feat: Add SSL support with configuration updates for Apache, FrankenPHP and Nginx, including certificate files. (#108)

Author: terabytesoftw

README.md

@@ -38,6 +38,7 @@ A modern, Bootstrap 5-powered Yii2 application template designed for rapid web-a
 - ✅ **Multi-language Support** - Built-in internationalization (i18n) support with message translations.
 - ✅ **Ready-to-Use Pages** - Pre-built pages including home, about, contact, and error handling.
 - ✅ **Security Features** - Built-in CSRF protection, input validation, and secure configurations.
+- ✅ **SSL Support** - Configured for secure HTTPS connections with SSL (mkcert).
 - ✅ **Testing Ready** - Codeception test suite with examples for functional and unit testing.
 
 ## Environment support
@@ -120,10 +121,10 @@ http://localhost:8080/
 http://localhost:8080/
 
 # For FrankenPHP
-http://localhost:8082/
+http://localhost:8081/
 
 # For Nginx
-http://localhost:8081/
+http://localhost:8082/
 ```
 
 ### Basic usage

composer.lock

@@ -11,9 +11,9 @@ services:
       - caddy_data:/data
       - caddy_config:/config
     ports:
-      - '8082:80'
-      - '8443:443'
-      - '8443:443/udp'
+      - '8081:80'
+      - '8444:443'
+      - '8444:443/udp'
     environment:
       TZ: "UTC"
     tty: true

docker-compose.frankenphp.yml

@@ -9,6 +9,7 @@ services:
       - ./:/app
       - ~/.composer-docker/cache:/root/.composer/cache:delegated
     ports:
-      - '8081:80'
+      - '8082:80'
+      - '8445:443'
     environment:
       TZ: "UTC"

docker-compose.nginx.yml

@@ -11,5 +11,6 @@ services:
       - ~/.composer-docker/cache:/root/.composer/cache:delegated
     ports:
       - '8080:80'
+      - '8443:443'
     environment:
       TZ: "UTC"

docker-compose.yml

@@ -1,13 +1,18 @@
 FROM yiisoftware/yii2-php:8.4-apache
 
-# change web server config
+# Enable SSL modules and configure ports before copying config
+RUN a2enmod ssl rewrite headers mime \
+    && echo "Listen 80" > /etc/apache2/ports.conf \
+    && echo "Listen 443 ssl" >> /etc/apache2/ports.conf
+
+# Change web server config
 COPY docker/apache/apache.conf /etc/apache2/apache2.conf
 COPY docker/apache/vhost.conf /etc/apache2/sites-available/000-default.conf
 
-# change PHP config
+# Change PHP config
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/base.ini
 
-# install supervisord and Node.js (includes npm)
+# Install supervisord and Node.js (includes npm)
 RUN apt-get update && apt-get install -y \
     supervisor \
     curl \
@@ -17,14 +22,14 @@ RUN apt-get update && apt-get install -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# copy supervisord config
+# Copy supervisord config
 COPY docker/apache/supervisord/supervisord.conf /etc/supervisor/supervisord.conf
 
-# copy supervisord program configs
+# Copy supervisord program configs
 COPY docker/apache/supervisord/conf.d/apache2.conf /etc/supervisor/conf.d/apache2.conf
 
-# copy queue worker config uncommented for use with yii2-queue
+# Copy queue worker config uncommented for use with yii2-queue
 #COPY docker/apache/supervisord/conf.d/queue.conf /etc/supervisor/conf.d/queue.conf
 
-# run supervisord
+# Run supervisord
 CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]

docker/apache/Dockerfile

@@ -1,36 +1,71 @@
+# Global configuration for the public directory
 <Directory /app/public>
         Options FollowSymLinks
         AllowOverride All
         Require all granted
+
+        # Ensure Apache serves static files directly
+        <FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$">
+            Header unset ETag
+            FileETag None
+
+            # Completely disable PHP processing for these files
+            RemoveHandler .php
+            SetHandler default-handler
+        </FilesMatch>
 </Directory>
 
+# HTTP Virtual Host - Redirect to HTTPS
 <VirtualHost *:80>
-        # The ServerName directive sets the request scheme, hostname and port that
-        # the server uses to identify itself. This is used when creating
-        # redirection URLs. In the context of virtual hosts, the ServerName
-        # specifies what hostname must appear in the request's Host: header to
-        # match this virtual host. For the default virtual host (this file) this
-        # value is not decisive as it is used as a last resort host regardless.
-        # However, you must set it for any further virtual host explicitly.
-        #ServerName example.com
-        #ServerAlias www.example.com
-
         ServerAdmin webmaster@localhost
         DocumentRoot /app/public
 
-        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
-        # error, crit, alert, emerg.
-        # It is also possible to configure the loglevel for particular
-        # modules, e.g.
-        #LogLevel info ssl:warn
+        # Redirect all HTTP to HTTPS
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteRule ^(.*)$ https://localhost:8443%{REQUEST_URI} [R=301,L]
 
+        # Logging configuration
         ErrorLog ${APACHE_LOG_DIR}/error.log
         CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
+
+# HTTPS Virtual Host
+<VirtualHost *:443>
+        # ServerName directive, which sets the request scheme, hostname and port that
+        ServerName localhost
+        ServerAdmin webmaster@localhost
+        DocumentRoot /app/public
+
+        # SSL Configuration
+        SSLEngine on
+        SSLCertificateFile /app/docker/ssl/localhost.pem
+        SSLCertificateKeyFile /app/docker/ssl/localhost-key.pem
