Dockerize app

.dockerignore

@@ -0,0 +1,45 @@
+# Git internals
+.git
+.gitignore
+.gitattributes
+
+# Documentation
+*.md
+LICENSE-AGPLv3.txt
+
+# Development and CI tooling
+spec/
+decidim-signature_collection/spec/
+.github/
+Procfile.dev
+docker-compose*.yml
+
+# Secrets — must NEVER be baked into the image
+config/application.yml
+config/master.key
+.env
+*.env
+
+# Pre-built JS assets — rebuilt fresh inside the Dockerfile
+/public/decidim-packs/
+/public/packs-test/
+/public/sw.js
+/public/sw.js.gz
+/public/sw.js.map
+
+# Bundler and gem cache from local development / CI
+.bundle/
+vendor/bundle/
+
+# Node modules (reinstalled inside the Dockerfile)
+node_modules/
+
+# Runtime data
+/log/*
+!/log/.keep
+/tmp/*
+!/tmp/.keep
+!/tmp/pids/
+!/tmp/pids/.keep
+/storage/*
+!/storage/.keep

.github/workflows/ci_app.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  RUBY_VERSION: 3.3.4
+  RUBY_VERSION: 3.3.11
   NODE_VERSION: 18.17.1
 
 jobs:

.github/workflows/ci_signature_collection.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  RUBY_VERSION: 3.3.4
+  RUBY_VERSION: 3.3.11
   NODE_VERSION: 18.17.1
 
 jobs:

.github/workflows/linters.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  RUBY_VERSION: 3.3.4
+  RUBY_VERSION: 3.3.11
   NODE_VERSION: 18.17.1
   SHAKAPACKER_RUNTIME_COMPILE: "false"
 

.github/workflows/validate_migrations.yml

@@ -12,7 +12,7 @@ env:
   DB_DATABASE: app
   DB_USERNAME: postgres
   DB_PASSWORD: postgres
-  RUBY_VERSION: 3.3.4
+  RUBY_VERSION: 3.3.11
 
 jobs:
   test:

.github/workflows/zeitwerk.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  RUBY_VERSION: 3.3.4
+  RUBY_VERSION: 3.3.11
   DB_DATABASE: app
   DB_USERNAME: postgres
   DB_PASSWORD: postgres

.gitignore

@@ -39,13 +39,15 @@
 .env
 .envrc
 .rbenv-vars
+docker/*.env
 
 # Ignore the files and folders generated through Webpack
 /public/decidim-packs
 /public/packs
 /public/packs-test
 /public/sw.js
 /public/sw.js.*
+/public/sw.js*
 
 # Ignore node modules
 /node_modules
@@ -64,4 +66,4 @@ decidim-signature_collection/spec/decidim_dummy_app/
 .byebug_history
 .DS_Store
 
