mirror of
https://github.com/MarijnDoeve/TijdVoorDeTest.git
synced 2026-07-08 16:40:15 +02:00
Marijn
1d3e99d2b2
* feat: user settings page (#182) - Settings link in the backoffice nav next to Logout - Language selector (Dutch only, noop save) - Change password form with current-password check - Change email form that re-triggers email confirmation - Resend confirmation email button for unconfirmed addresses - Disabled Download data button with Soon(tm) popover - Delete account with password confirmation modal, removes seasons the user is the sole owner of - Well-known URLs: change-password redirect and security.txt * feat: base security.txt Expires on the container build time The BUILD_TIME build arg is baked into the prod image as an env var and set by CI at image build. security.txt expires one year after the build, so the file goes stale when deployments stop. Dev and test fall back to one year from the request time. * refactor: extract shared controller functionality - AbstractController: authenticatedUser property hook and assertSameSeason() (moved from QuestionBankController) - EmailVerifier::sendDefaultConfirmation() replaces the duplicated confirmation email block in RegistrationController and SettingsController - QuizController: deduplicate candidate-data preparation into buildCandidateData() - Drop manual 422 status handling in QuizQuestionController, QuestionBankController and SettingsController: render() already returns 422 for submitted invalid forms passed as parameters * fix: address PR review comments - Catch UniqueConstraintViolationException when changing email to handle the race between the uniqueness check and the flush - Avoid else-only block in UserRepository::deleteUser - Align duplicate-email translation with the validators domain * fix: apply code-review findings for PR #191 - Invalidate outstanding ResetPasswordRequests after password or email change to close the account-takeover window (tokens otherwise remain valid) - Exclude the current user from email uniqueness check so submitting your own address no longer returns an error - Surface transport failures from sendDefaultConfirmation via a warning flash instead of silently showing success - Move Dockerfile ARG BUILD_TIME/ENV to after all build steps so changing the build timestamp no longer busts the composer/asset cache - Throw in prod when BUILD_TIME is missing (WellKnownController) so the security.txt Expires goes stale as intended when deployments stop; fall back to 'now' only in dev/test
116 lines
3.1 KiB
Docker
116 lines
3.1 KiB
Docker
#syntax=docker/dockerfile:1
|
|
|
|
# Versions
|
|
FROM dunglas/frankenphp:1-php8.5 AS frankenphp_upstream
|
|
|
|
# The different stages of this Dockerfile are meant to be built into separate images
|
|
# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
|
|
# https://docs.docker.com/compose/compose-file/#target
|
|
|
|
|
|
# Base FrankenPHP image
|
|
FROM frankenphp_upstream AS frankenphp_base
|
|
|
|
WORKDIR /app
|
|
|
|
VOLUME /app/var/
|
|
|
|
# persistent / runtime deps
|
|
# hadolint ignore=DL3008
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
acl \
|
|
file \
|
|
gettext \
|
|
git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN set -eux; \
|
|
install-php-extensions \
|
|
@composer \
|
|
apcu \
|
|
intl \
|
|
opcache \
|
|
zip \
|
|
gd \
|
|
;
|
|
|
|
# https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
|
|
ENV COMPOSER_ALLOW_SUPERUSER=1
|
|
|
|
ENV PHP_INI_SCAN_DIR=":$PHP_INI_DIR/app.conf.d"
|
|
|
|
###> recipes ###
|
|
###> doctrine/doctrine-bundle ###
|
|
RUN install-php-extensions pdo_pgsql
|
|
###< doctrine/doctrine-bundle ###
|
|
###< recipes ###
|
|
|
|
COPY --link frankenphp/conf.d/10-app.ini $PHP_INI_DIR/app.conf.d/
|
|
COPY --link --chmod=755 frankenphp/docker-entrypoint.sh /usr/local/bin/docker-entrypoint
|
|
COPY --link frankenphp/Caddyfile /etc/caddy/Caddyfile
|
|
|
|
ENTRYPOINT ["docker-entrypoint"]
|
|
|
|
HEALTHCHECK --start-period=60s CMD curl -f http://localhost:2019/metrics || exit 1
|
|
CMD [ "frankenphp", "run", "--config", "/etc/caddy/Caddyfile" ]
|
|
|
|
# Dev FrankenPHP image
|
|
FROM frankenphp_base AS frankenphp_dev
|
|
|
|
ENV APP_ENV=dev XDEBUG_MODE=off
|
|
|
|
# hadolint ignore=DL3008
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
bash-completion \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --link frankenphp/console-complete.bash /usr/share/bash-completion/completions/console
|
|
COPY --link frankenphp/composer-complete.bash /usr/share/bash-completion/completions/composer
|
|
|
|
RUN mv "$PHP_INI_DIR/php.ini-development" "$PHP_INI_DIR/php.ini"
|
|
|
|
RUN set -eux; \
|
|
install-php-extensions \
|
|
xdebug/xdebug@3.5.0 \
|
|
;
|
|
|
|
COPY --link frankenphp/conf.d/20-app.dev.ini $PHP_INI_DIR/app.conf.d/
|
|
|
|
RUN git config --global --add safe.directory /app
|
|
|
|
CMD [ "frankenphp", "run", "--config", "/etc/caddy/Caddyfile", "--watch" ]
|
|
|
|
# Prod FrankenPHP image
|
|
FROM frankenphp_base AS frankenphp_prod
|
|
|
|
RUN rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV APP_ENV=prod
|
|
|
|
RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
|
|
|
|
COPY --link frankenphp/conf.d/20-app.prod.ini $PHP_INI_DIR/app.conf.d/
|
|
|
|
# prevent the reinstallation of vendors at every changes in the source code
|
|
COPY --link composer.* symfony.* ./
|
|
RUN set -eux; \
|
|
composer install --no-cache --prefer-dist --no-dev --no-autoloader --no-scripts --no-progress
|
|
|
|
# copy sources
|
|
COPY --link . ./
|
|
RUN rm -Rf frankenphp/
|
|
|
|
RUN set -eux; \
|
|
mkdir -p var/cache var/log; \
|
|
composer dump-autoload --classmap-authoritative --no-dev; \
|
|
composer dump-env prod; \
|
|
composer run-script --no-dev post-install-cmd; \
|
|
chmod +x bin/console; \
|
|
bin/console sass:build; \
|
|
bin/console asset-map:compile --no-debug --quiet --no-ansi; \
|
|
sync;
|
|
|
|
# Build timestamp for /.well-known/security.txt Expires; must be injected last to avoid cache busting.
|
|
ARG BUILD_TIME=""
|
|
ENV BUILD_TIME=$BUILD_TIME
|