install-php

#!/bin/bash -e

. /etc/os-release

case "$ID" in
    debian)
        case "$VERSION" in
            "10 (buster)")
                DEBIAN_LIBICU=libicu63
                DEBIAN_LIBTIDY=libtidy5deb1
                DEBIAN_LIBSODIUM=libsodium23
            ;;
            "9 (stretch)")
                DEBIAN_LIBICU=libicu57
                DEBIAN_LIBTIDY=libtidy5
                DEBIAN_LIBSODIUM=libsodium18
            ;;
            *)
                echo "debian version must be strech or buster (got $VERSION)"
                exit -1
            ;;
        esac
        PACKAGE_FORMAT=apt
        APT_EXTRA=
        APT_DEV_EXTRA=
        ;;
    alpine)
        case "$PRETTY_NAME" in
            "Alpine Linux v3.11")
            ;;
            "Alpine Linux v3.10")
                APK_EXTRA_DIST="libgcrypt libgpg-error"
                APK_DEV_EXTRA_DIST="libgcrypt-dev libgpg-error-dev"
            ;;
            "Alpine Linux v3.9")
            ;;
            *)
                echo "alpine version must be 3.9, 3.10 or 3.11 (got $PRETTY_NAME)"
                exit -1
            ;;
        esac
        PACKAGE_FORMAT=apk
        APK_EXTRA=
        APK_DEV_EXTRA=
        ;;
    *)
        echo "linux distribution not supported (got $ID)"
        exit -1
    ;;
esac

echo "PHP VERSION: $PHP_VERSION"

APCU_DISABLE=
NPM_VERSION=npm
NODE_VERSION=8.x
XDEBUG_VERSION=xdebug
MEMCACHED_VERSION=memcached
EXT_EXTRA=
APT_EXTRA=
APT_DEV_EXTRA=
PECL_EXTRA="ast memcache"
TIDEWAYS_XHPROF=5.0.2
LEGACY_XHPROF=
GD_OPTIONS="--with-png-dir=/usr --with-jpeg-dir=/usr --with-webp-dir=/usr --with-freetype-dir=/usr"

case $PHP_VERSION in
    5.6.*)
        APCU_DISABLE=1
        NODE_VERSION=4.x
        NPM_VERSION=npm@5
        APT_EXTRA=libmcrypt4
        APT_DEV_EXTRA=libmcrypt-dev
        EXT_EXTRA="mysql mcrypt"
        XDEBUG_VERSION=xdebug-2.5.5
        MEMCACHED_VERSION=memcached-2.2.0
        PECL_EXTRA="memcache-3.0.8"
        TIDEWAYS_XHPROF=
        LEGACY_XHPROF=0.9.4
    ;;
    7.0.*)
        NODE_VERSION=4.x
        NPM_VERSION=npm@5
        APT_EXTRA="libmcrypt4 $DEBIAN_LIBSODIUM"
        APT_DEV_EXTRA="libmcrypt-dev libsodium-dev"
        EXT_EXTRA=mcrypt
        XDEBUG_VERSION=xdebug-2.9.0
        PECL_EXTRA="ast memcache libsodium"
    ;;
    7.1.*)
        NODE_VERSION=6.x
        APT_EXTRA="libmcrypt4 $DEBIAN_LIBSODIUM"
        APT_DEV_EXTRA="libmcrypt-dev libsodium-dev"
        APK_EXTRA="libmcrypt libsodium"
        APK_DEV_EXTRA="libmcrypt-dev libsodium-dev"
        EXT_EXTRA=mcrypt
        PECL_EXTRA="ast memcache libsodium"
    ;;
    7.2.*)
    ;;
    7.3.*)
        APT_EXTRA=libzip4
        APT_DEV_EXTRA=libzip-dev
    ;;
    7.4.*)
        APT_EXTRA=libzip4
        APT_DEV_EXTRA=libzip-dev
        GD_OPTIONS="--with-jpeg --with-webp --with-freetype"
    ;;
    *)
        echo "not supported."
        exit -1
    ;;
esac

if [ -e "/etc/apache2/apache2.conf" ]; then
    sed -i "s|/var/www/html|\$\{WEB_ROOT\}|" /etc/apache2/apache2.conf
    sed -i "s|/var/www|\$\{WEB_ROOT\}|"      /etc/apache2/apache2.conf
    sed -i "s|<VirtualHost \*:80>|<VirtualHost *:\$\{WEB_PORT\}>|" /etc/apache2/sites-enabled/000-default.conf
    sed -i "s|Listen 80|Listen \$\{WEB_PORT\}|" /etc/apache2/ports.conf
    sed -i "s|/var/www/html|\$\{WEB_ROOT\}|" /etc/apache2/sites-enabled/000-default.conf
    { \
        echo 'ServerName localhost'; \
        echo '<Directory ${WEB_ROOT}/>'; \
        echo '  Options FollowSymLinks'; \
        echo '  AllowOverride All'; \
        echo '  Require all granted'; \
        echo '</Directory>'; \
    } >> /etc/apache2/sites-enabled/000-default.conf
    sed -i "s|^ServerTokens .*|ServerTokens Prod|" /etc/apache2/conf-available/security.conf
    sed -i "s|^ServerSignature .*|ServerSignature Off|" /etc/apache2/conf-available/security.conf
fi

