php-apache/README.md

# php-apache

Arch Linux container image with Apache and PHP. It is the common runtime for
the PHP sites hosted at brunner.ninja, including WordPress and phpPgAdmin.

The image enables PostgreSQL and PDO PostgreSQL, GD and Imagick for image
processing and responsive sizes, EXIF for photo metadata, Iconv and Intl for
text and locale handling, and a production-sized PHP OPcache. Timestamp checks
remain enabled so edits made through the browser-based development container
and WordPress updates on the shared CephFS volume become visible without
restarting Apache.

Apache exposes extended `mod_status` data only on pod-local loopback port 8080.
The Helm chart can add an Apache exporter sidecar, a `ServiceMonitor`, and
portable alert rules without exposing the detailed status page to the cluster.

PHP session-backed upload progress is temporarily disabled in the image while
the announced October 2026 PHP security release is pending. This does not
disable ordinary uploads and is not a substitute for rebuilding with a fixed
PHP package once Arch publishes it. Verify the installed PHP package in the
built image before calling a release patched.

## Continuous integration

The Gitea Actions workflow builds and tests the image on every push. It also
rebuilds the rolling Arch Linux base every Monday. Push builds publish the
image to `registry.brunner.ninja/feedc0de/php-apache` with the Git commit SHA.
Builds of `main` additionally publish `latest` and an
`<apache-version>-<php-version>` tag. Scheduled and manually dispatched builds
do not overwrite commit tags; they refresh only the mutable main tags.

The workflow requires these repository secrets:

- `QUAY_USERNAME`: Quay robot-account username with write access to the image.
- `QUAY_TOKEN`: token for that robot account.
- `PACKAGE_USERNAME`: Gitea user that publishes packages for `feedc0de`.
- `PACKAGE_TOKEN`: Gitea token with package write access.

No downstream repository is triggered. PostgreSQL support is part of this
image, and derivative images such as phpPgAdmin rebuild on their own schedule.

## PHP homepage Helm chart

`helm/php-homepage` deploys this image with a CephFS-backed web root. Existing
sites should set `persistence.existingClaim`; in that mode the chart references
the PVC but deliberately does not render or own it. This keeps site content
independent of the Helm release and safe from `helm uninstall`.

The chart can create a new RWX PVC when `existingClaim` is empty. Such PVCs
carry Helm's `keep` resource policy by default as an additional safeguard for
website content.

Each successful `main` push also publishes a new chart to the `feedc0de`
Gitea Helm registry. Scheduled builds refresh the image tags without
publishing a chart. The chart's `appVersion` is the unique image tag built by
the same push. Site values do not override the image, so updating the Helm
repository and upgrading a release selects the image from the new chart:

```sh
helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install example-site brunner.ninja/php-homepage -f values.yaml
```

The chart repository tag follows the bundled Apache and PHP versions. The
current image contains Apache 2.4.69 and PHP 8.5.11, so `v2.4.69-8.5.11`
publishes chart `2.4.69-8.5.11`; later chart commits append the Git describe
count and hash. CI checks the built image's versions against the base Git tag
before publishing a chart.