refactor: prod server adjustments

6 files changed, 84 insertions, 11 deletions

diff --git a/Dockerfile b/Dockerfile
index 1ef8e06..c5657dd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,7 +19,6 @@ RUN set -eux \
         cgit=${CGIT_VERSION} \
         fcgiwrap \
         git \
-        highlight \
         lua5.3-libs \
         py3-markdown \
         py3-pygments \
@@ -32,8 +31,9 @@ RUN set -eux \
     && rm -rf /tmp/* \
     && true
 
-COPY conf/cgit.conf /tmp/cgitrc.tmpl
-COPY conf/default.conf /etc/nginx/conf.d/default.conf
+COPY cgit/cgit.conf /tmp/cgitrc.tmpl
+COPY nginx/nginx.conf /etc/nginx/nginx.conf
+COPY nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
 
 VOLUME [ "/srv/git", "/var/cache/cgit" ]
 
@@ -51,5 +51,5 @@ LABEL org.opencontainers.image.vendor="Jose Quintana" \
     org.opencontainers.image.url="https://github.com/joseluisq/alpine-cgit" \
     org.opencontainers.image.title="cgit" \
     org.opencontainers.image.description="A fast web interface for git." \
-    org.opencontainers.image.version="${SERVER_VERSION}" \
+    org.opencontainers.image.version="${CGIT_VERSION}" \
     org.opencontainers.image.documentation="https://github.com/joseluisq/alpine-cgit"
diff --git a/LICENSE-MIT b/LICENSE-MIT
index 0e60829..c698317 100644
--- a/LICENSE-MIT
+++ b/LICENSE-MIT
@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2019-present Jose Quintana <https://git.io/joseluisq>
+Copyright (c) 2021-present Jose Quintana <https://git.io/joseluisq>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
diff --git a/README.md b/README.md
index 5780e37..e048b40 100644
--- a/README.md
+++ b/README.md
@@ -64,4 +64,4 @@ Feel free to send some [Pull request](https://github.com/joseluisq/alpine-cgit/p
 
 This work is primarily distributed under the terms of both the [MIT license](LICENSE-MIT) and the [Apache License (Version 2.0)](LICENSE-APACHE).
 
-© 2021 [Jose Quintana](https://git.io/joseluisq)
+© 2021-present [Jose Quintana](https://git.io/joseluisq)
diff --git a/conf/cgit.conf b/cgit/cgit.conf
index db9e4da..3a1c755 100644
--- a/conf/cgit.conf
+++ b/cgit/cgit.conf
@@ -7,10 +7,10 @@ root-desc=$CGIT_DESC
 source-filter=/usr/lib/cgit/filters/syntax-highlighting.py
 about-filter=/usr/lib/cgit/filters/about-formatting.sh
 
-##
-## Search for these files in the root of the default branch of repositories
-## for coming up with the about page:
-##
+#
+# Search for these files in the root of the default branch of repositories
+# for coming up with the about page:
+#
 readme=:README.md
 readme=:readme.md
 readme=:README.mkd
@@ -46,7 +46,7 @@ logo=/cgit.png
 
 # Cache
 cache-root=/var/cache/cgit
-cache-size=1000
+cache-size=2000
 
 enable-index-links=1
 enable-index-owner=0
diff --git a/conf/default.conf b/nginx/conf.d/default.conf
index fe5c9ad..fe5c9ad 100644
--- a/conf/default.conf
+++ b/nginx/conf.d/default.conf
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
new file mode 100644
index 0000000..c45d90c
--- /dev/null
+++ b/nginx/nginx.conf
@@ -0,0 +1,73 @@
+user nginx;
+worker_processes auto;
+error_log stderr crit;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 2048;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    open_file_cache max=200000 inactive=20s;
+    open_file_cache_valid 30s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors on;
+
+    access_log off;
+    error_log stderr crit;
+
+    sendfile on;
+    sendfile_max_chunk 512k;
+    tcp_nopush on;
+    tcp_nodelay on;
+    types_hash_max_size 4096;
+
+    keepalive_timeout 35;
+
+    gzip on;
+    gzip_min_length 10240;
+    gzip_comp_level 1;
+    gzip_vary on;
+    gzip_disable msie6;
+    gzip_proxied expired no-cache no-store private auth;
+    # text/html is always compressed by HttpGzipModule
+    gzip_types
+        text/css
+        text/javascript
+        text/xml
+        text/plain
+        text/x-component
+        application/javascript
+        application/x-javascript
+        application/json
+        application/xml
+        application/rss+xml
+        application/atom+xml
+        font/truetype
+        font/opentype
+        application/vnd.ms-fontobject
+        image/svg+xml;
+
+    reset_timedout_connection on;
+    client_body_timeout 10;
+    send_timeout 5;
+
+    server_tokens off;
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    client_body_buffer_size 128k;
+    large_client_header_buffers 4 256k;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    include /etc/nginx/conf.d/*.conf;
+}