Release 5.0: Add IP address SSL certificates, Additonal Proxy Support, web server improvements, and other fixes - #645

…atabase connection checks (#628)

* Refactor Laravel migration script to improve isolation handling and database connection checks

- Removed migration isolation argument from test-db-connection script.
- Introduced a helper function for running migrations per database, enhancing clarity and reusability.
- Updated migration flag assembly logic to better manage isolation settings.
- Improved error handling and logging for database connection issues.

* Remove debug log from Laravel migration script to streamline output during migrations

* Update Laravel migration script to change error message from error to warning for version check

* Update PHP base opertating systems. Add Alpine 3.23 support (#638)

PHP repo no longer has images available for alpine3.21 for latest minor versions, this removes 3.21 if its no longer available and adds 3.23 if available

* Update PHP extension installer version to 2.9.27

* Update NGINX version to 1.28.1

* Refactor and improve security headers, file blocks, etc (#631)

* Fix blocking .well-known path for FrankenPHP

* Remove specific endpoint checks because the whole folder should be allowed

* Enhance security configurations across Apache, NGINX, and Caddy by implementing best practices for HTTP headers and file access restrictions. Added protections against clickjacking, MIME type sniffing, and sensitive file exposure while allowing necessary access to well-known URIs as per RFC 8615.

---------

Co-authored-by: Jay Rogers <3174134+jaydrogers@users.noreply.github.com>
Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net>

* Update GitHub Actions to use actions/checkout@v6 in multiple workflows

* Update GitHub Actions to use actions/upload-artifact@v6 for improved artifact handling

* Update GitHub Actions to use actions/download-artifact@v7 for improved artifact handling

* Upgrade FrankenPHP to v1.11.1

* Increase size of GitHub Actions Runners because of memory segmentation fault issues (Thanks Depot! 😅)

* Add security measures to block PHP execution in storage directory (#641)

Implemented restrictions across Apache, NGINX, and FrankenPHP configurations to prevent the execution of PHP files in the /storage directory, addressing potential vulnerabilities related to arbitrary file uploads (GHSA-29cq-5w36-x7w3).

* Refactor Laravel version check and isolation mode handling in automation script

- Updated the logic for enabling isolation mode based on Laravel version, ensuring it only activates for versions 9.38.0 and above.
- Improved error handling and logging for Laravel version detection, providing clearer output when version determination fails.
- Simplified version comparison logic to enhance readability and maintainability.

* Update container info script to include automation status

---------

Co-authored-by: alloylab <trevor@alloylab.com>
Co-authored-by: Marcel Arns <38068686+marns93@users.noreply.github.com>

…n get-php-versions.sh

- Added a retry mechanism with a maximum of 3 attempts for fetching PHP versions from the specified JSON feed.
- Included validation to ensure the response is valid JSON, with error handling for invalid responses.
- Enhanced error messages to provide more context in case of failures.

…andling

- Modified the curl command in get-php-versions.sh to include a custom user agent string for better identification of requests.
- This change aims to enhance compatibility with the PHP versions JSON feed.

…vironment

…ild environment

… configurations (#646)

* Add import for DB facade

* Move DB facade import to file scope

---------

Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net>

…e/webserver-improvements-and-fixes' of github.com:serversideup/docker-php into release/webserver-improvements-and-fixes

* Enhance logging and SSL generation scripts

- Updated the `LOG_OUTPUT_LEVEL` description in the documentation to clarify verbosity levels and their impact on logging behavior.
- Modified the entrypoint script to remove unnecessary checks for `LOG_OUTPUT_LEVEL` when displaying container info.
- Added checks in the SSL generation script to conditionally log messages based on the `LOG_OUTPUT_LEVEL`, improving debugging capabilities.

* Update log level in debug Caddyfile from INFO to DEBUG for enhanced logging detail

…profiles

- Added details on using Let's Encrypt short-lived certificates and the `CADDY_ACME_PROFILE` environment variable in the documentation.
- Updated the Dockerfile to set the default value for `CADDY_ACME_PROFILE` to "off".
- Modified the Caddyfile to include the option for selecting a Let's Encrypt ACME certificate profile.

These changes improve clarity on SSL options and enhance the configuration flexibility for users.

#697)

* Enhance CI/CD workflows and Docker image publishing

- Update Docker workflows to improve build and publish processes for production, beta, and PR images.
- Introduce a new setup matrix workflow for better PHP version management.
- Implement auto-retry for failed image builds to handle transient errors.
- Add support for additional environment variables in the Docker build process.
- Refactor PHP version validation to ensure all necessary base images are available on DockerHub.
- Update documentation to reflect changes in CI/CD processes and workflows.

* Fix formatting of run-name in Docker Publish workflow

* Add actionlint workflow and update documentation for workflow linting

* Enhance auto-retry workflow for failed builds and update documentation on transient failures

* Increase MAX_FAILED_JOBS limit from 5 to 10 for better handling of transient failures

* Implement docker-php-serversideup-download for reliable file downloads during builds

* Refactor CI workflows: consolidate linting into service_lint.yml and update documentation for improved clarity

* Fix web images failing to start with s6-overlay 3.2.3

s6-overlay 3.2.3 moved its user bundle to /etc/s6-overlay/user-bundles.d
and no longer ships s6-rc.d/user/type. With our services still registered
under the old s6-rc.d/user/contents.d path, rc.init tried to create that
type file at startup, failed as the unprivileged www-data user, and nginx
or apache never started, leaving the container unhealthy forever.

