Feature/docker beta - #477
Draft
Neophytis wants to merge 15 commits into
Draft
Conversation
…e preload, config split; fix mailer Reply-To - Production PHP-FPM/Nginx Docker image with Manticore 6.3.8 and geonames column fix - Enable OPcache preload for Symfony prod container - Split prod-only framework settings into config/packages/prod/framework.yaml - Remove freemail Reply-To header to prevent rspamd SPOOF_REPLYTO false positives
The Twig Extension reads ../VERSION (relative to PHP CWD /srv/bewelcome) to populate the footer revision link. The build workflow already passes APP_VERSION and APP_VERSION_TIMESTAMP as build args but the Dockerfile never declared or used them, so the footer always showed an empty revision. Write the short SHA to /srv/VERSION and touch its mtime to the commit timestamp so the footer displays both the commit link and the build date.
The relative path 'build/entrypoints.json' resolves to /srv/bewelcome/build/entrypoints.json (the PHP templates dir), not /srv/bewelcome/public/build/entrypoints.json (webpack output). When EntrypointLookup can't find the file it silently returns empty, so getCssFiles/getJavaScriptFiles emit no tags — causing old-MVC pages (profile, forum, etc.) to render completely without CSS or JS.
CVE-2026-54164 is fixed in api-platform/core v4.1.30, v4.2.26, v4.3.12. Upgrading from v2 is a breaking change requiring a full code migration. Ignored alongside the existing v2.x CVEs (CVE-2025-31481, -31485, -26-49858).
Traefik terminates TLS and forwards requests to nginx as HTTP. Without these two changes Symfony sees http:// as the scheme and generates http:// base URLs for all absolute URLs (redirects, forms, assets). - nginx: add fastcgi_param HTTP_X_FORWARDED_PROTO so the header Traefik sets reaches PHP-FPM (the default fastcgi_params file does not include it) - .env: change TRUSTED_PROXIES from 127.0.0.1 to REMOTE_ADDR so Symfony trusts the immediate upstream (nginx container) and reads the forwarded scheme correctly
api-platform is not used — no API endpoints are exposed. Keeping it meant adding a new .trivyignore entry for every new CVE in the v2.x branch (4 entries accumulated; v2 receives no security backports). Removes: - api-platform/core from composer.json + composer.lock - config/packages/api_platform.yaml - src/ApiPlatform/ (JWTAuthorizationDecorator, MemberExtension) - src/Serializer/MemberContextBuilder (implements api-platform interface) - services.yaml decorator entries for both classes - all 4 api-platform CVE ignores from .trivyignore
…ayload The merge-nginx job only tagged the Nginx manifest as docker-beta-web (no SHA-based tag), making it impossible to deploy PHP and Nginx as a deterministically-paired build. Add sha-xxx-web tag so both images share the same commit identifier. Also add web_image to the rox-beta-image-pushed repository_dispatch payload so the sysadmins-infra deploy workflow can pull the matching Nginx image.
The previous removal of api-platform/core (composer.json + core classes) missed three files that still referenced the bundle: - config/bundles.php: ApiPlatformBundle registration (crashes kernel on boot) - config/routes/api_platform.yaml: route type api_platform (no-op without bundle) - src/Entity/Member.php: @ApiResource, @ApiProperty, @APIFilter annotations These leftovers cause a PHP fatal on every container start, making the beta deploy fail immediately with exit 255.
AddressNormalizer and MemberNormalizer were introduced in da0714c (Install API Platform) and depend on ContextAwareNormalizerInterface / NormalizerAwareTrait from symfony/serializer. After api-platform/core was removed in 3dd46fc, these files were accidentally left in src/. The DI container scans all of src/Serializer/ as services and tries to load the trait/interface via the classmap-authoritative autoloader; since symfony/serializer has no hard requirer after the api-platform removal its classes are absent from the classmap, causing a fatal ReflectionException on every container compile. Also removes the dead `use SerializerInterface` import from SearchController (the controller only calls PHP's native serialize()/unserialize(), not Symfony's Serializer component).
symfony/serializer has no hard requirer after api-platform/core was removed. With classmap-authoritative autoloading the serializer's annotation class can't be found at runtime, causing Doctrine's annotation reader to throw a AnnotationException on every container compile: [Semantical Error] The annotation "@symfony\Component\Serializer\Annotation \Groups" in property App\Entity\Member::$username was never imported. The Symfony Serializer component is disabled in config/packages/framework.yaml (serializer: line is commented out), so these @groups annotations have been dead code since api-platform was removed. Remove the annotations and use statements from all affected entities.
The default alpine PHP-FPM image ships with pm.max_children=5, which is completely inadequate for a 500K+ member site. With ~104 MB RSS per worker on a 16 GB host, 25 workers costs ~2.6 GB — well within budget. New pool config (z-workers.conf): pm = dynamic pm.max_children = 25 pm.start_servers = 5 pm.min_spare_servers = 3 pm.max_spare_servers = 10 pm.max_requests = 500
…ation dep - ManticoreIndicesGeonamesCommand: g.geonameid → g.geoname_id (column was renamed in preflight Fix 2; the old name caused Unknown column errors) - ManticoreIndicesForumCommand: replace forum_trads JOIN with fp.message directly — forum_trads was removed from bewelcome_fixed; post content now lives in forums_posts.message - composer.json: declare willdurand/negotiation ^3.1 as a direct dep so composer dump-autoload includes it in autoload_psr4.php (was a transitive dep that Symfony Flex excluded from the classmap)
Webpack build files carry content-hash suffixes — safe to cache for 1 year with Cache-Control: immutable. Without compression, CSS files were 300+ KB raw; gzip cuts that to ~60 KB. Missing cache headers forced every page reload to re-download all assets.
…ptyAvatar check emptyAvatar() looks for empty_avatar_<N>_<N>.png but createEmptyAvatarImage() was saving without the extension, causing an infinite NotWritableException retry loop on every request for members without an avatar.
…match emptyAvatar check" This reverts commit 77fb266.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is WIP please ignore and do not merge to master