Initial Version

deploy/nginx/vhost-dev.conf

@@ -0,0 +1,125 @@
+# HTTP to HTTPS redirect
+server {
+    listen *:80;
+    listen [::]:80;
+    server_name ktrix;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen *:443 ssl http2;
+    listen [::]:443 ssl http2;
+    #listen *:443 quic reuseport;
+    #listen [::]:443 quic reuseport;
+
+    #http2 on;
+
+    server_name ktrix;
+
+    ### SSL Configuration ###
+
+    # SSL Certificates
+    ssl_certificate /etc/ssl/certs/localhost.crt;
+    ssl_certificate_key /etc/ssl/private/localhost.key;
+
+    # SSL Protocols and Ciphers
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem; # openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
+    
+    # SSL Sessions
+    ssl_session_timeout    60m;
+    ssl_session_cache      shared:SSL:10m;
+    ssl_session_tickets    off;
+
+    ### Logging Configuration ###
+    error_log /var/log/nginx/ktrix-error.log;
+    access_log /var/log/nginx/ktrix-access.log;
+
+    ### Upload Configuration ###
+    client_max_body_size 1024M;
+
+    ### Site Configuration ###
+    root /var/www/ktrix/main/public;
+    index index.html;
+
+    # Serve index.html for root path only
+    #location = / {
+    #    try_files /index.html =404;
+    #}
+
+    # Serve module static assets directly from module folders
+    # URL: /modules/<Module>/static/... -> FS: /var/www/ktrix/main/modules/<Module>/static/...
+    # Note: Linux is case-sensitive; ensure URL module casing matches folder name
+    location ~ ^/modules/([^/]+)/static/(.*)$ {
+        alias /var/www/ktrix/main/modules/$1/static/$2;
+        expires 10m;
+        add_header Cache-Control "public, immutable";
+        access_log on;
+        types {
+            text/css css;
+            application/javascript js;
+            application/javascript mjs;
+            image/svg+xml svg;
+            image/gif gif;
+            image/png png;
+            image/jpeg jpg;
+            image/jpeg jpeg;
+            image/x-icon ico;
+            font/woff woff;
+            font/woff2 woff2;
+            font/ttf ttf;
+            application/vnd.ms-fontobject eot;
+            application/json map;
+        }
+    }
+
+    # Handle asset files (css, js, images, etc.) - serve directly if they exist
+    location ~* \.(css|js|mjs|svg|gif|png|jpg|jpeg|ico|woff|woff2|ttf|eot|map)$ {
+        try_files $uri =404;
+        expires 1m;
+        add_header Cache-Control "public, immutable";
+        types {
+            text/css css;
+            application/javascript js;
+            application/javascript mjs;
+            image/svg+xml svg;
+            image/gif gif;
+            image/png png;
+            image/jpeg jpg;
+            image/jpeg jpeg;
+            image/x-icon ico;
+            font/woff woff;
+            font/woff2 woff2;
+            font/ttf ttf;
+            application/vnd.ms-fontobject eot;
+            application/json map;
+        }
+    }
+
+    # All other URLs should be handled by index.php
+    location / {
+        try_files $uri @php;
+    }
+
+    # Named location for PHP handling
+    location @php {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
+        fastcgi_param DOCUMENT_ROOT $realpath_root;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param REQUEST_URI $uri?$args;
+        fastcgi_pass fpm;
+    }
+
+    # return 404 for all other php files not matching the front controller
+    # this prevents access to other php files you don't want to be accessible.
+    location ~ \.php$ {
+        return 404;
+    }
+
+    # Optional: Gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+}

deploy/nginx/vhost.conf

@@ -0,0 +1,83 @@
+# HTTP to HTTPS redirect
+server {
+    listen *:80;
+    listen [::]:80;
+    server_name ktrix;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen *:443 ssl http2;
+    listen [::]:443 ssl http2;
+    #listen *:443 quic reuseport;
+    #listen [::]:443 quic reuseport;
+
+    #http2 on;
+
+    server_name ktrix;
+
+    ### SSL Configuration ###
+
+    # SSL Certificates
+    ssl_certificate /etc/ssl/certs/localhost.crt;
+    ssl_certificate_key /etc/ssl/private/localhost.key;
+
+    # SSL Protocols and Ciphers
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem; # openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
+    
+    # SSL Sessions
+    ssl_session_timeout    60m;
+    ssl_session_cache      shared:SSL:10m;
+    ssl_session_tickets    off;
+
+    ### Logging Configuration ###
+    error_log /var/log/nginx/ktrix-error.log;
+    access_log /var/log/nginx/ktrix-access.log;
+
+    ### Upload Configuration ###
+    client_max_body_size 1024M;
+
+    ### Site Configuration ###
+    root /var/www/ktrix/main/public;
+    index index.html;
+
+    # Serve index.html for root path only
+    location = / {
+        try_files /index.html =404;
+    }
+
+    # Handle asset files (css, js, images, etc.) - serve directly if they exist
+    location ~* \.(css|js|svg|gif|png|jpg|jpeg|ico|woff|woff2|ttf|eot|map)$ {
+        try_files $uri =404;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # All other URLs should be handled by index.php
+    location / {
+        try_files $uri @php;
+    }
+
+    # Named location for PHP handling
+    location @php {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $realpath_root/index.php;
+        fastcgi_param DOCUMENT_ROOT $realpath_root;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param REQUEST_URI $uri?$args;
+        fastcgi_pass fpm;
+    }
+
+    # return 404 for all other php files not matching the front controller
+    # this prevents access to other php files you don't want to be accessible.
+    location ~ \.php$ {
+        return 404;
+    }
+
+    # Optional: Gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+}

deploy/supervisor/mail-daemon.conf

@@ -0,0 +1,22 @@
+[program:ktrix-mail-daemon]
+command=/usr/bin/php /var/www/ktrix/main/bin/console mail:queue:daemon
+directory=/var/www/ktrix/main
+user=www-data
+numprocs=1
+autostart=true
+autorestart=true
+startsecs=5
+startretries=3
+exitcodes=0
+stopsignal=TERM
+stopwaitsecs=30
+stopasgroup=true
+killasgroup=true
+redirect_stderr=true
+stdout_logfile=/var/www/ktrix/main/var/log/mail-daemon.log
+stdout_logfile_maxbytes=10MB
+stdout_logfile_backups=5
+environment=PHP_INI_SCAN_DIR="/etc/php/8.2/cli/conf.d"
+
+; Process name for easier identification
+process_name=%(program_name)s_%(process_num)02d

deploy/systemd/mail-daemon.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=Ktrix Mail Queue Daemon
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+WorkingDirectory=/var/www/ktrix/main
+ExecStart=/usr/bin/php bin/console mail:queue:daemon
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+RestartSec=5
+StandardOutput=append:/var/www/ktrix/main/var/log/mail-daemon.log
+StandardError=append:/var/www/ktrix/main/var/log/mail-daemon.log
+
+# Process management
+KillMode=process
+KillSignal=SIGTERM
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/www/ktrix/main/storage
+ReadWritePaths=/var/www/ktrix/main/var
+
+[Install]
+WantedBy=multi-user.target