xdebug trigger

- MariaDB 초기화시 Root host 지정
- 세부 DB 계정마다 생성된 비밀번호 안내

hidche/account.orig.env

@@ -1,6 +1,8 @@
 
 #MARIADB 비밀번호. (필수)
 MARIADB_ROOT_PASSWORD=
+#MARIADB ROOT 접근 주소(선택, 외부 접근 시 % 입력)
+MARIADB_ROOT_HOST=
 HIDCHE_PW_SALT=
 HIDCHE_DB_PREFIX=hidche
 

hidche/app/Dockerfile

@@ -1,17 +1,17 @@
-FROM php:8.1-fpm-bullseye
+FROM php:8.2-fpm-bullseye
 #debian
 
 ENV LC_ALL=C.UTF-8
 
 RUN apt -y update ;\
     apt -y install \
-    bzip2 git rsync \
-    libmemcached-dev libcurl4-openssl-dev libmcrypt-dev \
-    libicu-dev libjpeg-dev libpng-dev libwebp-dev libfreetype6-dev \
+    bzip2 zip unzip p7zip-full git rsync \
+    libmemcached-dev libcurl4-openssl-dev \
+    libicu-dev libjpeg-dev libpng-dev libwebp-dev libavif-dev libfreetype6-dev \
     libzip-dev libxml2-dev libsqlite3-dev gosu build-essential;
 
 RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
-    docker-php-ext-configure gd --with-freetype-dir=/usr --with-png-dir=/usr --with-jpeg-dir=/usr --with-webp-dir=/usr; \
+    docker-php-ext-configure gd --with-freetype --with-webp --with-avif --with-jpeg --with-png ; \
     docker-php-ext-configure pdo_mysql --with-pdo-mysql=mysqlnd; \
     docker-php-ext-configure mysqli --with-mysqli=mysqlnd; \
     docker-php-ext-install -j "$(nproc)" \
@@ -19,16 +19,38 @@ RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
         gd \
         intl \
         opcache \
+        sysvmsg \
+        sysvsem \
+        sysvshm \
         pcntl \
         pdo_mysql \
         mysqli \
         zip;
-RUN pecl install memcached mcrypt;
+RUN pecl install memcached ds;
 
 RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
     apt install -yq nodejs
 RUN npm install -g npm
 
+ARG XDEBUG=0
+
+#xdebug
+RUN if [ "$XDEBUG" != "0" ]; then \
+        pecl install xdebug; \
+        docker-php-ext-enable xdebug; \
+    fi;
+# 환경 설정을 나누기 위해.
+RUN if [ "$XDEBUG" != "0" ]; then \
+        {\
+            echo "[xdebug]"; \
+            echo "xdebug.mode=profile"; \
+            echo "xdebug.profiler_append=1"; \
+            echo "xdebug.start_with_request=trigger"; \
+            echo "xdebug.trigger_value=XDEBUGPROFILE"; \
+            echo 'xdebug.output_dir="/var/www/html/sam/d_log"'; \
+        }  >> /usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini; \
+    fi;
+
 #from nextcloud setting
 RUN mkdir -p /var/www/html/;  \
     mkdir -p /var/www/.ssh;
@@ -58,5 +80,10 @@ RUN if [ "$UID" != 33 ]; then  \
 
 COPY sam_conf.ini /usr/local/etc/php/conf.d/sam_conf.ini
 
+# SETUP PHP-FPM CONFIG SETTINGS (max_children / max_requests)
+RUN echo 'pm.max_children = 15' >> /usr/local/etc/php-fpm.d/zz-docker.conf && \
+    echo 'pm.max_requests = 500' >> /usr/local/etc/php-fpm.d/zz-docker.conf && \
+     echo 'request_terminate_timeout = 600' >> /usr/local/etc/php-fpm.d/zz-docker.conf
+
 ENTRYPOINT ["entrypoint.sh"]
 CMD ["php-fpm"]

hidche/app/sam_conf.ini

@@ -16,3 +16,6 @@ opcache.save_comments=1
 opcache.revalidate_freq=1
 opcache.file_cache="/var/www/opcache"
 opcache.jit="function"
+
+extension=ds.so
+extension=memcached.so

hidche/backup/Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3-alpine
+#alpine + python3 + cron(from alpine) + mariadb-client
+RUN apk add --no-cache mariadb-client rsync
+
+COPY run_backup.py /usr/local/bin/
+RUN chmod +x /usr/local/bin/run_backup.py && \
+    echo '0 5 * * * python3 /usr/local/bin/run_backup.py' > /etc/crontabs/root
+
+ENTRYPOINT []
+CMD ["crond", "-f" , "-L", "/dev/stdout"]

