<commit_before>base_image: "rubybench/rubybench_docker"

update_pups: false

env:
  RAILS_ENV: production
  HOSTNAME: rubybench.org
  LETSENCRYPT_DIR: "/shared/letsencrypt"

params:
  db_name: rubybench_production
  db_user: rubybench
  home: /var/www/ruby-bench-web

templates:
  - "containers/templates/secrets.yml"
  - "templates/redis.template.yml"
  - "templates/postgres.template.yml"

expose:
  - "80:80"
  - "443:443"

volumes:
  - volume:
      host: /var/docker/shared/rubybench
      guest: /shared

hooks:
  after_postgres:
    - exec:
        background: true
        cmd: "sudo -u redis /usr/bin/redis-server /etc/redis/redis.conf --dbfilename test.rdb"

    - exec:
        cd: $home
        cmd:
          - git checkout production
          - git status
          - git pull --rebase origin production
          - install -d -m 0755 -g rubybench -o rubybench /shared/gems
          - sudo -u rubybench bundle install -j4 --deployment --verbose --without test:development --path=/shared/gems

    - replace:
        filename: /var/www/ruby-bench-web/config/database.yml
        from: |
          # production:
          #   <<: *default
          #   database: ruby-bench-web_production
          #   username: ruby-bench-web
        to: |
          production:
            <<: *default
            database: $db_name
            username: $db_user

    - exec:
        cd: $home
        cmd:
          - sudo -u rubybench RAILS_ENV=production bundle exec rake db:migrate
          - sudo -u rubybench RAILS_ENV=production bundle exec rake assets:precompile

    - file:
       path: /etc/service/unicorn/run
       chmod: "+x"
       contents: |
          #!/bin/bash
          exec 2>&1
          # redis
          # postgres
          cd $home
          LD_PRELOAD=/usr/lib/libjemalloc.so.1 HOME=/home/rubybench USER=rubybench exec chpst -u rubybench:www-data -U rubybench:www-data bundle exec unicorn_rails -E production -c config/unicorn.rb
    - file:
        path: /etc/service/sidekiq/run
        chmod: "+x"
        contents: |
          #!/bin/bash
          exec 2>&1
          cd $home
          chown -R rubybench /shared/log/rails
          exec chpst -u rubybench bundle exec sidekiq -e production -L /shared/log/rails/sidekiq.log -c 5
    - replace:
        filename: /etc/nginx/nginx.conf
        from: pid /run/nginx.pid;
        to: daemon off;

    - exec:
        cmd:
          - rm /etc/nginx/sites-enabled/default

    - exec:
        cd: /shared
        cmd:
          - mkdir -p log/nginx
          - touch log/nginx/access.log
          - touch log/nginx/error.log
    - file:
       path: /etc/service/nginx/run
       chmod: "+x"
       contents: |
          #!/bin/sh
          exec 2>&1
          exec /usr/sbin/nginx
    - file:
       path: /etc/runit/3.d/01-nginx
       chmod: "+x"
       contents: |
         #!/bin/bash
         sv stop nginx
    - file:
       path: /etc/runit/3.d/02-unicorn
       chmod: "+x"
       contents: |
         #!/bin/bash
         sv stop unicorn
    - file:
        path: /etc/runit/3.d/03-sidekiq
        chmod: "+"
        contents: |
          #!/bin/bash
          sv stop sidekiq
    - replace:
        filename: "/etc/logrotate.d/nginx"
        from: "weekly"
        to: "daily"

    - replace:
        filename: "/etc/logrotate.d/nginx"
        from: "52"
        to: "14"

    - replace:
        filename: "/etc/nginx/nginx.conf"
        from: "worker_processes 4"
        to: "worker_processes auto"

    - file:
       path: /etc/logrotate.d/rails
       contents: |
          /shared/log/rails/*.log
          {
                  rotate 14
                  dateext
                  daily
                  missingok
                  notifempty
                  delaycompress
                  compress
                  postrotate
                  sv 1 unicorn
                  endscript
          }

    - exec:
       cmd:
         - cd /root && git clone https://github.com/Neilpang/acme.sh.git
         - cd /root/acme.sh && git reset --hard 6cd3a8a5492b6fd3ad7ae411a5a59164cef09093
         - touch /var/spool/cron/crontabs/root
         - install -d -m 0755 -g root -o root $LETSENCRYPT_DIR
         - cd /root/acme.sh && LE_WORKING_DIR="${LETSENCRYPT_DIR}" ./acme.sh install

