Merge pull request #467 from paper42/upgrades-2025

* use LTS version of composer
* use a maintained version of alpine
* upgrade php to 8.4 (because 8.1 was dropped from alpine and it's
  almost EOL)

.github/dependabot.yml

@@ -12,3 +12,10 @@ updates:
     versions:
     - ">= 3.11.a"
     - "< 3.12"
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+    time: "04:00"
+    timezone: Europe/Paris
+  open-pull-requests-limit: 10

.github/workflows/publish.yml

@@ -13,16 +13,16 @@ jobs:
       contents: read
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -30,23 +30,23 @@ jobs:
           
        # Documentation: https://github.com/docker/setup-qemu-action
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         
       # Documentation: https://github.com/docker/setup-buildx-action
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             wallabag/wallabag
             ghcr.io/${{ github.repository }}
 
       - name: Build and push Docker images
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true

.github/workflows/test.yml

@@ -24,29 +24,28 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
 
       - name: "Build image"
-        run: docker-compose -f tests/docker-compose.${{ matrix.database }}.yml build
-
-      - name: "Run image"
-        run: docker-compose -f tests/docker-compose.${{ matrix.database }}.yml up -d
+        run: docker compose -f tests/docker-compose.${{ matrix.database }}.yml build
 
       - name: "Install dependencies"
-        run: pip install pytest requests
-
-      - name: "Check running instance"
-        run: docker ps
-
-      - name: "Wait 60s"
-        run: sleep 60
+        run: pip install pytest pytest-docker requests
 
       - name: "Run tests"
-        run: py.test tests/
+        run: py.test --database=${{ matrix.database }} tests/
+
+      - name: "Get docker logs"
+        if: ${{ always() }}
+        run: docker compose -p "wallabag_${{ matrix.database }}" -f tests/docker-compose.${{ matrix.database }}.yml logs wallabag
+
+      - name: "Cleanup environment"
+        if: ${{ always() }}
+        run: docker compose -p "wallabag_${{ matrix.database }}" -f tests/docker-compose.${{ matrix.database }}.yml down -v

Dockerfile

@@ -1,15 +1,19 @@
-FROM golang:alpine as builder
+ARG COMPOSER_VERSION=2.2
+
+FROM composer:$COMPOSER_VERSION AS composer
+
+FROM golang:alpine AS builder
 
 # envsubst from gettext can not replace env vars with default values
 # this package is not available for ARM32 and we have to build it from source code
 # flag -ldflags "-s -w" produces a smaller executable
-RUN go install -ldflags "-s -w" -v github.com/a8m/envsubst/cmd/envsubst@v1.3.0
+RUN go install -ldflags "-s -w" -v github.com/a8m/envsubst/cmd/envsubst@v1.4.3
 
-FROM alpine:3.17
+FROM alpine:3.22
 
 COPY --from=builder /go/bin/envsubst /usr/bin/envsubst
 
-ARG WALLABAG_VERSION=2.6.1
+ARG WALLABAG_VERSION=2.6.14
 
 RUN set -ex \
  && apk add --no-cache \
@@ -17,52 +21,53 @@ RUN set -ex \
       libwebp \
       nginx \
       pcre \
-      php81 \
-      php81-bcmath \
-      php81-ctype \
-      php81-curl \
-      php81-dom \
-      php81-fpm \
-      php81-gd \
-      php81-gettext \
-      php81-iconv \
-      php81-json \
-      php81-mbstring \
-      php81-openssl \
-      php81-pecl-amqp \
-      php81-pdo_mysql \
-      php81-pdo_pgsql \
-      php81-pdo_sqlite \
-      php81-phar \
-      php81-session \
-      php81-simplexml \
-      php81-tokenizer \
-      php81-xml \
-      php81-zlib \
-      php81-sockets \
-      php81-xmlreader \
-      php81-tidy \
-      php81-intl \
-      php81-sodium \
+      php84 \
+      php84-bcmath \
+      php84-ctype \
+      php84-curl \
+      php84-dom \
+      php84-fpm \
+      php84-gd \
+      php84-gettext \
+      php84-iconv \
+      php84-json \
+      php84-mbstring \
+      php84-opcache \
+      php84-openssl \
+      php84-pecl-amqp \
+      php84-pecl-imagick \
+      php84-pdo_mysql \
+      php84-pdo_pgsql \
+      php84-pdo_sqlite \
+      php84-phar \
+      php84-session \
+      php84-simplexml \
+      php84-tokenizer \
+      php84-xml \
+      php84-zlib \
+      php84-sockets \
+      php84-xmlreader \
+      php84-tidy \
+      php84-intl \
+      php84-sodium \
       mariadb-client \
-      postgresql14-client \
+      postgresql17-client \
       rabbitmq-c \
       s6 \
       tar \
       tzdata \
- && ln -sf /usr/bin/php81 /usr/bin/php \
- && ln -sf /usr/sbin/php-fpm81 /usr/sbin/php-fpm \
+ && ln -sf /usr/bin/php84 /usr/bin/php \
+ && ln -sf /usr/sbin/php-fpm84 /usr/sbin/php-fpm \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
- && ln -sf /dev/stderr /var/log/nginx/error.log \
- && curl -s https://getcomposer.org/installer | php \
- && mv composer.phar /usr/local/bin/composer \
- && rm -rf /root/.composer/*
+ && ln -sf /dev/stderr /var/log/nginx/error.log
+
+COPY --from=composer /usr/bin/composer /usr/local/bin/composer
 
