Feature/docker beta

.env

@@ -13,7 +13,7 @@ MANTICORE_PORT=9312
 APP_ENV=dev
 # Set secret in .env.local
 APP_SECRET=7dfa1f3adbe7f25c8c085ee1f74f816a
-#TRUSTED_PROXIES=127.0.0.1,127.0.0.2
+TRUSTED_PROXIES=REMOTE_ADDR
 #TRUSTED_HOSTS=localhost,example.com
 ###< symfony/framework-bundle ###
 

.github/workflows/build-image-beta.yml

@@ -0,0 +1,266 @@
+name: Build and publish beta image
+
+# Builds the production images for the feature/docker-beta branch (PHP-FPM + Nginx
+# architecture, master-based) and pushes them to GHCR. Dispatches to sysadmins-infra
+# on success so the beta stack can be manually redeployed.
+#
+# Does NOT auto-deploy — the deploy-bewelcome-beta.yml workflow on sysadmins-infra
+# is triggered manually or via the repository_dispatch.
+#
+# Two images are published:
+#   ghcr.io/bewelcome/rox:docker-beta     — PHP-FPM (bewelcome_php target)
+#   ghcr.io/bewelcome/rox:docker-beta-web — Nginx   (bewelcome_nginx target)
+
+on:
+  push:
+    branches: [feature/docker-beta]
+    paths:
+      - 'Dockerfile'
+      - '.dockerignore'
+      - 'docker/**'
+      - 'composer.json'
+      - 'composer.lock'
+      - 'symfony.lock'
+      - 'package.json'
+      - 'yarn.lock'
+      - 'webpack.config.js'
+      - 'src/**'
+      - 'assets/**'
+      - 'config/**'
+      - 'templates/**'
+      - 'public/**'
+      - 'bin/**'
+      - '.trivyignore'
+      - '.github/workflows/build-image-beta.yml'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  packages: write
+  actions: read
+
+env:
+  IMAGE: ghcr.io/bewelcome/rox
+
+concurrency:
+  group: build-image-beta-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build ${{ matrix.prefix }} ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {arch: amd64, platform: linux/amd64,  runner: ubuntu-latest,      target: bewelcome_php,   prefix: php}
+          - {arch: arm64, platform: linux/arm64,  runner: ubuntu-24.04-arm,   target: bewelcome_php,   prefix: php}
+          - {arch: amd64, platform: linux/amd64,  runner: ubuntu-latest,      target: bewelcome_nginx, prefix: nginx}
+          - {arch: arm64, platform: linux/arm64,  runner: ubuntu-24.04-arm,   target: bewelcome_nginx, prefix: nginx}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # tag=v4.2.2
+
+      - name: Compute version metadata
+        id: version
+        run: |
+          echo "revision=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          echo "timestamp=$(git log -n 1 --format=%ct)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # tag=v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # tag=v6.2.0
+        with:
+          images: ${{ env.IMAGE }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # tag=v4.3.0
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # tag=v7.3.0
+        with:
+          context: .
+          target: ${{ matrix.target }}
+          platforms: ${{ matrix.platform }}
+          build-args: |
+            APP_VERSION=${{ steps.version.outputs.revision }}
+            APP_VERSION_TIMESTAMP=${{ steps.version.outputs.timestamp }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=beta-${{ matrix.prefix }}-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=beta-${{ matrix.prefix }}-${{ matrix.arch }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # tag=v4.6.2
+        with:
+          name: digests-${{ matrix.prefix }}-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-php:
+    name: Push PHP manifest
+    runs-on: ubuntu-latest
+    needs: [build]
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
+      digest: ${{ steps.manifest.outputs.digest }}
+    steps:
+      - name: Download PHP digests
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # tag=v4.1.8
+        with:
+          path: /tmp/digests
+          pattern: digests-php-*
+          merge-multiple: true
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # tag=v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # tag=v4.3.0
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # tag=v6.2.0
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=sha,prefix=sha-
+            type=raw,value=docker-beta
+
+      - name: Create and push multi-arch manifest
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+
+      - name: Compute short sha
+        id: vars
+        run: echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: Capture manifest digest
+        id: manifest
+        run: |
+          digest=$(docker buildx imagetools inspect "${{ env.IMAGE }}:sha-${{ steps.vars.outputs.short_sha }}" --format '{{json .Manifest.Digest}}' | tr -d '"')
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+
+  merge-nginx:
+    name: Push Nginx manifest
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - name: Download Nginx digests
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # tag=v4.1.8
+        with:
+          path: /tmp/digests
+          pattern: digests-nginx-*
+          merge-multiple: true
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # tag=v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # tag=v4.3.0
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # tag=v6.2.0
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=sha,prefix=sha-,suffix=-web
+            type=raw,value=docker-beta-web
+
+      - name: Create and push multi-arch manifest
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+
+  scan:
+    name: Scan image
+    runs-on: ubuntu-latest
+    needs: [merge-php]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # tag=v4.1.7
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # tag=v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # tag=v0.36.0
+        env:
+          TRIVY_DISABLE_VEX_NOTICE: '1'
+        with:
+          image-ref: ${{ env.IMAGE }}:sha-${{ needs.merge-php.outputs.short_sha }}
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+          exit-code: '1'
+          ignore-unfixed: true
+          trivyignores: .trivyignore
+          version: v0.74.0
+
+  notify:
+    name: Notify sysadmins-infra
+    runs-on: ubuntu-latest
+    needs: [merge-php, merge-nginx, scan]
+    if: >
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/feature/docker-beta' &&
+      needs.merge-php.result == 'success' &&
+      needs.merge-nginx.result == 'success' &&
+      needs.scan.result == 'success'
+    steps:
+      - name: Mint cross-repo token
+        id: app-token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69  # tag=v1.11.0
+        with:
+          app-id: ${{ secrets.DEPLOY_APP_ID }}
+          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+          owner: BeWelcome
+          repositories: sysadmins-infra
+
+      - name: Notify sysadmins-infra of new beta image
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0  # tag=v3.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          repository: BeWelcome/sysadmins-infra
+          event-type: rox-beta-image-pushed
+          client-payload: |
+            {
+              "image": "${{ env.IMAGE }}:sha-${{ needs.merge-php.outputs.short_sha }}@${{ needs.merge-php.outputs.digest }}",
+              "web_image": "${{ env.IMAGE }}:sha-${{ needs.merge-php.outputs.short_sha }}-web",
+              "tag": "sha-${{ needs.merge-php.outputs.short_sha }}",
+              "sha": "${{ github.sha }}",
+              "ref": "${{ github.ref }}"
+            }

