chore: critical security update for livewire/volt

refactor: use correct storage path for app key check

.dockerignore

@@ -13,4 +13,4 @@ storage/framework/cache/*
 storage/framework/sessions/*
 storage/framework/testing/*
 storage/framework/views/*
-storage/framework/logs/*
+storage/logs/*

.env.example

@@ -66,7 +66,6 @@ QUEUE_CONNECTION=redis
 
 CACHE_STORE=redis
 
-REDIS_CLIENT=predis
 REDIS_HOST=investbrain-redis
 REDIS_PATH=/tmp/database_server.sock
 REDIS_PASSWORD=null

README.md

@@ -214,6 +214,14 @@ docker exec -it investbrain-app tail -f storage/logs/laravel.log
 
 <details>
 
+**<summary>Application styling is broken and images are too big</summary>**
+
+If you're serving Investbrain from a DNS name (e.g. example.com), it's likely that you haven't updated the `ASSET_URL` environment yet. The URL provided there will be used to generate absolute URLs for images, JS, and CSS assets on the front end of the application.
+
+</details>
+
+<details>
+
 **<summary>Market data not refreshing on fresh install</summary>**
 
 If you're unable to refresh market data out of the box (i.e. your market data provider is set to Yahoo), there is a chance Yahoo is being blocked by a firewall or adblocker.  Pihole is known to block `fc.yahoo.com` which is the domain used to query Yahoo. 

app/Models/Holding.php

@@ -7,6 +7,7 @@ namespace App\Models;
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
 
 class Holding extends Model
@@ -253,7 +254,19 @@ class Holding extends Model
             $date_interval = "date(date, '+1 day')";
         } else {
 
-            DB::statement('SET cte_max_recursion_depth=1000000;');
+            // MySQL default
+            $max_recursion_var_name = 'cte_max_recursion_depth';
+
+            // Determine if running MySQL or MariaDB
+            $versionString = Arr::get(
+                DB::select('SELECT VERSION() as version;'),
+                '0', new \stdClass
+            )->version;
+            if (stripos($versionString, 'MariaDB') !== false) {
+                $max_recursion_var_name = 'max_recursive_iterations'; // Must be MariaDB
+            }
+
+            DB::statement("SET $max_recursion_var_name=1000000;");
         }
 
         return DB::table(DB::raw("(

config/app.php

@@ -100,7 +100,8 @@ return [
 
     'cipher' => 'AES-256-CBC',
 
-    'key' => env('APP_KEY'),
+    'key' => env('APP_KEY')
+        ?: when(file_exists(storage_path('app/.key')), fn () => trim(file_get_contents(storage_path('app/.key')))),
 
     'previous_keys' => [
         ...array_filter(

config/cache.php

@@ -17,7 +17,7 @@ return [
     |
     */
 
-    'default' => env('CACHE_STORE', 'database'),
+    'default' => env('CACHE_STORE', 'redis'),
 
     /*
     |--------------------------------------------------------------------------

config/queue.php

@@ -15,7 +15,7 @@ return [
     |
     */
 
-    'default' => env('QUEUE_CONNECTION', 'database'),
+    'default' => env('QUEUE_CONNECTION', 'redis'),
 
     /*
     |--------------------------------------------------------------------------

config/session.php

@@ -20,7 +20,7 @@ return [
     |
     */
 
-    'driver' => env('SESSION_DRIVER', 'database'),
+    'driver' => env('SESSION_DRIVER', 'redis'),
 
     /*
     |--------------------------------------------------------------------------

docker-compose.yml

@@ -8,23 +8,23 @@ services:
     restart: unless-stopped
     tty: true
     ports:
-      - "${APP_PORT:-8000}:80"
+      - 8000:80
-    environment:
+    environment: # You can either use these properties OR an .env file. Do not use both!
-      APP_KEY: "" # Generate a key using `echo base64:$(openssl rand -base64 32)`
       APP_URL: "http://localhost:8000"
       ASSET_URL: "http://localhost:8000"
       DB_CONNECTION: mysql
       DB_HOST: investbrain-mysql
       DB_PORT: 3306
-      DB_DATABASE: ${DB_DATABASE:-investbrain}
+      DB_DATABASE: investbrain
-      DB_USERNAME: ${DB_USERNAME:-investbrain}
+      DB_USERNAME: investbrain
-      DB_PASSWORD: ${DB_PASSWORD:-investbrain}
+      DB_PASSWORD: investbrain
       SESSION_DRIVER: redis
       QUEUE_CONNECTION: redis
       CACHE_STORE: redis
       REDIS_HOST: investbrain-redis
     volumes:
-      - ./storage:/var/app/storage
+      - investbrain-storage:/var/app/storage # You can use a volume... 
+      # - /path/to/storage:/var/app/storage:delegated # ...or you can use a path on host
     depends_on:
       - mysql
       - redis
@@ -35,10 +35,12 @@ services:
     container_name: investbrain-redis
     restart: unless-stopped
     tty: true
-    networks:
+    command:
-      - investbrain-network
+      - --loglevel warning
     volumes:
       - investbrain-redis:/data
+    networks:
+      - investbrain-network
   mysql:
     image: mysql:8.0
     container_name: investbrain-mysql
@@ -55,5 +57,6 @@ services:
     networks:
       - investbrain-network
 volumes:
+  investbrain-storage:
   investbrain-redis:
   investbrain-mysql:

