Hosting Drupal 9 on AWS Fargate Part 1: Local Development

$ docker run --rm --interactive --tty --volume $PWD:/app composer install --ignore-platform-reqs
Unable to find image 'composer:latest' locally
latest: Pulling from library/composer
a0d0a0d46f8b: Pull complete 
153eea49496a: Pull complete 
11efd0df1fcb: Pull complete 
b3f3214c344d: Pull complete 
9abd2f85688c: Pull complete 
83d85b95eb4c: Pull complete 
923d73ddadfa: Pull complete 
711b5c4b02a7: Pull complete 
ee08fa481788: Pull complete 
5f9f812bf61d: Pull complete 
28b3ecec72d5: Pull complete 
a5ffb14bc4f9: Pull complete 
d92aff3e5aec: Pull complete 
cd0274c84e75: Pull complete 
Digest: sha256:33d2c1d9fb7311cb8f215a8f52669894ef534292ac5d331347f929c27e317bb1
Status: Downloaded newer image for composer:latest
> DrupalProject\composer\ScriptHandler::checkComposerVersion
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
  - Downloading composer/installers (v2.0.1)
<---- SNIPPED ---->
  - Copy [web-root]/profiles/README.txt from assets/scaffold/files/profiles.README.txt
  - Copy [web-root]/themes/README.txt from assets/scaffold/files/themes.README.txt
> DrupalProject\composer\ScriptHandler::createRequiredFiles
Created a sites/default/files directory with chmod 0777

FROM drupal:9.2.6-php7.4-fpm-alpine3.14
 
# Copy the artefact (on Bitbucket) or local files into the image
COPY ./ /opt/drupal/.
 
# PHP Memcached which needs the libmemcached API
# Bug in Apline - creates extensions in the wrong directory so add them in correct location
RUN apk add php7-igbinary php7-pecl-memcached libmemcached \
    && echo "extension=memcached.so" > /usr/local/etc/php/conf.d/docker-php-ext-memcached.ini \
    && echo "extension=igbinary.so" > /usr/local/etc/php/conf.d/docker-php-ext-igbinary.ini \
    && mv /usr/lib/php7/modules/memcached.so /usr/local/lib/php/extensions/no-debug-non-zts-20190902 \
    && mv /usr/lib/php7/modules/igbinary.so /usr/local/lib/php/extensions/no-debug-non-zts-20190902
 
# APCu cache
RUN apk add --update --no-cache --virtual .build-dependencies $PHPIZE_DEPS \
    && pecl install apcu \
    && docker-php-ext-enable apcu \
    && pecl clear-cache \
    && apk del .build-dependencies

$ tree docker
docker
├── core-drupal
├── memcached
└── nginx
    ├── fargate
    │   ├── default.conf
    │   ├── Dockerfile
    │   └── nginx.conf
    └── local
        ├── default.conf
        ├── Dockerfile
        └── nginx.conf
 
5 directories, 6 files

user  nginx;
worker_processes  auto;
 
error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;
 
 
events {
    worker_connections  1024;
}
 
 
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
 
    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 32k;
 
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
 
    access_log  /var/log/nginx/access.log  main;
 
    sendfile        on;
    #tcp_nopush     on;
 
    keepalive_timeout  65;
 
    #gzip  on;
 
    include /etc/nginx/conf.d/*.conf;
}

  server {
    server_name badzilla-fargate.test;
    root /opt/drupal/web; ## <-- Your only path reference.
 
    location = /favicon.ico {
      log_not_found off;
      access_log off;
    }
 
    location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
    }
 
    location ~ \..*/.*\.php$ {
      return 403;
    }
 
    location ~ ^/sites/.*/private/ {
      return 403;
    }
 
    # Block access to scripts in site files directory
    location ~ ^/sites/[^/]+/files/.*\.php$ {
      deny all;
    }
 
    # Allow "Well-Known URIs" as per RFC 5785
    location ~* ^/.well-known/ {
      allow all;
    }
 
    # Block access to "hidden" files and directories whose names begin with a
    # period. This includes directories used by version control systems such
    # as Subversion or Git to store control files.
    location ~ (^|/)\. {
      return 403;
    }
 
    location / {
      # try_files $uri @rewrite; # For Drupal <= 6
      try_files $uri /index.php?$query_string; # For Drupal >= 7
    }
 
    location @rewrite {
      #rewrite ^/(.*)$ /index.php?q=$1; # For Drupal <= 6
      rewrite ^ /index.php; # For Drupal >= 7
    }
 