-/config/application.yml
+/config/application.yml

.ruby-version

@@ -1 +1 @@
-3.3.4
+3.3.11

Dockerfile

@@ -1 +1,150 @@
-FROM decidim/decidim:0.30.1
+FROM ruby:3.3.11-trixie
+
+ENV HOME=/var/www
+ENV APP_HOME=$HOME/sge_plus
+
+# Force Madrid's timezone
+ENV TZ=Europe/Madrid
+RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+
+# Install system dependencies
+RUN apt -qq update && apt upgrade -y
+RUN apt -qq install -y \
+    build-essential \
+    graphviz \
+    imagemagick \
+    libicu-dev \
+    libpq-dev \
+    gettext-base \
+    tzdata \
+    vim \
+    locales \
+    p7zip \
+    ca-certificates \
+    curl \
+    cron \
+    python3 \
+    git \
+    icu-devtools \
+    zlib1g-dev \
+    # required by wkhtmltopdf
+    xfonts-base \
+    xfonts-75dpi \
+    fontconfig \
+    libjpeg62-turbo \
+    libxrender1 \
+    xfonts-encodings \
+    xfonts-utils \
+    libx11-6 \
+    libxext6 \
+    && apt install -y --no-install-recommends libjemalloc2
+
+ENV LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ENV MALLOC_CONF='dirty_decay_ms:1000,narenas:2,background_thread:true'
+
+# Install wkhtmltopdf
+RUN curl -L -o wkhtmltox.deb https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-2/wkhtmltox_0.12.6.1-2.bullseye_amd64.deb \
+    && dpkg -i wkhtmltox.deb || true \
+    && apt install -f -y \
+    && rm wkhtmltox.deb
+
+# Define volumes
+VOLUME $APP_HOME/storage
+VOLUME $APP_HOME/log
+
+##############################
+# Update Ruby ecosystem
+##############################
+RUN gem update --system 3.3.22 && update_rubygems
+RUN gem install bundler:2.6.8 \
+ && gem install stringio:3.1.7
+
+##############################
+# Install NodeJs & Yarn
+##############################
+ENV NODE_VERSION=18.17.1
+RUN apt update
+RUN apt -y install curl gnupg
+RUN curl -fsSL https://deb.nodesource.com/node_18.x/pool/main/n/nodejs/nodejs_18.17.1-1nodesource1_amd64.deb -o nodejs_18.17.1.deb \
+ && dpkg -i nodejs_${NODE_VERSION}.deb \
+ && rm nodejs_${NODE_VERSION}.deb
+RUN npm -v
+RUN npm install -g yarn
+
+##############################
+# Prepare working directory & other configurations
+##############################
+
+# Create app dir
+RUN mkdir -p $APP_HOME
+RUN mkdir -p $APP_HOME/tmp
+
+WORKDIR $APP_HOME
+RUN chown -R www-data:www-data $HOME
+RUN chown -R www-data:www-data $APP_HOME
+RUN chown -R www-data:www-data /var/www/.npm
+
+##############################
+# Copy app code into docker image
+##############################
+ADD . $APP_HOME
+RUN rm -Rf tmp/*
+RUN chown -R www-data:www-data $APP_HOME
+
+USER www-data
+ENV RAILS_ENV=production
+WORKDIR $APP_HOME
+
+##############################
+# Install Node dependencies
+##############################
+RUN rm -Rf node_modules/ && npm cache clean --force
+
+RUN npm install
+
+# ##############################
+# # Install Bundler dependencies
+# ##############################
+
+# ADD Gemfile Gemfile
+# ADD Gemfile.lock Gemfile.lock
+
+RUN cp config/application.example.yml config/application.yml
+RUN cp config/puma.example.rb config/puma.rb
+RUN bundle config --without development test \
+ && bundle config set deployment 'true' \
+ && bundle install --jobs=10
+
+# ##############################
+# # Build app
+# ##############################
+ENV DISABLE_SPRING=1
+RUN RAILS_ENV=production SECRET_KEY_BASE=WHATEVER DATABASE_URL=postgresql://localhost/dummy DOCKER=1 bundle exec rake shakapacker:clobber shakapacker:compile
+
+# make sure nothing gets leacked
+RUN rm config/application.yml && touch config/application.yml
+
+# Add a tmp folder for pids
+RUN mkdir -p tmp/pids
+
+##############################
+# Clean up APT and bundler when done.
+##############################
+USER root
+# clean caches
+RUN apt clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# remove compilation tools
+RUN apt -y remove build-essential libpq-dev libicu-dev curl python3 git icu-devtools zlib1g-dev
+
+USER www-data
+
+##############################
+# RUN image as www-data
+##############################
+#################RUN chown -R www-data:www-data $APP_HOME
+USER www-data
+WORKDIR $APP_HOME
+
+# Print the UID and GID (only one CMD is allowed in a Dockerfile, it executes when the container starts)
+CMD ["sh", "-c", "echo 'Inside Container:' && echo 'User: `$(whoami)` UID: `$(id -u)` GID: `$(id -g)`'"]

Gemfile.lock

@@ -847,7 +847,7 @@ DEPENDENCIES
   web-console (~> 4.2)
 