hidche/backup/run_backup.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+
+import os
+import os.path
+from subprocess import Popen, PIPE, run as subprocess_run
+from datetime import datetime
+from multiprocessing.dummy import Pool as ThreadPool
+
+def backup_table(db_name, table_name, output_prefix):
+    sql_path = '{}/{}/{}.sql.gz'.format(output_prefix, db_name, table_name)
+    #print(sql_path)
+    with open(sql_path, 'wb') as sql_out:
+        sqldump = Popen(['mysqldump', '-f', '--skip-comments', '-h', 'db', '-u', 'root', '--password={}'.format(root_pw), db_name, table_name], stdout=PIPE)
+        gzdump = Popen(['gzip', '-c'], stdin=sqldump.stdout, stdout=sql_out)
+        sqldump.wait()
+        gzdump.wait()
+    os.chmod(sql_path, 0o644)
+    print('sql done {}, {}'.format(db_name, table_name))
+
+def backup_files(src_path, output_path):
+    subprocess_run(['rsync', '-au', src_path, output_path])
+    print('file done {}'.format(src_path))
+
+now = datetime.now()
+print('> backup begin', now.isoformat())
+weekday = now.weekday()
+hour = now.hour
+
+store_path = '/var/backup'
+output_prefix = '{}/hidche_backup_w{}-{:02}'.format(store_path, weekday, hour)
+
+os.makedirs(output_prefix, exist_ok=True)
+
+db_prefix = os.environ['HIDCHE_DB_PREFIX']
+server_list = os.environ['HIDCHE_SERVER_LIST'].strip(' ,').split(',')
+server_list.append('root')
+
+board_db_name = os.environ['HIDCHE_DB_BBS_USER']
+server_list.append(board_db_name)
+#print(server_list)
+
+root_pw = os.environ['MARIADB_ROOT_PASSWORD']
+
+board_files_path = os.environ.get('HIDCHE_BOARD_FILES_PATH', '/var/www/board/files')
+
+with ThreadPool(4) as pool:
+    waiters = []
+    waiters.append(pool.apply_async(backup_files, ('/var/www/html/sam/d_pic', '{}/sam_image'.format(output_prefix))))
+    print(board_files_path)
+    if os.path.exists(board_files_path):
+        waiters.append(pool.apply_async(backup_files, (board_files_path, '{}/board_files'.format(output_prefix))))
+
+    for server_name in server_list:
+        db_name = '{}_{}'.format(db_prefix, server_name)
+        raw_tables = subprocess_run(['mysql', '-NBA' , '-h' ,'db', '-u', 'root' ,'--password={}'.format(root_pw), '-D', db_name, '-e', 'show tables'], stdout=PIPE)
+        raw_tables = raw_tables.stdout.decode('utf-8').strip(' \n\t')
+        if raw_tables == '':
+            continue
+
+        tables = raw_tables.split('\n')
+        d_setting_path = '/var/www/html/sam/{}/d_setting'.format(server_name)
+
+        if os.path.exists(d_setting_path):
+            waiters.append(pool.apply_async(backup_files, (d_setting_path, '{}/{}'.format(output_prefix, db_name))))
+
+        os.makedirs('{}/{}'.format(output_prefix, db_name), exist_ok=True)
+        for table_name in tables:
+            waiters.append(pool.apply_async(backup_table, (db_name, table_name, output_prefix)))
+    for waiter in waiters:
+        waiter.wait()
+
+print('> backup finish', datetime.now().isoformat())

hidche/board/Dockerfile

@@ -1,17 +1,17 @@
-FROM php:7.4-fpm-bullseye
+FROM php:8.2-fpm-bullseye
 #debian
 
 ENV LC_ALL=C.UTF-8
 
 RUN apt -y update ;\
     apt -y install \
-    bzip2 git rsync \
-    libmemcached-dev libcurl4-openssl-dev libmcrypt-dev \
-    libicu-dev libjpeg-dev libpng-dev libwebp-dev libfreetype6-dev \
+    bzip2 zip unzip p7zip-full git rsync \
+    libmemcached-dev libcurl4-openssl-dev \
+    libicu-dev libjpeg-dev libpng-dev libwebp-dev libavif-dev libfreetype6-dev \
     libzip-dev libxml2-dev libsqlite3-dev gosu build-essential;
 
 RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
-    docker-php-ext-configure gd --with-freetype-dir=/usr --with-png-dir=/usr --with-jpeg-dir=/usr --with-webp-dir=/usr; \
+    docker-php-ext-configure gd --with-freetype --with-webp --with-avif --with-jpeg --with-png ; \
     docker-php-ext-configure pdo_mysql --with-pdo-mysql=mysqlnd; \
     docker-php-ext-configure mysqli --with-mysqli=mysqlnd; \
     docker-php-ext-install -j "$(nproc)" \
@@ -23,21 +23,9 @@ RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
         pdo_mysql \
         mysqli \
         zip;
-RUN pecl install memcached mcrypt;
+RUN pecl install memcached ds;
 #from nextcloud setting
-RUN { \
-        echo 'opcache.enable=1'; \
-        echo 'opcache.interned_strings_buffer=8'; \
-        echo 'opcache.max_accelerated_files=10000'; \
-        echo 'opcache.memory_consumption=128'; \
-        echo 'opcache.save_comments=1'; \
-        echo 'opcache.revalidate_freq=1'; \
-    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
-    \
-    echo 'apc.enable_cli=1' >> /usr/local/etc/php/conf.d/docker-php-ext-apcu.ini; \
-    \
-    echo 'memory_limit=512M' > /usr/local/etc/php/conf.d/memory-limit.ini; \
-    mkdir -p /var/www/board; \
+RUN mkdir -p /var/www/board; \
     mkdir -p /var/www/.ssh;
 
 COPY entrypoint.sh /usr/local/bin/

hidche/db/Dockerfile

@@ -1,4 +1,4 @@
-FROM mariadb
+FROM mariadb:11
 #ubuntu
 
 COPY entrypoint.sh /usr/local/bin/
@@ -7,4 +7,4 @@ ENTRYPOINT ["entrypoint.sh"]
 
