION=1.17.7
export NDK_VERSION=0.3.1rc1
export SETMISC_VERSION=0.32
export MORE_HEADERS_VERSION=0.33
export NGINX_DIGEST_AUTH=cd8641886c873cf543255aeda20d23e4cd603d05 export NGINX_DIGEST_AUTH=cd8641886c873cf543255aeda20d23e4cd603d05
export NGINX_SUBSTITUTIONS=bc58cb11844bc42735bbaef7085ea86ace46d05b export NGINX_SUBSTITUTIONS=bc58cb11844bc42735bbaef7085ea86ace46d05b
export NGINX_OPENTRACING_VERSION=0.9.0 export NGINX_OPENTRACING_VERSION=0.9.0
@ -31,14 +34,20 @@ export JAEGER_VERSION=741b1af2805388e98dbfea449f40c6d6b19c13be
export MSGPACK_VERSION=3.2.0 export MSGPACK_VERSION=3.2.0
export DATADOG_CPP_VERSION=1.1.1 export DATADOG_CPP_VERSION=1.1.1
export MODSECURITY_VERSION=1.0.1 export MODSECURITY_VERSION=1.0.1
export MODSECURITY_LIB_VERSION=3.0.3 export MODSECURITY_LIB_VERSION=6624a18a4e7fd9881a7a9b435db3e481e8e986a5
export OWASP_MODSECURITY_CRS_VERSION=3.2.0 export OWASP_MODSECURITY_CRS_VERSION=3.2.0
export LUA_NGX_VERSION=0.10.15
export LUA_STREAM_NGX_VERSION=0.0.7
export LUA_UPSTREAM_VERSION=0.07
export LUA_BRIDGE_TRACER_VERSION=0.1.1 export LUA_BRIDGE_TRACER_VERSION=0.1.1
export NGINX_INFLUXDB_VERSION=5b09391cb7b9a889687c0aa67964c06a2d933e8b export NGINX_INFLUXDB_VERSION=5b09391cb7b9a889687c0aa67964c06a2d933e8b
export GEOIP2_VERSION=3.2 export GEOIP2_VERSION=3.3
export NGINX_AJP_VERSION=bf6cd93f2098b59260de8d494f0f4b1f11a84627 export NGINX_AJP_VERSION=bf6cd93f2098b59260de8d494f0f4b1f11a84627
export RESTY_LUAROCKS_VERSION=3.1.3 export RESTY_LUAROCKS_VERSION=3.2.1
export LUA_RESTY_BALANCER_VERSION=0.03 export LUAJIT_VERSION=9d5750d28478abfdcaefdfdc408f87752a21e431
export LUA_RESTY_BALANCER=0.03
export LUA_RESTY_CORE=0.1.17
export LUA_CJSON_VERSION=2.1.0.7
export BUILD_PATH=/tmp/build export BUILD_PATH=/tmp/build
@ -84,15 +93,11 @@ clean-install \
libcurl4-openssl-dev \ libcurl4-openssl-dev \
libprotobuf-dev protobuf-compiler \ libprotobuf-dev protobuf-compiler \
libz-dev \ libz-dev \
procps \
git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libtool dh-autoreconf libxml2 libpcre++-dev libxml2-dev \ git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libtool dh-autoreconf libxml2 libpcre++-dev libxml2-dev \
python \ python \
libmaxminddb-dev \ libmaxminddb-dev \
dumb-init \
bc \ bc \
unzip \ unzip \
nano \
ssdeep \
dos2unix mercurial \ dos2unix mercurial \
libyaml-cpp0.6 \ libyaml-cpp0.6 \
|| exit 1 || exit 1
@ -126,8 +131,17 @@ mkdir --verbose -p "$BUILD_PATH"
cd "$BUILD_PATH" cd "$BUILD_PATH"
# download, verify and extract the source files # download, verify and extract the source files
get_src 221cfecadd0ed2902738757e7d8fb0bc41882840f07ea87112740b44f173722f \ get_src b62756842807e5693b794e5d0ae289bd8ae5b098e66538b2a91eb80f25c591ff \
"https://github.com/openresty/openresty/archive/${OPENRESTY_VERSION}.tar.gz" "https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz"
get_src 49f50d4cd62b166bc1aaf712febec5e028d9f187cedbc27a610dfd01bdde2d36 \
"https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz"
get_src f1ad2459c4ee6a61771aa84f77871f4bfe42943a4aa4c30c62ba3f981f52c201 \
"https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz"
get_src a3dcbab117a9c103bc1ea5200fc00a7b7d2af97ff7fd525f16f8ac2632e30fbf \
"https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz"
get_src fe683831f832aae4737de1e1026a4454017c2d5f98cb88b08c5411dc380062f8 \ get_src fe683831f832aae4737de1e1026a4454017c2d5f98cb88b08c5411dc380062f8 \
