stack: updated loki/grafana stacks

Added JSON option logs into RhodeCode
Various fixes and optimizations on docker files

config/loki/loki-config.yaml

@@ -0,0 +1,50 b''
+auth_enabled: false
+
+server:
+  http_listen_address: 0.0.0.0
+  grpc_listen_address: 0.0.0.0
+  http_listen_port: 3100
+  grpc_listen_port: 9095
+  log_level: info
+
+common:
+  path_prefix: /tmp/loki
+  storage:
+    filesystem:
+      chunks_directory: /tmp/loki/chunks
+      rules_directory: /tmp/loki/rules
+  replication_factor: 1
+  ring:
+    instance_addr: 127.0.0.1
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2020-10-24
+      store: boltdb-shipper
+      object_store: filesystem
+      schema: v11
+      index:
+        prefix: index_
+        period: 24h
+
+limits_config:
+  max_streams_per_user: 100000
+
+  ingestion_burst_size_mb: 64
+  ingestion_rate_mb: 512
+
+  per_stream_rate_limit: 512M
+  per_stream_rate_limit_burst: 1024M
+  max_entries_limit_per_query: 1000000
+  max_label_value_length: 20480
+  max_label_name_length: 10240
+
+ruler:
+  alertmanager_url: http://localhost:9093
+
+# If you would like to disable reporting, uncomment the following lines:
+#analytics:
+#  reporting_enabled: false
+

config/loki/promtail-config.yaml

@@ -0,0 +1,38 b''
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+# Describes how to save read file offsets to disk
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://loki:3100/loki/api/v1/push
+    tenant_id: docker
+
+## Definition to what to scrape
+scrape_configs:
+
+- job_name: scraping_nginx
+  static_configs:
+  - targets:
+      - localhost
+    labels:
+      __path__: /var/log_volume/nginx/rhodecode*
+      job: nginx
+
+- job_name: scraping_vcsserver
+  static_configs:
+  - targets:
+      - localhost
+    labels:
+      __path__: /var/log_volume/apps/rhodecode*
+      job: rhodecode
+
+- job_name: scraping_rhodecode
+  static_configs:
+  - targets:
+      - localhost
+    labels:
+      __path__: /var/log_volume/apps/vcsserver*
+      job: vcsserver
  No newline at end of file

config/statsd-exporter/statsd.yaml

@@ -0,0 +1,31 b''
+defaults:
+  # metrics expiration
+  ttl: 48h
+
+mappings:
+
+  - match: "*.histogram"
+    name: "${1}"
+    observer_type: histogram
+    histogram_options:
+      buckets: [.1, .25, .5, .75, 1, 1.5, 2, 5, 10]
+
+  - match: "*.slow_histogram"
+    name: "${1}"
+    observer_type: histogram
+    histogram_options:
+      buckets: [.1, .25, .5, 1, 2, 5, 10, 30, 60]
+
+  - match: "*.summary"
+    name: "${1}"
+    observer_type: summary
+    summary_options:
+        quantiles:
+          - quantile: 0.99
+            error: 0.001
+          - quantile: 0.95
+            error: 0.01
+          - quantile: 0.9
+            error: 0.05
+          - quantile: 0.5
+            error: 0.005

config/prometheus/prometheus.yml

@@ -1,10 +1,17 b''
 global:
-  scrape_interval: 10s
-  evaluation_interval: 10s
+  scrape_interval: 15s
+  evaluation_interval: 15s
 
 scrape_configs:
-  # Scrape statsd exporter
+
+  # Scrape statsd exporter from RhodeCode
   - job_name: "rhodecode_metrics"
     metrics_path: "/metrics"
     static_configs:
       - targets: ["statsd-exporter:9102"]
+
+  # scrape node exporter
+  - job_name: node_metrics
+    metrics_path: "/metrics"
+    static_configs:
+      - targets: ["node-exporter:9100"]

dev.sh

@@ -1,68 +1,75 b''
 #!/usr/bin/env bash
 set -euo pipefail
 IFS=$'\n\t'
 CURRENT_USER_UID=$(id -u)
 CURRENT_USER_GID=$(id -g)
 USER_UID=${USER_UID:-$CURRENT_USER_UID}
 USER_GID=${USER_GID:-$CURRENT_USER_GID}
 CMD="docker-compose -f docker-compose.yml"
 BUILD_CMD="docker-compose -f docker-compose.yaml -f docker-compose.source.yaml"
 DEV_CMD="docker-compose -f docker-compose.yaml -f docker-compose.source.yaml -f docker-compose.dev.yaml"
+DEV_CMD="docker-compose -f docker-compose.yaml -f docker-compose.source.yaml -f docker-compose.dev.yaml"
+METRICS_CMD="docker-compose -f docker-compose-grafana.yaml"
 
 usage="$(basename "$0") ./dev.sh <COMMAND> -- run docker command
 where <COMMAND>:
     [v]cs       -- run bash console for vcsserver
     [r]c        -- run bash console for rhodecode-ee
     ce          -- run bash console for rhodecode-ce
     [t]est[s]   -- run bash console for rhodecode-ce tests
     test-mysql  -- run bash console for rhodecode-ce tests with mysql
     test-pgsql  -- run bash console for rhodecode-ce tests with postgres
     dev-build   -- build rhodecode dev app for use without cache use
     dev-env     -- run the dev stack required for development
     redis       -- run the redis CLI attached to rc_cluster_redis_1
     db          -- run the db bash attached to rc_cluster_database_1
+    [m]etrics   -- run the metrics stack
     run <cmd>   -- run <cmd>"
 
 case ${1:-} in
     v|vcs )
-        eval "(docker stop vcsserver-dev || echo skip-stop ) && ${DEV_CMD} run --service-ports --rm --use-aliases --workdir="/home/rhodecode/rhodecode-vcsserver" --name="vcsserver-dev" vcsserver bash"
+        eval "(docker stop dev-vcsserver || echo skip-stop ) && ${DEV_CMD} run --service-ports --rm --use-aliases --workdir="/home/rhodecode/rhodecode-vcsserver" --name="dev-vcsserver" vcsserver bash"
         exit
         ;;
     r|rc )
-        eval "(docker stop enterprise-ee-dev || echo skip-stop ) && ${DEV_CMD} run --publish 8080:8080 --rm --use-aliases --workdir="/home/rhodecode/rhodecode-enterprise-ee" --name="enterprise-ee-dev" rhodecode bash"
+        eval "(docker stop dev-enterprise-ee || echo skip-stop ) && ${DEV_CMD} run --publish 8080:8080 --rm --use-aliases --workdir="/home/rhodecode/rhodecode-enterprise-ee" --name="dev-enterprise-ee" rhodecode bash"
         exit
         ;;
     ce )
-        eval "(docker stop enterprise-ce-dev || echo skip-stop ) && ${DEV_CMD} run --publish 8081:8080 --rm --use-aliases --workdir="/home/rhodecode/rhodecode-enterprise-ce" --name="enterprise-ce-dev" rhodecode bash"
+        eval "(docker stop dev-enterprise-ce || echo skip-stop ) && ${DEV_CMD} run --publish 8081:8080 --rm --use-aliases --workdir="/home/rhodecode/rhodecode-enterprise-ce" --name="dev-enterprise-ce" rhodecode bash"
         exit
         ;;
     t|test|tests )
         eval "${DEV_CMD} run --rm --use-aliases --workdir="/home/rhodecode/rhodecode-enterprise-ce" --name="enterprise-dev-test" rhodecode bash"
         exit
         ;;
     dev-build )
         eval "${BUILD_CMD} up --detach database && ${BUILD_CMD} build --no-cache --progress=plain rhodecode"
         exit
         ;;
     dev-env )
         eval "${BUILD_CMD} up --detach database redis channelstream nginx celery beat elasticsearch"
         exit
         ;;
     redis )
         eval "docker exec --interactive --tty rc_cluster_redis_1 redis-cli"
         exit
         ;;
     db )
         eval "docker exec --interactive --tty rc_cluster_database_1 /bin/bash -c 'psql -U $$POSTGRES_USER' "
         exit
         ;;
+    m|metrics )
+        eval "${METRICS_CMD} up --detach"
+        exit
+        ;;
     run )
         command=${@:2}
         eval "${DEV_CMD} run --rm rhodecode ${command}"
         exit
         ;;
     * )
         echo "${usage}"
         exit
         ;;
 esac