 
 EXPOSE 3306
-CMD ["mysqld"]
+CMD ["mariadbd"]

hidche/db/entrypoint.sh

@@ -71,6 +71,8 @@ hidcheDBList=("root" "che" "kwe" "pwe" "twe" "nya" "pya" "hwe")
 # process initializer files, based on file extensions
 docker_process_init_files() {
 	# mysql here for backwards compatibility "${mysql[@]}"
+	# ShellCheck: mysql appears unused. Verify use (or export if used externally)
+	# shellcheck disable=SC2034
 	mysql=( docker_process_sql )
 
 	echo
@@ -85,6 +87,8 @@ docker_process_init_files() {
 					"$f"
 				else
 					mysql_note "$0: sourcing $f"
+					# ShellCheck can't follow non-constant source. Use a directive to specify location.
+					# shellcheck disable=SC1090
 					. "$f"
 				fi
 				;;
@@ -101,7 +105,6 @@ docker_process_init_files() {
 # arguments necessary to run "mariadbd --verbose --help" successfully (used for testing configuration validity and for extracting default/configured values)
 _verboseHelpArgs=(
 	--verbose --help
-	--log-bin-index="$(mktemp -u)" # https://github.com/docker-library/mysql/issues/136
 )
 
 mysql_check_config() {
@@ -123,9 +126,13 @@ mysql_get_config() {
 
 # Do a temporary startup of the MariaDB server, for init purposes
 docker_temp_server_start() {
-	"$@" --skip-networking --default-time-zone=SYSTEM --socket="${SOCKET}" --wsrep_on=OFF &
+	"$@" --skip-networking --default-time-zone=SYSTEM --socket="${SOCKET}" --wsrep_on=OFF \
+		--expire-logs-days=0 \
+		--loose-innodb_buffer_pool_load_at_startup=0 &
+	declare -g MARIADB_PID
+	MARIADB_PID=$!
 	mysql_note "Waiting for server startup"
-	# only use the root password if the database has already been initializaed
+	# only use the root password if the database has already been initialized
 	# so that it won't try to fill in a password file when it hasn't been set yet
 	extraArgs=()
 	if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
@@ -143,18 +150,43 @@ docker_temp_server_start() {
 	fi
 }
 
-# Stop the server. When using a local socket file mysqladmin will block until
+# Stop the server. When using a local socket file mariadb-admin will block until
 # the shutdown is complete.
 docker_temp_server_stop() {
-	if ! MYSQL_PWD=$MARIADB_ROOT_PASSWORD mysqladmin shutdown -uroot --socket="${SOCKET}"; then
-		mysql_error "Unable to shut down server."
-	fi
+	kill "$MARIADB_PID"
+	wait "$MARIADB_PID"
 }
 
 # Verify that the minimally required password settings are set for new databases.
 docker_verify_minimum_env() {
-	if [ -z "$MARIADB_ROOT_PASSWORD" -a -z "$MARIADB_ALLOW_EMPTY_ROOT_PASSWORD" -a -z "$MARIADB_RANDOM_ROOT_PASSWORD" ]; then
-		mysql_error $'Database is uninitialized and password option is not specified\n\tYou need to specify one of MARIADB_ROOT_PASSWORD, MARIADB_ALLOW_EMPTY_ROOT_PASSWORD and MARIADB_RANDOM_ROOT_PASSWORD'
+	if [ -z "$MARIADB_ROOT_PASSWORD" ] && [ -z "$MARIADB_ROOT_PASSWORD_HASH" ] && [ -z "$MARIADB_ALLOW_EMPTY_ROOT_PASSWORD" ] && [ -z "$MARIADB_RANDOM_ROOT_PASSWORD" ]; then
+		mysql_error $'Database is uninitialized and password option is not specified\n\tYou need to specify one of MARIADB_ROOT_PASSWORD, MARIADB_ROOT_PASSWORD_HASH, MARIADB_ALLOW_EMPTY_ROOT_PASSWORD and MARIADB_RANDOM_ROOT_PASSWORD'
+	fi
+	# More preemptive exclusions of combinations should have been made before *PASSWORD_HASH was added, but for now we don't enforce due to compatibility.
+	if [ -n "$MARIADB_ROOT_PASSWORD" ] || [ -n "$MARIADB_ALLOW_EMPTY_ROOT_PASSWORD" ] || [ -n "$MARIADB_RANDOM_ROOT_PASSWORD" ] && [ -n "$MARIADB_ROOT_PASSWORD_HASH" ]; then
+		mysql_error "Cannot specify MARIADB_ROOT_PASSWORD_HASH and another MARIADB_ROOT_PASSWORD* option."
+	fi
+	if [ -n "$MARIADB_PASSWORD" ] && [ -n "$MARIADB_PASSWORD_HASH" ]; then
+		mysql_error "Cannot specify MARIADB_PASSWORD_HASH and MARIADB_PASSWORD option."
+	fi
+	if [ -n "$MARIADB_REPLICATION_USER" ]; then
+		if [ -z "$MARIADB_MASTER_HOST" ]; then
+			# its a master, we're creating a user
+			if [ -z "$MARIADB_REPLICATION_PASSWORD" ] && [ -z "$MARIADB_REPLICATION_PASSWORD_HASH" ]; then
+				mysql_error "MARIADB_REPLICATION_PASSWORD or MARIADB_REPLICATION_PASSWORD_HASH not found to create replication user for master"
+			fi
+		else
+			# its a replica
+			if [ -z "$MARIADB_REPLICATION_PASSWORD" ] ; then
+				mysql_error "MARIADB_REPLICATION_PASSWORD is mandatory to specify the replication on the replica image."
+			fi
+			if [ -n "$MARIADB_REPLICATION_PASSWORD_HASH" ] ; then
+				mysql_warn "MARIADB_REPLICATION_PASSWORD_HASH cannot be specified on a replica"
+			fi
+		fi
+	fi
+	if [ -n "$MARIADB_MASTER_HOST" ] && { [ -z "$MARIADB_REPLICATION_USER" ] || [ -z "$MARIADB_REPLICATION_PASSWORD" ] ; }; then
+		mysql_error "For a replica, MARIADB_REPLICATION_USER and MARIADB_REPLICATION is mandatory."
 	fi
 }
 