"https://github.com/atomx/nginx-http-auth-digest/archive/$NGINX_DIGEST_AUTH.tar.gz" "https://github.com/atomx/nginx-http-auth-digest/archive/$NGINX_DIGEST_AUTH.tar.gz"
@ -153,6 +167,18 @@ get_src db377619a07d538bdbf328272fdec3893e6f674bdf469b3b575f778866e3ace7 \
get_src ff865a36bad5c72b8e7ebc4b7cf5f27a820fce4faff9c571c1791e3728355a39 \ get_src ff865a36bad5c72b8e7ebc4b7cf5f27a820fce4faff9c571c1791e3728355a39 \
"https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz" "https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz"
get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \
"https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \
"https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
get_src 2a69815e4ae01aa8b170941a8e1a10b6f6a9aab699dee485d58f021dd933829a \
"https://github.com/openresty/lua-upstream-nginx-module/archive/v$LUA_UPSTREAM_VERSION.tar.gz"
get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \
"https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz"
get_src 052fd37cd698e24ab73ee18fc3fa55acd1d43153c12a0e65b0fba0447de1117e \ get_src 052fd37cd698e24ab73ee18fc3fa55acd1d43153c12a0e65b0fba0447de1117e \
"https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz" "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz"
@ -162,17 +188,29 @@ get_src 6faab57557bd9cc9fc38208f6bc304c1c13cf048640779f98812cf1f9567e202 \
get_src 1af5a5632dc8b00ae103d51b7bf225de3a7f0df82f5c6a401996c080106e600e \ get_src 1af5a5632dc8b00ae103d51b7bf225de3a7f0df82f5c6a401996c080106e600e \
"https://github.com/influxdata/nginx-influxdb-module/archive/$NGINX_INFLUXDB_VERSION.tar.gz" "https://github.com/influxdata/nginx-influxdb-module/archive/$NGINX_INFLUXDB_VERSION.tar.gz"
get_src 15bd1005228cf2c869a6f09e8c41a6aaa6846e4936c473106786ae8ac860fab7 \ get_src 41378438c833e313a18869d0c4a72704b4835c30acaf7fd68013ab6732ff78a7 \
"https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz"
get_src 5f629a50ba22347c441421091da70fdc2ac14586619934534e5a0f8a1390a950 \ get_src 5f629a50ba22347c441421091da70fdc2ac14586619934534e5a0f8a1390a950 \
"https://github.com/yaoweibin/nginx_ajp_module/archive/$NGINX_AJP_VERSION.tar.gz" "https://github.com/yaoweibin/nginx_ajp_module/archive/$NGINX_AJP_VERSION.tar.gz"
get_src c573435f495aac159e34eaa0a3847172a2298eb6295fcdc35d565f9f9b990513 \ get_src f27e20c9cdb3ffb991ccdb85796c36a0690566676f8e1a59b0d0ee6598907d04 \
"https://luarocks.github.io/luarocks/releases/luarocks-${RESTY_LUAROCKS_VERSION}.tar.gz" "https://luarocks.github.io/luarocks/releases/luarocks-${RESTY_LUAROCKS_VERSION}.tar.gz"
get_src 5d16e623d17d4f42cc64ea9cfb69ca960d313e12f5d828f785dd227cc483fcbd \
"https://github.com/openresty/lua-resty-upload/archive/v0.10.tar.gz"
get_src 095615fe94e64615c4a27f4f4475b91c047cf8d10bc2dbde8d5ba6aa625fc5ab \
"https://github.com/openresty/lua-resty-string/archive/v0.11.tar.gz"
get_src 82209d5a5d9545c6dde3db7857f84345db22162fdea9743d5e2b2094d8d407f8 \ get_src 82209d5a5d9545c6dde3db7857f84345db22162fdea9743d5e2b2094d8d407f8 \
"https://github.com/openresty/lua-resty-balancer/archive/v${LUA_RESTY_BALANCER_VERSION}.tar.gz" "https://github.com/openresty/lua-resty-balancer/archive/v$LUA_RESTY_BALANCER.tar.gz"
get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \
"https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
get_src 59d2f18ecadba48be61061004c8664eaed1111a3372cd2567cb24c5a47eb41fe \
"https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz"
# improve compilation times # improve compilation times
CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0)) CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
@ -180,9 +218,17 @@ CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
export MAKEFLAGS=-j${CORES} export MAKEFLAGS=-j${CORES}
export CTEST_BUILD_FLAGS=${MAKEFLAGS} export CTEST_BUILD_FLAGS=${MAKEFLAGS}
export HUNTER_JOBS_NUMBER=${CORES} export HUNTER_JOBS_NUMBER=${CORES}
export HUNTER_KEEP_PACKAGE_SOURCES=false
export HUNTER_USE_CACHE_SERVERS=true export HUNTER_USE_CACHE_SERVERS=true
# Install luajit from openresty fork
export LUAJIT_LIB=/usr/local/lib
export LUA_LIB_DIR="$LUAJIT_LIB/lua"
export LUAJIT_INC=/usr/local/include/luajit-2.1
cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
make CCDEBUG=-g
make install
if [[ ${ARCH} == "armv7l" ]]; then if [[ ${ARCH} == "armv7l" ]]; then
export PCRE_DIR=/usr/lib/arm-linux-gnueabihf export PCRE_DIR=/usr/lib/arm-linux-gnueabihf
fi fi
@ -197,8 +243,6 @@ fi
cd "$BUILD_PATH" cd "$BUILD_PATH"
export PATH=$PATH:/usr/local/openresty/luajit
# install openresty-gdb-utils # install openresty-gdb-utils
cd / cd /
git clone --depth=1 https://github.com/openresty/openresty-gdb-utils.git git clone --depth=1 https://github.com/openresty/openresty-gdb-utils.git
@ -316,14 +360,31 @@ cd ngx_brotli
git submodule init git submodule init
git submodule update git submodule update
cd "$BUILD_PATH"
git clone https://github.com/ssdeep-project/ssdeep
cd ssdeep/
./bootstrap
./configure
make
make install
# build modsecurity library # build modsecurity library
cd "$BUILD_PATH" cd "$BUILD_PATH"
git clone -b v$MODSECURITY_LIB_VERSION https://github.com/SpiderLabs/ModSecurity git clone https://github.com/SpiderLabs/ModSecurity
cd ModSecurity/ cd ModSecurity/
git checkout $MODSECURITY_LIB_VERSION
git submodule init git submodule init
git submodule update git submodule update
sh build.sh sh build.sh
./configure --disable-doxygen-doc --disable-examples --disable-dependency-tracking
./configure \
--disable-doxygen-doc \
--disable-doxygen-html \
--disable-examples
make make
make install make install
@ -381,7 +442,13 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTE
" > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf " > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
# build nginx # build nginx
cd "$BUILD_PATH/openresty-$OPENRESTY_VERSION" cd "$BUILD_PATH/nginx-$NGINX_VERSION"
# apply nginx patches
for PATCH in `ls /patches`;do
echo "Patch: $PATCH"
patch -p1 < /patches/$PATCH
done
WITH_FLAGS="--with-debug \ WITH_FLAGS="--with-debug \
--with-compat \ --with-compat \
@ -401,10 +468,7 @@ WITH_FLAGS="--with-debug \
--with-stream_ssl_preread_module \ --with-stream_ssl_preread_module \
--with-threads \ --with-threads \
--with-http_secure_link_module \ --with-http_secure_link_module \
--with-http_gunzip_module \ --with-http_gunzip_module"
--with-md5-asm \
--with-sha1-asm \
-j${CORES} "
# "Combining -flto with -g is currently experimental and expected to produce unexpected results." # "Combining -flto with -g is currently experimental and expected to produce unexpected results."
# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html # https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
@ -434,8 +498,14 @@ if [[ ${ARCH} == "x86_64" ]]; then
CC_OPT+=' -m64 -mtune=native' CC_OPT+=' -m64 -mtune=native'
fi fi
WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \ WITH_MODULES="--add-module=$BUILD_PATH/ngx_devel_kit-$NDK_VERSION \
--add-module=$BUILD_PATH/set-misc-nginx-module-$SETMISC_VERSION \
--add-module=$BUILD_PATH/headers-more-nginx-module-$MORE_HEADERS_VERSION \
--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
--add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \ --add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \
--add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \
--add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \
--add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \
--add-module=$BUILD_PATH/nginx-influxdb-module-$NGINX_INFLUXDB_VERSION \ --add-module=$BUILD_PATH/nginx-influxdb-module-$NGINX_INFLUXDB_VERSION \
--add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \ --add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \
--add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \ --add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \
@ -443,11 +513,19 @@ WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH
--add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \ --add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \
--add-module=$BUILD_PATH/ngx_brotli" --add-module=$BUILD_PATH/ngx_brotli"
make
cd openresty-1.17.4.1rc0
./configure \ ./configure \
--prefix=/usr/local/nginx \
--conf-path=/etc/nginx/nginx.conf \
--modules-path=/etc/nginx/modules \
--http-log-path=/var/log/nginx/access.log \
--error-log-path=/var/log/nginx/error.log \
--lock-path=/var/lock/nginx.lock \
--pid-path=/run/nginx.pid \
--http-client-body-temp-path=/var/lib/nginx/body \
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/proxy \
--http-scgi-temp-path=/var/lib/nginx/scgi \
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
${WITH_FLAGS} \ ${WITH_FLAGS} \
--without-mail_pop3_module \ --without-mail_pop3_module \
--without-mail_smtp_module \ --without-mail_smtp_module \
@ -460,26 +538,18 @@ cd openresty-1.17.4.1rc0
--group=www-data \ --group=www-data \
${WITH_MODULES} ${WITH_MODULES}
make || exit 1 make
make install || exit 1 make install
cd "$BUILD_PATH/luarocks-${RESTY_LUAROCKS_VERSION}" cd "$BUILD_PATH/luarocks-${RESTY_LUAROCKS_VERSION}"
./configure \ ./configure \
--prefix=/usr/local/openresty/luajit \
--with-lua=/usr/local/openresty/luajit \
--lua-suffix=jit-2.1.0-beta3 \ --lua-suffix=jit-2.1.0-beta3 \
--with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1 --with-lua-include=/usr/local/include/luajit-2.1
make || exit 1 make
make install || exit 1 make install
export PATH=$PATH:/usr/local/openresty/luajit/bin export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
cd /usr/local/openresty
# build and install lua-resty-waf with dependencies
export LUA_LIB_DIR=/usr/local/openresty/lualib
export LUA_INCLUDE_DIR=/tmp/build/openresty-$OPENRESTY_VERSION/openresty-1.17.4.1rc0/build/luajit-root/usr/local/openresty/luajit/include/luajit-2.1
ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1 ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
@ -487,14 +557,33 @@ if [[ ${ARCH} != "armv7l" ]]; then
luarocks install lrexlib-pcre 2.7.2-1 PCRE_LIBDIR=${PCRE_DIR} luarocks install lrexlib-pcre 2.7.2-1 PCRE_LIBDIR=${PCRE_DIR}
fi fi
cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
make install
cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER"
make all
make install
cd "$BUILD_PATH/lua-cjson-$LUA_CJSON_VERSION"
make all
make install
luarocks install lua-resty-iputils 0.3.0-1 luarocks install lua-resty-iputils 0.3.0-1
luarocks install lua-resty-cookie 0.1.0-1 luarocks install lua-resty-cookie 0.1.0-1
luarocks install lua-resty-lrucache 0.09-2
luarocks install lua-resty-lock 0.08-0
luarocks install lua-resty-dns 0.21-1
cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER_VERSION" # required for OCSP verification
luarocks install lua-resty-http
make cd "$BUILD_PATH/lua-resty-upload-0.10"
make install make install
cd "$BUILD_PATH/lua-resty-string-0.11"
make install
# build Lua bridge tracer # build Lua bridge tracer
cd "$BUILD_PATH/lua-bridge-tracer-$LUA_BRIDGE_TRACER_VERSION" cd "$BUILD_PATH/lua-bridge-tracer-$LUA_BRIDGE_TRACER_VERSION"
mkdir .build mkdir .build
@ -513,76 +602,22 @@ cmake ../..
make make
make install make install
echo "Cleaning..."
cd /
apt-mark unmarkauto \
bash \
curl ca-certificates \
libgeoip1 \
libpcre3 \
zlib1g \
libaio1 \
geoip-bin \
libyajl2 liblmdb0 libxml2 libpcre++ \
gzip \
openssl \
libyaml-cpp0.6
apt-get remove -y --purge \
build-essential \
libgeoip-dev \
libpcre3-dev \
libssl-dev \
zlib1g-dev \
libaio-dev \
linux-libc-dev \
cmake \
wget \
patch \
protobuf-compiler \
python \
xz-utils \
bc \
sensible-utils \
git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libgeoip-dev libtool dh-autoreconf libpcre++-dev libxml2-dev
apt-get autoremove -y
# Remove configuration files left after the package removal.
# To see such packages run: apt list | grep residual
dpkg -l | grep '^rc' | awk '{print $2}' | xargs apt-get purge --yes
rm -rf "$BUILD_PATH"
rm -Rf /usr/share/man /usr/share/doc
rm -rf /tmp/* /var/tmp/*
rm -rf /var/lib/apt/lists/*
rm -rf /var/cache/apt/archives/*
rm -rf /usr/local/modsecurity/bin
rm -rf /usr/local/modsecurity/include
rm -rf /usr/local/modsecurity/lib/libmodsecurity.a
rm -rf /root/.cache
rm -rf /etc/nginx/owasp-modsecurity-crs/.git
rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
rm -rf $HOME/.hunter
rm -rf $LUA_INCLUDE_DIR /usr/include/lua5.1
# update image permissions # update image permissions
writeDirs=( \ writeDirs=( \
/etc/nginx \ /etc/nginx \
/usr/local/openresty/nginx \ /usr/local/nginx \
/opt/modsecurity/var/log \ /opt/modsecurity/var/log \
/opt/modsecurity/var/upload \ /opt/modsecurity/var/upload \
/opt/modsecurity/var/audit \ /opt/modsecurity/var/audit \
/var/log/audit \ /var/log/audit \
/var/log/nginx \
); );
for dir in "${writeDirs[@]}"; do for dir in "${writeDirs[@]}"; do
mkdir -p ${dir}; mkdir -p ${dir};
chown -R www-data.www-data ${dir}; chown -R www-data.www-data ${dir};
done done
rm -rf /etc/nginx/owasp-modsecurity-crs/.git
rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
rm -rf /usr/local/modsecurity/lib/libmodsecurity.a