docker-compose-grafana.yaml

@@ -1,58 +1,110 b''
 version: '3.9'
 
 volumes:
   prometheus_data: {}
   grafana_data: {}
+  logvolume:
+   driver: local
+   driver_opts:
+    type: none
+    o: bind
+    device: $PWD/logs
 
 networks:
   rhodecode_network:
    name: rhodecode_network
 
 
 services:
 
   statsd-exporter:
     image: prom/statsd-exporter:v0.22.8
     restart: unless-stopped
     command: [
-      '--statsd.mapping-config=/statsd/statsd.conf',
+      '--statsd.mapping-config=/statsd/statsd.yaml',
       '--statsd.listen-udp=:9125',
       '--web.listen-address=:9102'
     ]
     networks:
       - rhodecode_network
     ports:
-      - "9125:9125/udp"
-      - "9102:9102"
+      - "127.0.0.1:9125:9125/udp"
+      - "127.0.0.1:9102:9102"
     volumes:
-      - ./config/statsd-exporter/statsd.conf:/statsd/statsd.conf
+      - ./config/statsd-exporter:/statsd
+
+  node-exporter:
+    image: prom/node-exporter:v1.4.0
+    command:
+      - "--path.procfs=/host/proc"
+      - "--path.rootfs=/rootfs"
+      - "--path.sysfs=/host/sys"
+      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
+      - "--collector.systemd"
+      - "--collector.processes"
+    networks:
+      - rhodecode_network
+    pid: host
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:9100:9100"
+    volumes:
+      - "/proc:/host/proc:ro"
+      - "/sys:/host/sys:ro"
+      - "/:/rootfs:ro"
 
   prometheus:
     image: prom/prometheus:v2.39.1
     restart: unless-stopped
     command:
       - "--config.file=/etc/prometheus/prometheus.yml"
       - "--storage.tsdb.path=/prometheus"
       - "--web.console.libraries=/etc/prometheus/console_libraries"
       - "--web.console.templates=/etc/prometheus/consoles"
       - "--storage.tsdb.retention.time=24h"
       - "--web.enable-lifecycle"
     ports:
-      - "9090:9090"
+      - "127.0.0.1:9090:9090"
     networks:
       - rhodecode_network
     volumes:
       - ./config/prometheus:/etc/prometheus
       - prometheus_data:/prometheus
 
   grafana:
-    image: grafana/grafana:9.1.8-ubuntu
+    image: grafana/grafana:9.2.1-ubuntu
     restart: unless-stopped
     env_file:
       - ./config/grafana/grafana.env
     ports:
-      - "3000:3000"
+      - "4000:3000"
     volumes:
       - grafana_data:/var/lib/grafana
     networks:
       - rhodecode_network
+
+  loki:
+    image: grafana/loki:2.6.1
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:3100:3100"
+      - "127.0.0.1:9095:9095"
+    command: [
+      "-config.file=/etc/loki/loki-config.yaml"
+    ]
+    networks:
+      - rhodecode_network
+    volumes:
+      - ./config/loki:/etc/loki
+
+  promtail:
+    image: grafana/promtail:latest
+    command: [
+      "-config.file=/etc/promtail/promtail-config.yaml"
+    ]
+    networks:
+      - rhodecode_network
+    volumes:
+      - /var/log:/var/log
+      - logvolume:/var/log_volume
+      - ./config/loki:/etc/promtail

service/database/pg_customized.conf

@@ -1,808 +1,808 b''
 # -----------------------------
 # PostgreSQL configuration file
 # -----------------------------
 #
 # This file consists of lines of the form:
 #
 #   name = value
 #
 # (The "=" is optional.)  Whitespace may be used.  Comments are introduced with
 # "#" anywhere on a line.  The complete list of parameter names and allowed
 # values can be found in the PostgreSQL documentation.
 #
 # The commented-out settings shown in this file represent the default values.
 # Re-commenting a setting is NOT sufficient to revert it to the default value;
 # you need to reload the server.
 #
 # This file is read on server startup and when the server receives a SIGHUP
 # signal.  If you edit the file on a running system, you have to SIGHUP the
 # server for the changes to take effect, run "pg_ctl reload", or execute
 # "SELECT pg_reload_conf()".  Some parameters, which are marked below,
 # require a server shutdown and restart to take effect.
 #
 # Any parameter can also be given as a command-line option to the server, e.g.,
 # "postgres -c log_connections=on".  Some parameters can be changed at run time
 # with the "SET" SQL command.
 #
 # Memory units:  B  = bytes            Time units:  us  = microseconds
 #                kB = kilobytes                     ms  = milliseconds
 #                MB = megabytes                     s   = seconds
 #                GB = gigabytes                     min = minutes
 #                TB = terabytes                     h   = hours
 #                                                   d   = days
 
 
 #------------------------------------------------------------------------------
 # FILE LOCATIONS
 #------------------------------------------------------------------------------
 
 # The default values of these variables are driven from the -D command-line
 # option or PGDATA environment variable, represented here as ConfigDir.
 
 #data_directory = 'ConfigDir'		# use data in another directory
 					# (change requires restart)
 #hba_file = 'ConfigDir/pg_hba.conf'	# host-based authentication file
 					# (change requires restart)
 #ident_file = 'ConfigDir/pg_ident.conf'	# ident configuration file
 					# (change requires restart)
 
 # If external_pid_file is not explicitly set, no extra PID file is written.
 #external_pid_file = ''			# write an extra PID file
 					# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # CONNECTIONS AND AUTHENTICATION
 #------------------------------------------------------------------------------
 
 # - Connection Settings -
 
 listen_addresses = '*'
 					# comma-separated list of addresses;
 					# defaults to 'localhost'; use '*' for all
 					# (change requires restart)
 #port = 5432				# (change requires restart)
 #max_connections = 100			# (change requires restart)
 #superuser_reserved_connections = 3	# (change requires restart)
 #unix_socket_directories = '/tmp'	# comma-separated list of directories
 					# (change requires restart)
 #unix_socket_group = ''			# (change requires restart)
 #unix_socket_permissions = 0777		# begin with 0 to use octal notation
 					# (change requires restart)
 #bonjour = off				# advertise server via Bonjour
 					# (change requires restart)
 #bonjour_name = ''			# defaults to the computer name
 					# (change requires restart)
 
 # - TCP settings -
 # see "man tcp" for details
 
 #tcp_keepalives_idle = 0		# TCP_KEEPIDLE, in seconds;
 					# 0 selects the system default
 #tcp_keepalives_interval = 0		# TCP_KEEPINTVL, in seconds;
 					# 0 selects the system default
 #tcp_keepalives_count = 0		# TCP_KEEPCNT;
 					# 0 selects the system default
 #tcp_user_timeout = 0			# TCP_USER_TIMEOUT, in milliseconds;
 					# 0 selects the system default
 
