Arch Linux container image with Apache and PHP. It is the common runtime for the PHP sites hosted at brunner.ninja, including WordPress and phpPgAdmin.

The image enables PostgreSQL and PDO PostgreSQL, GD for image thumbnails and responsive sizes, EXIF for photo metadata, Intl for locale-aware operations, and a production-sized PHP OPcache. Timestamp checks remain enabled so edits made through the browser-based development container and WordPress updates on the shared CephFS volume become visible without restarting Apache.

Apache exposes extended mod_status data only on pod-local loopback port 8080. The Helm chart can add an Apache exporter sidecar, a ServiceMonitor, and portable alert rules without exposing the detailed status page to the cluster.

Continuous integration

The Gitea Actions workflow builds and tests the image on every push. It also rebuilds the rolling Arch Linux base every Monday. Push builds publish the image to registry.brunner.ninja/feedc0de/php-apache with the Git commit SHA. Builds of main additionally publish latest and an <apache-version>-<php-version> tag. Scheduled and manually dispatched builds do not overwrite commit tags; they refresh only the mutable main tags.

The workflow requires these repository secrets:

QUAY_USERNAME: Quay robot-account username with write access to the image.
QUAY_TOKEN: token for that robot account.
PACKAGE_USERNAME: Gitea user that publishes packages for feedc0de.
PACKAGE_TOKEN: Gitea token with package write access.

No downstream repository is triggered. PostgreSQL support is part of this image, and derivative images such as phpPgAdmin rebuild on their own schedule.

PHP homepage Helm chart

helm/php-homepage deploys this image with a CephFS-backed web root. Existing sites should set persistence.existingClaim; in that mode the chart references the PVC but deliberately does not render or own it. This keeps site content independent of the Helm release and safe from helm uninstall.

The chart can create a new RWX PVC when existingClaim is empty. Such PVCs carry Helm's keep resource policy by default as an additional safeguard for website content.

Each successful main or scheduled image build also publishes a new chart to the feedc0de Gitea Helm registry. Its appVersion is the unique image tag built by that same workflow run. Site values do not override the image, so updating the Helm repository and upgrading a release selects the image from the new chart:

helm repo add brunner https://brunner.ninja/charts
helm repo update brunner
helm upgrade --install example-site brunner/php-homepage -f values.yaml