58 lines
2.6 KiB
Markdown
58 lines
2.6 KiB
Markdown
# php-apache
|
|
|
|
Arch Linux container image with Apache and PHP. It is the common runtime for
|
|
the PHP sites hosted at brunner.ninja, including WordPress and phpPgAdmin.
|
|
|
|
The image enables PostgreSQL and PDO PostgreSQL, GD and Imagick for image
|
|
processing and responsive sizes, EXIF for photo metadata, Iconv and Intl for
|
|
text and locale handling, and a production-sized PHP OPcache. Timestamp checks
|
|
remain enabled so edits made through the browser-based development container
|
|
and WordPress updates on the shared CephFS volume become visible without
|
|
restarting Apache.
|
|
|
|
Apache exposes extended `mod_status` data only on pod-local loopback port 8080.
|
|
The Helm chart can add an Apache exporter sidecar, a `ServiceMonitor`, and
|
|
portable alert rules without exposing the detailed status page to the cluster.
|
|
|
|
## Continuous integration
|
|
|
|
The Gitea Actions workflow builds and tests the image on every push. It also
|
|
rebuilds the rolling Arch Linux base every Monday. Push builds publish the
|
|
image to `registry.brunner.ninja/feedc0de/php-apache` with the Git commit SHA.
|
|
Builds of `main` additionally publish `latest` and an
|
|
`<apache-version>-<php-version>` tag. Scheduled and manually dispatched builds
|
|
do not overwrite commit tags; they refresh only the mutable main tags.
|
|
|
|
The workflow requires these repository secrets:
|
|
|
|
- `QUAY_USERNAME`: Quay robot-account username with write access to the image.
|
|
- `QUAY_TOKEN`: token for that robot account.
|
|
- `PACKAGE_USERNAME`: Gitea user that publishes packages for `feedc0de`.
|
|
- `PACKAGE_TOKEN`: Gitea token with package write access.
|
|
|
|
No downstream repository is triggered. PostgreSQL support is part of this
|
|
image, and derivative images such as phpPgAdmin rebuild on their own schedule.
|
|
|
|
## PHP homepage Helm chart
|
|
|
|
`helm/php-homepage` deploys this image with a CephFS-backed web root. Existing
|
|
sites should set `persistence.existingClaim`; in that mode the chart references
|
|
the PVC but deliberately does not render or own it. This keeps site content
|
|
independent of the Helm release and safe from `helm uninstall`.
|
|
|
|
The chart can create a new RWX PVC when `existingClaim` is empty. Such PVCs
|
|
carry Helm's `keep` resource policy by default as an additional safeguard for
|
|
website content.
|
|
|
|
Each successful `main` or scheduled image build also publishes a new chart to
|
|
the `feedc0de` Gitea Helm registry. Its `appVersion` is the unique image tag
|
|
built by that same workflow run. Site values do not override the image, so
|
|
updating the Helm repository and upgrading a release selects the image from the
|
|
new chart:
|
|
|
|
```sh
|
|
helm repo add brunner https://brunner.ninja/charts
|
|
helm repo update brunner
|
|
helm upgrade --install example-site brunner/php-homepage -f values.yaml
|
|
```
|