 #client_connection_check_interval = 0	# time between checks for client
 					# disconnection while running queries;
 					# 0 for never
 
 # - Authentication -
 
 #authentication_timeout = 1min		# 1s-600s
 #password_encryption = scram-sha-256	# scram-sha-256 or md5
 #db_user_namespace = off
 
 # GSSAPI using Kerberos
 #krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
 #krb_caseins_users = off
 
 # - SSL -
 
 #ssl = off
 #ssl_ca_file = ''
 #ssl_cert_file = 'server.crt'
 #ssl_crl_file = ''
 #ssl_crl_dir = ''
 #ssl_key_file = 'server.key'
 #ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
 #ssl_prefer_server_ciphers = on
 #ssl_ecdh_curve = 'prime256v1'
 #ssl_min_protocol_version = 'TLSv1.2'
 #ssl_max_protocol_version = ''
 #ssl_dh_params_file = ''
 #ssl_passphrase_command = ''
 #ssl_passphrase_command_supports_reload = off
 
 
 #------------------------------------------------------------------------------
 # RESOURCE USAGE (except WAL)
 #------------------------------------------------------------------------------
 
 # - Memory -
 
 #shared_buffers = 32MB			# min 128kB
 					# (change requires restart)
 #huge_pages = try			# on, off, or try
 					# (change requires restart)
 #huge_page_size = 0			# zero for system default
 					# (change requires restart)
 #temp_buffers = 8MB			# min 800kB
 #max_prepared_transactions = 0		# zero disables the feature
 					# (change requires restart)
 # Caution: it is not advisable to set max_prepared_transactions nonzero unless
 # you actively intend to use prepared transactions.
 #work_mem = 4MB				# min 64kB
 #hash_mem_multiplier = 1.0		# 1-1000.0 multiplier on hash table work_mem
 #maintenance_work_mem = 64MB		# min 1MB
 #autovacuum_work_mem = -1		# min 1MB, or -1 to use maintenance_work_mem
 #logical_decoding_work_mem = 64MB	# min 64kB
 #max_stack_depth = 2MB			# min 100kB
 #shared_memory_type = mmap		# the default is the first option
 					# supported by the operating system:
 					#   mmap
 					#   sysv
 					#   windows
 					# (change requires restart)
 #dynamic_shared_memory_type = posix	# the default is the first option
 					# supported by the operating system:
 					#   posix
 					#   sysv
 					#   windows
 					#   mmap
 					# (change requires restart)
 #min_dynamic_shared_memory = 0MB	# (change requires restart)
 
 # - Disk -
 
 #temp_file_limit = -1			# limits per-process temp file space
 					# in kilobytes, or -1 for no limit
 
 # - Kernel Resources -
 
 #max_files_per_process = 1000		# min 64
 					# (change requires restart)
 
 # - Cost-Based Vacuum Delay -
 
 #vacuum_cost_delay = 0			# 0-100 milliseconds (0 disables)
 #vacuum_cost_page_hit = 1		# 0-10000 credits
 #vacuum_cost_page_miss = 2		# 0-10000 credits
 #vacuum_cost_page_dirty = 20		# 0-10000 credits
 #vacuum_cost_limit = 200		# 1-10000 credits
 
 # - Background Writer -
 
 #bgwriter_delay = 200ms			# 10-10000ms between rounds
 #bgwriter_lru_maxpages = 100		# max buffers written/round, 0 disables
 #bgwriter_lru_multiplier = 2.0		# 0-10.0 multiplier on buffers scanned/round
 #bgwriter_flush_after = 0		# measured in pages, 0 disables
 
 # - Asynchronous Behavior -
 
 #backend_flush_after = 0		# measured in pages, 0 disables
 #effective_io_concurrency = 1		# 1-1000; 0 disables prefetching
 #maintenance_io_concurrency = 10	# 1-1000; 0 disables prefetching
 #max_worker_processes = 8		# (change requires restart)
 #max_parallel_workers_per_gather = 2	# taken from max_parallel_workers
 #max_parallel_maintenance_workers = 2	# taken from max_parallel_workers
 #max_parallel_workers = 8		# maximum number of max_worker_processes that
 					# can be used in parallel operations
 #parallel_leader_participation = on
 #old_snapshot_threshold = -1		# 1min-60d; -1 disables; 0 is immediate
 					# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # WRITE-AHEAD LOG
 #------------------------------------------------------------------------------
 
 # - Settings -
 
 #wal_level = replica			# minimal, replica, or logical
 					# (change requires restart)
 #fsync = on				# flush data to disk for crash safety
 					# (turning this off can cause
 					# unrecoverable data corruption)
 #synchronous_commit = on		# synchronization level;
 					# off, local, remote_write, remote_apply, or on
 #wal_sync_method = fsync		# the default is the first option
 					# supported by the operating system:
 					#   open_datasync
 					#   fdatasync (default on Linux and FreeBSD)
 					#   fsync
 					#   fsync_writethrough
 					#   open_sync
 #full_page_writes = on			# recover from partial page writes
 #wal_log_hints = off			# also do full page writes of non-critical updates
 					# (change requires restart)
 #wal_compression = off			# enable compression of full-page writes
 #wal_init_zero = on			# zero-fill new WAL files
 #wal_recycle = on			# recycle WAL files
 #wal_buffers = -1			# min 32kB, -1 sets based on shared_buffers
 					# (change requires restart)
 #wal_writer_delay = 200ms		# 1-10000 milliseconds
 #wal_writer_flush_after = 1MB		# measured in pages, 0 disables
 #wal_skip_threshold = 2MB
 
 #commit_delay = 0			# range 0-100000, in microseconds
 #commit_siblings = 5			# range 1-1000
 
 # - Checkpoints -
 
 #checkpoint_timeout = 5min		# range 30s-1d
 #checkpoint_completion_target = 0.9	# checkpoint target duration, 0.0 - 1.0
 #checkpoint_flush_after = 0		# measured in pages, 0 disables
 #checkpoint_warning = 30s		# 0 disables
 #max_wal_size = 1GB
 #min_wal_size = 80MB
 
 # - Archiving -
 
 #archive_mode = off		# enables archiving; off, on, or always
 				# (change requires restart)
 #archive_command = ''		# command to use to archive a logfile segment
 				# placeholders: %p = path of file to archive
 				#               %f = file name only
 				# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
 #archive_timeout = 0		# force a logfile segment switch after this
 				# number of seconds; 0 disables
 
 # - Archive Recovery -
 
 # These are only used in recovery mode.
 
 #restore_command = ''		# command to use to restore an archived logfile segment
 				# placeholders: %p = path of file to restore
 				#               %f = file name only
 				# e.g. 'cp /mnt/server/archivedir/%f %p'
 #archive_cleanup_command = ''	# command to execute at every restartpoint
 #recovery_end_command = ''	# command to execute at completion of recovery
 
 # - Recovery Target -
 
 # Set these only when performing a targeted recovery.
 
 #recovery_target = ''		# 'immediate' to end recovery as soon as a
                                 # consistent state is reached
 				# (change requires restart)
 #recovery_target_name = ''	# the named restore point to which recovery will proceed
 				# (change requires restart)
 #recovery_target_time = ''	# the time stamp up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_xid = ''	# the transaction ID up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_lsn = ''	# the WAL LSN up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_inclusive = on # Specifies whether to stop:
 				# just after the specified recovery target (on)
 				# just before the recovery target (off)
 				# (change requires restart)
 #recovery_target_timeline = 'latest'	# 'current', 'latest', or timeline ID
 				# (change requires restart)
 #recovery_target_action = 'pause'	# 'pause', 'promote', 'shutdown'
 				# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # REPLICATION
 #------------------------------------------------------------------------------
 
