Uh oh!
There was an error while loading. Please reload this page.
feat(docker): production PHP-FPM/Nginx infra stack — no code changes - #478
Draft
Neophytis wants to merge 7 commits into
Draft
feat(docker): production PHP-FPM/Nginx infra stack — no code changes#478Neophytis wants to merge 7 commits into
Neophytis wants to merge 7 commits into
Conversation
…e preload, config split; fix mailer Reply-To - Production PHP-FPM/Nginx Docker image with Manticore 6.3.8 and geonames column fix - Enable OPcache preload for Symfony prod container - Split prod-only framework settings into config/packages/prod/framework.yaml - Remove freemail Reply-To header to prevent rspamd SPOOF_REPLYTO false positives
The Twig Extension reads ../VERSION (relative to PHP CWD /srv/bewelcome) to populate the footer revision link. The build workflow already passes APP_VERSION and APP_VERSION_TIMESTAMP as build args but the Dockerfile never declared or used them, so the footer always showed an empty revision. Write the short SHA to /srv/VERSION and touch its mtime to the commit timestamp so the footer displays both the commit link and the build date.
Traefik terminates TLS and forwards requests to nginx as HTTP. Without these two changes Symfony sees http:// as the scheme and generates http:// base URLs for all absolute URLs (redirects, forms, assets). - nginx: add fastcgi_param HTTP_X_FORWARDED_PROTO so the header Traefik sets reaches PHP-FPM (the default fastcgi_params file does not include it) - .env: change TRUSTED_PROXIES from 127.0.0.1 to REMOTE_ADDR so Symfony trusts the immediate upstream (nginx container) and reads the forwarded scheme correctly
…ayload The merge-nginx job only tagged the Nginx manifest as docker-beta-web (no SHA-based tag), making it impossible to deploy PHP and Nginx as a deterministically-paired build. Add sha-xxx-web tag so both images share the same commit identifier. Also add web_image to the rox-beta-image-pushed repository_dispatch payload so the sysadmins-infra deploy workflow can pull the matching Nginx image.
The default alpine PHP-FPM image ships with pm.max_children=5, which is completely inadequate for a 500K+ member site. With ~104 MB RSS per worker on a 16 GB host, 25 workers costs ~2.6 GB — well within budget. New pool config (z-workers.conf): pm = dynamic pm.max_children = 25 pm.start_servers = 5 pm.min_spare_servers = 3 pm.max_spare_servers = 10 pm.max_requests = 500
Webpack build files carry content-hash suffixes — safe to cache for 1 year with Cache-Control: immutable. Without compression, CSS files were 300+ KB raw; gzip cuts that to ~60 KB. Missing cache headers forced every page reload to re-download all assets.
Neophytis
marked this pull request as draft
August 15, 2026 16:56
| mysql $database_name -u $database_user -p$database_password -h $database_host < docker/db/geonamesadminunits.sql | ||
| fi | ||
| elif ls -A Migrations/*.php > /dev/null 2>&1; then | ||
| elif ls -A migrations/*.php > /dev/null 2>&1; then |
Contributor
There was a problem hiding this comment.
The migrations here are not doctrine migrations.
| ; | ||
| ARG APCU_VERSION=5.1.28 | ||
| ARG APCU_VERSION=5.1.18 |
Contributor
There was a problem hiding this comment.
Why the downgrade? This leads to loads of deprecation messages.
| COPY roxlauncher roxlauncher/ | ||
| COPY src src/ | ||
| COPY Migrations Migrations/ | ||
| COPY migrations migrations/ |
Contributor
There was a problem hiding this comment.
Never used, can be removed.
| - 'templates/**' | ||
| - 'public/**' | ||
| - 'bin/**' | ||
| - 'migrations/**' |
Contributor
There was a problem hiding this comment.
Not needed (old migrations all already applied on production DB).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Infrastructure-only branch derived from
feature/docker-beta. Contains exactly the Docker/CI/Nginx changes needed to build and deploy rox with PHP-FPM + Nginx, with no rox code changes and no DB schema changes.Goal: let the rox team work with code as close to master as possible while having a deployable Docker stack for the beta migration. All code fixes and DB-related changes (api-platform removal, geonames column, friends ETL, migration fixes) are intentionally excluded — those live in
feature/docker-betaand are Shevek's call.What's included (6 commits)
58fdc4abewelcome_php(PHP-FPM) +bewelcome_nginx(Nginx) Dockerfile targets; Manticore 6.3.8; OPcache preload; config split; composer PHP 8.2→8.3f856534/srv/VERSIONfromAPP_VERSIONbuild arg58ceac4X-Forwarded-Protoso Symfony generateshttps://URLs behind Traefikef118ed3d6e26e4d0622fWhat's excluded (vs feature/docker-beta)
api-platform/coreremovalentrypoints.jsonpath fix (__DIR__)GeonamesUpdateFullCommand.phpchangesVolunteerToolController.phpchangesStatisticsModel.phpchangesMailer.php/MailerTest.phpchangesconfig/packages/prod/framework.yamlDeployment
This branch is what
beta.stage.bewelcome.orgwas running (plus the code fixes fromfeature/docker-beta). The CI workflow (build-image-beta.yml) builds bothbewelcome_phpandbewelcome_nginxtargets and pushes them to GHCR.For the beta avatar path issue (
AVATAR_PATHrelative path breaks under FPM), seesysadmins-infrabranchneophytis/fix-beta-avatar-path(infra workaround) or fixAvatarController::AVATAR_PATHto use an absolute path (code fix).