Merge branch 'master' into docker-secrets

.github/workflows/publish.yml

@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3

.github/workflows/test.yml

@@ -21,15 +21,16 @@ jobs:
           - "sqlite"
           - "mariadb"
           - "postgresql"
+          - "postgresql-secret"
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 

Dockerfile

@@ -1,19 +1,19 @@
-ARG COMPOSER_VERSION=2.2
+ARG COMPOSER_VERSION=2.5.8
 
-FROM composer:$COMPOSER_VERSION AS composer
+FROM composer:$COMPOSER_VERSION as composer
 
-FROM golang:alpine AS builder
+FROM golang:alpine as builder
 
 # envsubst from gettext can not replace env vars with default values
 # this package is not available for ARM32 and we have to build it from source code
 # flag -ldflags "-s -w" produces a smaller executable
-RUN go install -ldflags "-s -w" -v github.com/a8m/envsubst/cmd/envsubst@v1.4.3
+RUN go install -ldflags "-s -w" -v github.com/a8m/envsubst/cmd/envsubst@v1.3.0
 
-FROM alpine:3.22
+FROM alpine:3.18
 
 COPY --from=builder /go/bin/envsubst /usr/bin/envsubst
 
-ARG WALLABAG_VERSION=2.6.14
+ARG WALLABAG_VERSION=2.6.12
 
 RUN set -ex \
  && apk add --no-cache \
@@ -21,43 +21,43 @@ RUN set -ex \
       libwebp \
       nginx \
       pcre \
-      php84 \
-      php84-bcmath \
-      php84-ctype \
-      php84-curl \
-      php84-dom \
-      php84-fpm \
-      php84-gd \
-      php84-gettext \
-      php84-iconv \
-      php84-json \
-      php84-mbstring \
-      php84-opcache \
-      php84-openssl \
-      php84-pecl-amqp \
-      php84-pecl-imagick \
-      php84-pdo_mysql \
-      php84-pdo_pgsql \
-      php84-pdo_sqlite \
-      php84-phar \
-      php84-session \
-      php84-simplexml \
-      php84-tokenizer \
-      php84-xml \
-      php84-zlib \
-      php84-sockets \
-      php84-xmlreader \
-      php84-tidy \
-      php84-intl \
-      php84-sodium \
+      php81 \
+      php81-bcmath \
+      php81-ctype \
+      php81-curl \
+      php81-dom \
+      php81-fpm \
+      php81-gd \
+      php81-gettext \
+      php81-iconv \
+      php81-json \
+      php81-mbstring \
+      php81-opcache \
+      php81-openssl \
+      php81-pecl-amqp \
+      php81-pecl-imagick \
+      php81-pdo_mysql \
+      php81-pdo_pgsql \
+      php81-pdo_sqlite \
+      php81-phar \
+      php81-session \
+      php81-simplexml \
+      php81-tokenizer \
+      php81-xml \
+      php81-zlib \
+      php81-sockets \
+      php81-xmlreader \
+      php81-tidy \
+      php81-intl \
+      php81-sodium \
       mariadb-client \
-      postgresql17-client \
+      postgresql14-client \
       rabbitmq-c \
       s6 \
       tar \
       tzdata \
- && ln -sf /usr/bin/php84 /usr/bin/php \
- && ln -sf /usr/sbin/php-fpm84 /usr/sbin/php-fpm \
+ && ln -sf /usr/bin/php81 /usr/bin/php \
+ && ln -sf /usr/sbin/php-fpm81 /usr/sbin/php-fpm \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log

README.md

@@ -43,6 +43,8 @@ Default login is `wallabag:wallabag`.
 - `-e SYMFONY__ENV__SERVER_NAME=...` (defaults to "Your wallabag instance". Specifies a user-friendly name for the 2FA issuer)
 - `-e PHP_MEMORY_LIMIT=...` (allows you to change the PHP `memory_limit` value. defaults to 128M, and should be a number and unit, eg. 512K, 128M, 2G, or a number of bytes)
 
+To set any of these environment variables from a file (for instance a Docker Secret), append `__FILE` to the name of the environment variable.
+
 ## SQLite
 