Register php-fpm, nginx, and apache2 in user-bundles.d/user/contents.d
instead. Verified with local fpm-nginx and fpm-apache builds on bookworm:
both services start and the HEALTHCHECK reports healthy.

* Lint Dockerfiles with hadolint

Add a hadolint job to the lint group so Dockerfile mistakes are caught
before any image builds. Rules that conflict with deliberate project
decisions (unpinned apt/apk packages for weekly security rebuilds,
shell-form CMD, named USER, and so on) are ignored in .hadolint.yaml
with the reason recorded next to each one.

Fix the two findings it raised in the fpm-nginx Dockerfile: the Alpine
repository printf had five placeholders but four arguments, and egrep
is replaced with grep -E.

* Summarize every run in one table with image sizes

Replace the per-job summary cards (68 lists of pull commands) with a
single table for the whole run. Each build job now records its canonical
tag and compressed size per architecture, read from the registry
manifest, and uploads it as a small artifact. A new service_summary.yml
merges those files with scripts/build-summary.sh into one table grouped
by variation, listing images that failed to build as well.

Before building, each job looks up the same tag on serversideup/php so
the table shows how much every image grew compared to what users pull
today. Growth over 10% is flagged.

The setup card shrinks to the PHP patch versions resolved from php.net,
which is the one thing only that job knows.

* Add smoke tests for published images

Nothing ran the images after they were built, so a broken entrypoint
would only be noticed by users. scripts/smoke-test.sh runs an image and
checks what a user would hit first: PHP reports the expected version,
the container runs as an unprivileged user, and images with a
HEALTHCHECK become healthy. On failure it prints the container logs.

service_smoke-test.yml selects the newest PHP version of every variation
on one Debian and one Alpine base from the run's image details and tests
each on native amd64 and arm64 GitHub runners. Images that were not
pushed (pull requests from forks) are skipped.

The script works against any image reference, so it doubles as a local
check before opening a PR that touches startup behavior. It caught the
s6-overlay user bundle regression fixed earlier in this branch.

* Run smoke tests and the summary table on every publish

Add smoke and summary jobs to the PR, production, and beta workflows.
Both run whenever the matrix was generated, even if some builds failed,
so a red run still shows which images are missing and whether the rest
work. The PR comment now reports the smoke test result and carries the
full image table, collapsed, next to the pull commands.

* Enhance documentation on CI processes, including linting and smoke testing for Docker images

* Fix jq command in smoke test workflow to ensure proper JSON parsing

* Update PR comment formatting to include build status headline

* Refactor CI workflows for image publishing and testing

- Split the image build and publish processes into separate reusable workflows: `service_build-images.yml` and `service_publish-images.yml`.
- Enhance the smoke test workflow to pull images from the Depot Registry and validate them against expected behaviors.
- Introduce a new script `select-smoke-images.sh` to select representative images for smoke testing based on the latest PHP versions and variations.
- Update the summary generation script to reflect changes in image publishing and size reporting.
- Add tests for CI helper scripts to ensure consistent behavior across environments.
- Improve documentation to clarify the CI/CD process and the role of each workflow in the image publishing pipeline.

* Enhance CI workflows with concurrency control, improved release tagging, and refined smoke test processes

* Refactor CI workflows to unify job naming and output references for image selection and publishing

* Refactor CI workflows to replace smoke tests with image tests, enhancing reliability and clarity in the publishing process

* Refactor CI workflows to improve job naming for clarity and consistency across image publishing and testing processes

* Enhance CI/CD workflows and image testing

- Updated service_build-images.yml to handle image loading and testing for pull requests from forks, ensuring that amd64 images are tested directly on the runner.
- Modified service_publish-images.yml to improve image promotion logic, including digest verification and enhanced error handling for failed image promotions.
- Improved service_test-images.yml to group saved images by PHP version and base OS, allowing for more efficient testing and clearer reporting of results.
- Enhanced trigger_auto-retry-failed-builds.yml to better manage transient failures, including automatic issue creation for persistent failures.
- Updated AGENTS.md and contributing documentation to reflect changes in the CI/CD process and image testing.
- Refined scripts/build-summary.sh to prioritize published image records and improve error visibility for failed builds.
- Enhanced scripts/test-image.sh to check for loaded PHP extensions and validate web server responses for images that include a web server.
- Adjusted scripts/tests/run.sh to reflect changes in image publishing status and ensure accurate testing of image details.

* Refactor image testing logic to improve failure handling and remove redundant result reporting

* Refactor image publishing and testing workflows to enhance logging and error handling

…and PHP_SESSION_COOKIE_HTTPONLY environment variables (#692)

* Add new configureable variables

* Reorganized variables and added documentation

* Add validation for PHP_* environment variables in php.ini

---------

Co-authored-by: Jay Rogers <3174134+jaydrogers@users.noreply.github.com>
Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net>

…ile (#702)

The Dockerfile declared FRANKEN_PHP_CONFIG, but the Caddyfile and the
docs reference FRANKENPHP_CONFIG. Rename the ENV so the default matches
the variable Caddy actually reads.

…ed PHP versions, and new environment variables

- Document changes to S6 Overlay user bundle location and usage.
- Enhance `docker-php-serversideup-s6-init` script for better service management and execution order.