Pin dependencies

.changes/2.13.6.md

@@ -1,3 +0,0 @@
-## 2.13.6 - 2026-10-26
-### DX
-* Run container as www-data user instead of root

.changes/unreleased/Release-renovate-1792721072893.yaml

@@ -10,6 +10,6 @@ body: |
   - redis:  ->  
   - registry.gitlab.com/champs-libres/public/relatorio-tornado/app: latest ->  latest
 
-time: 2026-11-08T02:05:03+00:00
+time: 2026-10-23T02:04:32+00:00
 custom:
   Issue: ""

.gitea/workflows/release/build-image.yaml

@@ -19,7 +19,7 @@ jobs:
           password: ${{ secrets.OVH_REGISTRY_PASSWORD }}
 
       - name: Install Dependencies and Build Assets
-        uses: docker://chill/base-image:8.4-edge@sha256:2b2f849dbcf99e664191adbf648f8b1190ab5f3ae2bf79c0303efc383ee00fa9
+        uses: docker://chill/base-image:8.4-edge@sha256:56b487a0e9aab7638894351104afbb3e6cd0e7b94bddd7d76cdb3ce66b89fea9
         env:
           APP_ENV: prod
         with:

.gitignore

@@ -1,4 +1,4 @@
-docker/
+
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php

CHANGELOG.md

@@ -6,10 +6,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
-## 2.13.6 - 2026-10-26
-### DX
-* Run container as www-data user instead of root
-
 ## 2.13.5 - 2026-10-21
 ### Security
 * Update with patch for php vulnerability

Dockerfile

@@ -1,38 +1,31 @@
-FROM chill/base-image:8.4-edge@sha256:2b2f849dbcf99e664191adbf648f8b1190ab5f3ae2bf79c0303efc383ee00fa9
+FROM chill/base-image:8.4-edge@sha256:56b487a0e9aab7638894351104afbb3e6cd0e7b94bddd7d76cdb3ce66b89fea9
 
-# copy directories with ownership for the unprivileged runtime user
-COPY --chown=www-data:www-data ./bin    /var/www/app/bin/.
-COPY --chown=www-data:www-data ./composer.* /var/www/app/
-COPY --chown=www-data:www-data ./config    /var/www/app/config/.
-COPY --chown=www-data:www-data ./migrations /var/www/app/migrations/.
-COPY --chown=www-data:www-data ./public    /var/www/app/public/.
-COPY --chown=www-data:www-data ./src    /var/www/app/src/.
-COPY --chown=www-data:www-data ./templates /var/www/app/templates/.
-COPY --chown=www-data:www-data ./translations /var/www/app/translations/.
-COPY --chown=www-data:www-data ./vendor /var/www/app/vendor/.
+# copy directories
 
-COPY --chown=www-data:www-data ./.env /var/www/app/.env
+COPY ./bin    /var/www/app/bin/.
+COPY ./composer.* /var/www/app/
+COPY ./config    /var/www/app/config/.
+COPY ./migrations /var/www/app/migrations/.
+COPY ./public    /var/www/app/public/.
+COPY ./src    /var/www/app/src/.
+COPY ./templates /var/www/app/templates/.
+COPY ./translations /var/www/app/translations/.
+COPY ./vendor /var/www/app/vendor/.
+
+COPY ./.env /var/www/app/.env
 
 # import the manifest.json file
-COPY --chown=www-data:www-data ./public/build/manifest.json /var/www/app/public/build/manifest.json
+COPY ./public/build/manifest.json /var/www/app/public/build/manifest.json
 
-COPY ./entrypoint.sh /entrypoint.sh
+ADD ./entrypoint.sh /.
 
-# - mark entrypoint executable
-# - declare the FPM pool user/group at build time (was previously written by entrypoint.sh as root)
-# - prepare writable Symfony var/ and COMPOSER_HOME directories for the unprivileged runtime user
-RUN chmod +x /entrypoint.sh \
-    && printf '[www]\nuser=www-data\ngroup=www-data\n' > /usr/local/etc/php-fpm.d/zz-user.conf \
-    && mkdir -p /var/www/app/var/cache /var/www/app/var/log /var/www/app/.composer \
-    && chown -R www-data:www-data /var/www/app/var /var/www/app/.composer \
-    && chown www-data:www-data /var/www/app
-# php-fpm listens on 9000 by default (unprivileged port)
-EXPOSE 9000
-
-USER www-data
+RUN chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
 
-ENV COMPOSER_HOME=/var/www/app/.composer
+ENV PHP_FPM_USER=www-data \
+    PHP_FPM_GROUP=www-data \
+    COMPOSER_HOME=/var/www/app/.composer \
+    SESSION_LIFETIME=10800
 
 CMD [ "php-fpm" ]

compose.override.yaml

@@ -3,7 +3,7 @@ version: '3'
 services:
 ###> symfony/mailer ###
   mailer:
-    image: axllent/mailpit@sha256:aef2aacc11f075ec0fb6874275ee4a421e688e11a96ebb296134d1735c7761ce
+    image: axllent/mailpit@sha256:0790692be935ea4420d085694f7985b1f692ca6a8771ab0e0bd8ba75ac180498
     ports:
       - "1025"
       - "8025"

compose.yaml

@@ -17,7 +17,7 @@ services:
 
 ###> chill-project/chill-bundles ###
   redis:
-      image: redis@sha256:1f88291b4c57bdf249f02eb085a8669889b2d2954e91d4de5118a5da6b78dd53
+      image: redis@sha256:97ec88159e6d7cfb5ddef9015386087d58a912de80112f06ebdfa78fa5989901
   relatorio:
       image: registry.gitlab.com/champs-libres/public/relatorio-tornado/app:latest@sha256:2c4aa2f422c389d940adfd760b0856d237023d66cded0aa026b532b29192212e
 ###< chill-project/chill-bundles ###

docker/nginx/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx@sha256:165ddde8751e75a1c907d24ef10d9f6deb08b57e0fe56caf67512486aff76d82
+FROM nginx@sha256:4c41e2d0a3a55b325ed572cd0200bdb72af1433c3daa2bca6ef8eea68ce504a2
 
 COPY ./public /var/www/app/public
 

entrypoint.sh

@@ -16,6 +16,23 @@ else
   echo "we assume the database is ready";
 fi
 
+
+if [ $(id -u) = "0" ]; then
+  { \
+    echo "[www]"; \
+    echo ""; \
+    echo "user=${PHP_FPM_USER}"; \
+    echo "group=${PHP_FPM_GROUP}"; \
+  } > /usr/local/etc/php-fpm.d/zz-user.conf
+fi
+
+{ \
+    echo ""; \
+    echo "session.save_handler = redis" ; \
+    echo "session.save_path = \"tcp://${REDIS_HOST}:${REDIS_PORT}?db=10\"" ; \
+    echo "session.gc_maxlifetime = ${SESSION_LIFETIME}" ; \
+} >> /usr/local/etc/php/conf.d/custom.ini
+
 if [ "${APP_ENV}" = "prod" ]; then
   composer dump-env "${APP_ENV}"
   chmod +r /var/www/app/.env.local.php
@@ -31,6 +48,8 @@ fi
 if [ "${CLEAR_CACHE}" != "false" ]; then
   #prepare cache
   php /var/www/app/bin/console cache:clear --no-warmup
+  chgrp ${PHP_FPM_GROUP} /var/www/app/var/cache -R && chmod g+rw /var/www/app/var/cache -R
+  chgrp ${PHP_FPM_GROUP} /var/www/app/var/log   -R && chmod g+rw /var/www/app/var/log   -R
 fi
 
 exec "${@}"