+
+        # Enable rewrite logging for debugging (remove in production)
+        LogLevel warn rewrite:trace6
+
+        # Yii2 URL Rewriting Configuration
+        RewriteEngine On
+
+        # Step 1: Exclude static files by extension completely
+        RewriteRule \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|map)$ - [L,QSA]
+
+        # Step 2: Exclude specific asset directories by path
+        RewriteRule ^(assets|image|images|css|js|fonts|media)/ - [L,QSA]
+
+        # Step 3: If it's an existing file, serve it directly
+        RewriteCond %{REQUEST_FILENAME} -f
+        RewriteRule ^ - [L]
+
+        # Step 4: If it's an existing directory, serve it directly
+        RewriteCond %{REQUEST_FILENAME} -d
+        RewriteRule ^ - [L]
+
+        # Step 5: Only if none of the above apply, send to index.php
+        RewriteRule ^(.*)$ index.php [L,QSA]
 
-        # For most configuration files from conf-available/, which are
-        # enabled or disabled at a global level, it is possible to
-        # include a line for only one particular virtual host. For example the
-        # following line enables the CGI configuration for this host only
-        # after it has been globally disabled with "a2disconf".
-        #Include conf-available/serve-cgi-bin.conf
-</VirtualHost>
+        # Logging configuration for SSL
+        ErrorLog ${APACHE_LOG_DIR}/ssl_error.log
+        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
+</VirtualHost>

docker/apache/vhost.conf

@@ -3,8 +3,11 @@
     auto_https off
 }
 
-# Main server block
-:80 {
+# HTTPS server block using mkcert certificates
+https://localhost:443 {
+    # Specify mkcert certificates
+    tls /app/docker/ssl/localhost.pem /app/docker/ssl/localhost-key.pem
+
     # Document root
     root * /app/public
 
@@ -16,6 +19,7 @@
         X-Frame-Options "SAMEORIGIN"
         X-XSS-Protection "1; mode=block"
         X-Content-Type-Options "nosniff"
+        Strict-Transport-Security "max-age=31536000; includeSubDomains"
         -Server
     }
 
@@ -50,3 +54,9 @@
     # Try files for Yii2 URL rewriting
     try_files {path} {path}/ /index.php?{query}
 }
+
+# HTTP server block - redirect to HTTPS
+http://localhost:80 {
+    # Redirect all HTTP traffic to HTTPS
+    redir https://localhost:8444{uri} permanent
+}

docker/frankenphp/Caddyfile

@@ -1,12 +1,12 @@
 FROM dunglas/frankenphp:1.8-php8.4
 
-# change web server config
+# Change web server config
 COPY docker/frankenphp/Caddyfile /etc/caddy/Caddyfile
 
-# set document root to /app/public (Yii2 structure)
+# Set document root to /app/public (Yii2 structure)
 WORKDIR /app
 
-# install required system packages for PHP extensions for Yii 2.0 Framework
+# Install required system packages for PHP extensions for Yii 2.0 Framework
 COPY --from=mlocati/php-extension-installer /usr/bin/install-php-extensions /usr/local/bin/
 RUN install-php-extensions \
         bcmath \
@@ -22,13 +22,13 @@ RUN install-php-extensions \
         xdebug \
         zip
 
-# set composer environment
+# Set composer environment
 ENV COMPOSER_ALLOW_SUPERUSER=1
 
-# change PHP config
+# Change PHP config
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/base.ini
 
-# install supervisord and Node.js (includes npm)
+# Install supervisord and Node.js (includes npm)
 RUN apt-get update && apt-get install -y \
     supervisor \
     curl \
@@ -38,13 +38,13 @@ RUN apt-get update && apt-get install -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# copy supervisord config
+# Copy supervisord config
 COPY docker/frankenphp/supervisord/supervisord.conf /etc/supervisor/supervisord.conf
 
-# copy supervisord program configs
+# Copy supervisord program configs
 COPY docker/frankenphp/supervisord/conf.d/frankenphp.conf /etc/supervisor/conf.d/frankenphp.conf
 
-# copy queue worker config uncommented for use with yii2-queue
+# Copy queue worker config uncommented for use with yii2-queue
 #COPY docker/frankenphp/supervisord/conf.d/queue.conf /etc/supervisor/conf.d/queue.conf
 
 RUN mkdir -p /var/run && chown -R www-data:www-data /var/run

docker/frankenphp/Dockerfile

@@ -1,13 +1,13 @@
 FROM yiisoftware/yii2-php:8.4-fpm-nginx
 
-# change nginx config
+# Change nginx config
 COPY docker/nginx/nginx.conf /etc/nginx/nginx.conf
 COPY docker/nginx/default.conf /etc/nginx/conf.d/default.conf
 
-# change PHP config
+# Change PHP config
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/base.ini
 
-# install supervisord and Node.js (includes npm)
+# Install supervisord and Node.js (includes npm)
 RUN apt-get update && apt-get install -y \
     supervisor \
     curl \
@@ -17,15 +17,15 @@ RUN apt-get update && apt-get install -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# copy supervisord config
+# Copy supervisord config
 COPY docker/nginx/supervisord/supervisord.conf /etc/supervisor/supervisord.conf
 
-# copy supervisord program configs
+# Copy supervisord program configs
 COPY docker/nginx/supervisord/conf.d/nginx.conf /etc/supervisor/conf.d/nginx.conf
 COPY docker/nginx/supervisord/conf.d/php-fpm.conf /etc/supervisor/conf.d/php-fpm.conf
 
-# copy queue worker config uncommented for use with yii2-queue
+# Copy queue worker config uncommented for use with yii2-queue
 #COPY docker/apache/supervisord/conf.d/queue.conf /etc/supervisor/conf.d/queue.conf
 
-# run supervisord
+# Run supervisord
 CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]