    - file:
       path: /etc/runit/1.d/letsencrypt
       chmod: "+x"
       contents: |
          #!/bin/bash
          set -e
          LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/acme.sh issue no $$ENV_HOSTNAME no 4096
          LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/acme.sh installcert $$ENV_HOSTNAME /shared/ssl/$$ENV_HOSTNAME.cer /shared/ssl/$$ENV_HOSTNAME.key /shared/ssl/$$ENV_HOSTNAME.cer "sv reload nginx"
          # After the initial install, switch to Webroot plugin
          LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/acme.sh _setopt $$ENV_LETSENCRYPT_DIR/$$ENV_HOSTNAME/$$ENV_HOSTNAME.conf "Le_Webroot" "=" "/var/www/discourse/public"

    - exec:
       cmd:
         # Generate strong Diffie-Hellman parameters
         - "mkdir -p /shared/ssl/"
         - "[ -e /shared/ssl/dhparams.pem ] || openssl dhparam -out /shared/ssl/dhparams.pem 4096"

    - file:
        path: /etc/nginx/conf.d/rubybench.conf
        contents: |
          upstream rubybench {
            server localhost:3000;
          }
          server {
            listen 80;
            server_name $$ENV_HOSTNAME;
            return 301 https://$host$request_uri;
          }
          server {
            listen 443 ssl http2;
            server_name $$ENV_HOSTNAME;
            ssl on;
            ssl_protocols TLSv1.2;
            # courtesy of https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
            ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
            ssl_prefer_server_ciphers on;
            ssl_certificate /shared/ssl/$$ENV_HOSTNAME.cer;
            ssl_certificate_key /shared/ssl/$$ENV_HOSTNAME.key;
            ssl_dhparam /shared/ssl/dhparams.pem;<commit_msg>Upgrade acme.sh for LE cert.<commit_after>base_image: "rubybench/rubybench_docker"

update_pups: false

env:
  RAILS_ENV: production
  HOSTNAME: rubybench.org
  LETSENCRYPT_DIR: "/shared/letsencrypt"

params:
  db_name: rubybench_production
  db_user: rubybench
  home: /var/www/ruby-bench-web

templates:
  - "containers/templates/secrets.yml"
  - "templates/redis.template.yml"
  - "templates/postgres.template.yml"

expose:
  - "80:80"
  - "443:443"

volumes:
  - volume:
      host: /var/docker/shared/rubybench
      guest: /shared

hooks:
  after_postgres:
    - exec:
        background: true
        cmd: "sudo -u redis /usr/bin/redis-server /etc/redis/redis.conf --dbfilename test.rdb"

    - exec:
        cd: $home
        cmd:
          - git checkout production
          - git status
          - git pull --rebase origin production
          - install -d -m 0755 -g rubybench -o rubybench /shared/gems
          - sudo -u rubybench bundle install -j4 --deployment --verbose --without test:development --path=/shared/gems

    - replace:
        filename: /var/www/ruby-bench-web/config/database.yml
        from: |
          # production:
          #   <<: *default
          #   database: ruby-bench-web_production
          #   username: ruby-bench-web
        to: |
          production:
            <<: *default
            database: $db_name
            username: $db_user

    - exec:
        cd: $home
        cmd:
          - sudo -u rubybench RAILS_ENV=production bundle exec rake db:migrate
          - sudo -u rubybench RAILS_ENV=production bundle exec rake assets:precompile

    - file:
       path: /etc/service/unicorn/run
       chmod: "+x"
       contents: |
          #!/bin/bash
          exec 2>&1
          # redis
          # postgres
          cd $home
          LD_PRELOAD=/usr/lib/libjemalloc.so.1 HOME=/home/rubybench USER=rubybench exec chpst -u rubybench:www-data -U rubybench:www-data bundle exec unicorn_rails -E production -c config/unicorn.rb
    - file:
        path: /etc/service/sidekiq/run
        chmod: "+x"
        contents: |
          #!/bin/bash
          exec 2>&1
          cd $home
          chown -R rubybench /shared/log/rails
          exec chpst -u rubybench bundle exec sidekiq -e production -L /shared/log/rails/sidekiq.log -c 5
    - replace:
        filename: /etc/nginx/nginx.conf
        from: pid /run/nginx.pid;
        to: daemon off;