 COPY root /
 
 RUN set -ex \
- && curl -L -o /tmp/wallabag.tar.gz https://github.com/wallabag/wallabag/archive/$WALLABAG_VERSION.tar.gz \
+ && curl -L -o /tmp/wallabag.tar.gz https://github.com/wallabag/wallabag/releases/download/$WALLABAG_VERSION/wallabag-$WALLABAG_VERSION.tar.gz \
  && tar xvf /tmp/wallabag.tar.gz -C /tmp \
  && mkdir /var/www/wallabag \
  && mv /tmp/wallabag-*/* /var/www/wallabag/ \
@@ -74,6 +79,13 @@ RUN set -ex \
  && rm -rf /root/.composer/* /var/www/wallabag/var/cache/* /var/www/wallabag/var/logs/* /var/www/wallabag/var/sessions/* \
  && chown -R nobody:nobody /var/www/wallabag
 
+ENV PATH="${PATH}:/var/www/wallabag/bin"
+
+# Set console entry path
+WORKDIR /var/www/wallabag
+
+HEALTHCHECK CMD curl --fail --silent --show-error --user-agent healthcheck http://localhost/api/info || exit 1
+
 EXPOSE 80
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["wallabag"]

README.md

@@ -29,9 +29,8 @@ Default login is `wallabag:wallabag`.
 - `-e SYMFONY__ENV__LOCALE=...` (default to en)
 - `-e SYMFONY__ENV__MAILER_DSN=...`  (defaults to "smtp://127.0.0.1")
 - `-e SYMFONY__ENV__FROM_EMAIL=...`(defaults to "`wallabag@example.com`", the address wallabag uses for outgoing emails)
-- `-e SYMFONY__ENV__TWOFACTOR_AUTH=...` (defaults to "true", enable or disable two-factor authentication)
 - `-e SYMFONY__ENV__TWOFACTOR_SENDER=...` (defaults to "`no-reply@wallabag.org`", the address wallabag uses for two-factor emails)
-- `-e SYMFONY__ENV__FOSUSER_REGISTRATION=...`(defaults to "true", enable or disable public user registration)
+- `-e SYMFONY__ENV__FOSUSER_REGISTRATION=...`(defaults to "false", enable or disable public user registration)
 - `-e SYMFONY__ENV__FOSUSER_CONFIRMATION=...`(defaults to "true", enable or disable registration confirmation)
 - `-e SYMFONY__ENV__DOMAIN_NAME=...`  defaults to "`https://your-wallabag-instance.wallabag.org`", the URL of your wallabag instance)
 - `-e SYMFONY__ENV__REDIS_SCHEME=...` (defaults to "tcp", protocol to use to communicate with the target server (tcp, unix, or http))
@@ -42,6 +41,7 @@ Default login is `wallabag:wallabag`.
 - `-e SYMFONY__ENV__SENTRY_DSN=...` (defaults to "~", this is the data source name for sentry)
 - `-e POPULATE_DATABASE=...`(defaults to "True". Does the DB has to be populated or is it an existing one)
 - `-e SYMFONY__ENV__SERVER_NAME=...` (defaults to "Your wallabag instance". Specifies a user-friendly name for the 2FA issuer)
+- `-e PHP_MEMORY_LIMIT=...` (allows you to change the PHP `memory_limit` value. defaults to 128M, and should be a number and unit, eg. 512K, 128M, 2G, or a number of bytes)
 
