icydocker/php7.4-nginx-acme repository overview

⁠docker image to run php-fpm-7.4.33 + nginx-1.28 + acme.sh based on alpine:3.15

• latest packages
• smaller size less than 230 MB
• replace supervisor with s6-overlay

⁠Variables

• PUID, PGID id of user/group to run nginx and fpm as

• WEBROOT set default web root, default: /var/www/html

• PHP_ERRORS php_flag[display_errors]=on/off

• PHP_ERRORS_STDERR forward php errors to stderr: error_log = /dev/stderr

• PHP_MEM_LIMIT memory_limit

• PHP_POST_MAX_SIZE post_max_size

• PHP_UPLOAD_MAX_FILESIZE upload_max_filesize

• ENABLE_XDEBUG enable xdebug for local development

• HIDE_NGINX_HEADERS nginx: server_tokens on/off;

• REAL_IP_HEADER nginx: X-Forwarded-For

• REAL_IP_FROM nginx: set_real_ip_from

• DISABLE_IP_ACCESS disable direct ip address access

• DISABLE_ACCESS_CODE default: 403

• ENABLE_PHPINFO protected by /etc/auth/basic-auth.htpasswd or /etc/auth/nginx-digest.htpasswd

  • BASIC_AUTH 1 use basic authentication method, otherwise use digest authentication

• RUN_SCRIPTS run scripts under /root/scripts during startup

• ACME_DEFAULT_SERVER default: letsencrypt

⁠possible mount points

• /var/www/letsencrypt: .well-known
• /root/scripts: scripts to run at startup
• /etc/auth: htpasswd files if enable phpinfo page
• /etc/nginx/conf.d virtual hosts configuration
• /etc/php/conf.d/ custom php settings
• /acme.sh home of acme.sh

⁠scripts

• run /acmectl.sh to enable cron jobs to update certificates

⁠sample compose.yaml

services:
  php-alpine:
    image: icydocker/php7.4-nginx-acme
    container_name: nginx-fpm-acme
    restart: "always"
    environment:
      - PUID=1005
      - PGID=1005
      - RUN_SCRIPTS=1
      - PHP_MEM_LIMIT=1024
      - PHP_POST_MAX_SIZE=300
      - PHP_UPLOAD_MAX_FILESIZE=250
      - DISABLE_IP_ACCESS=1
      - DISABLE_ACCESS_CODE=503
      - ENABLE_PHPINFO=1
    ports:
      - "443:443/tcp"
      - "80:80/tcp"
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "20m"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /webroot/letsencrypt:/etc/letsencrypt
      - /webroot/acmehome:/acme.sh
      - /webroot/acme-certs:/etc/acme
      - /webroot/conf/nginx:/etc/nginx/conf.d
      - /webroot/conf/php-fpm:/etc/php/conf.d
      - /webroot/webroot:/opt/webroot
      - ./well-known:/var/www/letsencrypt
      - ./scripts:/root/scripts
      - ./auth:/etc/auth