 # - Sending Servers -
 
 # Set these on the primary and on any standby that will send replication data.
 
 #max_wal_senders = 10		# max number of walsender processes
 				# (change requires restart)
 #max_replication_slots = 10	# max number of replication slots
 				# (change requires restart)
 #wal_keep_size = 0		# in megabytes; 0 disables
 #max_slot_wal_keep_size = -1	# in megabytes; -1 disables
 #wal_sender_timeout = 60s	# in milliseconds; 0 disables
 #track_commit_timestamp = off	# collect timestamp of transaction commit
 				# (change requires restart)
 
 # - Primary Server -
 
 # These settings are ignored on a standby server.
 
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# method to choose sync standbys, number of sync standbys,
 				# and comma-separated list of application_name
 				# from standby(s); '*' = all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
 
 # These settings are ignored on a primary server.
 
 #primary_conninfo = ''			# connection string to sending server
 #primary_slot_name = ''			# replication slot on sending server
 #promote_trigger_file = ''		# file name whose presence ends recovery
 #hot_standby = on			# "off" disallows queries during recovery
 					# (change requires restart)
 #max_standby_archive_delay = 30s	# max delay before canceling queries
 					# when reading WAL from archive;
 					# -1 allows indefinite delay
 #max_standby_streaming_delay = 30s	# max delay before canceling queries
 					# when reading streaming WAL;
 					# -1 allows indefinite delay
 #wal_receiver_create_temp_slot = off	# create temp slot if primary_slot_name
 					# is not set
 #wal_receiver_status_interval = 10s	# send replies at least this often
 					# 0 disables
 #hot_standby_feedback = off		# send info from standby to prevent
 					# query conflicts
 #wal_receiver_timeout = 60s		# time that receiver waits for
 					# communication from primary
 					# in milliseconds; 0 disables
 #wal_retrieve_retry_interval = 5s	# time to wait before retrying to
 					# retrieve WAL after a failed attempt
 #recovery_min_apply_delay = 0		# minimum delay for applying changes during recovery
 
 # - Subscribers -
 
 # These settings are ignored on a publisher.
 
 #max_logical_replication_workers = 4	# taken from max_worker_processes
 					# (change requires restart)
 #max_sync_workers_per_subscription = 2	# taken from max_logical_replication_workers
 
 
 #------------------------------------------------------------------------------
 # QUERY TUNING
 #------------------------------------------------------------------------------
 
 # - Planner Method Configuration -
 
 #enable_async_append = on
 #enable_bitmapscan = on
 #enable_gathermerge = on
 #enable_hashagg = on
 #enable_hashjoin = on
 #enable_incremental_sort = on
 #enable_indexscan = on
 #enable_indexonlyscan = on
 #enable_material = on
 #enable_memoize = on
 #enable_mergejoin = on
 #enable_nestloop = on
 #enable_parallel_append = on
 #enable_parallel_hash = on
 #enable_partition_pruning = on
 #enable_partitionwise_join = off
 #enable_partitionwise_aggregate = off
 #enable_seqscan = on
 #enable_sort = on
 #enable_tidscan = on
 
 # - Planner Cost Constants -
 
 #seq_page_cost = 1.0			# measured on an arbitrary scale
 #random_page_cost = 4.0			# same scale as above
 #cpu_tuple_cost = 0.01			# same scale as above
 #cpu_index_tuple_cost = 0.005		# same scale as above
 #cpu_operator_cost = 0.0025		# same scale as above
 #parallel_setup_cost = 1000.0	# same scale as above
 #parallel_tuple_cost = 0.1		# same scale as above
 #min_parallel_table_scan_size = 8MB
 #min_parallel_index_scan_size = 512kB
 #effective_cache_size = 4GB
 
 #jit_above_cost = 100000		# perform JIT compilation if available
 					# and query more expensive than this;
 					# -1 disables
 #jit_inline_above_cost = 500000		# inline small functions if query is
 					# more expensive than this; -1 disables
 #jit_optimize_above_cost = 500000	# use expensive JIT optimizations if
 					# query is more expensive than this;
 					# -1 disables
 
 # - Genetic Query Optimizer -
 
 #geqo = on
 #geqo_threshold = 12
 #geqo_effort = 5			# range 1-10
 #geqo_pool_size = 0			# selects default based on effort
 #geqo_generations = 0			# selects default based on effort
 #geqo_selection_bias = 2.0		# range 1.5-2.0
 #geqo_seed = 0.0			# range 0.0-1.0
 
 # - Other Planner Options -
 
 #default_statistics_target = 100	# range 1-10000
 #constraint_exclusion = partition	# on, off, or partition
 #cursor_tuple_fraction = 0.1		# range 0.0-1.0
 #from_collapse_limit = 8
 #jit = on				# allow JIT compilation
 #join_collapse_limit = 8		# 1 disables collapsing of explicit
 					# JOIN clauses
 #plan_cache_mode = auto			# auto, force_generic_plan or
 					# force_custom_plan
 
 
 #------------------------------------------------------------------------------
 # REPORTING AND LOGGING
 #------------------------------------------------------------------------------
 
 # - Where to Log -
 
-#log_destination = 'stderr'		# Valid values are combinations of
+log_destination = 'stderr'		# Valid values are combinations of
 					# stderr, csvlog, syslog, and eventlog,
 					# depending on platform.  csvlog
 					# requires logging_collector to be on.
 
 # This is used when logging to stderr:
-#logging_collector = off		# Enable capturing of stderr and csvlog
+logging_collector = on		# Enable capturing of stderr and csvlog
 					# into log files. Required to be on for
 					# csvlogs.
 					# (change requires restart)
 
 # These are only used if logging_collector is on:
-#log_directory = 'log'			# directory where log files are written,
+log_directory = '/var/log/rhodecode/postgres'			# directory where log files are written,
 					# can be absolute or relative to PGDATA
-#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
+log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
 					# can include strftime() escapes
 #log_file_mode = 0600			# creation mode for log files,
 					# begin with 0 to use octal notation
 #log_rotation_age = 1d			# Automatic rotation of logfiles will
 					# happen after that time.  0 disables.
-#log_rotation_size = 10MB		# Automatic rotation of logfiles will
+log_rotation_size = 512MB		# Automatic rotation of logfiles will
 					# happen after that much log output.
 					# 0 disables.
 #log_truncate_on_rotation = off		# If on, an existing log file with the
 					# same name as the new log file will be
 					# truncated rather than appended to.
 					# But such truncation only occurs on
 					# time-driven rotation, not on restarts
 					# or size-driven rotation.  Default is
 					# off, meaning append to existing files
 					# in all cases.
 