 ## SQLite
 
@@ -109,10 +109,10 @@ $ docker exec -t NAME_OR_ID_OF_YOUR_WALLABAG_CONTAINER /var/www/wallabag/bin/con
 An example [docker-compose](https://docs.docker.com/compose/) file can be seen below:
 
 ```
-version: '3'
 services:
   wallabag:
     image: wallabag/wallabag
+    restart: unless-stopped
     environment:
       - MYSQL_ROOT_PASSWORD=wallaroot
       - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql
@@ -131,25 +131,23 @@ services:
       - "80"
     volumes:
       - /opt/wallabag/images:/var/www/wallabag/web/assets/images
-    healthcheck:
-      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost"]
-      interval: 1m
-      timeout: 3s
     depends_on:
       - db
       - redis
   db:
     image: mariadb
+    restart: unless-stopped
     environment:
       - MYSQL_ROOT_PASSWORD=wallaroot
     volumes:
       - /opt/wallabag/data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      test: ["CMD", "/usr/local/bin/healthcheck.sh", "--innodb_initialized"]
       interval: 20s
       timeout: 3s
   redis:
     image: redis:alpine
+    restart: unless-stopped    
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 20s

conftest.py

@@ -0,0 +1,4 @@
+import pytest
+
+def pytest_addoption(parser):
+    parser.addoption("--database", action="store", default="default")

root/entrypoint.sh

@@ -23,9 +23,12 @@ install_wallabag() {
 provisioner() {
     SYMFONY__ENV__DATABASE_DRIVER=${SYMFONY__ENV__DATABASE_DRIVER:-pdo_sqlite}
     POPULATE_DATABASE=${POPULATE_DATABASE:-True}
+    SQLITE_DB_DIR="/var/www/wallabag/data/db"
+    SQLITE_DB_FILEPATH="$SQLITE_DB_DIR/wallabag.sqlite"
 
     # Replace environment variables
     envsubst < /etc/wallabag/parameters.template.yml > app/config/parameters.yml
+    envsubst < /etc/wallabag/php-wallabag.template.ini > /etc/php84/conf.d/50_wallabag.ini
 
     # Wait for external database
     if [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_mysql" ] || [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql" ] ; then
@@ -33,10 +36,17 @@ provisioner() {
     fi
 
     # Configure SQLite database
-    SQLITE_FILE_SIZE=$(wc -c "/var/www/wallabag/data/db/wallabag.sqlite" | awk '{print $1}')
-    if [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_sqlite" ] && ([ ! -f "/var/www/wallabag/data/db/wallabag.sqlite" ] || [ "$SQLITE_FILE_SIZE" = 0 ]) ; then
-        echo "Configuring the SQLite database ..."
-        install_wallabag
+    if [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_sqlite" ]; then
+        # mkdir and chown are mandatory for local folder binding
+        if [ ! -f "$SQLITE_DB_FILEPATH" ]; then
+            mkdir -p "$SQLITE_DB_DIR"
+            chown nobody: "$SQLITE_DB_DIR"
+        fi
+
+        if [ ! -s "$SQLITE_DB_FILEPATH" ]; then
+            echo "Configuring the SQLite database ..."
+            install_wallabag
+        fi
     fi
 
     # Configure MySQL / MariaDB database

root/etc/nginx/nginx.conf

@@ -35,7 +35,7 @@ http {
     }
 
     server {
-        listen 80;
+        listen [::]:80 ipv6only=off;
         server_name _;
         root /var/www/wallabag/web;
 
@@ -57,6 +57,7 @@ http {
             # for more information).
             fastcgi_param  SCRIPT_FILENAME  $realpath_root$fastcgi_script_name;
             fastcgi_param DOCUMENT_ROOT $realpath_root;
+            fastcgi_read_timeout 300s;
             # Prevents URIs that include the front controller. This will 404:
             # http://domain.tld/app.php/some-path
             # Remove the internal directive to allow URIs like this

root/etc/wallabag/parameters.template.yml

@@ -5,7 +5,7 @@ parameters:
     database_name: ${SYMFONY__ENV__DATABASE_NAME:-symfony}
     database_user: ${SYMFONY__ENV__DATABASE_USER:-root}
     database_password: ${SYMFONY__ENV__DATABASE_PASSWORD:-~}
-    database_path: "%kernel.root_dir%/../data/db/wallabag.sqlite"
+    database_path: "%kernel.project_dir%/data/db/wallabag.sqlite"