if [ $PACKAGE_FORMAT == "apt" ]; then
    echo "force-unsafe-io" > /etc/dpkg/dpkg.cfg.d/02apt-speedup
    echo "Acquire::http {No-Cache=True;};" > /etc/apt/apt.conf.d/no-cache
    apt-get update && apt-get install -y gnupg2
    if [ -z $NODEJS_DISABLE ]; then
        >&2 echo "DEPRECATION: nodejs will be removed in the future of this image!"
        curl -sL https://deb.nodesource.com/setup_$NODE_VERSION | bash -
        echo -e "Package: *\nPin: origin deb.nodesource.com\nPin-Priority: 1001\n" >> /etc/apt/preferences.d/nodesource
        apt-get install -y nodejs
        npm install --quiet -g $NPM_VERSION
        npm install --quiet -g grunt-cli bower
        npm cache clean --force
    fi
    apt-get install -y \
        dumb-init \
        nano \
        locales \
        libfreetype6-dev \
        libjpeg62-turbo-dev \
        libcurl4-openssl-dev \
        libpng16-16 \
        libpng-dev \
        libwebp6 \
        libwebp-dev \
        libxslt1.1 \
        libxslt1-dev \
        libxml2-dev \
        $DEBIAN_LIBICU \
        icu-devtools \
        libicu-dev \
        $DEBIAN_LIBTIDY \
        libtidy-dev \
        zlib1g-dev \
        libxml2-dev \
        libmemcached11 \
        libmemcached-dev \
        curl \
        graphicsmagick \
        msmtp \
        git \
        mercurial \
        postgresql-client-common \
        libpq-dev \
        libsqlite3-dev \
        libssl-dev \
        libmagickwand-dev \
        unzip \
        $(if [ -e "/etc/apache2/apache2.conf" ]; then echo libcap2-bin; fi) \
        $APT_EXTRA \
        $APT_DEV_EXTRA
fi

if [ $PACKAGE_FORMAT == "apk" ]; then
    apk add --no-cache \
        dumb-init \
        fcgi \
        coreutils \
        freetype \
        libjpeg-turbo \
        libpng \
        libwebp \
        curl \
        libxslt \
        libxml2 \
        libmemcached-libs \
        icu-libs \
        tidyhtml-libs \
        zlib \
        libzip \
        msmtp \
        git  \
        postgresql-libs \
        openssl \
        sqlite-libs \
        curl \
        unzip \
        imagemagick \
        $APK_EXTRA \
        $APK_EXTRA_DIST

    apk add --no-cache --virtual .build-deps \
        freetype-dev \
        libjpeg-turbo-dev \
        libpng-dev \
        libwebp-dev \
        curl-dev \
        libxslt-dev \
        libxml2-dev \
        libmemcached-dev \
        icu-dev \
        tidyhtml-dev \
        zlib-dev \
        libzip-dev \
        postgresql-dev \
        openssl-dev \
        sqlite-dev \
        imagemagick-dev \
        $(if [ -e "/etc/apache2/apache2.conf" ]; then echo libcap; fi) \
        $APK_DEV_EXTRA \
        $APK_DEV_EXTRA_DIST
fi

export MAKEFLAGS="-j $(grep -c ^processor /proc/cpuinfo)"

if [ -e "/etc/apache2/apache2.conf" ]; then
    if [ $PACKAGE_FORMAT == "apt" ]; then
        apt-get install -y libapache2-mod-security2
    fi
    a2enmod rewrite headers expires security2

    cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRuleEngine) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRequestBodyAccess) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRequestBodyLimit) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRequestBodyNoFilesLimit) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRequestBodyInMemoryLimit) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecRequestBodyLimitAction) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecResponseBodyAccess) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecResponseBodyMimeType) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecResponseBodyLimit) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecResponseBodyLimitAction) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecTmpDir) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecDataDir) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecAuditEngine) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecAuditLogParts) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    sed -i -E "s/^(SecStatusEngine) .+$/\1 \$\{\1\}/g" /etc/modsecurity/modsecurity.conf
    cd /usr/share
    curl -L https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/v3.0.2.tar.gz | tar xvz
    mv modsecurity-crs modsecurity-crs-old
    mv owasp-modsecurity-crs-3.0.2 modsecurity-crs
    echo 'SecAction "id:900990, phase:1, nolog, pass, t:none, setvar:tx.crs_setup_version=310"' > modsecurity-crs/owasp-crs.load
    echo "Include /usr/share/modsecurity-crs/rules/*.conf" >> modsecurity-crs/owasp-crs.load
    touch modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS-DOCKER.conf
    chmod o+w modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS-DOCKER.conf
    cd /var/log/apache2
    ln -s /dev/stderr modsec_audit.log
fi