 # These are relevant when logging to syslog:
 #syslog_facility = 'LOCAL0'
 #syslog_ident = 'postgres'
 #syslog_sequence_numbers = on
 #syslog_split_messages = on
 
 # This is only relevant when logging to eventlog (Windows):
 # (change requires restart)
 #event_source = 'PostgreSQL'
 
 # - When to Log -
 
 #log_min_messages = warning		# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   info
 					#   notice
 					#   warning
 					#   error
 					#   log
 					#   fatal
 					#   panic
 
 #log_min_error_statement = error	# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   info
 					#   notice
 					#   warning
 					#   error
 					#   log
 					#   fatal
 					#   panic (effectively off)
 
-#log_min_duration_statement = -1	# -1 is disabled, 0 logs all statements
+log_min_duration_statement = 1000	# -1 is disabled, 0 logs all statements
 					# and their durations, > 0 logs only
 					# statements running at least this number
 					# of milliseconds
 
 #log_min_duration_sample = -1		# -1 is disabled, 0 logs a sample of statements
 					# and their durations, > 0 logs only a sample of
 					# statements running at least this number
 					# of milliseconds;
 					# sample fraction is determined by log_statement_sample_rate
 
 #log_statement_sample_rate = 1.0	# fraction of logged statements exceeding
 					# log_min_duration_sample to be logged;
 					# 1.0 logs all such statements, 0.0 never logs
 
 
 #log_transaction_sample_rate = 0.0	# fraction of transactions whose statements
 					# are logged regardless of their duration; 1.0 logs all
 					# statements from all transactions, 0.0 never logs
 
 # - What to Log -
 
 #debug_print_parse = off
 #debug_print_rewritten = off
 #debug_print_plan = off
 #debug_pretty_print = on
 #log_autovacuum_min_duration = -1	# log autovacuum activity;
 					# -1 disables, 0 logs all actions and
 					# their durations, > 0 logs only
 					# actions running at least this number
 					# of milliseconds.
 #log_checkpoints = off
 #log_connections = off
 #log_disconnections = off
 #log_duration = off
 #log_error_verbosity = default		# terse, default, or verbose messages
 #log_hostname = off
 #log_line_prefix = '%m [%p] '		# special values:
 					#   %a = application name
 					#   %u = user name
 					#   %d = database name
 					#   %r = remote host and port
 					#   %h = remote host
 					#   %b = backend type
 					#   %p = process ID
 					#   %P = process ID of parallel group leader
 					#   %t = timestamp without milliseconds
 					#   %m = timestamp with milliseconds
 					#   %n = timestamp with milliseconds (as a Unix epoch)
 					#   %Q = query ID (0 if none or not computed)
 					#   %i = command tag
 					#   %e = SQL state
 					#   %c = session ID
 					#   %l = session line number
 					#   %s = session start timestamp
 					#   %v = virtual transaction ID
 					#   %x = transaction ID (0 if none)
 					#   %q = stop here in non-session
 					#        processes
 					#   %% = '%'
 					# e.g. '<%u%%%d> '
 #log_lock_waits = off			# log lock waits >= deadlock_timeout
 #log_recovery_conflict_waits = off	# log standby recovery conflict waits
 					# >= deadlock_timeout
 #log_parameter_max_length = -1		# when logging statements, limit logged
 					# bind-parameter values to N bytes;
 					# -1 means print in full, 0 disables
 #log_parameter_max_length_on_error = 0	# when logging an error, limit logged
 					# bind-parameter values to N bytes;
 					# -1 means print in full, 0 disables
 #log_statement = 'none'			# none, ddl, mod, all
 #log_replication_commands = off
 #log_temp_files = -1			# log temporary files equal or larger
 					# than the specified size in kilobytes;
 					# -1 disables, 0 logs all temp files
 #log_timezone = 'GMT'
 
 
 #------------------------------------------------------------------------------
 # PROCESS TITLE
 #------------------------------------------------------------------------------
 
 #cluster_name = ''			# added to process titles if nonempty
 					# (change requires restart)
 #update_process_title = on
 
 
 #------------------------------------------------------------------------------
 # STATISTICS
 #------------------------------------------------------------------------------
 
 # - Query and Index Statistics Collector -
 
 #track_activities = on
 #track_activity_query_size = 1024	# (change requires restart)
 #track_counts = on
 #track_io_timing = off
 #track_wal_io_timing = off
 #track_functions = none			# none, pl, all
 #stats_temp_directory = 'pg_stat_tmp'
 
 
 # - Monitoring -
 
 #compute_query_id = auto
 #log_statement_stats = off
 #log_parser_stats = off
 #log_planner_stats = off
 #log_executor_stats = off
 
 
 #------------------------------------------------------------------------------
 # AUTOVACUUM
 #------------------------------------------------------------------------------
 
 #autovacuum = on			# Enable autovacuum subprocess?  'on'
 					# requires track_counts to also be on.
 #autovacuum_max_workers = 3		# max number of autovacuum subprocesses
 					# (change requires restart)
 #autovacuum_naptime = 1min		# time between autovacuum runs
 #autovacuum_vacuum_threshold = 50	# min number of row updates before
 					# vacuum
 #autovacuum_vacuum_insert_threshold = 1000	# min number of row inserts
 					# before vacuum; -1 disables insert
 					# vacuums
 #autovacuum_analyze_threshold = 50	# min number of row updates before
 					# analyze
 #autovacuum_vacuum_scale_factor = 0.2	# fraction of table size before vacuum
 #autovacuum_vacuum_insert_scale_factor = 0.2	# fraction of inserts over table
 					# size before insert vacuum
 #autovacuum_analyze_scale_factor = 0.1	# fraction of table size before analyze
 #autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
 					# (change requires restart)
 #autovacuum_multixact_freeze_max_age = 400000000	# maximum multixact age
 					# before forced vacuum
 					# (change requires restart)
 #autovacuum_vacuum_cost_delay = 2ms	# default vacuum cost delay for
 					# autovacuum, in milliseconds;
 					# -1 means use vacuum_cost_delay
 #autovacuum_vacuum_cost_limit = -1	# default vacuum cost limit for
 					# autovacuum, -1 means use
 					# vacuum_cost_limit
 
 
 #------------------------------------------------------------------------------
 # CLIENT CONNECTION DEFAULTS
 #------------------------------------------------------------------------------
 
 # - Statement Behavior -
 
 #client_min_messages = notice		# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   log
 					#   notice
 					#   warning
 					#   error
 #search_path = '"$user", public'	# schema names
 #row_security = on
 #default_table_access_method = 'heap'
 #default_tablespace = ''		# a tablespace name, '' uses the default
 #default_toast_compression = 'pglz'	# 'pglz' or 'lz4'
 #temp_tablespaces = ''			# a list of tablespace names, '' uses
 					# only default tablespace
 #check_function_bodies = on
 #default_transaction_isolation = 'read committed'
 #default_transaction_read_only = off
 #default_transaction_deferrable = off
 #session_replication_role = 'origin'
 #statement_timeout = 0			# in milliseconds, 0 is disabled
 #lock_timeout = 0			# in milliseconds, 0 is disabled
 #idle_in_transaction_session_timeout = 0	# in milliseconds, 0 is disabled
 #idle_session_timeout = 0		# in milliseconds, 0 is disabled
 #vacuum_freeze_table_age = 150000000
 #vacuum_freeze_min_age = 50000000
 #vacuum_failsafe_age = 1600000000
 #vacuum_multixact_freeze_table_age = 150000000
 #vacuum_multixact_freeze_min_age = 5000000
 #vacuum_multixact_failsafe_age = 1600000000
 #bytea_output = 'hex'			# hex, escape
 #xmlbinary = 'base64'
 #xmloption = 'content'
 #gin_pending_list_limit = 4MB
 