    - exec:
        cmd:
          - rm /etc/nginx/sites-enabled/default

    - exec:
        cd: /shared
        cmd:
          - mkdir -p log/nginx
          - touch log/nginx/access.log
          - touch log/nginx/error.log
    - file:
       path: /etc/service/nginx/run
       chmod: "+x"
       contents: |
          #!/bin/sh
          exec 2>&1
          exec /usr/sbin/nginx
    - file:
       path: /etc/runit/3.d/01-nginx
       chmod: "+x"
       contents: |
         #!/bin/bash
         sv stop nginx
    - file:
       path: /etc/runit/3.d/02-unicorn
       chmod: "+x"
       contents: |
         #!/bin/bash
         sv stop unicorn
    - file:
        path: /etc/runit/3.d/03-sidekiq
        chmod: "+"
        contents: |
          #!/bin/bash
          sv stop sidekiq
    - replace:
        filename: "/etc/logrotate.d/nginx"
        from: "weekly"
        to: "daily"

    - replace:
        filename: "/etc/logrotate.d/nginx"
        from: "52"
        to: "14"

    - replace:
        filename: "/etc/nginx/nginx.conf"
        from: "worker_processes 4"
        to: "worker_processes auto"

    - file:
       path: /etc/logrotate.d/rails
       contents: |
          /shared/log/rails/*.log
          {
                  rotate 14
                  dateext
                  daily
                  missingok
                  notifempty
                  delaycompress
                  compress
                  postrotate
                  sv 1 unicorn
                  endscript
          }

    - exec:
       cmd:
         - cd /root && git clone https://github.com/acmesh-official/acme.sh.git
         - cd /root/acme.sh && git reset --hard b7a3fe05a4d8a9041159b4a773b35003166f0af0
         - touch /var/spool/cron/crontabs/root
         - install -d -m 0755 -g root -o root $LETSENCRYPT_DIR
         - cd /root/acme.sh && LE_WORKING_DIR="${LETSENCRYPT_DIR}" ./acme.sh install

    # - file:
    #    path: /etc/runit/1.d/letsencrypt
    #    chmod: "+x"
    #    contents: |
    #       #!/bin/bash
    #       set -e
    #       ${LETSENCRYPT_DIR}/acme.sh --issue --standalone -d $$ENV_HOSTNAME
    #       ${LETSENCRYPT_DIR}/acme.sh --install-cert -d $$ENV_HOSTNAME --key-file /shared/ssl/$$ENV_HOSTNAME.key --fullchain-file /shared/ssl/$$ENV_HOSTNAME.cer --reloadcmd "sv reload nginx"
    #       ${LETSENCRYPT_DIR}/acme.sh --issue -d $$ENV_HOSTNAME -w /var/www/discourse/public

    - exec:
       cmd:
         # Generate strong Diffie-Hellman parameters
         - "mkdir -p /shared/ssl/"
         - "[ -e /shared/ssl/dhparams.pem ] || openssl dhparam -out /shared/ssl/dhparams.pem 4096"

    - file:
        path: /etc/nginx/conf.d/rubybench.conf
        contents: |
          upstream rubybench {
            server localhost:3000;
          }
          server {
            listen 80;
            server_name $$ENV_HOSTNAME;
            return 301 https://$host$request_uri;
          }
          server {
            listen 443 ssl http2;
            server_name $$ENV_HOSTNAME;
            ssl on;
            ssl_protocols TLSv1.2;
            # courtesy of https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
            ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
            ssl_prefer_server_ciphers on;
            ssl_certificate /shared/ssl/$$ENV_HOSTNAME.cer;
            ssl_certificate_key /shared/ssl/$$ENV_HOSTNAME.key;
            ssl_dhparam /shared/ssl/dhparams.pem;
{'fraction_non_alphanumeric': 0.12016876365554133, 'fraction_numerical': 0.034280117531831536, 'mean_word_length': 1.7694554558731483, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 9, 'https://': 6, 'lorem ipsum': 0, 'www.': 10, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5416523', 'n_tokens_mistral': 5206, 'n_tokens_neox': 4570, 'n_words': 799}