admin/e-ticket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
627 Commits 1 Branch 0 Tags
master
Commit Graph

8 Commits

Author SHA1 Message Date
Serreau Jovann
eb884faea1 Align prod PHP container UID with bot user (1001) and harden restore.sh
Some checks failed
CI / sonarqube (push) Failing after 52s
Details 
Sur le serveur prod, l'utilisateur 'bot' (cree par Ansible) a UID 1001
alors que l'utilisateur 'appuser' du conteneur PHP etait hardcode a UID 1000,
ce qui causait des erreurs 'Unable to write in var/cache/prod' apres restore
ou deploiement: les fichiers du host appartenaient a bot:bot (1001) et
appuser (1000) ne pouvait pas y ecrire.

docker/php/prod/Dockerfile:
  - appuser UID/GID passe de 1000 a 1001 pour matcher bot
  - dev/Dockerfile reste a 1000 (les users dev sont generalement 1000)

ansible/deploy.yml:
  - chown des dossiers public/uploads/* et var/payouts passe de 1000 a 1001

restore.sh:
  - Nouvelle option --owner USER:GRP (defaut: bot:bot, override via RESTORE_OWNER)
  - Chown automatique en fin de restore sur var/, public/uploads/, config/cert/, .env.local
  - Purge automatique de var/cache (sera reconstruit par PHP)
  - Verification root au demarrage (sudo requis pour chown)
  - Verification de l'existence du user et group cibles
  - Option --skip-chown pour bypass (deconseille)
  - Etapes post-migration mises a jour (ajout de make build_prod en premier)

Procedure de migration sur le serveur apres ce commit:
  cd /var/www/e-ticket
  git pull origin master
  make build_prod              # rebuild image PHP avec UID 1001
  make stop_prod
  sudo chown -R bot:bot var public/uploads config/cert .env.local
  sudo rm -rf var/cache
  make start_prod
  make clear_prod

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-10 14:04:14 +02:00
Serreau Jovann
33ae25390c Add PHP exif extension to prod Dockerfile for PWA image processing 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-20 20:09:50 +01:00
Serreau Jovann
a047cfa787 Merge consecutive RUN instructions in Dockerfiles into single layer 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-19 15:14:21 +01:00
Serreau Jovann
ac677175d3 Add non-root user to PHP Docker images for security 
- Create appuser (UID 1000) in dev and prod Dockerfiles
- Set USER appuser to avoid running as root

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-19 15:06:49 +01:00
Serreau Jovann
456e0afed8 Fix Hadolint warnings: add --no-install-recommends to apt-get install 
- Add --no-install-recommends to both dev and prod Dockerfiles (DL3015)
- Add .hadolint.yaml to ignore DL3008 (pin versions)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-19 14:59:45 +01:00
Serreau Jovann
8e34a5b3a6 Fix WORKDIR, rename DB to e_ticket, simplify purge_dev 
- Add WORKDIR /app to dev and prod Dockerfiles
- Rename database from e-ticket to e_ticket (PostgreSQL compat)
- purge_dev: remove only containers and volumes, keep images

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-18 21:12:42 +01:00
Serreau Jovann
e3de0da1bf Add Cloudflare automation, ngrok tunnel, fix Dockerfiles 
- Ansible cloudflare.yml: DNS, SSL, HSTS, Brotli, bot fight, SEO bots allow
- Vault: add cloudflare_zone_id
- Workflow: run cloudflare config before deploy
- docker-compose-dev: add ngrok tunnel, vault, minio
- Ngrok sync script: writes OUTSIDE_URL to .env.local
- Fix Dockerfiles: remove mbstring/xml (built-in PHP 8.4), fix libfreetype-dev
- Makefile: maintenance_on/off, clear_prod
- Playbook: stop_prod, install_prod, start_prod, migrate, clear steps

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-18 21:06:11 +01:00
Serreau Jovann
653d7b4729 Add Docker infrastructure for dev and prod environments 
- Separate PHP Dockerfiles (dev/prod) with extensions and prod opcache/php.ini optimization
- docker-compose-dev: PHP, PostgreSQL, Redis, Messenger, Mailpit, RedisInsight
- docker-compose-prod: 2x PHP replicas, PgSQL master/slave with PgBouncer, 2x Messenger, Redis
- Makefile with build/start/stop/purge commands
- AGENT.md to restrict AI access to the repository

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-18 20:12:09 +01:00