@@ -169,22 +201,31 @@ docker_create_db_directories() {
 
 	if [ "$user" = "0" ]; then
 		# this will cause less disk access than `chown -R`
-		find "$DATADIR" \! -user mysql -exec chown mysql '{}' +
+		find "$DATADIR" \! -user mysql -exec chown mysql: '{}' +
 		# See https://github.com/MariaDB/mariadb-docker/issues/363
-		find "${SOCKET%/*}" -maxdepth 0 \! -user mysql -exec chown mysql '{}' \;
+		find "${SOCKET%/*}" -maxdepth 0 \! -user mysql -exec chown mysql: '{}' \;
 	fi
 }
 
+_mariadb_version() {
+        local mariaVersion="${MARIADB_VERSION##*:}"
+        mariaVersion="${mariaVersion%%[-+~]*}"
+	echo -n "${mariaVersion}-MariaDB"
+}
+
 # initializes the database directory
 docker_init_database_dir() {
 	mysql_note "Initializing database files"
 	installArgs=( --datadir="$DATADIR" --rpm --auth-root-authentication-method=normal )
-	if { mysql_install_db --help || :; } | grep -q -- '--skip-test-db'; then
-		# 10.3+
-		installArgs+=( --skip-test-db )
-	fi
 	# "Other options are passed to mariadbd." (so we pass all "mysqld" arguments directly here)
-	mysql_install_db "${installArgs[@]}" "${@:2}" --default-time-zone=SYSTEM --enforce-storage-engine=
+	mariadb-install-db "${installArgs[@]}" "${@:2}" \
+		--skip-test-db \
+		--old-mode='UTF8_IS_UTF8MB3' \
+		--default-time-zone=SYSTEM --enforce-storage-engine= \
+		--skip-log-bin \
+		--expire-logs-days=0 \
+		--loose-innodb_buffer_pool_load_at_startup=0 \
+		--loose-innodb_buffer_pool_dump_at_shutdown=0
 	mysql_note "Database files initialized"
 }
 
@@ -203,6 +244,16 @@ docker_setup_env() {
 	_mariadb_file_env 'MYSQL_USER'
 	_mariadb_file_env 'MYSQL_PASSWORD'
 	_mariadb_file_env 'MYSQL_ROOT_PASSWORD'
+	# No MYSQL_ compatibility needed for new variables
+	file_env 'MARIADB_PASSWORD_HASH'
+	file_env 'MARIADB_ROOT_PASSWORD_HASH'
+	# env variables related to replication
+	file_env 'MARIADB_REPLICATION_USER'
+	file_env 'MARIADB_REPLICATION_PASSWORD'
+	file_env 'MARIADB_REPLICATION_PASSWORD_HASH'
+	# env variables related to master
+	file_env 'MARIADB_MASTER_HOST'
+	file_env 'MARIADB_MASTER_PORT' 3306
 
 	# set MARIADB_ from MYSQL_ when it is unset and then make them the same value
 	: "${MARIADB_ALLOW_EMPTY_ROOT_PASSWORD:=${MYSQL_ALLOW_EMPTY_PASSWORD:-}}"
@@ -224,7 +275,7 @@ docker_exec_client() {
 	if [ -n "$MYSQL_DATABASE" ]; then
 		set -- --database="$MYSQL_DATABASE" "$@"
 	fi
-	mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" "$@"
+	mariadb --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" "$@"
 }
 
 # Execute sql script, passed via stdin
@@ -232,10 +283,9 @@ docker_exec_client() {
 #    ie: docker_process_sql --database=mydb <<<'INSERT ...'
 #    ie: docker_process_sql --dont-use-mysql-root-password --database=mydb <my-file.sql
 docker_process_sql() {
-	passfileArgs=()
 	if [ '--dont-use-mysql-root-password' = "$1" ]; then
 		shift
-		MYSQL_PWD= docker_exec_client "$@"
+		MYSQL_PWD='' docker_exec_client "$@"
 	else
 		MYSQL_PWD=$MARIADB_ROOT_PASSWORD docker_exec_client "$@"
 	fi
@@ -250,27 +300,28 @@ docker_sql_escape_string_literal() {
 	echo "${escaped//\'/\\\'}"
 }
 