 # - Locale and Formatting -
 
 #datestyle = 'iso, mdy'
 #intervalstyle = 'postgres'
 #timezone = 'GMT'
 #timezone_abbreviations = 'Default'     # Select the set of available time zone
 					# abbreviations.  Currently, there are
 					#   Default
 					#   Australia (historical usage)
 					#   India
 					# You can create your own file in
 					# share/timezonesets/.
 #extra_float_digits = 1			# min -15, max 3; any value >0 actually
 					# selects precise output mode
 #client_encoding = sql_ascii		# actually, defaults to database
 					# encoding
 
 # These settings are initialized by initdb, but they can be changed.
 #lc_messages = 'C'			# locale for system error message
 					# strings
 #lc_monetary = 'C'			# locale for monetary formatting
 #lc_numeric = 'C'			# locale for number formatting
 #lc_time = 'C'				# locale for time formatting
 
 # default configuration for text search
 #default_text_search_config = 'pg_catalog.simple'
 
 # - Shared Library Preloading -
 
 #local_preload_libraries = ''
 #session_preload_libraries = ''
 #shared_preload_libraries = ''	# (change requires restart)
 #jit_provider = 'llvmjit'		# JIT library to use
 
 # - Other Defaults -
 
 #dynamic_library_path = '$libdir'
 #extension_destdir = ''			# prepend path when loading extensions
 					# and shared objects (added by Debian)
 #gin_fuzzy_search_limit = 0
 
 
 #------------------------------------------------------------------------------
 # LOCK MANAGEMENT
 #------------------------------------------------------------------------------
 
 #deadlock_timeout = 1s
 #max_locks_per_transaction = 64		# min 10
 					# (change requires restart)
 #max_pred_locks_per_transaction = 64	# min 10
 					# (change requires restart)
 #max_pred_locks_per_relation = -2	# negative values mean
 					# (max_pred_locks_per_transaction
 					#  / -max_pred_locks_per_relation) - 1
 #max_pred_locks_per_page = 2            # min 0
 
 
 #------------------------------------------------------------------------------
 # VERSION AND PLATFORM COMPATIBILITY
 #------------------------------------------------------------------------------
 
 # - Previous PostgreSQL Versions -
 
 #array_nulls = on
 #backslash_quote = safe_encoding	# on, off, or safe_encoding
 #escape_string_warning = on
 #lo_compat_privileges = off
 #quote_all_identifiers = off
 #standard_conforming_strings = on
 #synchronize_seqscans = on
 
 # - Other Platforms and Clients -
 
 #transform_null_equals = off
 
 
 #------------------------------------------------------------------------------
 # ERROR HANDLING
 #------------------------------------------------------------------------------
 
 #exit_on_error = off			# terminate session on any error?
 #restart_after_crash = on		# reinitialize after backend crash?
 #data_sync_retry = off			# retry or panic on failure to fsync
 					# data?
 					# (change requires restart)
 #recovery_init_sync_method = fsync	# fsync, syncfs (Linux 5.8+)
 
 
 #------------------------------------------------------------------------------
 # CONFIG FILE INCLUDES
 #------------------------------------------------------------------------------
 
 # These options allow settings to be loaded from files other than the
 # default postgresql.conf.  Note that these are directives, not variable
 # assignments, so they can usefully be given more than once.
 
 #include_dir = '...'			# include files ending in '.conf' from
 					# a directory, e.g., 'conf.d'
 #include_if_exists = '...'		# include file only if it exists
 #include = '...'			# include file
 
 
 #------------------------------------------------------------------------------
 # CUSTOMIZED OPTIONS
 #------------------------------------------------------------------------------
 
 # Add settings for extensions here
 
 max_connections = 400
 shared_buffers = 1GB
 effective_cache_size = 3GB
 work_mem = 2621kB
 maintenance_work_mem = 256MB
 checkpoint_completion_target = 0.9
 wal_buffers = 16MB
 default_statistics_target = 100
 password_encryption = md5

service/nginx/http.conf

@@ -1,114 +1,131 b''
 # read more here http://tautt.com/best-nginx-configuration-for-security/
 
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
 #add_header X-Frame-Options SAMEORIGIN;
 
 # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
 # to disable content-type sniffing on some browsers.
 # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
 # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
 # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
 # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
 #add_header X-Content-Type-Options nosniff;
 
 # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
 # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
 # this particular website if it was disabled by the user.
 # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
 #add_header X-XSS-Protection "1; mode=block";
 
 # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
 # directives for css and js(if you have inline css or js, you will need to keep it too).
 # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 #add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 ## rate limiter for certain pages to prevent brute force attacks
 limit_req_zone  $binary_remote_addr  zone=http_req_limit:10m   rate=1r/s;
 
 ## custom log format
 log_format http_log_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time $pipe';
 
+log_format json_log_custom escape=json
+  '{'
+    '"source":"nginx",'
+    '"remote_user":"$remote_user",'
+    '"time_local":"$time_local",'
+    '"remote_addr":"$remote_addr",'
+    '"request":"$request",'
+    '"status": "$status",'
+    '"request_method": "$request_method",'
+    '"body_bytes_sent":"$body_bytes_sent",'
+    '"request_time":"$request_time",'
+    '"upstream_response_time":"$upstream_response_time",'
+    '"http_referrer":"$http_referer",'
+    '"http_user_agent":"$http_user_agent"'
+  '}';
+
+
 server {
   listen 80 default;
   # ensure we get the proper Docker DNS resolver for load balancing.
   resolver 127.0.0.11 ipv6=off;
   server_name localhost 127.0.0.1;
-  access_log      /var/log/rhodecode/nginx/rhodecode.http.access.log http_log_custom;
+  access_log      /var/log/rhodecode/nginx/rhodecode.http.access.log json_log_custom;
   error_log       /var/log/rhodecode/nginx/rhodecode.http.error.log;
 
   # uncomment to redirect http traffic to https
   #return 301 https://$host$request_uri;
 
   client_body_buffer_size     128k;
   # maximum number and size of buffers for large headers to read from client request
   large_client_header_buffers 16 256k;
 
   ## serve static files by nginx, recommended
   location /_static/rhodecode {
       gzip on;
       gzip_min_length  500;
       gzip_proxied     any;
       gzip_comp_level 4;
       gzip_types  text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
       gzip_vary on;
       gzip_disable     "msie6";
       expires 60d;
 
       alias /var/opt/rhodecode_data/static;
   }
 
   ## channelstream location handler, if channelstream live chat and notifications
   ## are enable this will proxy the requests to channelstream websocket server
   location /_channelstream {
       rewrite /_channelstream/(.*) /$1 break;
       gzip                         off;
       tcp_nodelay                  off;
 
       proxy_connect_timeout        10;
       proxy_send_timeout           10m;
       proxy_read_timeout           10m;
 
       proxy_set_header             Host $host;
       proxy_set_header             X-Real-IP $remote_addr;
       proxy_set_header             X-Url-Scheme $scheme;
       proxy_set_header             X-Forwarded-Proto $scheme;
       proxy_set_header             X-Forwarded-For $proxy_add_x_forwarded_for;
 
       proxy_http_version           1.1;
       proxy_set_header Upgrade     $http_upgrade;
       proxy_set_header Connection  "upgrade";
 
       proxy_pass                   http://channelstream:9800;
   }
 
   ## rate limit this endpoint to prevent login page brute-force attacks
   location /_admin/login {
       limit_req  zone=http_req_limit  burst=10  nodelay;
       try_files $uri @rhodecode_http;
   }
 
   location / {
       include     /etc/nginx/proxy.conf;
       try_files $uri @rhodecode_http;
   }
 
   location @rhodecode_http {
       include     /etc/nginx/proxy.conf;
       proxy_pass  http://rhodecode:10020;
   }
 