    # Don't allow direct access to PHP files in the vendor directory.
    location ~ /vendor/.*\.php$ {
      deny all;
      return 404;
    }
 
    # Protect files and directories from prying eyes.
    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|/(\.(?!well-known).*)|Entries.*|Root|/#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
      deny all;
      return 404;
    }
 
    # In Drupal 8, we must also match new paths where the '.php' appears in
    # the middle, such as update.php/selection. The rule we use is strict,
    # and only allows this pattern with the update.php front controller.
    # This allows legacy path aliases in the form of
    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
    # you do not have any paths like that, then you might prefer to use a
    # laxer rule, such as:
    #   location ~ \.php(/|$) {
    # The laxer rule will continue to work if Drupal uses this new URL
    # pattern with front controllers other than update.php in a future
    # release.
    location ~ '\.php$|^/update.php' {
      fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
      # Ensure the php file exists. Mitigates CVE-2019-11043
      try_files $fastcgi_script_name =404;
      # Security note: If you're running a version of PHP older than the
      # latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.
      # See http://serverfault.com/q/627903/94922 for details.
      include fastcgi_params;
      # Block httpoxy attacks. See https://httpoxy.org/.
      fastcgi_param HTTP_PROXY "";
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param PATH_INFO $fastcgi_path_info;
      fastcgi_param QUERY_STRING $query_string;
      fastcgi_intercept_errors on;
      # PHP 5 socket location.
      #fastcgi_pass unix:/var/run/php5-fpm.sock;
      # PHP 7 socket location.
#      fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
      fastcgi_pass fpm:9000;
    }
 
    # S3FS Module
    location ~ ^/s3/files/styles/ {
      try_files $uri @rewrite;
    }
 
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
      try_files $uri @rewrite;
      expires max;
      log_not_found off;
    }
 
    # Fighting with Styles? This little gem is amazing.
    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
    #location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
    #  try_files $uri @rewrite;
    #}
 
    # Handle private files through Drupal. Private file's path can come
    # with a language prefix.
    location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
      try_files $uri /index.php?$query_string;
    }
 
    # Enforce clean URLs
    # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page
    # Could be done with 301 for permanent or other redirect codes.
    if ($request_uri ~* "^(.*/)index\.php/(.*)") {
      return 307 $1$2;
    }
  }

FROM nginx:1.21.1-alpine
COPY ./default.conf /etc/nginx/conf.d/
COPY ./nginx.conf /etc/nginx/

    # S3FS Module
    location ~ ^/s3/files/styles/ {
      try_files $uri @rewrite;
    }

$ diff docker/nginx/local/default.conf docker/nginx/fargate/default.conf 
2c2
<     server_name badzilla-fargate.test;
---
>     server_name badzilla.co.uk www.badzilla.co.uk;
4a5,10
>     # User Agent ELB-HealthChecker sends no headers with the request so nginx by default will respond with a 400
>     # Fix with this
>     location = /health {
>         return 200;
>     }
> 
92c98
<       fastcgi_pass fpm:9000;
---
>       fastcgi_pass 127.0.0.1:9000;

version: "3"
 