+# Creates replication user
+create_replica_user() {
+	if [ -n  "$MARIADB_REPLICATION_PASSWORD_HASH" ]; then
+		echo "CREATE USER '$MARIADB_REPLICATION_USER'@'%' IDENTIFIED BY PASSWORD '$MARIADB_REPLICATION_PASSWORD_HASH';"
+	else
+		# SQL escape the user password, \ followed by '
+		local userPasswordEscaped
+		userPasswordEscaped=$( docker_sql_escape_string_literal "${MARIADB_REPLICATION_PASSWORD}" )
+		echo "CREATE USER '$MARIADB_REPLICATION_USER'@'%' IDENTIFIED BY '$userPasswordEscaped';"
+	fi
+	echo "GRANT REPLICATION REPLICA ON *.* TO '$MARIADB_REPLICATION_USER'@'%';"
+}
+
 # Initializes database with timezone info and root password, plus optional extra db/user
 docker_setup_db() {
 	# Load timezone info into database
 	if [ -z "$MARIADB_INITDB_SKIP_TZINFO" ]; then
-		{
-			# Aria in 10.4+ is slow due to "transactional" (crash safety)
-			# https://jira.mariadb.org/browse/MDEV-23326
-			# https://github.com/docker-library/mariadb/issues/262
-			local tztables=( time_zone time_zone_leap_second time_zone_name time_zone_transition time_zone_transition_type )
-			for table in "${tztables[@]}"; do
-				echo "/*!100400 ALTER TABLE $table TRANSACTIONAL=0 */;"
-			done
-
-			# sed is for https://bugs.mysql.com/bug.php?id=20545
-			mariadb-tzinfo-to-sql /usr/share/zoneinfo \
-				| sed 's/Local time zone must be set--see zic manual page/FCTY/'
-
-			for table in "${tztables[@]}"; do
-				echo "/*!100400 ALTER TABLE $table TRANSACTIONAL=1 */;"
-			done
-		} | docker_process_sql --dont-use-mysql-root-password --database=mysql
+		# --skip-write-binlog usefully disables binary logging
+		# but also outputs LOCK TABLES to improve the IO of
+		# Aria (MDEV-23326) for 10.4+.
+		mariadb-tzinfo-to-sql --skip-write-binlog /usr/share/zoneinfo \
+			| docker_process_sql --dont-use-mysql-root-password --database=mysql
 		# tell docker_process_sql to not use MYSQL_ROOT_PASSWORD since it is not set yet
 	fi
 	# Generate random root password
@@ -279,49 +330,64 @@ docker_setup_db() {
 		export MARIADB_ROOT_PASSWORD MYSQL_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD
 		mysql_note "GENERATED ROOT PASSWORD: $MARIADB_ROOT_PASSWORD"
 	fi
-	# Sets root password and creates root users for non-localhost hosts
+
+	# Creates root users for non-localhost hosts
 	local rootCreate=
-	local rootPasswordEscaped
-	rootPasswordEscaped=$( docker_sql_escape_string_literal "${MARIADB_ROOT_PASSWORD}" )
+	local rootPasswordEscaped=
+	if [ -n "$MARIADB_ROOT_PASSWORD" ]; then
+		# Sets root password and creates root users for non-localhost hosts
+		rootPasswordEscaped=$( docker_sql_escape_string_literal "${MARIADB_ROOT_PASSWORD}" )
+	fi
 
 	# default root to listen for connections from anywhere
 	if [ -n "$MARIADB_ROOT_HOST" ] && [ "$MARIADB_ROOT_HOST" != 'localhost' ]; then
-		# no, we don't care if read finds a terminating character in this heredoc
+		# ref "read -d ''", no, we don't care if read finds a terminating character in this heredoc
 		# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
-		read -r -d '' rootCreate <<-EOSQL || true
-			CREATE USER 'root'@'${MARIADB_ROOT_HOST}' IDENTIFIED BY '${rootPasswordEscaped}' ;
-			GRANT ALL ON *.* TO 'root'@'${MARIADB_ROOT_HOST}' WITH GRANT OPTION ;
-		EOSQL
+		if [ -n "$MARIADB_ROOT_PASSWORD_HASH" ]; then
+			read -r -d '' rootCreate <<-EOSQL || true
+				CREATE USER 'root'@'${MARIADB_ROOT_HOST}' IDENTIFIED BY PASSWORD '${MARIADB_ROOT_PASSWORD_HASH}' ;
+				GRANT ALL ON *.* TO 'root'@'${MARIADB_ROOT_HOST}' WITH GRANT OPTION ;
+			EOSQL
+		else
+			read -r -d '' rootCreate <<-EOSQL || true
+				CREATE USER 'root'@'${MARIADB_ROOT_HOST}' IDENTIFIED BY '${rootPasswordEscaped}' ;
+				GRANT ALL ON *.* TO 'root'@'${MARIADB_ROOT_HOST}' WITH GRANT OPTION ;
+			EOSQL
+		fi
 	fi
 
-	# tell docker_process_sql to not use MARIADB_ROOT_PASSWORD since it is just now being set
-	# --binary-mode to save us from the semi-mad users go out of their way to confuse the encoding.
-	docker_process_sql --dont-use-mysql-root-password --database=mysql --binary-mode <<-EOSQL
-		-- What's done in this file shouldn't be replicated
-		--  or products like mysql-fabric won't work
-		SET @@SESSION.SQL_LOG_BIN=0;
-                -- we need the SQL_MODE NO_BACKSLASH_ESCAPES mode to be clear for the password to be set
-		SET @@SESSION.SQL_MODE=REPLACE(@@SESSION.SQL_MODE, 'NO_BACKSLASH_ESCAPES', '');
+	local mysqlAtLocalhost=
+	local mysqlAtLocalhostGrants=
+	# Install mysql@localhost user
+	if [ -n "$MARIADB_MYSQL_LOCALHOST_USER" ]; then
+		read -r -d '' mysqlAtLocalhost <<-EOSQL || true
+		CREATE USER mysql@localhost IDENTIFIED VIA unix_socket;
+		EOSQL
+		if [ -n "$MARIADB_MYSQL_LOCALHOST_GRANTS" ]; then
+			if [ "$MARIADB_MYSQL_LOCALHOST_GRANTS" != USAGE ]; then
+				mysql_warn "Excessive privileges ON *.* TO mysql@localhost facilitates risks to the confidentiality, integrity and availability of data stored"
+			fi
+			mysqlAtLocalhostGrants="GRANT ${MARIADB_MYSQL_LOCALHOST_GRANTS} ON *.* TO mysql@localhost;";
+		fi
+	fi
 
-		DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mariadb.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
-		SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${rootPasswordEscaped}') ;
-		-- 10.1: https://github.com/MariaDB/server/blob/d925aec1c10cebf6c34825a7de50afe4e630aff4/scripts/mysql_secure_installation.sh#L347-L365
-		-- 10.5: https://github.com/MariaDB/server/blob/00c3a28820c67c37ebbca72691f4897b57f2eed5/scripts/mysql_secure_installation.sh#L351-L369
-		DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%' ;
-
-		GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
-		FLUSH PRIVILEGES ;
-		${rootCreate}
-		DROP DATABASE IF EXISTS test ;
-	EOSQL
+	local rootLocalhostPass=
+	if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
+		# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
+		rootLocalhostPass="SET PASSWORD FOR 'root'@'localhost'= PASSWORD('${rootPasswordEscaped}');"
+	fi
 