docker/Dockerfile

@@ -1,19 +1,16 @@
-FROM php:8.3-fpm
+# Stage 1: Build stage
+FROM php:8.3-fpm AS builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV APP_NAME=Investbrain
 ENV VITE_APP_NAME=Investbrain
-ENV APP_DEBUG=true
-ENV SELF_HOSTED=true
 
 # Set the working directory
-COPY . /var/app
 WORKDIR /var/app
 
 # Install required packages
 RUN apt-get update && apt-get upgrade -y \
     && apt-get install -y \
-        nginx \
         libfreetype-dev \
         libjpeg62-turbo-dev \
         libpng-dev \
@@ -22,44 +19,72 @@ RUN apt-get update && apt-get upgrade -y \
         libicu-dev \
         libpq-dev \
         binutils libc6-dev \
-        supervisor \
         unzip curl git \
         nodejs npm \
-# Clean up APT
     && apt-get -y autoremove \
-        && apt-get clean \
+    && apt-get clean \
-        && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
 # Install PHP extensions
+RUN docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install -j$(nproc) gd zip
+
+# Copy application files
+COPY . .
+
+# Install Composer and Node.js Install PHP dependencies and build front end assets
+RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer \
+    && composer install --no-scripts --optimize-autoloader \
+    && npm install && npm run build \
+    && rm -rf node_modules
+
+# Stage 2: Production stage
+FROM php:8.3-fpm-alpine
+
+# Set the working directory
+WORKDIR /var/app
+
+# Copy necessary files from the builder stage
+COPY --from=builder /var/app /var/app
+COPY --from=builder /usr/local/etc/php/conf.d /usr/local/etc/php/conf.d
+COPY --from=builder /usr/local/bin/composer /usr/local/bin/composer
+
+# Install required Alpine packages
+RUN apk add --no-cache \
+        nginx \
+        supervisor \
+        libpng-dev \
+        libzip-dev \
+        icu-dev \
+        postgresql-dev \
+        freetype-dev \
+        libjpeg-turbo-dev \
+        bash \
     && docker-php-ext-configure gd --with-freetype --with-jpeg \
     && docker-php-ext-install -j$(nproc) \
         gd pgsql zip pdo_mysql mysqli intl 
 
 # Remove default nginx config
-RUN rm /etc/nginx/sites-enabled/default \
+RUN rm -rf /var/www/html \
-    && rm -rf /var/www/html \
     && ln -s /var/app /var/www/app
 
-# Set permissions and ensure www-data has a shell available
+# Create required directories for supervisord
-RUN chown -R www-data:www-data . \ 
+RUN mkdir -p /var/log/supervisor /var/run/supervisor
-    && chmod -R 775 ./storage \
-    && chmod +x ./docker/entrypoint.sh \
-    && usermod -s /bin/bash www-data 
-
-# Install Composer and Node.js Install PHP dependencies and build front end assets
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer \
-    && composer install --no-scripts --optimize-autoloader \
-    && npm install && npm run build
 
 # Copy over configs
-COPY ./docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY ./docker/nginx.conf /etc/nginx/http.d/default.conf
 COPY ./docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 
+# Set permissions and link storage
+RUN php artisan storage:link \
+    && chown -R www-data:www-data . \
+    && chmod +x ./docker/entrypoint.sh
+
 # Serve on port 80
 EXPOSE 80
 
 # Set up healthcheck
-HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD curl -f http://localhost || exit 1
+HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD curl -f http://localhost/up || exit 1
 
 # Run everything else
-ENTRYPOINT ["/bin/bash", "./docker/entrypoint.sh"]
+ENTRYPOINT ["/bin/sh", "./docker/entrypoint.sh"]
-