   ## Custom 502 error page.
   ## Will be displayed while RhodeCode server is turned off
   error_page 502 /502.html;
   location = /502.html {
       root /var/opt/static;
   }
 
 }

service/rhodecode/rhodecode_source.dockerfile

@@ -1,305 +1,305 b''
-FROM ubuntu:latest
-# Using 20.04 LTS Release
+FROM ubuntu:22.04
+# Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
 ARG TZ="UTC"
 ARG LOCALE_TYPE=en_US.UTF-8
 ARG RHODECODE_TYPE=Enterprise
 # source-install
 ARG RHODECODE_VERSION=4.26.0
 
 ARG RHODECODE_DB=sqlite
 ARG RHODECODE_USER_NAME=admin
 ARG RHODECODE_USER_PASS=secret4
 ARG RHODECODE_USER_EMAIL=[e-mail]
 
 # nix ver/channels
 ARG DEV_NIX_VERSION=2.0.4
 ARG DEV_NIX_CHANNEL=nixos-18.03
 
 # env are runtime
 ENV \
     TZ=${TZ} \
     LOCALE_TYPE=${LOCALE_TYPE} \
     \
     ## Define type we build, and the instance we'll create
     RHODECODE_TYPE=${RHODECODE_TYPE} \
     RC_TYPE_ID=enterprise-1 \
     \
     ## SETUP ARGS FOR INSTALLATION ##
     ## set version we build on, get from .env or set default ver
     RHODECODE_VERSION=${RHODECODE_VERSION} \
     \
     ## set DB, default sqlite
     RHODECODE_DB=${RHODECODE_DB} \
     \
     ## set app bootstrap required data
     RHODECODE_USER_NAME=${RHODECODE_USER_NAME} \
     RHODECODE_USER_PASS=${RHODECODE_USER_PASS} \
     RHODECODE_USER_EMAIL=${RHODECODE_USER_EMAIL} \
     \
     RC_USER=rhodecode \
     \
     # SVN CONFIG
     MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf \
     MOD_DAV_SVN_PORT=8090 \
     \
     # SSHD CONFIG
     SSHD_CONF_FILE=/etc/rhodecode/sshd_config \
     \
     BUILD_CONF=/etc/rhodecode/conf_build \
     BUILD_BIN_DIR=/var/opt/rhodecode_bin \
     RHODECODE_DATA_DIR=/var/opt/rhodecode_data \
     RHODECODE_REPO_DIR=/var/opt/rhodecode_repo_store \
     RHODECODE_HTTP_PORT=10020 \
     RHODECODE_VCS_PORT=10010 \
     RHODECODE_HOST=0.0.0.0 \
     RHODECODE_VCS_HOST=127.0.0.1
 
 ENV \
     RCCONTROL=/home/$RC_USER/.rccontrol-profile/bin/rccontrol \
     SUPERVISOR_CONF=/home/$RC_USER/.rccontrol/supervisor/supervisord.ini \
     # make application scripts visible
     PATH=$PATH:/home/$RC_USER/.rccontrol-profile/bin
 
 ENV SVN_LOCALE_DEPS apache2 apache2-utils libapache2-mod-svn
 ENV SSH_LOCALE_DEPS openssh-server
 ENV PYTHON_DEPS python2
 ENV EXTRA_DEPS  vim
 
 ENV \
     PATH=$PATH:/nix/var/nix/profiles/per-user/$RC_USER/profile/bin:/home/$RC_USER/rhodecode-enterprise-ee/profile/bin \
     NIX_BLD_USER=nixbld \
     NIX_PATH=/nix/var/nix/profiles/per-user/$RC_USER/channels \
     NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 
 
 RUN \
 echo "** install base packages **" && \
 set -eux; \
 	\
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	DEBIAN_FRONTEND="noninteractive" \
 	apt-get install -y --no-install-recommends \
         tini \
         bash \
         binutils \
         tzdata \
         locales \
         openssl \
         curl \
         sudo \
         gosu \
         bzip2 \
         ca-certificates \
         $PYTHON_DEPS \
         $SSH_LOCALE_DEPS \
         $SVN_LOCALE_DEPS \
         $EXTRA_DEPS \
 	; \
 	rm -rf /var/lib/apt/lists/*;
 
 RUN \
 echo "** Configure the python executable for py2/3 compat **" && \
 ISPY=$(which python3 || which python2) && \
 if [ -n $ISPY ] ; then ln -s $ISPY /usr/bin/python ; fi
 
 RUN \
 echo "** Configure the locales **" && \
     sed -i "s/^# ${LOCALE_TYPE}/${LOCALE_TYPE}/g" /etc/locale.gen && \
     locale-gen
 
 # locale-archive is a fix for old nix glibc2.26 locales available
 ENV \
     LOCALE_ARCHIVE=/var/opt/locale-archive \
     LANG=${LOCALE_TYPE} \
     LANGUAGE=${LOCALE_TYPE} \
     LC_ALL=${LOCALE_TYPE}
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
   useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER && \
   usermod -G $RC_USER $RC_USER
 
 RUN \
 echo "** Create nix-build user $NIX_BLD_USER **" && \
     groupadd --system --gid 1099 $NIX_BLD_USER && \
     useradd --system --gid $NIX_BLD_USER --uid 1099 --shell /bin/bash $NIX_BLD_USER && \
     usermod -G $NIX_BLD_USER $NIX_BLD_USER
 
 RUN \
 echo "** disable nix sandboxing **" && \
     mkdir /etc/nix && echo 'sandbox = false' > /etc/nix/nix.conf
 
 
 # set the defult bash shell
 SHELL ["/bin/bash", "-c"]
 
 # Fix and set a timezone
 RUN \
 echo "** configure the timezone **" && \
 rm /etc/localtime && cp /usr/share/zoneinfo/$TZ /etc/localtime && \
 echo $TZ > /etc/timezone
 
 
 RUN \
 echo "** prepare rhodecode store and cache **" && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /nix && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /opt/rhodecode && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /var/opt/rhodecode_bin && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_REPO_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_DATA_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $BUILD_CONF && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-vcsserver && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ce && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ee && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/ && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/cache && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/bootstrap && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.ssh
 
 # expose our custom sshd config
 COPY service/sshd/sshd_config $SSHD_CONF_FILE
 
 # Apache SVN setup
 RUN \
     echo "**** Apache config cleanup ****" && \
     rm -f /etc/apache2/conf.d/info.conf \
           /etc/apache2/conf.d/mpm.conf \
           /etc/apache2/conf.d/userdir.conf && \
     rm -f /etc/apache2/sites-enabled/* && \
     rm -f /etc/apache2/sites-available/*
 
 # custom SVN virtualhost
 COPY service/svn/virtualhost.conf /etc/apache2/sites-enabled/
 
 RUN \
 echo "**** Apache config ****" && \
     echo $(strings /usr/lib/apache2/modules/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
     mkdir -p /run/apache2 && \
     mkdir -p /var/opt/www && \
     echo "unset HOME" > /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_PID_FILE=/var/run/apache2/apache2.pid" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_DIR=/var/run/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_LOCK_DIR=/var/lock/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
     sed -i "s/Listen 80/Listen ${MOD_DAV_SVN_PORT}/g" /etc/apache2/ports.conf
 