.trivyignore

@@ -0,0 +1,4 @@
+# CVE-2026-58055: nghttp2-libs 1.69.0-r0, fix is 1.70.0-r0, not yet backported to Alpine 3.24.
+# Track: https://pkgs.alpinelinux.org/packages?name=nghttp2&branch=v3.24
+# Remove once Alpine 3.24 ships nghttp2-libs >= 1.70.0-r0.
+CVE-2026-58055

Dockerfile

@@ -4,14 +4,17 @@
 
 
 # https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
-ARG PHP_VERSION=8.2.33
+ARG PHP_VERSION=8.3.33
 ARG NGINX_VERSION=1.30.4
 
 
 # "php" stage
-FROM php:${PHP_VERSION}-fpm-alpine3.23 AS bewelcome_php
+FROM php:${PHP_VERSION}-fpm-alpine3.24 AS bewelcome_php
 
 # persistent / runtime deps
+# Upgrade all base packages to pick up security patches (CVE fixes in OS packages)
+RUN apk update && apk upgrade --no-cache
+
 RUN apk add --no-cache \
 		acl \
 		freetype \
@@ -79,6 +82,7 @@ RUN export PATH="/usr/local/bin:$PATH"
 
 RUN ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
 COPY docker/php/conf.d/bewelcome.prod.ini $PHP_INI_DIR/conf.d/bewelcome.ini
+COPY docker/php/fpm/z-workers.conf /usr/local/etc/php-fpm.d/z-workers.conf
 
 RUN set -eux; \
 	{ \
@@ -99,6 +103,8 @@ WORKDIR /srv/bewelcome
 
 # build for production
 ARG APP_ENV=prod
+ARG APP_VERSION=unknown
+ARG APP_VERSION_TIMESTAMP=
 
 # copy only specifically what we need for production
 COPY assets assets/
@@ -112,7 +118,6 @@ COPY pthacks pthacks/
 COPY public public/
 COPY roxlauncher roxlauncher/
 COPY src src/
-COPY Migrations Migrations/
 COPY templates templates/
 COPY tools tools/
 COPY translations translations/
@@ -129,7 +134,9 @@ RUN set -eux; \
 COPY package.json yarn.lock webpack.config.js postcss.config.js tailwind.config.js tsconfig.json ./
 RUN set -eux; \
 	yarn install --frozen-lock; \
-	yarn encore production --mode=production
+	yarn encore production --mode=production; \
+	rm -rf node_modules; \
+	yarn cache clean --force
 
 # do not use .env files in production
 COPY .env ./
@@ -140,6 +147,10 @@ RUN set -eux; \
 	mkdir -p var/cache var/log; \
 	composer dump-autoload --classmap-authoritative --no-dev; \
 	chmod +x bin/console; sync
+
+RUN set -eux; \
+	printf '%s\n' "$APP_VERSION" > VERSION; \
+	if [ -n "$APP_VERSION_TIMESTAMP" ]; then php -r 'touch("VERSION", (int) $argv[1]);' "$APP_VERSION_TIMESTAMP"; fi
 VOLUME /srv/bewelcome/var
 VOLUME /srv/bewelcome/data
 

behat.yml.dist

@@ -27,3 +27,4 @@ localhost:
     extensions:
         'Alex\MailCatcher\Behat\MailCatcherExtension\Extension':
             url: http://localhost:1080
+

composer.json

@@ -21,7 +21,6 @@
         "ext-zip": "*",
         "amphp/http-client": "^4.6",
         "anthonymartin/geo-location": "^2.0",
-        "api-platform/core": "2.*",
         "babdev/pagerfanta-bundle": "3.*",
         "beberlei/doctrineextensions": "^1.3",
         "doctrine/doctrine-bundle": "^2.0",
@@ -86,6 +85,7 @@
         "twig/intl-extra": "^3.0",
         "twig/markdown-extra": "^3.0",
         "twig/twig": "^3.0",
+        "willdurand/negotiation": "^3.1",
         "xemlock/htmlpurifier-html5": "^0.1.10"
     },
     "conflict": {
@@ -154,7 +154,7 @@
     "config": {
         "sort-packages": true,
         "platform": {
-            "php": "8.2"
+            "php": "8.3"
         },
         "allow-plugins": {
             "infection/extension-installer": true,