docker/entrypoint.sh

@@ -2,25 +2,29 @@
 
 cd /var/app
 
+# Starting Investbrain
+echo "CiAgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKICAqICBJSUkgICBOICAgTiAgViAgIFYgIEVFRUVFICBTU1NTICBUVFRUVCAgQkJCQkIgICBSUlJSICAgIEFBQUFBICBJSUkgICBOICAgTiAgKgogICogICBJICAgIE5OICBOICBWICAgViAgRSAgICAgIFMgICAgICAgVCAgICBCICAgIEIgIFIgICBSICAgQSAgIEEgICBJICAgIE5OICBOICAqCiAgKiAgIEkgICAgTiBOIE4gIFYgICBWICBFRUVFICAgU1NTUyAgICBUICAgIEJCQkJCICAgUlJSUiAgICBBQUFBQSAgIEkgICAgTiBOIE4gICoKICAqICAgSSAgICBOICBOTiAgViAgIFYgIEUgICAgICAgICAgUyAgIFQgICAgQiAgICBCICBSICBSICAgIEEgICBBICAgSSAgICBOICBOTiAgKgogICogIElJSSAgIE4gICBOICAgVlZWICAgRUVFRUUgIFNTU1MgICAgVCAgICBCQkJCQiAgIFIgICBSICAgQSAgIEEgIElJSSAgIE4gICBOICAqCiAgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKICA=" | base64 -d
+
 echo -e "\n====================== Validating environment...  ====================== "
-for dir in storage/framework/cache storage/framework/sessions storage/framework/views; do
-    if [ ! -d "$dir" ]; then
-        echo -e "\n > $dir is missing. Creating scaffold for storage directory... "
-        mkdir -p storage/framework/{cache,sessions,views}
-        chmod -R 775 storage
-        chown -R www-data:www-data storage
-    fi
-done
 
-if [ ! -L "public/storage" ]; then
+# Ensure app storage directory is scaffolded
-    echo -e "\n > Creating symbolic link for app public storage... "
+mkdir -p storage/framework/cache \
+          storage/framework/sessions \
+          storage/framework/views \
+          storage/app \
+          storage/logs
 
-    php artisan storage:link
+echo -e "\n > Storage directory scaffolding is OK... "
-fi
 
-if [[ -z "$APP_KEY" ]]; then
+# Ensure storage directory is permissioned for www-data
-    echo -e "\n > Oops! The required APP_KEY configuration is missing in your environment! "
+chmod -R 775 storage
-    echo -e "\n > You should set this APP_KEY in your .env file! "
+chown -R www-data:www-data storage
+
+echo -e "\n > Permissions are OK... "
+
+# Ensure app key exists / generate if required
+KEY_FILE="storage/app/.key"
+if [ -z "$APP_KEY" ] && [ ! -s "$KEY_FILE" ]; then
 
     draw_box() {
       local text="$1"
@@ -32,25 +36,43 @@ if [[ -z "$APP_KEY" ]]; then
       echo "$border"
     }
 
-    export APP_KEY=$(php artisan key:generate --show)
+    export APP_KEY="$(php artisan key:generate --show)"
+
+    echo -e "\n > Oops! The required APP_KEY configuration is missing! Generated app key and saved in $KEY_FILE"
+
+    echo "$APP_KEY" > "$KEY_FILE"
+
     draw_box $APP_KEY
+else
+    echo -e "\n > APP_KEY is OK... "
 fi
 
 echo -e "\n====================== Running migrations...  ====================== "
-run_migrations() {
+
-    php artisan migrate --force
+# Wait 60 seconds for database to be ready
-}
+RETRIES=12 
-RETRIES=12 # wait 60 seconds for database to be ready
 DELAY=5
+run_migrations() {
+    sleep $DELAY
+    # php artisan migrate --force
+    output=$(php artisan migrate --force 2>/dev/null)
+    if [[ $? -eq 0 ]]; then
+        echo "$output"
+        return 0
+    else
+        return 1
+    fi
+}
 until run_migrations; do
   RETRIES=$((RETRIES-1))
-  if [ $RETRIES -le 0 ]; then
+  if [[ $RETRIES -le 0 ]]; then
-    echo -e "\n > Database is not ready after $RETRIES attempts. Exiting... "
+    echo -e "\n > Database is not ready after one minute. Exiting... \n"
     exit 1
   fi
-  echo -e "\n > Waiting for database to be ready... retrying in $DELAY seconds. "
+  echo -e "\n > Waiting for database to be ready... retrying in $DELAY seconds. \n"
-  sleep $DELAY
 done
 
 echo -e "\n====================== Spinning up Supervisor daemon...  ====================== \n"
+
 exec supervisord -c /etc/supervisor/conf.d/supervisord.conf
+

docker/supervisord.conf

@@ -2,33 +2,38 @@
 nodaemon=true
 user=root
 pidfile=/var/run/supervisord.pid
+logfile=/var/log/supervisor/supervisord.log
 
 [program:nginx]
 command=nginx -g 'daemon off;'
 autostart=true
 autorestart=true
 redirect_stderr=true
-redirect_stdout=true
 
 [program:php]
 command=php-fpm -F
 autostart=true
 autorestart=true
 redirect_stderr=true
-redirect_stdout=true
 
 [program:scheduler]
 command=php artisan schedule:work
+user=www-data
 autorestart=true
 redirect_stderr=true
-redirect_stdout=true
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
 
 [program:queue-worker]
-command=php artisan queue:work --sleep=3 --tries=1 --memory=256 --timeout=3600
 process_name=%(program_name)s_%(process_num)02d
+command=php artisan queue:work --sleep=3 --tries=1 --memory=256 --timeout=3600
+user=www-data
 autorestart=true
 redirect_stderr=true
-redirect_stdout=true
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
 numprocs=2
+stopasgroup=true
+killasgroup=true
 
 [supervisorctl]