if [ -e "/etc/locale.gen" ]; then
    echo "de_DE.UTF-8 UTF-8" >> /etc/locale.gen
    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen
    echo "en_GB.UTF-8 UTF-8" >> /etc/locale.gen
    echo "fr_FR.UTF-8 UTF-8" >> /etc/locale.gen
    echo "it_IT.UTF-8 UTF-8" >> /etc/locale.gen
    echo "nl_NL.UTF-8 UTF-8" >> /etc/locale.gen
    locale-gen
    /usr/sbin/update-locale LANG=en_US.UTF-8
fi

docker-php-ext-configure gd $GD_OPTIONS
for P in mongodb imagick $MEMCACHED_VERSION $PECL_EXTRA; do
    echo pecl install $P
    pecl install $P
    if [ "$P" = "libsodium" ]; then
        echo "extension=sodium.so" >> /usr/local/etc/php/conf.d/pecl_exts.ini
    else
        echo "extension=${P%-*}.so" >> /usr/local/etc/php/conf.d/pecl_exts.ini
    fi
done
if [ -z "$APCU_DISABLE" ]; then
    yes '' | pecl install apcu
    echo "extension=apcu.so" > /usr/local/etc/php/conf.d/apcu.ini
fi
if [ -n "$XDEBUG_VERSION" ]; then
    pecl install $XDEBUG_VERSION
fi
docker-php-ext-install -j$(nproc) \
    opcache \
    tidy \
    iconv \
    curl \
    zip \
    intl \
    xmlrpc \
    xsl \
    gd \
    pdo_mysql \
    pdo_pgsql \
    pdo_sqlite \
    mysqli \
    soap \
    sockets \
    bcmath \
    exif \
    $EXT_EXTRA

if [ -n "$TIDEWAYS_XHPROF" ]; then
    curl -fsSL "https://github.com/tideways/php-xhprof-extension/archive/v${TIDEWAYS_XHPROF}.tar.gz" -o tideways_xhprof.tar.gz
    mkdir -p /tmp/tideways_xhprof
    tar -xf tideways_xhprof.tar.gz -C /tmp/tideways_xhprof --strip-components=1
    rm tideways_xhprof.tar.gz
    docker-php-ext-configure /tmp/tideways_xhprof --enable-tideways_xhprof
    docker-php-ext-install /tmp/tideways_xhprof
    rm -r /tmp/tideways_xhprof
fi

if [ -n "$LEGACY_XHPROF" ]; then
    pecl install xhprof-$LEGACY_XHPROF
    echo "extension=xhprof.so" >> /usr/local/etc/php/conf.d/pecl_exts.ini
fi

if [ -e "/etc/apache2/apache2.conf" ]; then
    if [ -e "/usr/sbin/setcap" ]; then
        SETCAP=/usr/sbin/setcap
    fi
    if [ -e "/sbin/setcap" ]; then
        SETCAP=/sbin/setcap
    fi
    if [ -e "/usr/sbin/apache2" ]; then
        $SETCAP cap_net_bind_service+ep /usr/sbin/apache2
    fi
fi

if [ $PACKAGE_FORMAT == "apt" ]; then
    apt-get remove -y \
        libfreetype6-dev \
        libjpeg62-turbo-dev \
        libcurl4-openssl-dev \
        libpng-dev \
        libwebp-dev \
        libxslt1-dev \
        libxml2-dev \
        libicu-dev \
        libtidy-dev \
        zlib1g-dev \
        libxml2-dev \
        libmemcached-dev \
        libssl-dev \
        libmagickwand-dev \
        $(if [ -e "/etc/apache2/apache2.conf" ]; then echo libcap2-bin; fi) \
        $APT_DEV_EXTRA

    rm -r /var/lib/apt/lists/*
fi

if [ $PACKAGE_FORMAT == "apk" ]; then
    apk del --no-network .build-deps
fi

php -r "readfile('https://getcomposer.org/installer');" > /bin/composer-setup.php && php /bin/composer-setup.php --install-dir=/bin
ln -s /bin/composer.phar /bin/composer

if ([ -n "$TIDEWAYS_XHPROF" ] || [ -n "$LEGACY_XHPROF" ]) && [ -e '/xhgui/config/config.php' ]; then
    curl -fsSL https://github.com/perftools/xhgui/archive/master.tar.gz -o xhgui.tar.gz
    mkdir -p /xhgui
    tar -xf xhgui.tar.gz -C /xhgui --strip-components=1
    rm xhgui.tar.gz
    cd /xhgui
    composer.phar install
fi

if [ -e "/usr/share/doc" ]; then
    rm -r /usr/share/doc
fi

mkdir /state && chmod o+w /state /usr/local/etc/php/conf.d

if [ -e "/var/run/apache2" ]; then
    chmod o+w /var/run/apache2/
fi

curl https://raw.githubusercontent.com/mcnilz/minicron/master/minicron > /usr/local/bin/minicron && chmod +x /usr/local/bin/minicron

if [ -e "/etc/bash.bashrc" ]; then
    sed -i -E "s/^( *)PS1='/\1PS1='🐳  /" /etc/bash.bashrc
else
    echo 'export PS1='"'"'🐳  \u@\h:\w \$ '"'" > /etc/profile.d/docker_prompt.sh
fi

rm -rf /tmp/*