+	local createDatabase=
 	# Creates a custom database and user if specified
 	if [ -n "$MARIADB_DATABASE" ]; then
 		mysql_note "Creating database ${MARIADB_DATABASE}"
-		docker_process_sql --database=mysql <<<"CREATE DATABASE IF NOT EXISTS \`$MARIADB_DATABASE\` ;"
+		createDatabase="CREATE DATABASE IF NOT EXISTS \`$MARIADB_DATABASE\`;"
 	fi
 
-	#modifed
+	local createUser=
+	local userGrants=
+
+    #modifed
 	for dbName in "${hidcheDBList[@]}"; do
 		local fullDBName
 		local subPW
@@ -329,33 +395,146 @@ docker_setup_db() {
 		mysql_note "Creating database ${fullDBName}"
 		subPW=`echo -n ${dbName}${HIDCHE_PW_SALT}${MARIADB_ROOT_PASSWORD}${dbName}${HIDCHE_PW_SALT} | shasum -a 512`
 		subPW=${subPW:0:32}
+		mysql_note "GENERATED ${fullDBName} PASSWORD: $subPW"
 		local userPasswordEscaped
 		userPasswordEscaped=$( docker_sql_escape_string_literal "${subPW}" )
 
-		docker_process_sql --database=mysql <<<"CREATE DATABASE IF NOT EXISTS \`$fullDBName\` ;"
-		docker_process_sql --database=mysql --binary-mode <<-EOSQL_SUBDB
-			SET @@SESSION.SQL_MODE=REPLACE(@@SESSION.SQL_MODE, 'NO_BACKSLASH_ESCAPES', '');
-			CREATE USER '$fullDBName'@'%' IDENTIFIED BY '$userPasswordEscaped';
-		EOSQL_SUBDB
-		docker_process_sql --database=mysql <<<"GRANT ALL ON \`${fullDBName//_/\\_}\`.* TO '$fullDBName'@'%' ;"
+		createDatabase+="CREATE DATABASE IF NOT EXISTS \`$fullDBName\` ;"
+		createUser+="CREATE USER '$fullDBName'@'%' IDENTIFIED BY '$userPasswordEscaped';"
+        userGrants+="GRANT ALL ON \`${fullDBName//_/\\_}\`.* TO '$fullDBName'@'%' ;"
 	done
 
 	if [ -n "$HIDCHE_DB_BBS_USER" ] && [ -n "$HIDCHE_DB_BBS_PASSWORD" ]; then
 		local fullBBS_DBName
 		fullBBS_DBName="${HIDCHE_DB_PREFIX}_board"
 		mysql_note "Creating database ${fullBBS_DBName}"
-		docker_process_sql --database=mysql <<<"CREATE DATABASE IF NOT EXISTS \`$fullBBS_DBName\` ;"
+		createDatabase+="CREATE DATABASE IF NOT EXISTS \`$fullBBS_DBName\` ;"
 