 
 # Copy artifacts
 COPY --chown=$RC_USER:$RC_USER .source/ /home/$RC_USER/
 COPY --chown=$RC_USER:$RC_USER .cache/* /home/$RC_USER/.rccontrol/cache/
 COPY --chown=$RC_USER:$RC_USER config/compose/rhodecode_enterprise.license /home/$RC_USER/.rccontrol/bootstrap/
 COPY --chown=$RC_USER:$RC_USER service/rhodecode/bootstrap/* /home/$RC_USER/.rccontrol/bootstrap/
 
 RUN \
 echo "**** locale-archive path ****" && \
     mv -v /home/$RC_USER/.rccontrol/cache/locale-archive /var/opt/locale-archive
 
 # change to non-root user for RUN commands
 USER $RC_USER
 WORKDIR /home/$RC_USER
 
 
 RUN \
 echo "** download and install nix ** from $DEV_NIX_VERSION/install" && \
     curl -L https://releases.nixos.org/nix/nix-$DEV_NIX_VERSION/install | USER=$RC_USER /bin/bash
 
 RUN \
 echo "** update nix package database and set channel to $DEV_NIX_CHANNEL **" && \
     . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
 	nix-channel --add https://channels.nixos.org/$DEV_NIX_CHANNEL nixpkgs && \
 	nix-channel --update
 
 
 RUN \
     echo "** save nix config **" && \
     touch /home/$RC_USER/.rhoderc && \
     mkdir -p /home/$RC_USER/.nixpkgs && touch /home/$RC_USER/.nixpkgs/config.nix && \
     printf '{\n  rc = {\n   sources = {\n    rhodecode-vcsserver = "/home/'$RC_USER'/rhodecode-vcsserver";\n    rhodecode-enterprise-ce = "/home/'$RC_USER'/rhodecode-enterprise-ce";\n    rhodecode-enterprise-ee = "/home/'$RC_USER'/rhodecode-enterprise-ee";\n   };\n  };\n}\n' > /home/$RC_USER/.nixpkgs/config.nix
 
 
 RUN \
 echo "** install rhodecode control **" && \
 #  cd /home/$RC_USER/.rccontrol/cache && \
 #  INSTALLER=$(ls -Art /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* | tail -n 1) && \
 #  chmod +x ${INSTALLER} && \
 #  ${INSTALLER} --accept-license && \
 #  ${RCCONTROL} self-init && \
 #  cp -v /home/$RC_USER/.rccontrol-profile/etc/ca-bundle.crt $BUILD_CONF/ && \
   echo "Done"
 
 RUN \
 echo "** install build vcsserver ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
   nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link rhodecode-vcsserver/result rhodecode-vcsserver/default.nix && \
   nix-shell --command 'echo ok' rhodecode-vcsserver/default.nix && \
   VCSSERVER_PATH=/home/$RC_USER/rhodecode-vcsserver && \
   rm -rf $BUILD_BIN_DIR/vcs_bin && ln -s ${VCSSERVER_PATH}/result/bin $BUILD_BIN_DIR/vcs_bin && \
   cp -v ${VCSSERVER_PATH}/configs/production.ini $BUILD_CONF/vcsserver.ini
 
 RUN \
 echo "** install build Community ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
   echo "done"
 
 RUN \
 echo "** install build Enterprise ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
   nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link rhodecode-enterprise-ee/result rhodecode-enterprise-ee/default.nix && \
   nix-shell --command 'echo ok' rhodecode-enterprise-ee/default.nix && \
   RHODECODE_PATH=/home/$RC_USER/rhodecode-enterprise-ee && \
   rm -rf $BUILD_BIN_DIR/bin && ln -s ${RHODECODE_PATH}/result/bin $BUILD_BIN_DIR/ && \
   cp -v ${RHODECODE_PATH}/configs/production.ini $BUILD_CONF/rhodecode.ini && \
   cp -v ${RHODECODE_PATH}/configs/gunicorn_config.py $BUILD_CONF/gunicorn_conf.py && \
   mkdir -p $RHODECODE_DATA_DIR/static && cp -r ${RHODECODE_PATH}/result/etc/static/* $RHODECODE_DATA_DIR/static/
 
 
 RUN \
 echo "** configure supervisord **" && \
   #cp -v ${SUPERVISOR_CONF} $BUILD_CONF/ && \
   #sed -i "s/self_managed_supervisor = False/self_managed_supervisor = True/g" /home/$RC_USER/.rccontrol.ini && \
   echo "done"
 
 USER root
 
 
 RUN \
 echo "**** cleanup ****" && \
     apt-get remove -y $PYTHON_DEPS && \
     apt-get autoclean -y && \
     rm -f /tmp/* && \
     rm -f /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* && \
     rm -f /home/$RC_USER/.rccontrol/cache/*.bz2 && \
     rm -rf /var/lib/apt/lists/* \
     rm -rf /var/cache/apk/* \
     rm ${SUPERVISOR_CONF}
 
 # copy entrypoints
 COPY entrypoints.d/entrypoint.sh /opt/entrypoints.d/entrypoint.sh
 RUN chmod +x /opt/entrypoints.d/entrypoint.sh
 
 # config volume
 VOLUME /etc/rhodecode/conf
 
 # repo store volume
 VOLUME /var/opt/rhodecode_repo_store
 
 # data volume
 VOLUME /var/opt/rhodecode_data
 
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/entrypoint.sh"]
 
 # compose can override this
 CMD ["supervisord", "--nodaemon", "-c", "/etc/rhodecode/conf/supervisord.ini"]

service/svn/rhodecode_svn.dockerfile

@@ -1,70 +1,72 b''
-FROM debian:buster
+FROM ubuntu:22.04
+# Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
+
 ENV \
     RC_USER=rhodecode \
     MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf
 
 RUN \
 echo "** install base svn packages **" && \
-  apk update && \
-  apk add --no-cache \
+  apt-get update && \
+  apt-get install --no-cache \
     tini \
     bash \
     curl \
     apache2 \
     apache2-utils \
     apache2-webdav \
     mod_dav_svn \
     subversion
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
   useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER
 
 
 RUN \
 echo "**** cleanup ****" && \
-    apk del tzdata python2 && \
+    apt-get purge tzdata python2 && \
     rm -f /tmp/* && \
     rm -rf /var/lib/apt/lists/* \
     rm -rf /var/cache/apk/*
 
 RUN \
     echo "**** Apache config cleanup ****" && \
     rm -f /etc/apache2/conf.d/info.conf \
           /etc/apache2/conf.d/mpm.conf \
           /etc/apache2/conf.d/userdir.conf
 
 
 COPY svn/virtualhost.conf /etc/apache2/conf.d/
 
 # copy entrypoints
 COPY entrypoints.d/svn-entrypoint.sh /opt/entrypoints.d/svn-entrypoint.sh
 RUN chmod +x /opt/entrypoints.d/svn-entrypoint.sh
 
 RUN \
     echo $(strings /usr/lib/apache2/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
     mkdir -p /run/apache2 && \
     mkdir -p /var/opt/www && \
     echo "export APACHE_RUN_USER=${RC_USER}" > /etc/apache2/envvars && \
     echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
     sed -i "s/User apache/User ${RC_USER}/g" /etc/apache2/httpd.conf && \
     sed -i "s/Group apache/Group ${RC_USER}/g" /etc/apache2/httpd.conf
 
 # repo store volume
 VOLUME /var/opt/rhodecode_repo_store
 
 # config volume
 VOLUME /etc/rhodecode/conf
 
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/svn-entrypoint.sh"]
 
 CMD ["apachectl", "-D", "FOREGROUND"]