services:
  mariadb:
    image: "mariadb:${MARIADB_VERSION}"
    restart: 'always'
    container_name: mariadb-drupal
    volumes:
      - "/var/lib/mysql/data:${MARIADB_DATA_DIR}"
      - "/var/lib/mysql/logs:${MARIADB_LOG_DIR}"
      - "/var/docker/mariadb/conf:/etc/mysql"
    environment:
      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
      MYSQL_DATABASE: "${MYSQL_DATABASE}"
      MYSQL_USER: "${MYSQL_USER}"
      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
  drupal:
    image: core-drupal:latest
    container_name: core-drupal
    depends_on:
      - mariadb
      - memcached
    volumes:
      - ./:/opt/drupal
    restart: 'always'
    environment:
      MYSQL_DATABASE: "${MYSQL_DATABASE}"
      MYSQL_USER: "${MYSQL_USER}"
      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
      MYSQL_HOSTNAME: "${MYSQL_HOSTNAME}"
      MYSQL_NAMESPACE: "${MYSQL_NAMESPACE}"
      MYSQL_DRIVER: "${MYSQL_DRIVER}"
      MYSQL_PORT: "${MYSQL_PORT}"
      AH_SITE_ENVIRONMENT: "${AH_SITE_ENVIRONMENT}"
      S3FS_ACCESS_KEY: "${S3FS_ACCESS_KEY}"
      S3FS_SECRET_KEY: "${S3FS_SECRET_KEY}"
      S3FS_BUCKET: "${S3FS_BUCKET}"
      S3FS_AWS_REGION: "${S3FS_AWS_REGION}"
      S3FS_CLOUDFRONT_CNAME: "${S3FS_CLOUDFRONT_CNAME}"
      S3FS_USE_S3_PUBLIC: "${S3FS_USE_S3_PUBLIC}"
      S3FS_USE_CNAME: "${S3FS_USE_CNAME}"
      S3FS_USE_HTTPS: "${S3FS_USE_HTTPS}"
      S3FS_TWIG_PATH: "${S3FS_TWIG_PATH}"
 
  nginx:
    image: nginx-drupal:latest
    container_name: nginx-drupal
    links:
      - drupal:fpm
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - drupal
    restart: 'always'
    volumes:
      - ./:/opt/drupal
  memcached:
    image: memcached:alpine3.14
    restart: 'always'
    container_name: memcached-drupal
    ports:
      - "11211:11211"

.DEFAULT_GOAL := help
 
 
help:
	@echo "See the README.md for available options"
 
exportdb: set-env
	@echo "Exporting the database"
	docker exec -i mariadb-drupal bash -c 'mysqldump -u $$MYSQL_USER -p$$MYSQL_PASSWORD $$MYSQL_DATABASE' > $(file)
 
importdb: set-env
	@echo "Importing the database"
	docker exec -i mariadb-drupal bash -c 'mysql -u $$MYSQL_USER -p$$MYSQL_PASSWORD $$MYSQL_DATABASE' < $(file)
 
core-drupal: set-env
	@echo "Building Drupal Core Docker from Official Image"
	docker build -t core-drupal .
 
composer-require:
	@echo "Composer require running"
	docker run --rm --interactive --tty --volume $$PWD:/app  --volume $${COMPOSER_HOME:-$$HOME/.composer}:/tmp composer require "$(module)"  --ignore-platform-reqs
 
build-all: set-env
	@echo "Building all non-standard docker images ready for spinning up docker-compose"
	cd docker/nginx/local && docker build -t nginx-drupal .
	docker build -t core-drupal .
 
start-web: set-env
	docker-compose up
 
stop-web:
	@echo "Stopping the web app gracefully. Please wait"
	docker-compose down
 
set-env:
	@echo "Setting the env variables"
	export $(cat .env | grep -v '^#' | grep '\S' | tr '\r' '\0' | xargs -0 -n1)

make build-all

make composer-require module=drupal/module_name

make importdb file=mydump.sql

docker exec -it mariadb-drupal mysql -uusername -ppassword

make start-web

drush() {
  PARAMS=$@
  CONTAINER="core-drupal"
  CMD="sh -c \"/opt/drupal/vendor/bin/drush ${PARAMS}\""
  DCMD="docker exec -it $CONTAINER $CMD"
  eval $DCMD
}

drush cr
 [success] Cache rebuild complete.