 The easiest way to start wallabag is to use the SQLite backend. You can spin that up with
@@ -142,7 +144,7 @@ services:
     volumes:
       - /opt/wallabag/data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "/usr/local/bin/healthcheck.sh", "--innodb_initialized"]
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
       interval: 20s
       timeout: 3s
   redis:

root/entrypoint.sh

@@ -2,6 +2,16 @@
 # Exit when any command fails
 set -e
 
+FILE_ENV_VARS="$(env | grep '__FILE=')"
+for env_var in $FILE_ENV_VARS; do
+    var_name="$(echo $env_var | grep -o '.*__FILE=' | sed 's/__FILE=//g')"
+    file_path="$(echo $env_var | grep -o '__FILE=.*' | sed 's/__FILE=//g')"
+    file_content="$(cat $file_path)"
+    [[ ! $? -eq 0 ]] && exit 1 # Exit if last command failed
+    new_var="$(echo $var_name=$file_content)"
+    export $(echo $new_var | xargs)
+done
+
 COMMAND_ARG1="$1"
 COMMAND_ARG2="$2"
 
@@ -28,7 +38,7 @@ provisioner() {
 
     # Replace environment variables
     envsubst < /etc/wallabag/parameters.template.yml > app/config/parameters.yml
-    envsubst < /etc/wallabag/php-wallabag.template.ini > /etc/php84/conf.d/50_wallabag.ini
+    envsubst < /etc/wallabag/php-wallabag.template.ini > /etc/php81/conf.d/50_wallabag.ini
 
     # Wait for external database
     if [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_mysql" ] || [ "$SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql" ] ; then

root/etc/wallabag/parameters.template.yml

@@ -36,11 +36,11 @@ parameters:
     rss_limit: 50
 
     # RabbitMQ processing
-    rabbitmq_host: ${SYMFONY__ENV__RABBITMQ_HOST:-localhost}
-    rabbitmq_port: ${SYMFONY__ENV__RABBITMQ_PORT:-5672}
-    rabbitmq_user: ${SYMFONY__ENV__RABBITMQ_USER:-guest}
-    rabbitmq_password: ${SYMFONY__ENV__RABBITMQ_PASSWORD:-guest}
-    rabbitmq_prefetch_count: ${SYMFONY__ENV__RABBITMQ_PREFETCH_COUNT:-10}
+    rabbitmq_host: localhost
+    rabbitmq_port: 5672
+    rabbitmq_user: guest
+    rabbitmq_password: guest
+    rabbitmq_prefetch_count: 10
 
     # Redis processing
     redis_scheme: ${SYMFONY__ENV__REDIS_SCHEME:-tcp}

tests/credentials/db_password

@@ -0,0 +1 @@
+wallapass

tests/credentials/env_secret

@@ -0,0 +1 @@
+F00B4R

tests/credentials/postgres_password

@@ -0,0 +1 @@
+my-secret-pw

tests/docker-compose.postgresql-secret.yml

@@ -0,0 +1,31 @@
+version: '2'
+services:
+  wallabag:
+    build:
+      context: ../
+    image: wallabag:postgresql
+    container_name: wallabag
+    environment:
+      - POSTGRES_PASSWORD__FILE=/run/secrets/postgres_password
+      - POSTGRES_USER=my-super-user
+      - SYMFONY__ENV__SECRET__FILE=/run/secrets/env_secret
+      - SYMFONY__ENV__DATABASE_DRIVER=pdo_pgsql
+      - SYMFONY__ENV__DATABASE_HOST=db
+      - SYMFONY__ENV__DATABASE_PORT=5432
+      - SYMFONY__ENV__DATABASE_NAME=wallabag
+      - SYMFONY__ENV__DATABASE_USER=wallabag
+      - SYMFONY__ENV__DATABASE_PASSWORD__FILE=/run/secrets/db_password
+    ports:
+      - "127.0.0.1:80:80"
+    # Docker Secrets require Swarm Mode, so we use volumes instead to spoof the behaviour
+    volumes:
+      - ./credentials/db_password:/run/secrets/db_password
+      - ./credentials/postgres_password:/run/secrets/postgres_password
+      - ./credentials/env_secret:/run/secrets/env_secret
+  db:
+    image: postgres:10.3
+    environment:
+      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
+      - POSTGRES_USER=my-super-user
+    volumes:
+      - ./credentials/postgres_password:/run/secrets/postgres_password