70 lines
3.4 KiB
Markdown
70 lines
3.4 KiB
Markdown
# php-apache
|
|
|
|
Arch Linux container image with Apache and PHP. It is the common runtime for
|
|
the PHP sites hosted at brunner.ninja, including WordPress and phpPgAdmin.
|
|
|
|
The image enables PostgreSQL and PDO PostgreSQL, GD and Imagick for image
|
|
processing and responsive sizes, EXIF for photo metadata, Iconv and Intl for
|
|
text and locale handling, and a production-sized PHP OPcache. Timestamp checks
|
|
remain enabled so edits made through the browser-based development container
|
|
and WordPress updates on the shared CephFS volume become visible without
|
|
restarting Apache.
|
|
|
|
Apache exposes extended `mod_status` data only on pod-local loopback port 8080.
|
|
The Helm chart can add an Apache exporter sidecar, a `ServiceMonitor`, and
|
|
portable alert rules without exposing the detailed status page to the cluster.
|
|
|
|
PHP session-backed upload progress is temporarily disabled in the image while
|
|
the announced October 2026 PHP security release is pending. This does not
|
|
disable ordinary uploads and is not a substitute for rebuilding with a fixed
|
|
PHP package once Arch publishes it. Verify the installed PHP package in the
|
|
built image before calling a release patched.
|
|
|
|
## Continuous integration
|
|
|
|
The Gitea Actions workflow builds and tests the image on every push. It also
|
|
rebuilds the rolling Arch Linux base every Monday. Push builds publish the
|
|
image to `registry.brunner.ninja/feedc0de/php-apache` with the Git commit SHA.
|
|
Builds of `main` additionally publish `latest` and an
|
|
`<apache-version>-<php-version>` tag. Scheduled and manually dispatched builds
|
|
do not overwrite commit tags; they refresh only the mutable main tags.
|
|
|
|
The workflow requires these repository secrets:
|
|
|
|
- `QUAY_USERNAME`: Quay robot-account username with write access to the image.
|
|
- `QUAY_TOKEN`: token for that robot account.
|
|
- `PACKAGE_USERNAME`: Gitea user that publishes packages for `feedc0de`.
|
|
- `PACKAGE_TOKEN`: Gitea token with package write access.
|
|
|
|
No downstream repository is triggered. PostgreSQL support is part of this
|
|
image, and derivative images such as phpPgAdmin rebuild on their own schedule.
|
|
|
|
## PHP homepage Helm chart
|
|
|
|
`helm/php-homepage` deploys this image with a CephFS-backed web root. Existing
|
|
sites should set `persistence.existingClaim`; in that mode the chart references
|
|
the PVC but deliberately does not render or own it. This keeps site content
|
|
independent of the Helm release and safe from `helm uninstall`.
|
|
|
|
The chart can create a new RWX PVC when `existingClaim` is empty. Such PVCs
|
|
carry Helm's `keep` resource policy by default as an additional safeguard for
|
|
website content.
|
|
|
|
Each successful `main` push also publishes a new chart to the `feedc0de`
|
|
Gitea Helm registry. Scheduled builds refresh the image tags without
|
|
publishing a chart. The chart's `appVersion` is the unique image tag built by
|
|
the same push. Site values do not override the image, so updating the Helm
|
|
repository and upgrading a release selects the image from the new chart:
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
helm upgrade --install example-site brunner.ninja/php-homepage -f values.yaml
|
|
```
|
|
|
|
The chart repository tag follows the bundled Apache and PHP versions. The
|
|
current image contains Apache 2.4.69 and PHP 8.5.11, so `v2.4.69-8.5.11`
|
|
publishes chart `2.4.69-8.5.11`; later chart commits append the Git describe
|
|
count and hash. CI checks the built image's versions against the base Git tag
|
|
before publishing a chart.
|