     database_table_prefix: ${SYMFONY__ENV__DATABASE_TABLE_PREFIX:-wallabag_}
     database_socket: null
     database_charset: ${SYMFONY__ENV__DATABASE_CHARSET:-utf8}
@@ -20,11 +20,10 @@ parameters:
     secret: ${SYMFONY__ENV__SECRET:-ovmpmAWXRCabNlMgzlzFXDYmCFfzGv}
 
     # two factor stuff
-    twofactor_auth: ${SYMFONY__ENV__TWOFACTOR_AUTH:-true}
     twofactor_sender: ${SYMFONY__ENV__TWOFACTOR_SENDER:-no-reply@wallabag.org}
 
     # fosuser stuff
-    fosuser_registration: ${SYMFONY__ENV__FOSUSER_REGISTRATION:-true}
+    fosuser_registration: ${SYMFONY__ENV__FOSUSER_REGISTRATION:-false}
     fosuser_confirmation: ${SYMFONY__ENV__FOSUSER_CONFIRMATION:-true}
 
     # how long the access token should live in seconds for the API
@@ -37,11 +36,11 @@ parameters:
     rss_limit: 50
 
     # RabbitMQ processing
-    rabbitmq_host: localhost
-    rabbitmq_port: 5672
-    rabbitmq_user: guest
-    rabbitmq_password: guest
-    rabbitmq_prefetch_count: 10
+    rabbitmq_host: ${SYMFONY__ENV__RABBITMQ_HOST:-localhost}
+    rabbitmq_port: ${SYMFONY__ENV__RABBITMQ_PORT:-5672}
+    rabbitmq_user: ${SYMFONY__ENV__RABBITMQ_USER:-guest}
+    rabbitmq_password: ${SYMFONY__ENV__RABBITMQ_PASSWORD:-guest}
+    rabbitmq_prefetch_count: ${SYMFONY__ENV__RABBITMQ_PREFETCH_COUNT:-10}
 
     # Redis processing
     redis_scheme: ${SYMFONY__ENV__REDIS_SCHEME:-tcp}

root/etc/wallabag/php-wallabag.template.ini

@@ -0,0 +1 @@
+memory_limit = ${PHP_MEMORY_LIMIT:-128M}

tests/test_login.py

@@ -1,24 +1,63 @@
 import pytest
 import re
 import requests
+import os
 
+from requests.exceptions import ConnectionError
 
-URL = 'http://127.0.0.1:80'
+@pytest.fixture(scope="session")
+def database(pytestconfig):
+    return pytestconfig.getoption("database")
 
+def is_responsive(url):
+    try:
+        response = requests.get(url)
+        if response.status_code == 200:
+            return True
+    except ConnectionError:
+        return False
 
-def test_accessing_login_page():
-    r = requests.get(URL, allow_redirects=True)
+@pytest.fixture(scope="session")
+def docker_compose_project_name(database):
+    return "wallabag_{}".format(database)
+
+@pytest.fixture(scope="session")
+def docker_cleanup():
+    """Disable docker cleanup at the end of tests to get logs outside of pytest"""
+    return False
+
+@pytest.fixture(scope="session")
+def docker_compose_command() -> str:
+    return "docker compose"
+
+@pytest.fixture(scope="session")
+def docker_compose_file(pytestconfig, database):
+    return os.path.join(str(pytestconfig.rootdir), "tests/", "docker-compose.{}.yml".format(database))
+
+@pytest.fixture(scope="session")
+def wallabag_service(docker_ip, docker_services):
+    """Ensure that wallabag service is up and responsive"""
+
+    # `port_for` takes a container port and returns the corresponding host port
+    port = docker_services.port_for("wallabag", 80)
+    url = "http://{}:{}".format(docker_ip, port)
+    docker_services.wait_until_responsive(
+            timeout=60.0, pause=0.5, check=lambda: is_responsive(url)
+    )
+    return url
+
+def test_accessing_login_page(wallabag_service):
+    r = requests.get(wallabag_service, allow_redirects=True)
 
     assert r.status_code == 200
     assert 'Log in' in r.text
     assert 'Password' in r.text
-    assert 'Register' in r.text
     assert 'Username' in r.text
 
 
-def test_logging_in():
+def test_logging_in(wallabag_service):
     client = requests.session()
-    r = client.get(URL, allow_redirects=True)
+    r = client.get(wallabag_service, allow_redirects=True)
     jar = r.cookies
 
     # get csrf token
@@ -39,7 +78,7 @@ def test_logging_in():
         '_csrf_token': csrf
     }
 
-    r = client.post(URL + '/login_check', cookies=jar, data=data)
+    r = client.post(wallabag_service + '/login_check', cookies=jar, data=data)
     assert r.status_code == 200
     assert '/unread/list' in r.text
     assert '/starred/list' in r.text