 RUBY VERSION
-   ruby 3.3.4p94
+   ruby 3.3.11p205
 
 BUNDLED WITH
    2.6.8

config/puma.example.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# Puma can serve each request in a thread from an internal thread pool.
+# The `threads` method setting takes two numbers: a minimum and maximum.
+# Any libraries that use thread pools should be configured to match
+# the maximum value specified for Puma. Default is set to 5 threads for minimum
+# and maximum; this matches the default thread size of Active Record.
+#
+threads_count = ENV.fetch("RAILS_MAX_THREADS", 5)
+threads threads_count, threads_count
+
+# Specifies the `port` that Puma will listen on to receive requests; default is 3000.
+#
+port ENV.fetch("PORT", 3000)
+
+# Specifies the `environment` that Puma will run in.
+#
+environment ENV.fetch("RAILS_ENV", "development")
+
+# Specifies the number of `workers` to boot in clustered mode.
+# Workers are forked webserver processes. If using threads and workers together
+# the concurrency of the application would be max `threads` * `workers`.
+# Workers do not work on JRuby or Windows (both of which do not support
+# processes).
+#
+workers ENV.fetch("WEB_CONCURRENCY", 2)
+
+# Use the `preload_app!` method when specifying a `workers` number.
+# This directive tells Puma to first boot the application and load code
+# before forking the application. This takes advantage of Copy On Write
+# process behavior so workers use less memory. If you use this option
+# you need to make sure to reconnect any threads in the `on_worker_boot`
+# block.
+preload_app!
+
+# If you are preloading your application and using Active Record, it's
+# recommended that you close any connections to the database before workers
+# are forked to prevent connection leakage.
+before_fork do
+  ActiveRecord::Base.connection_pool.disconnect! if defined?(ActiveRecord)
+end
+
+# The code in the `on_worker_boot` will be called if you are using
+# clustered mode by specifying a number of `workers`. After each worker
+# process is booted, this block will be run. If you are using the `preload_app!`
+# option, you will want to use this block to reconnect to any threads
+# or connections that may have been created at application boot, as Ruby
+# cannot share connections between processes.
+on_worker_boot do
+  ActiveRecord::Base.establish_connection if defined?(ActiveRecord)
+end
+
+# Allow puma to be restarted by `rails restart` command.
+plugin :tmp_restart

db/migrate/20260424100041_convert_private_exports_id_to_uuid.decidim.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+# This migration comes from decidim (originally 20250819110800)
+# This migration comes from decidim (originally 20250819110800)
+class ConvertPrivateExportsIdToUuid < ActiveRecord::Migration[7.0]
+  def up
+    create_table :decidim_private_exports_new, force: :cascade do |t|
+      t.uuid :uuid, null: false
+      t.string :export_type, null: false
+      t.string :attached_to_type
+      t.integer :attached_to_id
+      t.string :file
+      t.string :content_type, null: false
+      t.string :file_size, null: false
+      t.datetime :expires_at
+      t.jsonb :metadata, default: {}
+      t.timestamps
+
+      t.index [:uuid], name: "index_decidim_private_exports_on_uuid", unique: true
+    end
+    # Copy data from old table to new table
+    execute <<-SQL.squish
+      INSERT INTO decidim_private_exports_new (uuid, export_type, attached_to_type, attached_to_id, file, content_type, file_size, expires_at, metadata, created_at, updated_at)
+      SELECT id, export_type, attached_to_type, attached_to_id, file, content_type, file_size, NOW(), metadata, created_at, updated_at
+      FROM decidim_private_exports
+    SQL
+
+    # Drop old table and rename new table
+    drop_table :decidim_private_exports
+    rename_table :decidim_private_exports_new, :decidim_private_exports
+  end
+
+  def down
+    # Similar approach for rollback
+    create_table :decidim_private_exports_new, id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+      t.string :export_type, null: false
+      t.string :attached_to_type
+      t.integer :attached_to_id
+      t.string :file
+      t.string :content_type, null: false
+      t.string :file_size, null: false
+      t.datetime :expires_at
+      t.jsonb :metadata, default: {}
+      t.timestamps
+    end
+
+    execute <<-SQL.squish
+      INSERT INTO decidim_private_exports_new (id, export_type, attached_to_type, attached_to_id, file, content_type, file_size, expires_at, metadata, created_at, updated_at)
+      SELECT uuid, export_type, attached_to_type, attached_to_id, file, content_type, file_size, expires_at, metadata, created_at, updated_at
+      FROM decidim_private_exports
+    SQL
+
+    drop_table :decidim_private_exports
+    rename_table :decidim_private_exports_new, :decidim_private_exports
+  end
+end