docker-compose.yml

-version: '2'
+version: '2.4'
 networks:
   lb_web:
     external: true
   back:
     driver: bridge
+    ipam:
+      driver: default
+      config:
+      - subnet: 10.0.${SUBNET}.0/24
 services:
-  db:
-    image: mysql:5.7
-    volumes:
-      - ./mysql/runtime:/var/lib/mysql
-    environment:
-      - MYSQL_ROOT_PASSWORD
-    networks:
-    - back
-  app:
-    image: piwik:fpm
-    links:
-      - db
-    volumes:
-      - ./config:/var/www/html/config
-    networks:
-    - back
   web:
     image: nginx
     volumes:
-      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf
     links:
       - app
     volumes_from:
@@ -32,21 +20,30 @@ services:
     environment:
       - VIRTUAL_HOST
     networks:
-    - back
-    - lb_web
-  cron:
-    image: piwik:fpm
+      - back
+      - lb_web
+  app:
+    image: matomo:${MATOMO_VERSION}
+    volumes:
+      - ./data/html:/var/www/html/
     links:
-      - db
-    volumes_from:
-      - app
-    entrypoint: |
-      bash -c 'bash -s <<EOF
-      trap "break;exit" SIGHUP SIGINT SIGTERM
-      while /bin/true; do
-        su -s "/bin/bash" -c "/usr/local/bin/php /var/www/html/console core:archive" www-data
-        sleep 3600
-      done
-      EOF'
+        - db
+    environment:
+      - MATOMO_DATABASE_ADAPTER
+      - MATOMO_DATABASE_TABLES_PREFIX
+      - MATOMO_DATABASE_USERNAME
+      - MATOMO_DATABASE_PASSWORD
+      - MATOMO_DATABASE_DBNAME
+    networks:
+      - back
+  db:
+    image: mariadb:${MYSQL_VERSION}
+    volumes:
+      - ./mysql/runtime:/var/lib/mysql
+    environment:
+      - MYSQL_ROOT_PASSWORD
+      - MYSQL_PASSWORD
+      - MYSQL_DATABASE
+      - MYSQL_USER
     networks:
-    - back
+      - back
\ No newline at end of file

nginx.conf

-user www-data;
-
-events {
-  worker_connections 768;
+upstream php-handler {
+	server app:9000;
 }
 
-http {
-  upstream backend {
-    server app:9000;
-  }
-
-  include /etc/nginx/mime.types;
-  default_type application/octet-stream;
-  gzip on;
-  gzip_disable "msie6";
-  
-  server {
-    listen 80;
-
-    root /var/www/html/;
-    index index.php index.html index.htm;
-
-    location / {
-      try_files $uri $uri/ =404;
-    }
-
-    error_page 404 /404.html;
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-      root /usr/share/nginx/html;
-    }
-
-    location = /favicon.ico {
-      log_not_found off;
-      access_log off;
-    }
-   
-    location ~ \.php$ {
-      fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
-      fastcgi_param  SERVER_SOFTWARE    nginx;
-      fastcgi_param  QUERY_STRING       $query_string;
-      fastcgi_param  REQUEST_METHOD     $request_method;
-      fastcgi_param  CONTENT_TYPE       $content_type;
-      fastcgi_param  CONTENT_LENGTH     $content_length;
-      fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
-      fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
-      fastcgi_param  REQUEST_URI        $request_uri;
-      fastcgi_param  DOCUMENT_URI       $document_uri;
-      fastcgi_param  DOCUMENT_ROOT      $document_root;
-      fastcgi_param  SERVER_PROTOCOL    $server_protocol;
-      fastcgi_param  REMOTE_ADDR        $remote_addr;
-      fastcgi_param  REMOTE_PORT        $remote_port;
-      fastcgi_param  SERVER_ADDR        $server_addr;
-      fastcgi_param  SERVER_PORT        $server_port;
-      fastcgi_param  SERVER_NAME        $server_name;
-      fastcgi_intercept_errors on;
-      fastcgi_pass backend;
-    }
-  }
+server {
+	listen 80;
+
+	add_header Referrer-Policy origin; # make sure outgoing links don't show the URL to the Matomo instance
+	root /var/www/html; # replace with path to your matomo instance
+	index index.php;
+	try_files $uri $uri/ =404;
+
+	## only allow accessing the following php files
+	location ~ ^/(index|matomo|piwik|js/index|plugins/HeatmapSessionRecording/configs).php {
+		# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+
+		# Check that the PHP script exists before passing it
+		try_files $fastcgi_script_name =404;
+
+		include fastcgi_params;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		fastcgi_param PATH_INFO $fastcgi_path_info;
+		fastcgi_param HTTP_PROXY ""; # prohibit httpoxy: https://httpoxy.org/
+		fastcgi_pass php-handler;
+	}
+
+	## deny access to all other .php files
+	location ~* ^.+\.php$ {
+		deny all;
+		return 403;
+	}
+
+	## disable all access to the following directories
+	location ~ /(config|tmp|core|lang) {
+		deny all;
+		return 403; # replace with 404 to not show these directories exist
+	}
+	location ~ /\.ht {
+		deny all;
+		return 403;
+	}
+
+	location ~ js/container_.*_preview\.js$ {
+		expires off;
+		add_header Cache-Control 'private, no-cache, no-store';
+	}
+
+	location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2|json)$ {
+		allow all;
+		## Cache images,CSS,JS and webfonts for an hour
+		## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
+		expires 1h;
+		add_header Pragma public;
+		add_header Cache-Control "public";
+	}
+
+	location ~ /(libs|vendor|plugins|misc/user) {
+		deny all;
+		return 403;
+	}
+
+	## properly display textfiles in root directory
+	location ~/(.*\.md|LEGALNOTICE|LICENSE) {
+		default_type text/plain;
+	}
 }
+
+# vim: filetype=nginx