 		mysql_note "Creating user ${HIDCHE_DB_BBS_USER}"
 		# SQL escape the user password, \ followed by '
 		local userPasswordEscaped
 		userPasswordEscaped=$( docker_sql_escape_string_literal "${HIDCHE_DB_BBS_PASSWORD}" )
-		docker_process_sql --database=mysql --binary-mode <<-EOSQL_USER
-			SET @@SESSION.SQL_MODE=REPLACE(@@SESSION.SQL_MODE, 'NO_BACKSLASH_ESCAPES', '');
-			CREATE USER '$HIDCHE_DB_BBS_USER'@'%' IDENTIFIED BY '$userPasswordEscaped';
-		EOSQL_USER
-		docker_process_sql --database=mysql <<<"GRANT ALL ON \`${fullBBS_DBName//_/\\_}\`.* TO '$HIDCHE_DB_BBS_USER'@'%' ;"
+		createUser+="CREATE USER '$HIDCHE_DB_BBS_USER'@'%' IDENTIFIED BY '$userPasswordEscaped';"
+		userGrants+="GRANT ALL ON \`${fullBBS_DBName//_/\\_}\`.* TO '$HIDCHE_DB_BBS_USER'@'%' ;"
 	fi
+
+	# To create replica user
+	local createReplicaUser=
+	local changeMasterTo=
+	local startReplica=
+	if  [ -n "$MARIADB_REPLICATION_USER" ] ; then
+		if [ -z "$MARIADB_MASTER_HOST" ]; then
+			# on master
+			mysql_note "Creating user ${MARIADB_REPLICATION_USER}"
+			createReplicaUser=$(create_replica_user)
+		else
+			# on replica
+			local rplPasswordEscaped
+			rplPasswordEscaped=$( docker_sql_escape_string_literal "${MARIADB_REPLICATION_PASSWORD}" )
+			# SC cannot follow how MARIADB_MASTER_PORT is assigned a default value.
+			# shellcheck disable=SC2153
+			changeMasterTo="CHANGE MASTER TO MASTER_HOST='$MARIADB_MASTER_HOST', MASTER_USER='$MARIADB_REPLICATION_USER', MASTER_PASSWORD='$rplPasswordEscaped', MASTER_PORT=$MARIADB_MASTER_PORT, MASTER_CONNECT_RETRY=10;"
+			startReplica="START REPLICA;"
+		fi
+	fi
+
+	mysql_note "Securing system users (equivalent to running mysql_secure_installation)"
+	# tell docker_process_sql to not use MARIADB_ROOT_PASSWORD since it is just now being set
+	# --binary-mode to save us from the semi-mad users go out of their way to confuse the encoding.
+	docker_process_sql --dont-use-mysql-root-password --database=mysql --binary-mode <<-EOSQL
+		-- Securing system users shouldn't be replicated
+		SET @orig_sql_log_bin= @@SESSION.SQL_LOG_BIN;
+		SET @@SESSION.SQL_LOG_BIN=0;
+                -- we need the SQL_MODE NO_BACKSLASH_ESCAPES mode to be clear for the password to be set
+		SET @@SESSION.SQL_MODE=REPLACE(@@SESSION.SQL_MODE, 'NO_BACKSLASH_ESCAPES', '');
+
+		DROP USER IF EXISTS root@'127.0.0.1', root@'::1';
+		EXECUTE IMMEDIATE CONCAT('DROP USER IF EXISTS root@\'', @@hostname,'\'');
+
+		${rootLocalhostPass}
+		${rootCreate}
+		${mysqlAtLocalhost}
+		${mysqlAtLocalhostGrants}
+		-- end of securing system users, rest of init now...
+		SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
+		-- create users/databases
+		${createDatabase}
+		${createUser}
+		${createReplicaUser}
+		${userGrants}
+
+		${changeMasterTo}
+		${startReplica}
+	EOSQL
+}
+
+# backup the mysql database
+docker_mariadb_backup_system()
+{
+	if [ -n "$MARIADB_DISABLE_UPGRADE_BACKUP" ] \
+		&& [ "$MARIADB_DISABLE_UPGRADE_BACKUP" = 1 ]; then
+		mysql_note "MariaDB upgrade backup disabled due to \$MARIADB_DISABLE_UPGRADE_BACKUP=1 setting"
+		return
+	fi
+	local backup_db="system_mysql_backup_unknown_version.sql.zst"
+	local oldfullversion="unknown_version"
+	if [ -r "$DATADIR"/mariadb_upgrade_info ]; then
+		read -r -d '' oldfullversion < "$DATADIR"/mariadb_upgrade_info || true
+		if [ -n "$oldfullversion" ]; then
+			backup_db="system_mysql_backup_${oldfullversion}.sql.zst"
+		fi
+	fi
+
+	mysql_note "Backing up system database to $backup_db"
+	if ! mariadb-dump --skip-lock-tables --replace --databases mysql --socket="${SOCKET}" | zstd > "${DATADIR}/${backup_db}"; then
+		mysql_error "Unable backup system database for upgrade from $oldfullversion."
+	fi
+	mysql_note "Backing up complete"
+}
+
+# perform mariadb-upgrade
+# backup the mysql database if this is a major upgrade
+docker_mariadb_upgrade() {
+	if [ -z "$MARIADB_AUTO_UPGRADE" ] \
+		|| [ "$MARIADB_AUTO_UPGRADE" = 0 ]; then
+		mysql_note "MariaDB upgrade (mariadb-upgrade) required, but skipped due to \$MARIADB_AUTO_UPGRADE setting"
+		return
+	fi
+	mysql_note "Starting temporary server"
+	docker_temp_server_start "$@" --skip-grant-tables \
+		--loose-innodb_buffer_pool_dump_at_shutdown=0 \
+		--skip-slave-start
+	mysql_note "Temporary server started."
+
+	docker_mariadb_backup_system
+
+	mysql_note "Starting mariadb-upgrade"
+	mariadb-upgrade --upgrade-system-tables
+	mysql_note "Finished mariadb-upgrade"
+
+	mysql_note "Stopping temporary server"
+	docker_temp_server_stop
+	mysql_note "Temporary server stopped"
+}
+
+
+_check_if_upgrade_is_needed() {
+	if [ ! -f "$DATADIR"/mariadb_upgrade_info ]; then
+		mysql_note "MariaDB upgrade information missing, assuming required"
+		return 0
+	fi
+	local mariadbVersion
+	mariadbVersion="$(_mariadb_version)"
+	IFS='.-' read -ra newversion <<<"$mariadbVersion"
+	IFS='.-' read -ra oldversion < "$DATADIR"/mariadb_upgrade_info || true
+
+	if [[ ${#newversion[@]} -lt 2 ]] || [[ ${#oldversion[@]} -lt 2 ]] \
+		|| [[ ${oldversion[0]} -lt ${newversion[0]} ]] \
+		|| [[ ${oldversion[0]} -eq ${newversion[0]} && ${oldversion[1]} -lt ${newversion[1]} ]]; then
+		return 0
+	fi
+	mysql_note "MariaDB upgrade not required"
+	return 1
 }
 
 # check arguments for an option that would cause mariadbd to stop
@@ -373,12 +552,13 @@ _mysql_want_help() {
 }
 
 _main() {
-	# if command starts with an option, prepend mysqld
+	# if command starts with an option, prepend mariadbd
 	if [ "${1:0:1}" = '-' ]; then
 		set -- mariadbd "$@"
 	fi
 
-	# skip setup if they aren't running mariadbd or want an option that stops mysqld
+	#ENDOFSUBSTITUTIONS
+	# skip setup if they aren't running mysqld or want an option that stops mysqld
 	if [ "$1" = 'mariadbd' ] || [ "$1" = 'mysqld' ] && ! _mysql_want_help "$@"; then
 		mysql_note "Entrypoint script for MariaDB Server ${MARIADB_VERSION} started."
 
@@ -390,7 +570,7 @@ _main() {
 		# If container is started as root user, restart as dedicated mysql user
 		if [ "$(id -u)" = "0" ]; then
 			mysql_note "Switching to dedicated user 'mysql'"
-			exec gosu mysql "$BASH_SOURCE" "$@"
+			exec gosu mysql "${BASH_SOURCE[0]}" "$@"
 		fi
 
 		# there's no database, so it needs to be initialized
@@ -408,14 +588,27 @@ _main() {
 
 			docker_setup_db
 			docker_process_init_files /docker-entrypoint-initdb.d/*
+			# Wait until after /docker-entrypoint-initdb.d is performed before setting
+			# root@localhost password to a hash we don't know the password for.
+			if [ -n "${MARIADB_ROOT_PASSWORD_HASH}" ]; then
+				mysql_note "Setting root@localhost password hash"
+				docker_process_sql --dont-use-mysql-root-password --binary-mode <<-EOSQL
+					SET @@SESSION.SQL_LOG_BIN=0;
+					SET PASSWORD FOR 'root'@'localhost'= '${MARIADB_ROOT_PASSWORD_HASH}';
+				EOSQL
+			fi
 
 			mysql_note "Stopping temporary server"
 			docker_temp_server_stop
 			mysql_note "Temporary server stopped"
 
 			echo
-			mysql_note "MariaDB init process with HIDCHE done. Ready for start up."
+			mysql_note "MariaDB init process done. Ready for start up."
 			echo
+		# MDEV-27636 mariadb_upgrade --check-if-upgrade-is-needed cannot be run offline
+		#elif mariadb-upgrade --check-if-upgrade-is-needed; then
+		elif _check_if_upgrade_is_needed; then
+			docker_mariadb_upgrade "$@"
 		fi
 	fi
 	exec "$@"

hidche/docker-compose.yml

@@ -13,8 +13,8 @@ services:
   web:
     build: ./web
     restart: always
-    ports:
-      - 8080:80
+    #ports:
+    #  - 8080:80
     volumes:
       - hidche:/var/www/html:ro
       - board:/var/www/board:ro
@@ -54,6 +54,22 @@ services:
       - db
       - web
 
+  backup:
+    build: ./backup
+    restart: "no"
+    #restart: always
+    #command:
+      #- crond -f -L /dev/stdout
+    volumes:
+      - hidche:/var/www/html:ro
+      - backup:/var/backup
+    env_file:
+      - account.env
+      - game.env
+    depends_on:
+      - app
+      - db
+
   cron:
     build: ./cron
     restart: always
@@ -66,3 +82,4 @@ volumes:
   db:
   hidche:
   board:
+  backup:

hidche/example.docker-compose.override.yml

@@ -25,7 +25,7 @@ services:
         target: /var/www/html
         #For DEV. Set app path as local directory
       - type: bind
-        source: ~/dev_sam/bbs
+        source: ~/dev_sam/board
         target: /var/www/board
 
   app:
@@ -66,3 +66,18 @@ services:
         target: /var/www/html
     depends_on:
       - app
+
+  backup:
+    restart: "no"
+    volumes:
+      #- type: bind
+      #  source: ~/dev_sam/backup
+      #  target: /var/backup
+      - type: bind
+        read_only: true
+        source: ~/dev_sam/app
+        target: /var/www/html
+      - type: bind
+        read_only: true
+        source: ~/dev_sam/board
+        target: /var/www/board

hidche/game.orig.env

@@ -19,3 +19,6 @@ HIDCHE_GAME_PATH=http://127.0.0.1:8080/sam
 HIDCHE_IMAGE_USE_INTERNAL=yes
 #이미지 경로, HIDCHE_IMAGE_USE_INTERNAL이 yes인 경우 HIDCHE_GAME_PATH의 상대 경로. yes가 아닌 경우 전체 도메인 경로.
 HIDCHE_IMAGE_PATH=../image
+
+#게시판 서버내 파일 백업 경로, /var/www/board/files 가 아니라면 직접 지정
+#HIDCHE_BOARD_FILES_PATH=

hidche/install/install_hidche.py

@@ -81,6 +81,8 @@ setupDBResult = session.post('http://web/sam/f_install/j_setup_db.php', {
     'kakao_rest_key':env['HIDCHE_KAKAO_REST_KEY'],
     'kakao_admin_key':env['HIDCHE_KAKAO_ADMIN_KEY'],
 }, headers=headers)
+if not setupDBResult.ok:
+    print(setupDBResult, flush=True)
 setupDBJsonResult = json.loads(setupDBResult.text)
 print(setupDBJsonResult, flush=True)
 
@@ -99,13 +101,8 @@ setupAdminResult = session.post('http://web/sam/f_install/j_create_admin.php', q
 setupAdminJsonResult = json.loads(setupAdminResult.text)
 print(setupAdminJsonResult, flush=True)
 
-jsonQuery = {
-    "path": ["Login", "LoginByID"],
-    "args": query
-}
-
 print("Login Admin...", flush=True)
-loginResult = session.post('http://web/sam/api.php', json=jsonQuery)
+loginResult = session.post('http://web/sam/api.php?path=Login%2FLoginByID', json=query, headers=headers)
 print(loginResult.text, flush=True)
 
 serverList = str(env['HIDCHE_SERVER_LIST']).split(',')

hidche/web/default.conf

@@ -25,6 +25,7 @@ server {
             include        fastcgi_params;
             fastcgi_pass   board:9000;
             fastcgi_index  index.php;
+            fastcgi_param  REMOTE_ADDR $http_x_real_ip;
             fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
         }
     }
@@ -36,6 +37,7 @@ server {
             proxy_read_timeout 600;
             fastcgi_pass   app:9000;
             fastcgi_index  index.php;
+            fastcgi_param  REMOTE_ADDR $http_x_real_ip;
             fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
         }
     }