scripts/install

+#!/bin/bash -eux
+
+#Versions
+
+source /etc/environment
+
+MATOMO_VERSION=4.8-fpm
+#Mariadb
+MYSQL_VERSION=10.5
+
+#Passwords 
+
+MYSQL_ROOT_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs`
+MYSQL_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs`
+MATOMO_DATABASE_PASSWORD=$MYSQL_PASSWORD
+
+#app
+MATOMO_DATABASE_HOST=db
+
+var=$(for folder in `ls /data/domains`; do cat /data/domains/$folder/.env | grep SUBNET | cut -d"=" -f2; done | sort | tail -n1)
+SUBNET=$(($var +1))
+
+# vars
+
+echo "SUBNET=${SUBNET}" >> .env
+
+echo "URL=${URL}" >> .env
+#echo "VIRTUAL_HOST=${URL}" >> .env
+
+echo "MAIL_DOMAIN=${MAIL_DOMAIN}" >> .env
+echo "SMTP_HOST=${MAIL_HOST}" >> .env
+echo "SMTP_PORT=${MAIL_PORT}" >> .env
+echo "SMTP_PASSWORD=${MAIL_PASS}" >> .env
+echo "MAIL_FROM_ADDRESS=${MAIL_USER}" >> .env
+echo "SMTP_NAME=${MAIL_USER}" >> .env
+
+#APP specific 
+
+MATOMO_DATABASE_ADAPTER=mysql
+
+MATOMO_DATABASE_TABLES_PREFIX=matomo_
+
+MATOMO_DATABASE_USERNAME=matomo
+
+MATOMO_DATABASE_DBNAME=matomo
+
+
+#Db specific 
+
+MYSQL_DATABASE=matomo
+
+MYSQL_USER=matomo
+
+
+#APP specific 
+
+echo "MATOMO_VERSION=${MATOMO_VERSION}" >> .env
+
+echo "MATOMO_DATABASE_ADAPTER=${MATOMO_DATABASE_ADAPTER}" >> .env
+
+echo "MATOMO_DATABASE_TABLES_PREFIX=${MATOMO_DATABASE_TABLES_PREFIX}" >> .env
+
+echo "MATOMO_DATABASE_USERNAME=${MATOMO_DATABASE_USERNAME}" >> .env
+
+echo "MATOMO_DATABASE_HOST=${MATOMO_DATABASE_HOST}" >> .env
+
+echo "MATOMO_DATABASE_DBNAME=${MATOMO_DATABASE_DBNAME}" >> .env
+
+echo "MATOMO_DATABASE_PASSWORD=${MATOMO_DATABASE_PASSWORD}" >> .env
+
+
+#DB specific
+
+echo "MYSQL_DATABASE=${MYSQL_DATABASE}" >> .env
+
+echo "MYSQL_USER=${MYSQL_USER}" >> .env
+
+echo "MYSQL_PASSWORD=${MYSQL_PASSWORD}" >> .env
+
+echo "MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}" >> .env
+
+echo "MYSQL_VERSION=${MYSQL_VERSION}" >> .env